Waraxe IT Security Portal

yamcho · Regular user

HI

i've just view that waraxe have found a bug in NukeSentinel 2.5.11
http://www.waraxe.us/advisory-53.html
http://www.waraxe.us/advisory-58.html

it's all right...

but how i can use this exploit?
in which page this code is execute?

i can see an output in my window o it is work only in backgroud?
for example for update o insert in DB.

thks a lot!!!

waraxe · Site admin

These two security holes in Nuke Sentinel are hard-to-exploit. Blind sql injection methods must be used and yes, i wrote some proof-of-concept exploits, but did not publish them.
So - if you are sure, that your target is using old version NukeSentinel (most websites have been upgraded!), then read tutorials about sql injection, set up local test system with apache/mysql/php/phpnuke/nukesentinel and then write working exploit. It's not so hard. If you have questions - let me know, i am able to give out hints, but exploit(s) must be written by yourself.

yamcho · Regular user

ooo... of course!

i not wont an explit script... i already know the sql injection..
my only question is: when the script report in the advisory is execute?

the thing that i don't know is PhpNuke system.

i know that sentinell is a phpnuke module and that work with any page of that.

thks

yamcho · Regular user

sorry 4 my horrible english Sad

waraxe · Site admin

I decided to publish my old PoC exploit. Here it is:

http://www.waraxe.us/ftopicp-11079.html

Feedback is welcome! Wink

yamcho · Regular user

you are soo good!

i think that the information thath i need is that..

http://localhost/phpnuke.7.9/includes/nsbypass.php

now i can analize you code e understand at all...

thaks a lot Very Happy