Waraxe IT Security Portal

bittertruth · Regular user

i got message like this

You don't have permission to access /myktmportal_data/kb.php on this server.

now, what possibly be the wrong. any idea??

Sm0ke · Moderator

make user to that forum, sometimes you need to be logged in

bittertruth · Regular user

seems it's not working and there is no kb.php files anywhere in my server. there is not even common.php in /includes folder.

In fact, i wanted to try if my site is compromised or not. I've a access as administrator and i 've registered as a normal user few hours aGo,

From my laptop, i tried to apply this script but always it says, 'You are unauthorized to view this page" or something like even after logging in as a normal user.

seems it's not working for me. but still i think i'm not safe.

thank you for your time. if anything comes up, please let me know, would be obliged to you.

bittertruth · Regular user

One more thing, my admin page says i'm running latest version of phpbb

so, is this exploit not working because of that? or what? kindly let me know that too.

Sm0ke · Moderator

1. Next time edit your post dont make new post
2. This exploit is for all versions of phpBB, but they must have this mod installed in it

blaxenet · Active user

This exploit works perfect Smile

Good find Sm0ke!

bittertruth · Regular user

Blaxenet,
how did you do?

i wrote my domain name in place of victim (in following kb script hack) and in place of phpfm, i put the directory where the board is installed. Am i doing something wrong??
,username,char(5 Cool

,user_password),4,5,6,7,8,9,10,11,12,13+from+phpbb_users+where+user_id+>+0&page_num=2&cat=1" target="_blank">http://victim/phpfm/kb.php?mode=article&k=-1+union+select+1,1,concat(user_id,char(5 Cool

,username,char(5 Cool

,user_password),4,5,6,7,8,9,10,11,12,13+from+phpbb_users+where+user_id+>+0&page_num=2&cat=1

blaxenet · Active user

Let's say there is a vulnerable site http://www.testdomain.tld/phpfm/index.php
Remove the index.php and replace it with the following code;

bittertruth · Regular user

blaxenet, i really appreciate your help. i just sent a pm to you.

thanks.

NpLm · Beginner

thanks blaxenet Smile