 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
IPB attachment folder |
 |
 Posted: Fri Mar 07, 2008 4:40 pm |
 |
|
| Nial |
| Advanced user |
 |
|
| Joined: Feb 29, 2008 |
| Posts: 103 |
|
|
|
 |
|
 |
|
I have access to an admin account on a IPB 2.1.3
I add php type of attachment files and upload a php shell on the site.. But when i want to launch it in my profile, it just download it.
So my question is how i can get the path to my php files like uploads/file.php (it doesnt work) and not juste get it with GET method in the url.
Any help for the upload dir or in general? |
|
|
|
|
| Posted: Fri Mar 07, 2008 7:09 pm |
|
|
| pexli |
| Valuable expert |
 |
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
New extension .phtml
Mime type application/octet-stream .phtml
Upload your shell with ext shell.phtml and look in ./uploads/shell.phtml |
|
|
|
|
| Posted: Sat Mar 08, 2008 12:32 am |
|
|
| Nial |
| Advanced user |
|
|
| Joined: Feb 29, 2008 |
| Posts: 103 |
|
|
|
|
|
|
|
Mime type : application/octet-stream .phtml or just application/octet-stream ?
Anyway, i dont find the file i upload... I saw that in ibp the location was crypted with something like MSG-id-dontremember-timestamp when the file was add. I am not sure, have you some clues? |
|
|
|
|
| Posted: Sat Mar 08, 2008 4:10 am |
|
|
| Nial |
| Advanced user |
|
|
| Joined: Feb 29, 2008 |
| Posts: 103 |
|
|
|
|
|
|
|
Hmm when i upload the phtml file, i ve turn on the DEBUG mode, and when i get the location, i see it replace .phtml or .php by .ibp
Is there a way ipb doesnt change the extension? |
|
|
|
|
| Posted: Sat Mar 08, 2008 4:18 am |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| Nial wrote: | Hmm when i upload the phtml file, i ve turn on the DEBUG mode, and when i get the location, i see it replace .phtml or .php by .ibp
Is there a way ipb doesnt change the extension? |
If you upload "test.php.php", then you get "test.php.ibp"??
If so, then try to access "test.php.ibp" via web - there is big chance that php code will execute. It's old and widely known Apache behavior in case of unknown file extensions and "php." substring in filename  |
|
|
|
|
|
|
|
|
| Posted: Sat Mar 08, 2008 4:30 am |
|
|
| Nial |
| Advanced user |
|
|
| Joined: Feb 29, 2008 |
| Posts: 103 |
|
|
|
|
|
|
|
I just test it, the location is always just *.ibp
| Code: | | INSERT INTO ibf_attachments (attach_ext,attach_file,attach_location,attach_thumb_location,attach_hits,attach_date,attach_temp,attach_pid,attach_post_key,attach_member_id,attach_filesize,attach_is_image) VALUES('php','test.php.php','post-2-1204950258.ipb','','',1204950258,0,'','6413df11172426d5798962a5cc0f85d0',2,83266,0) |
 |
|
|
|
|
| Posted: Sat Mar 08, 2008 5:15 am |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| Code: |
post-2-1204950258.ipb
|
As you can see - IPB is smart enough to rename file completely, so that ".php." trick will not work.
IPB is hard target, you can't find easy security holes from it |
|
|
|
|
| Posted: Sat Mar 08, 2008 8:31 am |
|
|
| pexli |
| Valuable expert |
|
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
|
|
|
|
| Posted: Sat Mar 08, 2008 1:52 pm |
|
|
| Nial |
| Advanced user |
|
|
| Joined: Feb 29, 2008 |
| Posts: 103 |
|
|
|
|
|
|
|
I get root admin level, i ve dump the forum database, but the password field are all blank. Is there anything i can do with my root admin lvl?  |
|
|
|
|
| Posted: Thu Aug 14, 2008 11:25 am |
|
|
| Henderson |
| Valuable expert |
|
|
| Joined: Jul 11, 2008 |
| Posts: 58 |
|
|
|
|
|
|
|
| AFAIR I managed to upload a shell on IPB 2.1.6 using "Emoticon Manager". Go to "Administration" ->"Look and feel"->"Manage emoticons" and upload your file into one of the directories e.g. default. Then you can acccess it from /forum/style_emoticons/default/shell.php |
|
|
|
|
www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 64
Members: 0
Total: 64
