 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 64
 Members: 0
 Total: 64
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
phpbb 2.0.21: A PoC exploit to change Avatar file location |
|
 Posted: Sat Aug 23, 2008 1:21 pm |
 |
|
| c2java |
| Regular user |
 |
|
| Joined: Aug 17, 2008 |
| Posts: 8 |
|
|
|
 |
|
 |
|
http://www.milw0rm.com/exploits/2348
im asking for a detailed explanation on how to use this thing. im trying to run it with these arguments selecting my own 2.0.21 phpbb forum as the victim:
perl phpbb.pl localhost/forum [actual admin name] [actual admin password] images/avatars/shell.php
it "thinks" for a sec and then just ends without any output and the avatar location doesnt change. what the hell am i doing wrong, how do i do it right and do i really have to put in the forum's admin's name and his password in order to make it work, coz i dont think if ill find the exploit very practical then.. |
|
|
|
|
| Posted: Sat Aug 23, 2008 4:18 pm |
|
|
| lenny |
| Valuable expert |
 |
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
I belive that it should be:
| Quote: | | perl phpbb.pl localhost/forum [admin password] images/avatars/shell.php |
Thats just from first glance 
Try it and get back to us |
|
|
|
|
| Posted: Sat Aug 23, 2008 6:42 pm |
|
|
| c2java |
| Regular user |
|
|
| Joined: Aug 17, 2008 |
| Posts: 8 |
|
|
|
|
|
|
|
nope, i dont know perl but i can still tell that you need 5 arguments (although i dont use the 5th as you might have noticed coz it gives me errors, i'd like some1 to lighten my mind on this one, i use [d<DEBUG>] as the last argument (just like it says in the exploit's code) and it gives me "The system cannot find the file specified.").
but thanks for the reply anyway ^^ |
|
|
|
|
| Posted: Sun Aug 24, 2008 12:05 am |
|
|
| gibbocool |
| Advanced user |
 |
|
| Joined: Jan 22, 2008 |
| Posts: 208 |
|
|
|
|
|
|
|
| Im pretty sure you need to be admin. |
|
|
|
|
| Posted: Sun Aug 24, 2008 8:39 am |
|
|
| c2java |
| Regular user |
|
|
| Joined: Aug 17, 2008 |
| Posts: 8 |
|
|
|
|
|
|
|
| could be, but as i said i am entering admin user and pass and it still doesnt work |
|
|
|
|
| Posted: Sun Aug 24, 2008 3:09 pm |
|
|
| lenny |
| Valuable expert |
|
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
| ... If you have access to the admin account, why not just change the path manually... and also, what is the aim of this attack if you alrady have control? |
|
|
|
|
| Posted: Sun Aug 24, 2008 5:31 pm |
|
|
| c2java |
| Regular user |
|
|
| Joined: Aug 17, 2008 |
| Posts: 8 |
|
|
|
|
|
|
|
| im trying the exploit on my own forum before the actual attack |
|
|
|
|
| Posted: Sun Aug 24, 2008 7:38 pm |
|
|
| lenny |
| Valuable expert |
|
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
Ok, upon closer inspection you were right - both admin username and password need to be supplied. The avatar location isn't supposed to change I believe - I think that it allows the upload of any file type to any directory through the profile page. The exploit simply adds the poison null byte to the end of the avatar path, possibly breaking any validation attempts by phpBB allowing you to upload malicious files.
Admittedly, the exploit is not very well documented, and no white-paper is provided... |
|
|
|
|
| Posted: Mon Aug 25, 2008 6:17 am |
|
|
| c2java |
| Regular user |
|
|
| Joined: Aug 17, 2008 |
| Posts: 8 |
|
|
|
|
|
|
|
| thanks alot but i still cant quite grasp how to choose where to upload the file.. |
|
|
|
|
| Posted: Mon Aug 25, 2008 10:29 am |
|
|
| lenny |
| Valuable expert |
|
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
Ok this is getting a little tedious 
I (to be absolutley honest) dont know. I get the idea behind the exploit, but it goes in no detail how to actually comprimise the system. From what I can see, all this does is add %00 to the avatar url - a simple poison null byte. Im pretty sure this can be exploited, but due to the lack of information provided by the exploit author I cannot do any more easily.
Edit: Ok, so I am doing a little more research - Ill post if i find anything. |
|
|
|
|
| Posted: Tue Aug 26, 2008 6:29 pm |
|
|
| c2java |
| Regular user |
|
|
| Joined: Aug 17, 2008 |
| Posts: 8 |
|
|
|
|
|
|
|
| thanks, i appreciate it alot |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
