Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: September 22, 2026 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 161 Members: 0 Total: 161 Full disclosure [0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2) [0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8) [0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8) [0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8) [0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2) [0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8) [0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8) [0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8) **Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8) CVE-2026-52307: Stored XSS in 1CMS v5.6 HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 /CVE-2026-12556 Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists O-CMS 1.0.0 Authenticated OS Command Injection viaai_cli_script Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery IT Security and Insecurity Portal www.waraxe.us Forum Index -> PhpBB -> Getting 2.0.23 vuln to work View previous topic :: View next topic Getting 2.0.23 vuln to work Posted: Thu Jul 31, 2008 11:54 am ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no Hi all Pls look at http://packetstormsecurity.org/0803-exploits/phpbb2023-hijack.txt I have some questions about this. Say I had a website, so I can find the referal to my image I posted in a thread that got closed. Now with any luck I will have the admin session ID Now comes my question: can I use a URL like in the exploit http://site.tld/phpBB2/modcp.php?t=1&mode=lock&sid=[session] to ride on the session of the admin? Or do I have to construct a special cookie? So my question is what can I do with the session ID? Thx ketchup Last edited by ketchup on Mon Aug 18, 2008 1:54 am; edited 1 time in total Posted: Thu Jul 31, 2008 1:18 pm gibbocool Advanced user Joined: Jan 22, 2008 Posts: 208 I think you just log in with your own account, then edit the cookie and you will be the mod or admin. But im not sure how you get the sid. _________________ http://www.gibbocool.com Posted: Thu Jul 31, 2008 1:54 pm lenny Valuable expert Joined: May 15, 2008 Posts: 275 You should clear your cookies and replace your session ID with the exploited session. Refresh the page and you *should* be logged in with the username of whoever closed the thread. Posted: Thu Jul 31, 2008 8:33 pm ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no tested replacing de sid, but that doesnt work :/ can somebody tell me how I should edit the cookie, if e.g. the sid=30c2791137336d65cd8c327f92f2e0fc. Posted: Thu Jul 31, 2008 9:02 pm lenny Valuable expert Joined: May 15, 2008 Posts: 275 Remember, sessions time out after about 30 minutes - after which time they become useless. You need a fresh session for session hijacking to work. I also noticed that the session ID "SID" has not been changed since you changed it. Make sure you get rid of "&sid=blablabla" in the URL before you refresh the page. Posted: Thu Jul 31, 2008 9:33 pm ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no meh can't get it to work I edit the cookie and make it just like it was, when I was logged in as admin and still doesn't work. :/ The session is a few seconds old. I don't get it. Posted: Thu Jul 31, 2008 9:56 pm lenny Valuable expert Joined: May 15, 2008 Posts: 275 Hmmm.... well make sure you don't log out from admin before you try the exploit. If the admin logs out, then the session will be automatically invalidated best way to get around this when testing exploits like this is to use two different browsers - for example firefox and safari Use firefox as your pretend victim logged in as admin, and on safari dont login until you have the session Posted: Thu Jul 31, 2008 10:22 pm ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no jeeeeeeeeeeeej finally werx, thx dude This is gonna be tough to exploit . If I would get the SID from an admin I would have to guess what his/her user ID is or is there a better way? I would have to edit the user ID in this part of the cookie? a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D Also the referrer info is updated every hour on awardspace.com :/ So I think im gonna have to use my server at localhost, but I really dont like the idea of that! Posted: Thu Jul 31, 2008 10:44 pm ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no ah found the user ID part a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D admin user ID in this case is 2 I made a new normal user and this is the cookie: a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D user ID is 3 Posted: Thu Jul 31, 2008 11:03 pm ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no found how to find the user ID: http://startrekguide.com/community/viewtopic.php?f=62&t=6402 Highway of Life wrote: Click on their profile and look at the URL. For example, if you view your profile.. (click your username) you get: http://startrekguide.com/community/memberlist.php?mode=viewprofile&u=6609 The u=xxxx digits is the user_id, therefore your user ID is 6609 so in the cookie it would be a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A3%3A%226609%22%3B%7D Posted: Fri Aug 01, 2008 3:28 pm ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no just one more question: Is there a way to host a picture that doesnt get caches, like a broken or not existing image. Will you still get the referer info? Maybe some other trick? Because if the picture gets cashed I wont get the referer info when its loaded? Posted: Mon Aug 18, 2008 1:59 am ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no Ive tested this, and its better to use a non existing image because it cant be cached by the victims browser, giving you a bigger chance of succeeding Exploit works great, only a little social engineering is needed Posted: Fri Aug 22, 2008 12:53 pm ketchup Regular user Joined: May 16, 2006 Posts: 23 Location: no For the people who may be interested, I have written a little C++ app. that checks the apache access_log for SID's every 5 seconds and outputs them the command line and writes them to a file. Getting 2.0.23 vuln to work www.waraxe.us Forum Index -> PhpBB You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

PCWizardHub - Helping you fix, build, and optimize your PC life
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.029 Seconds