EQdkp <= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability

🗓️ 03 Feb 2007 00:00:00Reported by RootType
EQdkp <= 1.3.1 Referer Spoof to access to SQL Database. Largest DKP tracking program used in MMORPG community

                                                Title:&nbsp;EQdkp&nbsp;&lt;=&nbsp;1.3.1&nbsp;Referer&nbsp;Spoof&nbsp;to&nbsp;access&nbsp;to&nbsp;SQL&nbsp;Database
URL:&nbsp;http://www.eqdkp.com
Hook:&nbsp;&quot;Powered&nbsp;by&nbsp;EQdkp&quot;
Author:&nbsp;Eight10
Contact:&nbsp;[email protected]
--------------------------------------------------------------------------------------------------------
Background:&nbsp;EQdkp&nbsp;is&nbsp;the&nbsp;largest&nbsp;DKP&nbsp;tracking&nbsp;program&nbsp;utilized&nbsp;largely&nbsp;by&nbsp;the&nbsp;MMORPG&nbsp;community,&nbsp;specifically
large&nbsp;use&nbsp;in&nbsp;the&nbsp;World&nbsp;of&nbsp;Warcraft&nbsp;Community&nbsp;among&nbsp;Guild/clan&nbsp;Websites.
--------------------------------------------------------------------------------------------------------
Discussion:&nbsp;A&nbsp;Vulnerability&nbsp;exists&nbsp;in&nbsp;all&nbsp;current&nbsp;versions&nbsp;of&nbsp;EQdkp&nbsp;that&nbsp;allows&nbsp;one&nbsp;to
spoof&nbsp;Their&nbsp;refering&nbsp;URL&nbsp;to&nbsp;gain&nbsp;access&nbsp;to&nbsp;an&nbsp;integrated&nbsp;class-1&nbsp;MySQL&nbsp;Backup/Restore&nbsp;program
which&nbsp;allows&nbsp;one&nbsp;to&nbsp;download&nbsp;and&nbsp;modify&nbsp;sensitive&nbsp;SQL&nbsp;data.&nbsp;The&nbsp;script&nbsp;only&nbsp;checks&nbsp;for&nbsp;authentication
via&nbsp;refering&nbsp;url&nbsp;from&nbsp;the&nbsp;administration&nbsp;control&nbsp;panel.&nbsp;Note&nbsp;some&nbsp;sites&nbsp;have&nbsp;this&nbsp;funcitonality&nbsp;
disabled/not&nbsp;installed.&nbsp;From&nbsp;the&nbsp;EQdkp_USERS.sql&nbsp;file,&nbsp;the&nbsp;username/email&nbsp;and&nbsp;MD5&nbsp;Hashed&nbsp;password&nbsp;can&nbsp;be
obtained.&nbsp;From&nbsp;there&nbsp;the&nbsp;password&nbsp;needs&nbsp;to&nbsp;be&nbsp;cracked.&nbsp;

Tested&nbsp;on:&nbsp;1.3.1&nbsp;Default&nbsp;install.
	&nbsp;&nbsp;&nbsp;1.3.0&nbsp;Default&nbsp;install.
---------------------------------------------------------------------------------------------------------
Exploit:
Use&nbsp;a&nbsp;referer&nbsp;spoofing&nbsp;program,&nbsp;like&nbsp;quickspoof.

Refering&nbsp;URL&nbsp;-&nbsp;-&nbsp;http://www.sitehere.com/pathtoeqdkp/admin/
Target&nbsp;URL&nbsp;&nbsp;&nbsp;-&nbsp;-&nbsp;http://www.sitehere.com/pathtoeqdkp/admin/backup

From&nbsp;the&nbsp;Control&nbsp;menu&nbsp;goto&nbsp;&quot;Backup&nbsp;MySQL&nbsp;data&quot;&nbsp;and&nbsp;select&nbsp;the&nbsp;appropraite&nbsp;Database*.
Download&nbsp;eqdkp_users.sql&nbsp;from&nbsp;there&nbsp;and&nbsp;MD5&nbsp;Hashes&nbsp;and&nbsp;usernames/emails&nbsp;will&nbsp;be&nbsp;present.
E.g.
VALUES&nbsp;('1',&nbsp;'admin',&nbsp;'ec67739608318602f2dd6bcb141b56bc',&nbsp;'[email protected]',&nbsp;......
---------------------------------------------------------------------------------------------------------
Alternative&nbsp;type&nbsp;attack**:&nbsp;
One&nbsp;downloads&nbsp;the&nbsp;EQDKP_users.sql&nbsp;and&nbsp;modifies&nbsp;the&nbsp;administration&nbsp;hash&nbsp;in&nbsp;there&nbsp;to&nbsp;be&nbsp;
&quot;5f4dcc3b5aa765d61d8327deb882cf99&quot;&nbsp;&nbsp;==&nbsp;password
One&nbsp;could&nbsp;then&nbsp;restore&nbsp;said&nbsp;Database&nbsp;and&nbsp;login&nbsp;to&nbsp;the&nbsp;EQdkp&nbsp;system&nbsp;as&nbsp;admin.

Alternate&nbsp;type&nbsp;attack&nbsp;2**:
One&nbsp;Downloads&nbsp;the&nbsp;EQDKP_users.sql&nbsp;and&nbsp;modifies&nbsp;the&nbsp;email&nbsp;address&nbsp;to&nbsp;his&nbsp;own.&nbsp;Then&nbsp;one&nbsp;requests
a&nbsp;password&nbsp;reset&nbsp;from&nbsp;the&nbsp;&quot;forgot&nbsp;my&nbsp;password&quot;&nbsp;page.&nbsp;Then&nbsp;the&nbsp;reset&nbsp;password&nbsp;is&nbsp;emailed&nbsp;to&nbsp;the
new&nbsp;email&nbsp;address.
----------------------------------------------------------------------------------------------------------

Futher&nbsp;Discussion:&nbsp;As&nbsp;we&nbsp;know&nbsp;people&nbsp;tend&nbsp;to&nbsp;use&nbsp;the&nbsp;same&nbsp;passwords&nbsp;in&nbsp;multiple&nbsp;places,&nbsp;especially&nbsp;when
the&nbsp;topics&nbsp;are&nbsp;related,&nbsp;for&nbsp;instance&nbsp;WoW&nbsp;account&nbsp;information&nbsp;and&nbsp;WoW&nbsp;clan&nbsp;websites.&nbsp;Along&nbsp;with&nbsp;similiar&nbsp;
passes&nbsp;often&nbsp;used&nbsp;for&nbsp;the&nbsp;email&nbsp;address,&nbsp;which&nbsp;one&nbsp;can&nbsp;retrieve&nbsp;account&nbsp;names&nbsp;from&nbsp;the&nbsp;blizzards&nbsp;site.
Note,&nbsp;when&nbsp;cracking,&nbsp;the&nbsp;requirements&nbsp;for&nbsp;WoW&nbsp;passwords,&nbsp;I&nbsp;believe&nbsp;it&nbsp;is&nbsp;atleast&nbsp;8&nbsp;characters&nbsp;long&nbsp;containing
both&nbsp;numbers&nbsp;and&nbsp;letters.&nbsp;These&nbsp;can&nbsp;be&nbsp;difficult&nbsp;hashes&nbsp;to&nbsp;break&nbsp;but&nbsp;when&nbsp;the&nbsp;passwords&nbsp;are&nbsp;weak&nbsp;dictionary&nbsp;words
simply&nbsp;followed&nbsp;by&nbsp;numbers,&nbsp;a&nbsp;good&nbsp;amount&nbsp;of&nbsp;success&nbsp;can&nbsp;be&nbsp;achieved.&nbsp;This&nbsp;method&nbsp;is&nbsp;especially&nbsp;good&nbsp;when
you&nbsp;already&nbsp;have&nbsp;appropriately&nbsp;generated&nbsp;rainbow&nbsp;tables,&nbsp;or&nbsp;hashes&nbsp;can&nbsp;be&nbsp;sent&nbsp;to&nbsp;online&nbsp;hash&nbsp;crackers.

*Note&nbsp;Other&nbsp;databases&nbsp;can&nbsp;be&nbsp;obtained&nbsp;using&nbsp;this&nbsp;SQL&nbsp;backup&nbsp;tool&nbsp;too!&nbsp;Such&nbsp;as&nbsp;PHPBB&nbsp;databases.
**(Note&nbsp;Sometimes&nbsp;Permission&nbsp;settings&nbsp;prevent&nbsp;SQL&nbsp;restores)

Shout&nbsp;Out:
RichyPoo&nbsp;(Calrich&nbsp;AKA&nbsp;Faglord).&nbsp;Throhg&nbsp;(pwnt).&nbsp;BrowerPower.&nbsp;Bliznat(ty)
&nbsp;_______&nbsp;_________&nbsp;_______&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_________&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;_______&nbsp;
(&nbsp;&nbsp;____&nbsp;\\__&nbsp;&nbsp;&nbsp;__/(&nbsp;&nbsp;____&nbsp;\|\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/|\__&nbsp;&nbsp;&nbsp;__//&nbsp;&nbsp;\&nbsp;&nbsp;(&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;)
|&nbsp;(&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;)&nbsp;(&nbsp;&nbsp;&nbsp;|&nbsp;(&nbsp;&nbsp;&nbsp;&nbsp;\/|&nbsp;)&nbsp;&nbsp;&nbsp;(&nbsp;|&nbsp;&nbsp;&nbsp;)&nbsp;(&nbsp;&nbsp;&nbsp;\/)&nbsp;)&nbsp;|&nbsp;(&nbsp;&nbsp;)&nbsp;&nbsp;|
|&nbsp;(__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;(___)&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;/&nbsp;&nbsp;&nbsp;|
|&nbsp;&nbsp;__)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;____&nbsp;|&nbsp;&nbsp;___&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;|&nbsp;(/&nbsp;/)&nbsp;|
|&nbsp;(&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;\_&nbsp;&nbsp;)|&nbsp;(&nbsp;&nbsp;&nbsp;)&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;/&nbsp;|&nbsp;|
|&nbsp;(____/\___)&nbsp;(___|&nbsp;(___)&nbsp;||&nbsp;)&nbsp;&nbsp;&nbsp;(&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;__)&nbsp;(_|&nbsp;&nbsp;(__)&nbsp;|
(_______/\_______/(_______)|/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\|&nbsp;&nbsp;&nbsp;)_(&nbsp;&nbsp;&nbsp;\____/(_______)
03 Feb 2007 00:00Current
7.1High risk
Vulners AI Score7.1
EQdkp &lt;= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability

EQdkp <= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability
