Must read! Nulled (vBulletin & IPB) Vulns!

[litewarez]

Ok so made lil video of me playing about with this little DD (Directory Disclosure) vuln in the DGT releases of vBulletin but it was too big to upload so heres some scrennshots!

vBulletin & IPB Vulns!

Boxheads Site!


Boxheads Files (http://belegit.org/validator.php)


Database ive collected


Via this method i have also rooted 2 sites !

Things you should do!
1. Go phpBB
2. Remove the validator.php script!
3. Remove any other scripts thats not needed!
4. Rename ModCp and AdminCp to summat else
5. DO NOT STORE BACKUPS ON htdocs .... and especially with names like backup.sql


PLEASE CHECK IF YOU HAVE THIS FILE ON YOUR SERVER ID SO DELETE ASAP!!!!

I had database from about 12 people who entered the chat the other day, but you all know your DBS are safe and im trusted but others aint!

DELETE them asap!

Proof: http://belegit.org/validator.php - http://vbteam.info/validator.php

SAY THANKS IF THIS HELPED YOU

Shouts to warezdeamon for this aswell lol

litewarez Reviewed by litewarez on 23rd Jan 2010. Must read! Nulled (vBulletin & IPB) Vulns! Ok so made lil video of me playing about with this little DD (Directory Disclosure) vuln in the DGT releases of vBulletin but it was too big to upload so heres some scrennshots! vBulletin & IPB Vulns! Boxheads Site! http://www.imgcentre.com/img/uploads/big/5637a1331e.png Boxheads Files (http://belegit.org/validator.php) Rating: 5

[Shad?w]

lol thats nothing, only if you store the database on public_html who do you think is enought stupid to do that rofl ^^

[litewarez]

Lmao you will be surprised dood!

I have like 3.5Gb's of databases and 2 full sites via this tool! i found stupid things hidden on the site like wysywigs that allow file uploads then shel then injected index with webshell then root!


About 50% of users who read this will be like ooh fuck!

[CyberJ37]

http://vbteam.info/validator.php

[litewarez]

theres your answer!

[Elio]

the only thing this thread shows is that you should be carefull when using nulled scripts nothing more is not rly an ipb or vb vulerability

[litewarez]

yea but it is lol because these files are mainly shipped for ipb and vb.. not but the creators but by the nullers and the larger amount of users have nulled!

[Elio]

ye but edit the topic title to Nulled vb and ipb vulns

[DJ Norix]

Yep ... Already warned a few admins on KWWH about it.Some of them even had backups ..

[Flash]

That's why you use patched vb nulls. I've used KickASSAMD's nulls and never been caught. Not even in 000webhost