[Starfall]

Today I am going to post a method of gaining free access to Prodigy source shell booters.
If we look at register.php, we will see these lines of code:

PHP Code


<?php 
// Generates activation code simple 4 digit number
$activ_code = rand(1000,9999);

/* snip irrelevant */ 
$sql_insert = "INSERT into `users`
              (`full_name`,`user_email`,`pwd`,`address`,`tel`,`fax`,`website`,`date`,`users_ip`,`activation_code`,`country`,`user_name`) 
 VALUES
            ('$data[full_name]','$usr_email','$sha1pass','$data[address]','$data[tel]','$data[fax]','$data[web]'
            ,now(),'$user_ip','$activ_code','$data[country]','$user_name'
            )
            "; 


Forgive the kinda-ugly code, it's not mine...
Anyway, we can see that, as the author himself said, the activation code is a simple 4 digit number.
Regardless of whether or not activation links are sent in emails (they usually aren't, to ensure that you pay for the booter),
we can write a script to brute force this within a few minutes.
To keep this tutorial skiddy-proof, I won't provide such a thing...
but here's the relevant code from activate.php containing everything you need to know to make one:

PHP Code


<?php 
/** ACTIVATION BY FORM**/
if ($_POST['doActivate']=='Activate')
{
$err = array();
$msg = array();

$user_email = mysql_real_escape_string($_POST['user_email']);
$activ = mysql_real_escape_string($_POST['activ_code']);
//check if activ code and user is valid as precaution
$rs_check = mysql_query("select id from users where user_email='$user_email' and activation_code='$activ'") or die (mysql_error()); 
$num = mysql_num_rows($rs_check);
  // Match row found with more than 1 results  - the user is authenticated. 
    if ( $num <= 0 ) { 
    $err[] = "Sorry no such account exists or activation code invalid.";
    //header("Location: activate.php?msg=$msg");
    //exit();
    }
//set approved field to 1 to activate the user
if(empty($err)) {
    $rs_activ = mysql_query("update users set approved='1' WHERE 
         user_email='$user_email' AND activation_code = '$activ' ") or die(mysql_error());
    $msg[] = "Thank you. Your account has been activated.";
 } 


[BattleToads]

omgzfg h4x0r is fake. the last exploit was soo fake this HAS to be fake. Nice troll post guys. This is HF no way there is a actual exploit on here.

[Starfall]

Yup, absolutely fake. That's why I pasted code from the vulnerable script itself. </sarcasm>
Read the code moron.

[BattleToads]

Yup, absolutely fake. That's why I pasted code from the vulnerable script itself. </sarcasm>
Read the code moron.

This is blackhat activity and will be removed immidiantley. And rep fucked for coming up with a good exploit and trashing gay ass booters

[Starfall]

This is blackhat activity and will be removed immidiantley. And rep fucked for coming up with a good exploit and trashing gay ass booters

Ah. I see. Troll replies... Carry on, then.

[BattleToads]

Ah. I see. Troll replies... Carry on, then.

-1 reps omfg SCAM REPORT DIS BIITCH. He's probably infecting memeberzz becuz he haz -1 repz lets all rep fawk him. REEP FAWKK.

[SoLong]

Vouch for ddos_king.
This exploit is real and legit.
Good job!

[Fossil]

Obviously a legit exploit, BattleToads doesn't know what he's talking about :3

[Phizo]

Very nice ddos_king, great contribution.
That is probably the worst authentication method I've ever came across. It generates a random integer between values 1000 and 9999; that would be ridiculously easy to brute force.

[Diksens]

Quick python script I wrote which makes use of this exploit. Enjoy activating your accounts.

Link: http://pastebin.com/qQXyhs1W

[Starfall]

Quick python script I wrote which makes use for this exploit. Enjoy activating your accounts.

Link: http://pastebin.com/qQXyhs1W

I was kinda waiting for this.
RIP Prodigy source.

[Phizo]

Quick python script I wrote which makes use of this exploit. Enjoy activating your accounts.

Link: http://pastebin.com/qQXyhs1W

That seems like a lot of code for such a simple task. Nevertheless good work :3
Then again, a lot of it is comments.

[Diksens]

I was kinda waiting for this.
RIP Prodigy source.

Haha. You might want to update the link in the quote, fixed a small issue regarding an infinite loop, which would make it keep looping if it didn't matched the regex. Nice find btw.

That seems like a lot of code for such a simple task. Nevertheless good work :3
Then again, a lot of it is comments.

Yeah, maybe. I'd like to comment my code, even though most of the code is simple to understand, it's mainly for people whom do not have any knowledge about python, yet they like to know what the code does. Anyway, this script will make divide the threads in half, one half will start looping from 0 to 5000, the other half from 9999 to 5000, just to speed up the process.

[Th3PonyWizard]

I'd go over creating a PHP brute-force script for that, does anybody know where can I get the full source code? Anyway, nice find OP.
EDIT: nevermind, saw the contents of activate.php, seems to be enough.

omgzfg h4x0r is fake. the last exploit was soo fake this HAS to be fake. Nice troll post guys. This is HF no way there is a actual exploit on here.

Dumbass.

[Starfall]

I'd go over creating a PHP brute-force script for that, does anybody know where can I get the full source code? Anyway, nice find OP.

Dumbass.

http://localhostr.com/download/0h1K963/B...%20PHP.zip
Here's the full Prodigy source. (both "old" and "new" are affected, as well as derivatives)