+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: [Challenge] MyBB Pwning (/Thread-Challenge-MyBB-Pwning)
Pages:
1
2
[Challenge] MyBB Pwning - Adorapuff - 02-10-2014
So you think you got what it takes to pwn some bulliten board systems?
Well, I got 5 sites for you that are vulnerable to the stupidest vulnerability on the planet.
If you exploit it, I'd prefer you shell the site and attempt to root it opposed to a deface, but I can't control what you do.
http://shareholdersunite.com/mybb/
http://www.ai-jane.org/bb/
http://www.autograph-maths.com/mybb/
http://forums.thegamesdb.net/
http://www.writeyourbookin5days.com/mybb/
RE: [Challenge] MyBB Pwning - Lain - 02-10-2014
This is just way too easy :3
RE: [Challenge] MyBB Pwning - OversouL - 02-10-2014
I want to learn how, maybe some nice tutorials written by you would be good.
RE: [Challenge] MyBB Pwning - Lain - 02-11-2014
(02-10-2014, 12:23 PM)OversouL Wrote: I want to learn how, maybe some nice tutorials written by you would be good.
/merge/
RE: [Challenge] MyBB Pwning - lux - 02-11-2014
(02-10-2014, 12:23 PM)OversouL Wrote: I want to learn how, maybe some nice tutorials written by you would be good.
Basically.
The merge is open. So go create yourself a MyBB database with an admin account you know. Then merge it to these sites and boom! You have an admin account.
RE: [Challenge] MyBB Pwning - BreShiE - 02-11-2014
Yes, that's the easy part. However, you then have to attempt to shell the site. Something which I have proven to be possible from this exact "vulnerability" if you can call it that.
I may write a tutorial on this if everyone's finding out about it anyway.
RE: [Challenge] MyBB Pwning - Crypt - 02-11-2014
Damn, easier than I thought lol.
I wouldn't call it a vulnerability though, it's just a page that a dumb ass administrator forgot to remove.
RE: [Challenge] MyBB Pwning - Lain - 02-11-2014
(02-11-2014, 01:11 AM)BreShiE Wrote: Yes, that's the easy part. However, you then have to attempt to shell the site. Something which I have proven to be possible from this exact "vulnerability" if you can call it that.
I may write a tutorial on this if everyone's finding out about it anyway.
Doesn't the calendar templates execute PHP?
[Challenge] MyBB Pwning - Adorapuff - 02-11-2014
(02-11-2014, 01:11 AM)BreShiE Wrote: Yes, that's the easy part. However, you then have to attempt to shell the site. Something which I have proven to be possible from this exact "vulnerability" if you can call it that.
I may write a tutorial on this if everyone's finding out about it anyway.
Can you pm me starfall's mybb shell (not fuhosion) or any mybb shell you got? Thanks
Also, it's about time for a release we've had it longer than most 0days, and while this isn't exactly anything secret, many people don't know about it, and it will give some fuel to the security section which has been sparking lately.
RE: [Challenge] MyBB Pwning - lux - 02-11-2014
(02-11-2014, 02:23 AM)Adorapuff Wrote: Can you pm me starfall's mybb shell (not fuhosion) or any mybb shell you got? Thanks
Also, it's about time for a release we've had it longer than most 0days, and while this isn't exactly anything secret, many people don't know about it, and it will give some fuel to the security section which has been sparking lately.
Nobody can PM you due to your inbox being full.