 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 258
 Members: 0
 Total: 258
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Quick Question about phpbb 2.0.18 |
|
 Posted: Thu Aug 31, 2006 5:35 am |
 |
|
| Norkie |
| Beginner |
 |
|
| Joined: Aug 31, 2006 |
| Posts: 2 |
|
|
|
 |
|
 |
|
Hello Waraxe Forums,
Have a few quick questions...
I have searched you site extensively and also searched google,
I Have used the 2.0.18 exploit and received my cookie data
The data is here
a:2:{s:11:\"autologinid\";s:33:\"194596883744f65d97da65f8.06574942\";s:6:\"userid\";s:2:\"24\";}
?194596883744f65d97da65f8.06574942?
This should be where my hash is located but its not valid because of the period in the middle
Is there anything I can do?
Thanks |
|
|
|
|
|
Re: Quick Question about phpbb 2.0.18 |
|
| Posted: Thu Aug 31, 2006 10:15 am |
|
|
| ToXiC |
| Moderator |
 |
|
| Joined: Dec 01, 2004 |
| Posts: 181 |
| Location: Cyprus |
|
|
|
|
|
|
| Norkie wrote: | Hello Waraxe Forums,
Have a few quick questions...
I have searched you site extensively and also searched google,
I Have used the 2.0.18 exploit and received my cookie data
The data is here
a:2:{s:11:\"autologinid\";s:33:\"194596883744f65d97da65f8.06574942\";s:6:\"userid\";s:2:\"24\";}
?194596883744f65d97da65f8.06574942?
This should be where my hash is located but its not valid because of the period in the middle
Is there anything I can do?
Thanks |
phpbb uses this function for the hash
| Quote: | ////
// This function makes a new password from a plaintext password.
function tep_encrypt_password($plain) {
$password = '';
for ($i=0; $i<10; $i++) {
$password .= tep_rand();
}
$salt = substr(md5($password), 0, 2);
$password = md5($salt . $plain) . ':' . $salt;
return $password;
}
|
so basicaly there you have a salted md5 hash value ...
if by any chance you receive the $salted value then you can work with it by adding the value into your wordlist at the beggining of each word ... or working with that function and see if you can reverse it ..
Its not an easy process but this is the only think you can do ..
i quess you used an xss exploit so you came up with the cookie of someone.
use firefox and replace the cookie for that session . Live http headers for firefox will do .. ( i never test it but you can change cookie functions)
ToX |
|
_________________
who|grep -i blonde|talk; cd~;wine;talk;touch;unzip;touch; strip;gasp;finger;gasp;mount; fsck; more; yes; gasp; umount; make clean; sleep;wakeup;goto http://www.md5this.com |
|
|
|
|
|
|
|
| Posted: Fri Sep 01, 2006 7:50 am |
|
|
| Norkie |
| Beginner |
|
|
| Joined: Aug 31, 2006 |
| Posts: 2 |
|
|
|
|
|
|
|
I used the cookie with live http headers and i got logged in as admin but i clicked on admin panel and it asked for the password. and now my cookie is invalid and i cannot log in anymore. so I need to find out the password...
| Quote: | Cookie: __utmz=127767706.1156986407.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=127767706.1119284662.1156986407.1157072455.1157088041.6; phpbb2mysql_data=a:2:{s:11:\"autologinid\";s:33:\"142983817944f7c332d60f70.13376255\";s:6:\"userid\";i:2;}; phpbb2mysql_sid=1c4a3f5f075b220d13eef65fd527d152; __utmb=127767706; __utmc=127767706; phpbb2mysql_t=a:11:{i:217;i:1157072509;i:245;i:1157072528;i:219;i:1157072688;i:10;i:1157072747;i:234;i:1157072801;i:198;i:1157072844;i:248;i:1157072923;i:258;i:1157072993;i:259;i:1157073009;i:251;i:1157073062;i:256;i:1157073190;}
IP: 66.103.165.69
Date and Time: 1 September, 2006, 12:14 am
Referer: http://htownews.forumcircle.com/privmsg.php?folder=inbox&mode=read&p=697 |
that is the cookie is there any way to use that timestamp to reverse it into a regular hash i was messing around and couldn't get it do reverse right,
any tips or help would be helpfull,
or if you guyz are really nice you could find the hash for me 
sorry for the long quote!
Thanks |
|
|
|
|
|
|
|
|
| Posted: Mon Sep 04, 2006 10:11 am |
|
|
| mainstream |
| Regular user |
|
|
| Joined: Sep 04, 2006 |
| Posts: 18 |
|
|
|
|
|
|
|
you logged in as the user not the admin,
admin would have this in his or her cookie
| Code: | admin=c2luOmI0NDI2Y2U5MDJiM2Y3Mzk4NjBhYzc3NzQ0N2I0ODE4OmVuZ2xpc2g=;
user=MjpCbGFaZWQ6YjQ0MjZjZTkwMmIzZjczOTg2MGFjNzc3NDQ3YjQ4MTg6MTA6OjA6MDowOjA6OjQwOTY=;
phpbb2mysql_data=a:2:{s:11:\"autologinid\";s:0:\"\";s:6:\"userid\";s:1:\"2\";};
phpbb2mysql_sid=8deca74a192b12e35f01a7713efcd51c; |
|
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
