Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
September 21, 2019
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 250
Members: 0
Total: 250
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PhpBB -> PHPBB 2.13 new exploit
Post new topic  Reply to topic View previous topic :: View next topic 
PHPBB 2.13 new exploit
PostPosted: Sat Mar 26, 2005 2:31 am Reply with quote
kontol_ngaceng
Beginner
Beginner
 
Joined: Mar 26, 2005
Posts: 2




I just found this articles on http://www.securityfocus.com/archive/1/394301/2005-03-23/2005-03-29/0


Hmmm where is the bugs anyway..?
View user's profile Send private message
PostPosted: Sat Mar 26, 2005 11:27 am Reply with quote
y3dips
Valuable expert
Valuable expert
 
Joined: Feb 25, 2005
Posts: 281
Location: Indonesia




please read the article clearly,
that guy only find that after failed exploitation (path forum) the guest (attacker) still mark as an admin , n he still finding out how to use it or take more advantage from this situation <-- this from what i understand by reading that

so i guest he put a wrong title for that article (post)

CMIIW

_________________
IO::y3dips->new(http://clog.ammar.web.id);
View user's profile Send private message Visit poster's website Yahoo Messenger
PostPosted: Tue Mar 29, 2005 10:28 pm Reply with quote
kontol_ngaceng
Beginner
Beginner
 
Joined: Mar 26, 2005
Posts: 2




I have found this
Quote:

------------------------------------------------------------------------
# phpBB 2.0.13 user level exploit
# By : Morinex
# e-mail : m0r1n3x@gmail.com
# date : 20-03-2005
# greetz : Ali7 (for helping me =P) , Zeltha , [code] , ASC and w00pie.NL

Exploit not founded by me!
Dunno who is the founder of this bug.
The original not works so i have fixed the some shit.

*Spechial thx 2 the founder of this bug*


This one goes for all phpBB versions up to 2.0.13. While applying and
testing the
patch for the autologin bug I found that phpBB2 doesn't reset the
$userdata['user_level']
variable after a failed autologin.

This is the vulvernable code in sessions.php:

Code:
f ( $user_id != ANONYMOUS )
{
$auto_login_key = $userdata['user_password'];

if ( $auto_create )
{
if ( isset($sessiondata['autologinid']) && $userdata['user_active'] )
{
// We have to login automagically
if( $sessiondata['autologinid'] === $auto_login_key )
{
// autologinid matches password
$login = 1;
$enable_autologin = 1;
}
else
{
// No match; don't login, set as anonymous user
$login = 0;
$enable_autologin = 0;
$user_id = $userdata['user_id'] = ANONYMOUS;
}
}
else
{
// Autologin is not set. Don't login, set as anonymous user
$login = 0;
$enable_autologin = 0;
$user_id = $userdata['user_id'] = ANONYMOUS;
}
}
else
{
$login = 1;
}
}
else
{
$login = 0;
$enable_autologin = 0;
}


As you can see, if autologin fails it will reset the
$userdata['user_id'] value to
ANONYMOUS, but $userdata['user_level'] stays at the value of the user
account that
failed to login.

Now phpBB only checks for the userlevel in various locations and
ignores the user_id
there. So if you manipulate the "_data" cookie to send the user_id of an admin
you can see some information that should only be visible to an admin.
Like hidden
users on the "who is online page" or email adresses from users, even if the
user disallowed that, in their profiles. Maybe you can even use some
admin functions,
I didn't check this in depth.

The cookie manipulation will only work on the first page requestet, as
the session.php
will then overwrite the user_id in it, unless you prevent the browser from
modifying the cookie of course.

The fix is quite simple, add $userdata['user_level'] = USER; after
every $userdata['user_id']
= ANONYMOUS; in session.php.

*Reported 2 PHPBB ^^


Morinex




Look like the bugs is there..but haven't found anyone wrote working script to run it.

Might be one of member will write it ?
View user's profile Send private message
PostPosted: Tue Mar 29, 2005 10:35 pm Reply with quote
mecha
Beginner
Beginner
 
Joined: Mar 30, 2005
Posts: 2




Let's hope it works, can't wait Laughing
View user's profile Send private message
PHPBB 2.13 new exploit
  www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Game Hints
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.079 Seconds