[manaox2]

First Succesful Exploit I found.

The phpBB 2.0.16 XSS Remote Exploit. It can be used for many things, but I only can think of java alert spamming and stealing cookies and the admin password by pming them and getting it to steal their hash.

What I used was:

[url]www.[url=www.s=''style='top:expression(eval(this.sss));'sss=`alert('MessageHereWithoutSpaces');this.sss=null`s='][/url][/url]'

You can also use code to steal cookies by writing your own cookie.php and cross site scripting with this. View the source to see what worked and what didn't.

Some References:

http://www.waraxe.us/ftopict-890.html
http://antichat.ru/txt/phpbb/ (Russian)
http://kisobox.com/e...ies.stealer.txt
http://www.milw0rm.com/id.php?id=1095

This only works on Internet Explorer. If you have your Local Intranet and Internet settings set to high as you should for the javaprxy.dll exploit out there, it also will not work. I want to know of more exploits for this. I hope everyone will get to work!

[Stephen]

Interesting but this also happens to be the very first exploit returned in a google search so good job eh <_<

[manaox2]

Salvia, on Jul 11 2005, 05:56 PM, said:

Interesting but this also happens to be the very first exploit returned in a google search so good job eh  <_<

<{POST_SNAPBACK}>

I believe its also the last. I have not heard of any other found vulnerabilities for phpBB 2.0.16. I admit that I didn't discover this vulnerability, but only proved it worked on the wargames server. I want to now know if someone had any more information on the new critical firefox exploits and if these two exploits could be combined to maybe, say, change a wallpaper.

[Blake]

Geez ok, the concept is to find new vulnerabilities in the software, not just rehash the old ones.

[manaox2]

GSecur, on Jul 12 2005, 04:35 PM, said:

Geez ok, the concept is to find new vulnerabilities in the software, not just rehash the old ones.

<{POST_SNAPBACK}>

Sorry about the misunderstanding. I had included references in my post, so as not to be trying to take credit for this exploit. I'll attempt to find a new one.

[Blake]

I know, it was more of my fault. I labeled tech topic before I completely read it.