+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Tutorial vBulletin Vulnerability, Versions 4.1 to 5+ (/Thread-Tutorial-vBulletin-Vulnerability-Versions-4-1-to-5)
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Cyanide and Cynicism - 09-12-2013
A better tutorial than some posted on here, on cURL why do you need to set the user-agent? It doesn't seem to have any info and vBulletin doesn't block cURL's user-agent as far as I know.
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Mom - 09-12-2013
(09-12-2013, 02:48 AM)tygr Wrote: I'm not a common user of coolrom, I just happened to go on the site the exact same day it got hacked :3
I don't get why people's jimmies were so rustled about the comprimise, the site was restored in less than a day.
People like video games. People love free games.
And the people from the mighty lands of the interwebz don't have the reputation to be patient I guess.
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Oni - 09-12-2013
(09-12-2013, 03:18 AM)Cyanide and Cynicism Wrote: A better tutorial than some posted on here, on cURL why do you need to set the user-agent? It doesn't seem to have any info and vBulletin doesn't block cURL's user-agent as far as I know.
Just an example and not necessarily required. I generally tend to specify the user-agent, regardless.
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Cyanide and Cynicism - 09-12-2013
(09-12-2013, 07:01 AM)Anonymoose Wrote: because maybe a cURL user agent is a lot more suspicious than a normal one?
Doesn't really matter if you attract attention if you use Tor, which you should do in the first place so you don't get v*
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Nefarious - 09-12-2013
(09-12-2013, 12:41 PM)Cyanide and Cynicism Wrote: Doesn't really matter if you attract attention if you use Tor, which you should do in the first place so you don't get v*
I highly doubt you would get vanned for hacking a forum....
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Cyanide and Cynicism - 09-12-2013
(09-12-2013, 03:43 PM)Kirito Wrote: I highly doubt you would get vanned for hacking a forum....
Better to use protection than not to, even in trivial cases
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Dong - 09-13-2013
Nice tutorial. Although, it is pretty disappointing that a popular company such as vBulletin hasn't learned of something called "user authentication" as yet.
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Cyanide and Cynicism - 09-14-2013
(09-14-2013, 07:48 AM)jewpack Wrote: Please elaborate on Tor's anti-van mechanism you speak of.
http://nostarch.com/tcpip.htm
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Dong - 09-14-2013
(09-14-2013, 07:48 AM)jewpack Wrote: How was this a user-authentication issue? Please, explain.
It's quite plain to see. You are given access to a forum owner's customer ID (even though it is hashed in MD5) without having to provide any sort of proof or AUTHENTICATION that you are the owner. Then, you can send a POST request containing this hashed customer ID (which appears to be the only authentication required) along with a few other variables in order to create your own Administrator account. Again, another problem to do with authentication as it doesn't require you to prove or AUTHENTICATE that you are the forum owner by any means other than a customer ID which, might I add, can be accessed EASILY just by looking into the source code on the "upgrade" page.
Therefore, this leads us to the conclusion that this vulnerability mainly comprises of vBulletin doing a terrible job authenticating whether you are actually the forum owner/customer or not.
As stated before, this should be plain to see.
RE: vBulletin Vulnerability, Versions 4.1 to 5+ - Oni - 09-14-2013
(09-14-2013, 04:11 PM)Aristotle Wrote: It's quite plain to see. You are given access to a forum owner's customer ID (even though it is hashed in MD5) without having to provide any sort of proof or AUTHENTICATION that you are the owner. Then, you can send a POST request containing this hashed customer ID (which appears to be the only authentication required) along with a few other variables in order to create your own Administrator account. Again, another problem to do with authentication as it doesn't require you to prove or AUTHENTICATE that you are the forum owner by any means other than a customer ID which, might I add, can be accessed EASILY just by looking into the source code on the "upgrade" page.
Therefore, this leads us to the conclusion that this vulnerability mainly comprises of vBulletin doing a terrible job authenticating whether you are actually the forum owner/customer or not.
As stated before, this should be plain to see.
I'm not sure who's explanation is better for imbeciles. You choose.
