+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT] How to upload a shell on phpbb3 [TUT] (/showthread.php?tid=2031654)
[TUT] How to upload a shell on phpbb3 [TUT] - CR33T3N - Dec 20, 2011
Hey guys,
In another Thread of me i mentioned to do a Tutorial about this subject, wanted to it a couple days ago but didnt had the time, sorry for that.
So here it is.
It's nothing special and probably everyone knows how to, but I didnt and I couldnt find a solution on HF so I thought maybe there are other newbies out there who have the same Problem and this Thread will help them.
Also for me this is an oppurtunity to give something back to this awesome Community.
So, first of all you go in the Admin Panel.
After that you enable "Allow PHP Templates" in the Security Settings.
Then you go to Style -> Templates and edit the "faq_body.html".
You will probably find a lot of people saying to just write something like
<!-- PHP -->
system($cmd);
<!-- END PHP -->
In there and than work with this.
But for me that didnt worked out, could be a problem with the permissions or maybe they fixed it in newer versions, idk.
So what I did is, I just wrote my shell in there.
But you cant just copy and paste it since phpbb3 wont recognize
" <?php and ?> "
So what you do is you use a Editor or a Tool that allows you to search for text and then replace it. I personally use Notepad++
Then you search for "<?php" and replace it with "<!-- PHP -->"
and you search for "?>" and replace it with "<!-- END PHP -->"
Then you just copy and paste your code into the faq_body.html
And go to that URL: http://HACKEDSITE.com/forum/phpBB2/faq.php
And there should be your shell.
* - Alpha Sierra - Dec 20, 2011
very helpful tutorial im sure everyone will need this!
* - VipVince - Dec 20, 2011
Used this method before. Can confirm it is effective and does the job.
* - Verts - Dec 20, 2011
(Dec 20, 2011 04:41 PM)CR33T3N Wrote: ....
Pretty damn good method man. 👍
* - CR33T3N - Dec 20, 2011
Thanks for all the Feedback.
But lolz, I just now see that i accidently posted this in "Hacking Tutorials" wanted to post it in the Webhacking Section.
* - Gusbu01 - Dec 20, 2011
Thanks alot this was needed, now I gonna pwn some :D
* - CR33T3N - Dec 20, 2011
(Dec 20, 2011 07:45 PM)Gusbu01 Wrote: Thanks alot this was needed, now I gonna pwn some :D
Just remember that if you want to keep your shell you should delete it from the FAQ and upload it somewhere else after you got access.
* - cdaddy - Dec 20, 2011
nice tut man i will try this out, looks useful
* - azerty - Jun 14, 2012
Hello,
Nice tuto but I have a problem.
I have activated the php in template.
I change the code of faq_body.html to
<!-- PHP -->
system($cmd);
<!-- END PHP -->
But when I go to faq.php, I have this error:
Parse error: syntax error, unexpected '}' in /home/***/www/forum/includes/template.php(230) : eval()'d code on line 4
The phpbb version: 3.0.9
thanks
* - SIM-111414 - Jun 14, 2012
Very good method. Effective and nice.
Thanks for sharing..
* - hack4all - Jun 14, 2012
very helpful tutorial
Thanks for sharing..
* - azerty - Jun 15, 2012
So who can help me for the problem ?
It's work for you on phpbb3 ?
* - TheRooter - Jun 15, 2012
Thanks bro im gonna try this out now and comment back
* - ToXiicPaNda1 - Jun 15, 2012
Do u put <!-- PHP --> system($cmd); <!-- END PHP --> in the url or the php code??
* - azerty - Jun 16, 2012
In the php template code. I have watched some videos on youtube and I have follow the instruction.