Boonex Dolphin all versoin <= 7.3 Authentication Bypass

Posted by Saadi On Wednesday, 26 October 2016 3 comments
# Exploit Title     : Boonex Dolphin all versoin <= 7.3 Authentication Bypass
# Exploit Author    : Saadat Ullah saadi_linux[@]rocketmail.com
# Software Link     : https://www.boonex.com
# Author HomePage   : http://security-geeks.blogspot.com
  
 
Proof of Concept
 
File: admin.inc.php
Line: 187
Code: (strcmp($aProfile['Password'], $passwd) != 0)
  
$passwd is equal to Cookie parameter memberpassword
  
Bug:
According to PHP documentation strcmp will compare strings, but what if we provide an array???
  
So, simple bypass is to put two cookies in browser
memberID=1
memberPassword[]=blah --->array
  
This will allow the attacker to bypass the authentication and can also enter in admin panel.
  
#Independent Pakistani Security Researcher
READ MORE

Hack Diaries - Pwning TLD Uganda

Posted by Saadi On Friday, 8 July 2016 1 comments
Hi, after a long time... today I am going to show you POC for pwning TLD .ug which I did some 3-4 years back.
Years back the interface of the domain was http://old.registry.co.ug/ and "Domain Manager Panel" sub-domain was not exposed in the TLD main domain and search engines.
So, after doing some information gathering e.g. port scanning, whois lookup's etc I found the Domain panel which was located at https://new.registry.co.ug:8006/

I am not going in detailed explanation of how I do the pentest rather show you the main weakness "Direct object reference".
So, after trying hard for RCE, SQLi, server vulnerabilities enumeration etc. I found a direct object reference to the admin panel.
To enter in the domain manager as admin you just have to locate below URL:
https://new.registry.co.ug:8006/admin

 

There was no validation of users via sessions or any other mechanism. And I was able to see all the stuff in admin panel including changing DNS of any domain such as google, MSN etc.
At that time I tried to contact them but I didn’t get any response and later in 2013 and 2015 someone hacked and changed the DNS of some domains like google.co.ug, MSN etc. When I came to know the defacement I recheck for the vulnerability but this time it was patch by them (after the defacement). But still it is vuln to direct object reference in many other places.


Will come up with some more cool Hack Diaries - Happy Hacking ;)
READ MORE