Waraxe IT Security Portal

WaterBird · Active user

hahahah :} nice one shai-tan my master :}

shai-tan · Valuable expert

lolz Whats a water bird btw?
Like a flying fish? Razz

g30rg3_x · Active user

well well...

i reach a point that im too lazy to continue xDD
seems to be a little bit hard to make a Proof-Of-Concept...

obviously the first problem its to get a forum for testing pourpose and some ppl like waterbird make me one but the second and third problem its the facts that have to be for make the poc work..

the other two facts are, that the server has to be a PHP 5 and have register globals on, obviously the thrid one, its very easy, normally a hosting provider activate this option, but the second its hard since php 5 its under heavy development and i dont see any kind of hosting using i just see many PHP 4

so lets take a summarized and we have this problems to get the PoC's Work

-> PHP 5+
-> Register Globals On
-> A Working phpBB <= 2.0.17

so because why i'm too lazy, well just say that there is no online test forum in the internet so i have to install On my localhost phpBB + MySQL + PHP 5...

only for testing pourpose, so i have reach a point that i have to ask a ppl they have a hosting with at least two of three facts(obviosly the php 5, has to be) just for testing pourpose...

i cant expected that every webmaster leave to play with a test forum or his forums, but i think it is worth the trouble to try...

grettings from mexico all waraxe fellows

Armageddon85 · Regular user

Ok I will spend all year getting this to work but I just need to be pointed in the right direction.

Armageddon85 · Regular user

OK here is what im basically trying to do.

The forum I browse has several sections that are not accessible unless you are a "privledged user"

I have no use in gaining admin rights other than to view the information that is in those sections. So what about downloading the database of the forum - how would I do that or is that even possible? Is there any other way to view these sections without being logged in as admin or one of the users?

I googled the hell out of the site but google can access those pages either. any help would be awesome.

g30rg3_x · Active user

well at first time or first impression when i read the advisory, i think like you that can be explotaible in PHP5 <= 5.0.5, so i can make the exploit work in PHP4...

But the fact that you have to take, that PHP has two develop levels, stable (PHP4), unstable -under heavy developement- (PHP5), so as you see in the adv, it says clearly that have to be PHP5...

And obviously have to be register globals "on" and in the sql injection magic_quotes_gpc "off", so belive me it didnt work in phpBB 2.0.17 with PHP4, i have been try a lot of my experimentals pocs..

at the this time, i have been fully exploited de XSS Bugs, obviously i'm researching the SQL Injection and Remote Command Executation, so the xss is a minor glitch, and i announce a poc when i confirm this experimentals exploits are complete...

for you question...

dependes, if the lock is the phpBB lock, you have to login qith this accounts, because i dont know a method to bypass, than using a cookie poison and enter as admin an make a fake user for enter to this locked forums...

there is a XSS bug in phpBB that i think it works, so googling a while you can easly find, and exploit to get the admin cookie with a low level social enginnering...

grettings from mexico and pardon me the bad writing

Armageddon85 · Regular user

I believe your talking about the exploit where you use an avatar to pull cookies - only problem is that we dont have avatars on this site, and from what I read avatars is the only way to do it. Ill ask admin to see if he will let them in.