Waraxe IT Security Portal

Aryan-Husky · Active user

Hi Friends,

Firstly thanks to the Admins and Moderators of this site for supplying so much information. Over the past few days I have found it to be a fantastic resource.

Now to the point, I am trying to gain access to the Administration Panel of a phpBB 2.0.16. This Board has just 1 Admin and 2 Moderators.

I have an account registered on this board. It is quite a popular community with nearly 2,000 Members and over 110,000 Articles.

The only vulnerability I have found on this board is to use XSS Remote Cookie Disclosure which will give me the Md5 of the logged in user who views a post made by myself.

This seems to be working fine and I have got several Passwords already of Normal Users but no Mods or the Admin just yet even though I know they have viewed my Post, can anybody share some light on this problem as to why I can't get the Mods or Admins Md5?

Also does anybody else know of another exploit for 2.0.16?

Thanks for your time.

Aryan-Husky · Active user

Ok I have finally got the Admins Md5

f329a817d2e94133825c36aa6f2f7a64

However I have tried all online tools to resolve this hash but all so far have been unsuccsessful.

I am now currently using MDCrack NG 1.2 and it is currently on Day 3 of trying to resolve the above hash.

Can any body recommend anything else I could try?

Also I recently found out the the XSS exploit in phpBB2.0.16 only works when a logged in user views a post using Internet Explorer only, just incase anybody else out there was having the same problem.

P.S. I got the Admins Md5 by sending him a PM Laughing

naragorn · Regular user

do u want to have the paswd or just enter as admin??

If u want to login as admin, u have to download IECV(google it)

then open it and search for the cookie of ur forum(You shouldopen the forum on Internet explorer, cause the program above just works with IE cookies

and replace ur cookie with this

a:2:{s:11:"autologinid";s:32:"f329a817d2e94133825c36aa6f2f7a64";s:6:"userid";s:2:"USERID-OFTHEADMIN";}

If that doesnt work, try this

a:2:{s:11:"autologinid";s:32:"f329a817d2e94133825c36aa6f2f7a64";s:6:"userid";s:1:"USERID-OFTHEADMIN";}

Then save it and load the forim again(Internet explorer)
If u need more help, well, tthere are tons here,(I learned a lot)

mobettahformeright · Beginner

"The only vulnerability I have found on this board is to use XSS Remote Cookie Disclosure which will give me the Md5 of the logged in user who views a post made by myself. "

which will give me????...........where do you get it?.........do i have to have my own server or sumthing?........i dont understand this part

Aryan-Husky · Active user

mobettahformeright · Beginner

ok, so i watched the video, where does he get that xlmrpc?........then he types in, kisobox.shit.php?..........whats that all about???

naragorn · Regular user

U have to try them separately, when u log into te forum, then u have to close all IE windows, and then open IECV, i think u didnt modify the right cookie, cause in case u had modify the cookie and it was wront, u would not be logged as ur usual user, but u wouldnt be logged,
try searching all cookies for that site, then look for a cookie that says
"phpbb2mysql_data" or something like it, thats the cookie u have to modify, then try the ones below separately,
Btw, thos md5s are the ones from the admin right??

a:2:{s:11:"autologinid";s:32:"f329a817d2e94133825c36aa6f2f7a64";s:6:"userid";s:2:"2";}

a:2:{s:11:"autologinid";s:32:"f329a817d2e94133825c36aa6f2f7a64";s:6:"userid";s:1:"2";}

Aryan-Husky · Active user

naragorn · Regular user

what do u mean??
U mean u logged in as admin, but u cant access to the admin panel cuz u have to login again??
If thats so, what version og phpbb is that??
Cuz i have used that technique on 2.0.16 and it works fine, i can access to admin panel, no verification needed
I havent run into that

Aryan-Husky · Active user

Aryan-Husky · Active user

mobettahformeright drop me a PM and i'll try talk your through it. Make sure your target forum is phpbb 2.0.16 <=

sljyro · Advanced user

hi,

im logged in as admin after doing a cookie exploit. the problem i am having is to go to the admin panel i need to re authenticate the password. this is a 2.0.15 phpBB version as well.

any help appreciated,

SL jyro

Aryan-Husky · Active user

Same problem as myself, hopefully somebody can help.

naragorn · Regular user

ok send a pm with the info, illtry to help, but b4 that, is it 2.0.15?? as far as i remember that one hast a lot of bugs, most important one is remote command execution, have u tried those??

sljyro · Advanced user

thanks but i got another admin in the trap, password was a mediocre '1'. when will people learn Wink

cheers anyway,

sljyro