Waraxe Forums - How to protect PHP-Nuke against hackers that use md5 pw

Saladin · Regular user

Your report about PhpNuke cookies manual crafting HowTo is cool and it works %100, i did it and i could get admin rights..

but know, how can you protect your own site against attackers that have received md5 passwords from your site of admins ..

Now my site is unsure against this attack code, please how can i save my site even if the attacker has my admin name and md5 passwords...

I installed PHP-Nuke-7.3 ( i also tested 7.0 and 7.2 ) and i tried to hack my own web site, and i could get admin rights over admin.php and /modules/Forums/admin/ , there are two big security holes...

Protector Systems or Fortress, UnionTap all can not block this security holes

Hi, waraxe, please help me, you really are my last rescue

I have to secure my site against md5 password attackers that use this code..

waraxe · Site admin

This is tricky problem. Because if attacker has your passwords md5 hash, then how can your website's engine be sure that it is you or someone else? This will apply not only to phpnuke, but to many other software, even when Session ID-s are used, not the md5 hash directly.
So i suggest to use IP address/range filtering, so admins/superadmin can administrate only from predefined addresses. If you have static IP, then it's very secure and simple to implement. If you have dynamic IP address (like many DSL services offer), then you must define IP address range(-es), which can be legitime for admin. This restriction will hold back most malicious people, I hope.
You can try other methods too, like specific UserAgent string from browser (it can be modified for IE and other browsers, if needed), so phpnuke engine can distinguish between legitimate admin and attacker.
By the way - there is one more thing which can be theoretically implemented in the phpnuke engine. Let's assume that the legitimate admin is about to log in and delivers username and real password (not md5 hash) to phpnuke engine. Now phpnuke will set up clientside cookie with md5 hash, but additionally will save in database ip address of the logged in admin. And if next in any time someone uses that cookie-stored md5 hash, then phpnuke will compare real ip address and stored ip address. If they do not match, authentication is assumed as a failed one. In this way admin can enjoy comfortability of the password caching, when ip address has not changed, but after IP change must log in again. And attacker will fail with md5 hash using.

Saladin · Regular user

Cool Idea

waraxe · Site admin

1. Use Fortress or Sentinel protection systems for preventing attackers to gather md5 hash from database.
2. Second layer, what i described, was my theoretical suggestion. Maybe it's allready working code in some of the protectors, but it can be custom coded as well. Have you experience with php/mysql?