[-DownFall]

So today I'm going to be showing you how to shell a phpbb 3.x.x forum.

Once you have administrator access, go to your forum and login.
Now go down once you get redirected all the way to the forum.

Spoiler (Click to View)

As you can see, if your account has administrator access, you can view the link to the admin panel.

It'll come up with another login.

Spoiler (Click to View)

It should look something like this.

Code

http://site.com/adm/index.php

You should now be sucessfully logged in.
Here's what the admin panel looks like.

Spoiler (Click to View)


On the settings tab, scroll down to security settings.

It looks like this.
Spoiler (Click to View)


Now scroll down to Allow php in templates.
Make sure this option is checked to YES.

Now go to the styles tab.
Under Style Components, click Templates.

Spoiler (Click to View)

Now it shows the installed templates. Click edit on the top one.

Spoiler (Click to View)

Now under select temlpate, choose faq_body.html.

Spoiler (Click to View)

It should take you to the template edit screen.

Spoiler (Click to View)

Copy everything on here, and paste it in notepad and save it as backup.txt.

Now delete everything on the page, and see if you can execute some commands to get the php info displayed.

Code

[b]<!--[/b] PHP -->

phpinfo();

[b]<!--[/b] ENDPHP -->

Spoiler (Click to View)

Hit submit.

Spoiler (Click to View)

Code

Information

Template file updated successfully.

« Back to previous page

Now go to your sites FAQ page.

Code

http://www.site.com/faq.php

Spoiler (Click to View)

Now we know we can execute remote commands. Now we can spawn our shell on there.

Go back to where you edited the file, and replace a phpinfo(); with your shell code.

You can use this one.

PHPBB Shell

Spoiler (Click to View)

Now go to your sites FAQ page again. Your shell will be on there.
Now use the uploader on that shell, and upload another one of your choide.


Spoiler (Click to View)

Now go back to where you put your shell code, open up backup.txt, and put the default code back in.

Spoiler (Click to View)

Then go back to your site, and the default FAQ page will be on there.

Now to remove suspicion, go back to the security settings on the general tab and set Allow php in templates to no.

Now click submit.

Code

Information

Configuration updated successfully.

Now we want to be sneaky, and delete all our dirty work off the admin log.
Spoiler (Click to View)

Check everything you did, scroll down and go to delete checked.
Then confirm it.

Now you can go to your shell and do what you want!


Shoutout to Hooded Robin and the rest of Zer0Lulz, for the idea and hash cracking!

Let me know if you have any questions.

-DownFall

[.bLaZeD]

Great tutorial. Will definatly bookmark this. :D

[-zerocool]

Nice tutorial bro.Bookmarked for future reference <3

[如果你能抓住我]

but i know this way from 2009 its old for me

but thanks

[Hooded Robin]

This may be old but not so well documented. Glad you were able to make it all work finally and great job on capturing all the details in an easy to follow tutorial. Keep up the great work!

[-DownFall]

but i know this way from 2009 its old for me

but thanks

As Hooded Robin said, you won't find one that explains everything how mine does. Thanks for the feedback!

[Numinous]

yea bro ....that's the best way which u described here ..

gud luck ..

[CR33T3N]

Nice tutorial, did it in a little other way then I did.
Just wanna mention that I did a Tutorial covering that too, yours is better tho imo. (For people interested: https://hackforums.net/showthread.php?tid=2031654)

But you could basically use any shell, you just need to change <?php and ?> in "<!-- PHP -->" and "<!-- ENDPHP -->"
So that phpbb recognizes it.

Offtopic: Are you still on Skype? havent seen you there for some time :D

[kakker]

GREAT tut , once again :) learned a lot of you , keep up the good work!!! :)

[-DownFall]

Nice tutorial, did it in a little other way then I did.
Just wanna mention that I did a Tutorial covering that too, yours is better tho imo. (For people interested: https://hackforums.net/showthread.php?tid=2031654)

But you could basically use any shell, you just need to change <?php and ?> in "<!-- PHP -->" and "<!-- ENDPHP -->"
So that phpbb recognizes it.

Offtopic: Are you still on Skype? havent seen you there for some time :D

I kept getting parsing errors the first few times, started to get on my nerves lol.

Im on skype right now if you want to hop on.

[Prominent]

phpBB, haven't seen tutorials on how to hack it for a while. Very nice tutorial :3

[-DownFall]

phpBB, haven't seen tutorials on how to hack it for a while. Very nice tutorial :3

Thanks Prominent! Added this to the list in my mega-thread under shells.

[Retribute]

Problem here is that it'll say "Admin log cleared" which would spark suspicion, otherwise this is a nice tutorial.

[-DownFall]

Problem here is that it'll say "Admin log cleared" which would spark suspicion, otherwise this is a nice tutorial.

Thanks, but there's not really much you can do about that :/
Leaves a lot less suspicion then leaving all the rest of the stuff on there though lol.

[Retribute]

You should also add a note in the OP that only Admins with Founder status may do this ;)