 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 37
 Members: 0
 Total: 37
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 Posted: Tue Aug 05, 2008 2:42 pm |
 |
|
| Harold |
| Regular user |
 |
|
| Joined: Aug 03, 2008 |
| Posts: 17 |
|
|
|
 |
|
 |
|
| Well thank you! I will try the second one. Save as .pl extension I think. *Tries* |
|
|
|
|
| Posted: Tue Aug 05, 2008 3:07 pm |
|
|
| oniric |
| Advanced user |
|
|
| Joined: Jul 24, 2008 |
| Posts: 65 |
|
|
|
|
|
|
|
Yes, then execute it giving
perl filename.pl
Obviously your working dir MUST be the one where filename.pl is located! |
|
|
|
|
| Posted: Tue Aug 05, 2008 3:17 pm |
|
|
| Harold |
| Regular user |
|
|
| Joined: Aug 03, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
ah perl has to be written before it ok. perl exploit.pl works.
And now I only need to know how I get admin rights with my account there. I have installed http live headers for firefox if that is needed. |
|
|
|
|
| Posted: Tue Aug 05, 2008 3:19 pm |
|
|
| oniric |
| Advanced user |
|
|
| Joined: Jul 24, 2008 |
| Posts: 65 |
|
|
|
|
|
|
|
| Did the exploit work? What you got? |
|
|
|
|
| Posted: Tue Aug 05, 2008 4:15 pm |
|
|
| Harold |
| Regular user |
|
|
| Joined: Aug 03, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Tue Aug 05, 2008 7:51 pm |
|
|
| oniric |
| Advanced user |
|
|
| Joined: Jul 24, 2008 |
| Posts: 65 |
|
|
|
|
|
|
|
Well.. you must read the instructions on screen. You must give parameters to the script like it says. From the first example you must type
perl exploit.pl -U youruserid:yourpass forumurl
Type forumurl without the initial http://www. part. |
|
|
|
|
| Posted: Tue Aug 05, 2008 8:06 pm |
|
|
| Harold |
| Regular user |
|
|
| Joined: Aug 03, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
| I thought I had to do something with the admins, and then change a cookie in fierefox. What you say won't do anything with my account. (tried that myself already too btw) |
|
|
|
|
| Posted: Wed Aug 06, 2008 7:38 am |
|
|
| oniric |
| Advanced user |
|
|
| Joined: Jul 24, 2008 |
| Posts: 65 |
|
|
|
|
|
|
|
| So the sploit didn't work? Maybe wrong version, that installation is patched. What's the output of the script? |
|
|
|
|
|
|
|
|
| Posted: Wed Aug 06, 2008 10:00 am |
|
|
| Harold |
| Regular user |
|
|
| Joined: Aug 03, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
C:\>perl exploit.pl -U id:pass ninyou.nl/forum
burned2.pl written by x666
report errors @ blueshisha@safe-mail.net.. thx
[x] Attacking http://ninyou.nl/forum/usergroups.php...
<html>
<head><title>An Error Occurred</title></head>
<body>
<h1>An Error Occurred</h1>
<p>404 Not Found</p>
</body>
</html>
[x] Cookie prefix: wbb2_
[x] Vulnerable check: Not Vulnerable!
<html>
<head><title>An Error Occurred</title></head>
<body>
<h1>An Error Occurred</h1>
<p>404 Not Found</p>
</body>
</html>
I can't tell you my id and pass, sorry because maybe they will notice.
But there is a youtube video in which you have to inject the admin, copy a line from the results and edit a cookie in the firefocx add-on.
Now I just inject myself, with an error. And even if i didn't get an error, do I have admin rights automatically then?
thanks 
P.S. Is the target always called usergroups.php? Otherwise I can just edit the exploit.
P.S2 Is the url really ninyou.nl/forum because you can login on the site itself already.
Sorry for all this questions, but I learned some nice things from you. |
|
|
|
|
|
|
|
|
| Posted: Wed Aug 06, 2008 12:39 pm |
|
|
| oniric |
| Advanced user |
|
|
| Joined: Jul 24, 2008 |
| Posts: 65 |
|
|
|
|
|
|
|
| As the output say, 404 Not Found. That page doesn't exist. This could be because of a wrong version. I just searched and I can tell you quite surely that they don't use WBB 3.x. So this must be version 2.x or lower. Unfortunately I don't really know this Bullettin Board so I can't tell you more about it. If I could have a WBB 2.x or 1.x package or viewing a site that use such a version I could bue more precise. |
|
Last edited by oniric on Wed Aug 06, 2008 1:53 pm; edited 1 time in total |
|
|
|
|
|
|
|
| Posted: Wed Aug 06, 2008 12:50 pm |
|
|
| Harold |
| Regular user |
|
|
| Joined: Aug 03, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
Ok tried another one trhis one is
exploit.pl [target] [userid] [Searchstring]
What is searchstring?
And I did a test like this
perl exploit.pl ninyou.nl/forum [1021] [Username????]
And I got:
<~>Exploiting...
<~> Hash:
What is hash?
And the last: With hat do I use the exploits who aren't compatible with Perl? the WBB ones from rgod is an example. |
|
|
|
|
|
|
|
|
| Posted: Wed Aug 06, 2008 1:55 pm |
|
|
| oniric |
| Advanced user |
|
|
| Joined: Jul 24, 2008 |
| Posts: 65 |
|
|
|
|
|
|
|
When they put parenthesis around script parameters you aren't really supposed to type them It's just a notation. Hash is a scrambled version of the password.
Some sploits are written in other languages than Perl, like PHP or Ruby. The rgod one is written in PHP. That is a CLI PHP program so it runs from the command line like this:
php spoitname.php parameters_here
just like Perl. You must have the php executable path in your PATH environment variable to launch it otherwise you should execute the command from the php binary directory. Puff, all this english writing is killing me ^_^ |
|
|
|
|
|
|
|
|
| Posted: Wed Aug 06, 2008 2:24 pm |
|
|
| Harold |
| Regular user |
|
|
| Joined: Aug 03, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
I'm sorry but I don't get it. PHP is not a recognizewd command in cmd. Do I have to download something like perl?
BTW: some exploits say: Vulnerable test: Not vulnerable!
Is it impossible now? Tried the injection 1 for WBB version 1 in mil0worm. |
|
|
|
|
|
|
|
|
| Posted: Wed Aug 06, 2008 2:32 pm |
|
|
| oniric |
| Advanced user |
|
|
| Joined: Jul 24, 2008 |
| Posts: 65 |
|
|
|
|
|
|
|
Well, sorry, I supposed you got PHP ^^. The easiest way to install it it's by downloading and installing XAMPP for Windows ( I think you use it ). This is also gonna install Apache Server and MySQL server too. Avoid the installation of MySQL if you don't need it.
You can also install PHP by using the official installer. It will install only the PHP binaries. You can find it at
http://www.php.net/downloads.php
Pick the installer.
If an exploit says it's not vulnerable probably it isn't ^^. Or you are just giving it bad parameters. I know, I know, all this trial and error can be a great pain.. |
|
|
|
|
| Posted: Wed Aug 06, 2008 2:34 pm |
|
|
| lenny |
| Valuable expert |
 |
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
| Navigate to the directory containing PHP/perl on your computer in cmd, and execute "./php.exe <params" instead of plain "php" in cmd. |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 2 of 3
Goto page Previous1, 2, 3Next
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
