Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - zediwon

Pages: [1]
1
Hacking and Security / Re: Taking over your Evilzone account - The easy way.
« on: October 23, 2014, 07:08:05 pm »
Quote
How would you turn an admin account into remote code execution?

Well Phage, I am pretty sure someone will manage something out once being Admin? I am sure it isn't that complex. even if I can write Javascript, it won't be that hard afterwards. :/

2
Hacking and Security / Re: Taking over your Evilzone account - The easy way.
« on: October 22, 2014, 06:07:28 pm »
and ^ there you have some info to look for more info, LOL. thanks Phage :P and still RCE in Forums is enough to infect more users and escalate the attack to more worse scenarios, very worse (I leave that to your imaginations)

3
Hacking and Security / Re: Taking over your Evilzone account - The easy way.
« on: October 21, 2014, 09:17:02 pm »
Quote
...That's a small DoS attack and I don't think an admin exists that wouldn't notice it. Even if you did throttle it back to a conservative rate :p

Actually, there just needs to be one successful bruteforce attempt against one Super-Admin and everything will be over. if you can do that attack with <10 mins, with rented zombies or whatever, it means that, you can take over the whole EZ. :/

I have faced similar problem with Facebook. http://paulosyibelo.blogspot.com/2014/08/ow-facebook-taking-over-random-accounts.html

4
Hacking and Security / Re: Taking over your Evilzone account - The easy way.
« on: October 18, 2014, 10:50:29 pm »
Btw Factionwars, Just wondering, did somebody removed my python script I made as a PoC to enumurate all the possibilites?

5
Hacking and Security / Re: Taking over your Evilzone account - The easy way.
« on: October 18, 2014, 08:41:22 pm »
nevermind, I liked the new fix. Its confusing to write a script that understands if the page "really reseting" or just showing up an "Invalid page" this way, its not possible to enumerate accounts :)

6
Hacking and Security / Re: Taking over your Evilzone account - The easy way.
« on: October 18, 2014, 08:35:17 pm »
Factionwars, I am confused about the fix.

https://evilzone.org/reminder/?sa=setpassword;u=13473;code=5c24bfdeaf or
https://evilzone.org/reminder/?sa=setpassword;u=13473;code=whatever still results a update page, I am confused, is this right?

7
Hacking and Security / Re: Taking over your Evilzone account - The easy way.
« on: October 18, 2014, 06:09:18 pm »
"Controling of the brutefoce would be nice" isnt the right mitigation technique (considering there are always zombies, so limiting by IP, useragent... is next to impossible)

However, strengthening the hash to a bigger length and not letting it have the userid, but as if encoded (having all possible symboles, chars, and numbers) would help. I think(?) :-D

8
Hacking and Security / Taking over your Evilzone account - The easy way.
« on: October 18, 2014, 05:44:35 pm »
Hi,

I haven't been here for a while, one because I fought with one of the *reputated* admins and another because I have been busy with school. meh, anyway, I just came back to Evilzone today and tried resetting my password and see whats been up in ~year (since i forgot it) then notice a very lame password reset logical flaw.

when you reset your password, evilzone will mail you a link similar to,

https://evilzone.org/reminder/?sa=setpassword;u=13473;code=5c24bf48ba

I haven't done a perfect cryptanalysis but so far I have noticed the url contains my userid (13473) and the reset code.

But if you notice carefully, the reset code is a substr version of MD5 value of some random hash and the worst part being, it have a constant length (10).

So taking that, we can construct all the possible values of that password reset hash.

md5 is hexadecimal, meaning there are 0-F characters. (abcdef0123456789), that is 10 numbers, 6 letters, 16 total characters. since its always 10 constact length, its 16^10, that is equvallent to
1,099,511,627,776 possible values. and thats very small, so I wrote a final python script to have all the possible password reset URL's



Now, all we got to do is reset the user (https://evilzone.org/reminder/) then all we got to do is know the userid, (simply by going to the user profile and clicking on personal message, the URLcontains the user ID, like https://evilzone.org/pm/?sa=send;u=13473) so the password reset pseudo would look like

https://evilzone.org/reminder/?sa=setpassword;u=USERID;code=HASH

then after making a simple python script to send all the requests, we can takeover ALL Evilzone accounts. :) Have zombies? Makes things even easier!

Enjoy!

Pages: [1]