[Tutorial] Shelling a 3.x.x PHPBB Forum [Pics/Detailed]

[Tutorial] Shelling a 3.x.x PHPBB Forum [Pics/Detailed] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial] Shelling a 3.x.x PHPBB Forum [Pics/Detailed] (/showthread.php?tid=2087563)

Pages: Pages 1 2 3

[Tutorial] Shelling a 3.x.x PHPBB Forum [Pics/Detailed] - -DownFall - Jan 6, 2012

So today I'm going to be showing you how to shell a phpbb 3.x.x forum.

Once you have administrator access, go to your forum and login.
Now go down once you get redirected all the way to the forum.

Spoiler (Click to View)

As you can see, if your account has administrator access, you can view the link to the admin panel.

It'll come up with another login.

Spoiler (Click to View)

It should look something like this.

Code 
http://site.com/adm/index.php

You should now be sucessfully logged in.
Here's what the admin panel looks like.

Spoiler (Click to View)

On the settings tab, scroll down to security settings.

It looks like this.
Spoiler (Click to View)

Now scroll down to Allow php in templates.
Make sure this option is checked to YES.

Now go to the styles tab.
Under Style Components, click Templates.

Spoiler (Click to View)

Now it shows the installed templates. Click edit on the top one.

Spoiler (Click to View)

Now under select temlpate, choose faq_body.html.

Spoiler (Click to View)

It should take you to the template edit screen.

Spoiler (Click to View)

Copy everything on here, and paste it in notepad and save it as backup.txt.

Now delete everything on the page, and see if you can execute some commands to get the php info displayed.

Code 
[b]<!--[/b] PHP -->

phpinfo();

[b]<!--[/b] ENDPHP -->

Spoiler (Click to View)

Hit submit.

Spoiler (Click to View)

Code 
Information

Template file updated successfully.

« Back to previous page

Now go to your sites FAQ page.

Code 
http://www.site.com/faq.php

Spoiler (Click to View)

Now we know we can execute remote commands. Now we can spawn our shell on there.

Go back to where you edited the file, and replace a phpinfo(); with your shell code.

You can use this one.

PHPBB Shell

Spoiler (Click to View)

Now go to your sites FAQ page again. Your shell will be on there.
Now use the uploader on that shell, and upload another one of your choide.

Spoiler (Click to View)

Now go back to where you put your shell code, open up backup.txt, and put the default code back in.

Spoiler (Click to View)

Then go back to your site, and the default FAQ page will be on there.

Now to remove suspicion, go back to the security settings on the general tab and set Allow php in templates to no.

Now click submit.

Code 
Information

Configuration updated successfully.

Now we want to be sneaky, and delete all our dirty work off the admin log.
Spoiler (Click to View)

Check everything you did, scroll down and go to delete checked.
Then confirm it.

Now you can go to your shell and do what you want!

Shoutout to Hooded Robin and the rest of Zer0Lulz, for the idea and hash cracking!

Let me know if you have any questions.

-DownFall

* - .bLaZeD - Jan 6, 2012

Great tutorial. Will definatly bookmark this. :D

* - -zerocool - Jan 6, 2012

Nice tutorial bro.Bookmarked for future reference <3

* - 如果你能抓住我 - Jan 6, 2012

but i know this way from 2009 its old for me

but thanks

* - Hooded Robin - Jan 7, 2012

This may be old but not so well documented. Glad you were able to make it all work finally and great job on capturing all the details in an easy to follow tutorial. Keep up the great work!

* - -DownFall - Jan 7, 2012

(Jan 6, 2012 11:37 PM)С м я у с Wrote: but i know this way from 2009 its old for me

but thanks

As Hooded Robin said, you won't find one that explains everything how mine does. Thanks for the feedback!

* - Numinous - Jan 7, 2012

yea bro ....that's the best way which u described here ..

gud luck ..

* - CR33T3N - Jan 7, 2012

Nice tutorial, did it in a little other way then I did.
Just wanna mention that I did a Tutorial covering that too, yours is better tho imo. (For people interested: https://hackforums.net/showthread.php?tid=2031654)

But you could basically use any shell, you just need to change <?php and ?> in "" and ""
So that phpbb recognizes it.

Offtopic: Are you still on Skype? havent seen you there for some time :D

* - kakker - Jan 7, 2012

GREAT tut , once again :) learned a lot of you , keep up the good work!!! :)

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 08:00 AM)CR33T3N Wrote: Nice tutorial, did it in a little other way then I did.
Just wanna mention that I did a Tutorial covering that too, yours is better tho imo. (For people interested: https://hackforums.net/showthread.php?tid=2031654)

But you could basically use any shell, you just need to change <?php and ?> in "" and ""
So that phpbb recognizes it.

Offtopic: Are you still on Skype? havent seen you there for some time :D

I kept getting parsing errors the first few times, started to get on my nerves lol.

Im on skype right now if you want to hop on.

* - Prominent - Jan 7, 2012

phpBB, haven't seen tutorials on how to hack it for a while. Very nice tutorial :3

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 09:41 AM)Prominent Wrote: phpBB, haven't seen tutorials on how to hack it for a while. Very nice tutorial :3

Thanks Prominent! Added this to the list in my mega-thread under shells.

* - Retribute - Jan 7, 2012

Problem here is that it'll say "Admin log cleared" which would spark suspicion, otherwise this is a nice tutorial.

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 02:55 PM)RubiksHQ Wrote: Problem here is that it'll say "Admin log cleared" which would spark suspicion, otherwise this is a nice tutorial.

Thanks, but there's not really much you can do about that :/
Leaves a lot less suspicion then leaving all the rest of the stuff on there though lol.

* - Retribute - Jan 7, 2012

You should also add a note in the OP that only Admins with Founder status may do this ;)