+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [EXPLOIT] Get free access to Prodigy shell booters! (/showthread.php?tid=2737713)
[EXPLOIT] Get free access to Prodigy shell booters! - Starfall - Aug 2, 2012
Today I am going to post a method of gaining free access to Prodigy source shell booters.
If we look at register.php, we will see these lines of code:
PHP Code
<?php
// Generates activation code simple 4 digit number
$activ_code = rand(1000,9999);
/* snip irrelevant */
$sql_insert = "INSERT into `users`
(`full_name`,`user_email`,`pwd`,`address`,`tel`,`fax`,`website`,`date`,`users_ip`,`activation_code`,`country`,`user_name`)
VALUES
('$data[full_name]','$usr_email','$sha1pass','$data[address]','$data[tel]','$data[fax]','$data[web]'
,now(),'$user_ip','$activ_code','$data[country]','$user_name'
)
";
Anyway, we can see that, as the author himself said, the activation code is a simple 4 digit number.
Regardless of whether or not activation links are sent in emails (they usually aren't, to ensure that you pay for the booter),
we can write a script to brute force this within a few minutes.
To keep this tutorial skiddy-proof, I won't provide such a thing...
but here's the relevant code from activate.php containing everything you need to know to make one:
PHP Code
<?php
/** ACTIVATION BY FORM**/
if ($_POST['doActivate']=='Activate')
{
$err = array();
$msg = array();
$user_email = mysql_real_escape_string($_POST['user_email']);
$activ = mysql_real_escape_string($_POST['activ_code']);
//check if activ code and user is valid as precaution
$rs_check = mysql_query("select id from users where user_email='$user_email' and activation_code='$activ'") or die (mysql_error());
$num = mysql_num_rows($rs_check);
// Match row found with more than 1 results - the user is authenticated.
if ( $num <= 0 ) {
$err[] = "Sorry no such account exists or activation code invalid.";
//header("Location: activate.php?msg=$msg");
//exit();
}
//set approved field to 1 to activate the user
if(empty($err)) {
$rs_activ = mysql_query("update users set approved='1' WHERE
user_email='$user_email' AND activation_code = '$activ' ") or die(mysql_error());
$msg[] = "Thank you. Your account has been activated.";
}
* - BattleToads - Aug 2, 2012
omgzfg h4x0r is fake. the last exploit was soo fake this HAS to be fake. Nice troll post guys. This is HF no way there is a actual exploit on here.
* - Starfall - Aug 2, 2012
Yup, absolutely fake. That's why I pasted code from the vulnerable script itself. </sarcasm>
Read the code moron.
* - BattleToads - Aug 2, 2012
(Aug 2, 2012 02:09 AM)ddos_king Wrote: Yup, absolutely fake. That's why I pasted code from the vulnerable script itself. </sarcasm>
Read the code moron.
This is blackhat activity and will be removed immidiantley. And rep fucked for coming up with a good exploit and trashing gay ass booters
* - Starfall - Aug 2, 2012
(Aug 2, 2012 02:10 AM)BattleToads Wrote: This is blackhat activity and will be removed immidiantley. And rep fucked for coming up with a good exploit and trashing gay ass booters
Ah. I see. Troll replies... Carry on, then.
* - BattleToads - Aug 2, 2012
(Aug 2, 2012 02:14 AM)ddos_king Wrote: Ah. I see. Troll replies... Carry on, then.
-1 reps omfg SCAM REPORT DIS BIITCH. He's probably infecting memeberzz becuz he haz -1 repz lets all rep fawk him. REEP FAWKK.
* - SoLong - Aug 2, 2012
Vouch for ddos_king.
This exploit is real and legit.
Good job!
* - Fossil - Aug 2, 2012
Obviously a legit exploit, BattleToads doesn't know what he's talking about :3
* - Phizo - Aug 2, 2012
Very nice ddos_king, great contribution.
That is probably the worst authentication method I've ever came across. It generates a random integer between values 1000 and 9999; that would be ridiculously easy to brute force.
* - Diksens - Aug 2, 2012
Quick python script I wrote which makes use of this exploit. Enjoy activating your accounts.
Link: http://pastebin.com/qQXyhs1W
* - Starfall - Aug 2, 2012
(Aug 2, 2012 04:31 AM)Diksens Wrote: Quick python script I wrote which makes use for this exploit. Enjoy activating your accounts.
Link: http://pastebin.com/qQXyhs1W
I was kinda waiting for this.
RIP Prodigy source.
* - Phizo - Aug 2, 2012
(Aug 2, 2012 04:31 AM)Diksens Wrote: Quick python script I wrote which makes use of this exploit. Enjoy activating your accounts.
Link: http://pastebin.com/qQXyhs1W
That seems like a lot of code for such a simple task. Nevertheless good work :3
Then again, a lot of it is comments.
* - Diksens - Aug 2, 2012
(Aug 2, 2012 04:32 AM)ddos_king Wrote: I was kinda waiting for this.
RIP Prodigy source.
Haha. You might want to update the link in the quote, fixed a small issue regarding an infinite loop, which would make it keep looping if it didn't matched the regex. Nice find btw.
(Aug 2, 2012 04:38 AM)Phizo Wrote: That seems like a lot of code for such a simple task. Nevertheless good work :3
Then again, a lot of it is comments.
Yeah, maybe. I'd like to comment my code, even though most of the code is simple to understand, it's mainly for people whom do not have any knowledge about python, yet they like to know what the code does. Anyway, this script will make divide the threads in half, one half will start looping from 0 to 5000, the other half from 9999 to 5000, just to speed up the process.
* - Th3PonyWizard - Aug 2, 2012
I'd go over creating a PHP brute-force script for that, does anybody know where can I get the full source code? Anyway, nice find OP.
EDIT: nevermind, saw the contents of activate.php, seems to be enough.
(Aug 2, 2012 02:08 AM)BattleToads Wrote: omgzfg h4x0r is fake. the last exploit was soo fake this HAS to be fake. Nice troll post guys. This is HF no way there is a actual exploit on here.Dumbass.
* - Starfall - Aug 2, 2012
(Aug 2, 2012 04:39 AM)Th3PonyWizard Wrote: I'd go over creating a PHP brute-force script for that, does anybody know where can I get the full source code? Anyway, nice find OP.http://localhostr.com/download/0h1K963/Booter%20Sources%20PHP.zip
Dumbass.
Here's the full Prodigy source. (both "old" and "new" are affected, as well as derivatives)