shell in phpBB

Pagini: 1

Moderat de Shocker

hfhun
Elite Member
Postari: 593

cum se uploadeaza un shell prin avatar? stiu ca era un exploit.

_______________________________________
"Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for." - The Mentor - The hacker's manifesto

Shocker
Super Moderator
Din: localhost
Postari: 2084

Pai poti cu null byte.

Dai sa uploadezi la avatar un fisier .php [sau cum e shellu] si mai adaugi acolo %00.jpg

El cand analizeaza sa vada daca e sau nu .jpg, vede ca se termina in .jpg pathul catre imagine si crede ca totul e OK. Dar functia care uploadeaza fisierul, citeste doar pana la %00 [caracterul 0 care semnifica sfarsit de string], deci uploadeaza c:blablablabla.php [tu ai scris c:blablablabla.php%00.jpg]

_______________________________________
ShockingSoft is back
Freakz only
Comics of the day

hfhun
Elite Member
Postari: 593

ms mult shocker. si merge pe orice versiune de phpBB care nu este securizata? pe phpBB 2.0.21 sau care e ultimul, mai merge?

_______________________________________
"Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for." - The Mentor - The hacker's manifesto

Shocker
Super Moderator
Din: localhost
Postari: 2084

Asta nu stiu, deoarece nu am incercat niciodata... stiu doar teoria [atat ma intereseaza

]

Anyway... pe noul forum care e 2.0.21 nu merge [am mai facut si eu mici modificari pe la securitate]

_______________________________________
ShockingSoft is back
Freakz only
Comics of the day

Pagini: 1

Mergi la