[Lysandre]

What was the obfuscation btw? i bet it was some lame eval() related stuff, lol.

[redpois0n]

Code

    if(isset($_GET['id'])
    && isset($_GET['os'])
    && isset($_GET['name'])){
    $result = mysql_query("SELECT * FROM bots WHERE id='" . $_GET['id'] . "'");

is this a blind sql injection i see ? ;)

What can you do with that? Blind sql injection?

[Lysandre]

What can you do with that? Blind sql injection?

Well, you COULD possibly get data out of the db, but it'll be very hard, you'd have to actually verify if it was inserted or updated, because nothing is given from the db. If there was a die(mysql_error()) it'd be a nice error-based injection, but there isn't, so...

[Shiroyasha]

and obfuscated the panel code slightly.

Slightly ? Did they even paid any efforts in trying to secure atleast the code of it ?
All they did was encrypt the php code with byte 64 which is the first thing anyone can do if they search google for "Crypt php code" or w/e

It is so easy to decrypt back to php code using online tools itself.

They could have atleast re-crypted the crypted code atleast 2-3 times or rather encoded it or used more better protection techniques

And god, for people making $50+ per sale, how hard is it to buy Zendguardian or ioncube

[Lysandre]

lol, they just did eval(base64_decode()) ?!

lololololololololol

[xRate]

That sucks lol. inb4 OPs slaves get stolen.

[redpois0n]

lol, they just did eval(base64_decode()) ?!

lololololololololol

eval executes php code? Oh god damn, this would make shit easier for me if I knew.

[xRate]

eval executes php code? Oh god damn, this would make shit easier for me if I knew.

eval() Exectutes the php code indeed. Shit coders here on hf use it to "obfuscate" their shells. Skids.

[redpois0n]

eval() Exectutes the php code indeed. Shit coders here on hf use it to "obfuscate" their shells. Skids.

Thats not that smart, but I can see myself using it :P

[Kernel Mode]

If customers are that worried I would recommend fixing it yourself. It takes probably 1 minute, if that..

Only on HF would some idiot suggest you fix the product yourself.

[redpois0n]

Only on HF would some idiot suggest you fix the product yourself.

And most of people cant fix it themselves.

[debug]

If the panel is leaked deobfuscated, why don't you just patch it yourself?

[betamonkey]

If the panel is leaked deobfuscated, why don't you just patch it yourself?

It shouldn't be up to customers to fix the product they bought. 'Barracuda team' should fix it themselves, it is so god damn easy I cannot even figure out why they can't or won't. On that note - It makes you wonder how shitty other parts of the project are, considering they really bungled this part of it.

Beta Monkey

[_Stoner]

It shouldn't be up to customers to fix the product they bought. 'Barracuda team' should fix it themselves, it is so god damn easy I cannot even figure out why they can't or won't. On that note - It makes you wonder how shitty other parts of the project are, considering they really bungled this part of it.

Beta Monkey

I like that word... 'bungled'

But yeah, why should the customers have to fix a product they paid good money for? The software should be sold in good and working condition.

The solution the 'Barracuda Team' proposes is that users of the bot should password protect the login directory. Seems to be more of a nig-rig solution than anything good.

Plus, password protecting the directory wouldn't stop attackers from injecting an iframe of their exploit pack or java driveby into the Barracuda HTTP dashboard in order to infect the owner of the bot panel.

[debug]

It shouldn't be up to customers to fix the product they bought. 'Barracuda team' should fix it themselves, it is so god damn easy I cannot even figure out why they can't or won't. On that note - It makes you wonder how shitty other parts of the project are, considering they really bungled this part of it.

Beta Monkey

Valid point, but their problem is only a google search away from being solved.