Waraxe IT Security Portal

Harold · Regular user

Well thank you! I will try the second one. Save as .pl extension I think. *Tries*

oniric · Advanced user

Yes, then execute it giving

perl filename.pl

Obviously your working dir MUST be the one where filename.pl is located!

Harold · Regular user

ah perl has to be written before it ok. perl exploit.pl works.
And now I only need to know how I get admin rights with my account there. I have installed http live headers for firefox if that is needed.

oniric · Advanced user

Did the exploit work? What you got?

Harold · Regular user

I have this
http://img80.imageshack.us/my.php?image=naamloosta4.jpg

And what now? I've created an account already.

URL admins:
http://www.ninyou.nl/alles/user/121/thomper/
http://www.ninyou.nl/alles/user/1/stex/

What do I have to do?

oniric · Advanced user

Well.. you must read the instructions on screen. You must give parameters to the script like it says. From the first example you must type

perl exploit.pl -U youruserid:yourpass forumurl

Type forumurl without the initial http://www. part.

Harold · Regular user

I thought I had to do something with the admins, and then change a cookie in fierefox. What you say won't do anything with my account. (tried that myself already too btw)

oniric · Advanced user

So the sploit didn't work? Maybe wrong version, that installation is patched. What's the output of the script?

Harold · Regular user

C:\>perl exploit.pl -U id:pass ninyou.nl/forum
burned2.pl written by x666
report errors @ blueshisha@safe-mail.net.. thx
[x] Attacking http://ninyou.nl/forum/usergroups.php...
<html>
<head><title>An Error Occurred</title></head>
<body>
<h1>An Error Occurred</h1>
<p>404 Not Found</p>
</body>
</html>
[x] Cookie prefix: wbb2_
[x] Vulnerable check: Not Vulnerable!
<html>
<head><title>An Error Occurred</title></head>
<body>
<h1>An Error Occurred</h1>
<p>404 Not Found</p>
</body>
</html>

I can't tell you my id and pass, sorry because maybe they will notice.

But there is a youtube video in which you have to inject the admin, copy a line from the results and edit a cookie in the firefocx add-on.

Now I just inject myself, with an error. And even if i didn't get an error, do I have admin rights automatically then?

thanks Smile

P.S. Is the target always called usergroups.php? Otherwise I can just edit the exploit.

P.S2 Is the url really ninyou.nl/forum because you can login on the site itself already.

Sorry for all this questions, but I learned some nice things from you.

oniric · Advanced user

As the output say, 404 Not Found. That page doesn't exist. This could be because of a wrong version. I just searched and I can tell you quite surely that they don't use WBB 3.x. So this must be version 2.x or lower. Unfortunately I don't really know this Bullettin Board so I can't tell you more about it. If I could have a WBB 2.x or 1.x package or viewing a site that use such a version I could bue more precise.

Harold · Regular user

Ok tried another one trhis one is

exploit.pl [target] [userid] [Searchstring]

What is searchstring?

And I did a test like this

perl exploit.pl ninyou.nl/forum [1021] [Username????]

And I got:

<~>Exploiting...
<~> Hash:

What is hash?

And the last: With hat do I use the exploits who aren't compatible with Perl? the WBB ones from rgod is an example.

oniric · Advanced user

When they put parenthesis around script parameters you aren't really supposed to type them Smile

It's just a notation. Hash is a scrambled version of the password.
Some sploits are written in other languages than Perl, like PHP or Ruby. The rgod one is written in PHP. That is a CLI PHP program so it runs from the command line like this:

php spoitname.php parameters_here

just like Perl. You must have the php executable path in your PATH environment variable to launch it otherwise you should execute the command from the php binary directory. Puff, all this english writing is killing me ^_^

Harold · Regular user

I'm sorry but I don't get it. PHP is not a recognizewd command in cmd. Do I have to download something like perl?

BTW: some exploits say: Vulnerable test: Not vulnerable!

Is it impossible now? Tried the injection 1 for WBB version 1 in mil0worm.

oniric · Advanced user

Well, sorry, I supposed you got PHP ^^. The easiest way to install it it's by downloading and installing XAMPP for Windows ( I think you use it ). This is also gonna install Apache Server and MySQL server too. Avoid the installation of MySQL if you don't need it.

You can also install PHP by using the official installer. It will install only the PHP binaries. You can find it at

http://www.php.net/downloads.php

Pick the installer.

If an exploit says it's not vulnerable probably it isn't ^^. Or you are just giving it bad parameters. I know, I know, all this trial and error can be a great pain..

lenny · Valuable expert

Navigate to the directory containing PHP/perl on your computer in cmd, and execute "./php.exe <params" instead of plain "php" in cmd.