Topic: @tp: spotted a hole in the walls of Arkham (Page 1 of 1)

'lo.

Could not find a way to directly reach you, eg. mail or mailform, even on your homepage.
I am not unveiling the vuln publicly, but I've found one here, while fiddling genuinely (out of typing stupid things in the right place to say the truth).

Currently, it *only* allows me to see the whole server-side structure (the public part of it at least), and to trigger error messages in all software modules
of the Asylum.

Allowing me to get more info. Ouch.

I don't really have time to audit deeper, but the root cause is clear at least, so gimme some way to reach you, and I can tell you.

Some Mad Sci, this is serious stuff.
Got the ozone asylum complete server configuration info now (phpinfo yeah). 16 more minutes from the first discovery.

Tested the gurusnetwork the same way, didn't encounter the same issue, but I suspect some similarity exists.

...As it stands, I finally can use my expertise without stroking it to say...

This is code red material, one can gain root control of the web server this way, not only Asylum.
I can see 5 or 6 ways to go for that.

I'd be admin in one hour.

Am emailing the Doc at least.

Found tp's addy.

And more bad news. Patch. Patch. Patch.

Because I am in. At the forum level. Haven't made the move and won't.
Have the exploit source code before my eyes.

And I confirm that the road to web server root continues.
1) Upgrade php to the next minor build, at all costs.

the rest seems a tad more difficult. Just a tad. Gosh... It's getting easy.

And you know what, _Mauro? We don't run this damn server. We can't do upgrades ourselves, only request that Dreamhost do it.


Justice 4 Pat Richard

Don't take offense, I am sure the host would be glad knowing they expose theyre servers and how to fix it.
Meh... am trying to help, am in the contact with TP for that (wrote a detailed email in reply to you, it went down to the drain due to an app crash - have to find 2 seconds to retype).

There seems to be some problem with your responsemail Mauro, at least it hasn't arrived yet

Yeah, the session of my webmail timed out and I lost it. As it contained detailed informations, it's long to retype and am having one of those 16 hours days. Will find the required time.

Well done, one day, and no more hole.

Thank you. *
Incidentially, your account has been locked for hacking the Asylum.**


Here's the run down for the rest of you.
Mauro discovered a way to receive a directory listing from the Asylum's webserver.
Ie. a list of files, automatically generated by apache, for any directory on the server.
Using that list he was able to find a file containing a call to ->phpinfo(), a function which
tells you what versions the various software on a server reports itself as.
In addition he was able to call any of the php scripts the grail usually includes from one main
file directly, creating 'error messages in every 'software module of the Asylum'.

Now, while this has been portraied by a member of the asylum as if the roof fell down,
none of it revealed anything that an attacker couldn't have gained another way.

• Directory listing: The grail's open source. I have shared the code with over 2 dozen people. Relying on obscurity is a pretty daft idea.
• Version information is usless. A server might be patched, especially at a bigger webhosting provider, without actually being the newest version.
  
  And trying exploits is cheap - you would not skip a known exploit, just because the server claimed to be a secure version.
• While all of the php includes will throw error messages, virtually every one will be 'function not found' within the first three lines of code. They do not include the main include file, which contains a lot of functions used througout the code. For example, neither file nor database, nor cookie access can happen in the code without that main include file.

There are some improvments to be made though:

• I have disabled the directorylisting. That means Options -Indexes in .htaccss.
• In the same vein, it's no longer possible to call the includes directly.

So long,
->Tyberius Prime

*I have some rather snide remarks for people who barely answer sensitive matters within a business day, but complain if they don't receive a 'thank you' within less than 24 hours. Alas, I'm afraid my english isn't up to it.
And boy, your definition of 'discreet' or 'secretly' must have been written while being on a certain powdery substance...

**jk.


Edit: Typos typos typos. Buy Two, pay three!

(Edited by Tyberius Prime on 09-27-2006 16:04)

What a shithead. You get a free audit of your pissy poor security -therefore helping remove the useless hits to all your still active scripts and the pertaining extra load, probably improving the asylum availability as is.

And there you go, complaining down to insults.
-right after I displayed a lot of patience in helping you with barcodes.
-*I have some rather snide remarks for people who barely answer sensitive matters within a business day

Ok, to whom should I send my bill then, miserable dick? You? I wasn't on business, I was helping you -again-
You and your silly brag ass ego of the mediocre programmer.

I should have burnt your pissy poor web server down, only it's the doc's.

Next time.

For hackers worldwide, there is no available patch for php version 4.4.2, and if you don't apologize, I post the phpinfo on forums where
people will show you what coding is all about. For anyone interested around, google->php 4.4.2 ldap exploit

Doesn't he deserve a big one "up his" for this bite to the hand that feeds?

Ini - if it is always going to come back to this bullshit from you, no matter what the circumstances are, how about you just piss off altogether?

Save yourself the aggravation already....

Somebody needs a nap.

I'm sorry Mauro.
You are not that kind of genius that you don't have to be polite.
That goes both for undue impatience and the expletive you seem so prone to use.


As for version information being a security risk, I suggest you take a look at the http headers this
webserver regularly sends with its answer.

quote:

---

Server:·Apache/1.3.33·(Unix)·mod_throttle/3.1.2·DAV/1.0.3·mod_fastcgi/2.4.2·mod_gzip/1.3.26.1a·PHP/4.4.2·mod_ssl/2.8.22·OpenSSL/0.9.7e(CR)(LF)

---

And good grief, learn to read. I have snide remarks for people expecting a thank you via e-mail in less than 24 hours when they're slow to reply themselves.

So long,

->Tyberius Prime

DL, poor piece of shit, your arrogant self should look twice at who's doing good here, and who's not, but what can I expect from a cowboy?
Still, morons or not, from now on, you get to be my bitches. TP, DL, and all the assholes who got such an ego they can't take advice with gratitude.

Don't come whining, I had warned you. Dogs usually know when not to bark. Since both of you failed at getting inspiration from that, you'll have your deserved lesson.

Words, words, words... time for some action and sports. Breaking bones. My fav.

_Mauro,

Go the fuck away.



.:[ Never resist a perfect moment ]:.

~Just wonders: who has the biggest ego of all? ~
We all know it.
There is no need to actualy answer this question.

.........................................................................
:: Develop yourself, develop your life, develop the world ::
.........................................................................

get over yourself ini. there's a whole wide world out there =)

Is this another meltdown?

Ini, one question - did you have permission to break into the Asylum and look about? Did you speak to TP about this beforehand?

WebShaman | The keenest sorrow (and greatest truth) is to recognize ourselves as the sole cause of all our adversities.
- Sophocles

(Edited by WebShaman on 10-03-2006 23:33)

quote:

---

Words, words, words... time for some action and sports. Breaking bones. My fav.

---

No one makes me bleed my own blood. No one.

Webbie, for his total lack of competency, this moron posted stuff to the internet - allowing the world to access it.

All I did was typo-ing two slashes instead of one at the end of www.ozoneasylum.com

There was no intent to attack, that's why I made the investigation report public - because it happened, and I was just witnessing and exploring
what he had deliberately - or by pure idiocy - decided to give away.

Needless to say, his making this stuff public added thousands hits by spiders to the bw load of the Asylum,
aside of exposing vulns he doesn't admit - it takes balls to admit one's mistake, especially when they expose info about 5000 users - and neighbour websites on the server.

It's much easier insulting.

Except he's provoked the wrong person.

As patient as I am, once someone really turns me on to disgust and beyond, I take action.

Now this is not about vengeance.
This is about bitch-slapping the shit out of cattle loving script kiddies, fucking peasants who can't stand theyre own weaknesses
publicly and be honest about being weak.

Meaning it has started, I am taking my time between two work travels, all of it, and I will not stop - ever - too late to back up.

And I don't even need to use any kind of badly crafted request, any kind of misdemeanour, nothing, just a web browser, it's all it takes.
Seen the movie Saw? Enjoy being my toys, enjoy life, enjoy the chance of being human beings instead of pigs.
Enjoy it wherever you take it - afterwards - because this place is condemned.

Because of the immense idiocy of a single person calling himself Tyberius Prime.

... No, I am no genius, gifted at best, and academically trained and grown to be part of the tech elite, these are the basic principles
that make the difference between a self-trained kiddie and a developper, and that's all.

Still, the pomposity of the bastard who bites the hand that feeds.

That.
Will get.
Everlasting.
Punishment.

Mauro - I have not quite insulted you.
I have belittled you for being petty about manners when you rarely show them yourself, and for claiming to be 'discreete' while at the same time trumpeting "I'd be admin in one hour" on a public forum.

Incidentially, I did say thank you, and made a joke ("jk" means just kidding) about the whole manner.
You are taking everything immensily serious when it isn't to anyone but you.

You did the right thing telling us about it - but you made a fool out of yourself at the same time, by being alarmist about the scope


Now, as for 'everlasting punishment', I suggest you reread the agreement under which you signed up to this place.

quote:

---

"You agree, through your use of this service, that you will not use this website to post any material which is knowingly false and/or defamatory,
inaccurate, abusive, vulgar, hateful, harassing, obscene, profane, sexually oriented, threatening, invasive of a person's
privacy, or otherwise in violation of any law. You agree not to post any copyrighted material unless you have the legal right to do so (for example, by
holding the copyright yourself, or through a written permission by the copyright holder).

---

(emphasis mine)

You're a guest. Please behave to the doc's rules.

So long,
->Tyberius Prime


PS: As for the "meat" of Mauros post: every link in this particulary forum (the MS Lab) contains a no-follow attribute. And even if spider's don't respect that, they will hardly index a 403: Forbidden.

Edit: Some breaks in the quote are nice...

(Edited by Tyberius Prime on 10-05-2006 13:28)

Mauro, seriously. Do you ever sit back and think before you type? Or read what your writing? Do you listen to yourself, at all? Ever? You know you have an anger management problem. I've seen you say as much before. Yet every time someone so much as stands up to you, or has a differing opinion, or doesn't bow down and kiss your feet for imparting your hard-won wisdom to them, you fly off the handle, start calling them names, throwing insults around like punches to the mind. I've seen this kind of behavious before, in pre-school play yards. In primary-school lunch breaks. You are, what, at least over 25 years of age? Think about it, man. You're an adult, but you certainly don't act it. I don't doubt that you're under pressure at work. Probably more than I'm under with my studies and job right now. That's a simple fact of life.

Yes, you're good at what you do. Other people are good at what they do. You're special, and unique, just like everyone else. But you know the big, glaring difference between you and almost everyone else I know around these parts? They know how to take criticism like an adult. To take things on the chin, and move on. They know how to keep from acting like it's the worst possible insult anyone could ever hand them, and to be an adult about conflicts. Do you honestly think you achieve anything around here with your heated posts and rageful replies? Let me tell you, here and now, that you don't.

All you do is turn people away from you. All you do is prove to them that you aren't worth their time, because if they say the least little thing out of line with your world-view, you'll throw it back in their faces, then fall down to the ground beating it with your fists and throwing a temper tantrum worthy of a five-year-old Paris Hilton. Two words, Mauro. Grow. Up. This was cute for about five seconds, but the veneer has worn off, and now it's a tatty old relic of a time-gone-by, and you win yourself no favour in anyone's eyes by it. You may not care about that, but, frankly, if you don't care about anyone's feelings but your own, you really do have problems, and you need to seek professional help.

In the meantime, though, grow up. Reply to this if you want. Throw it back at me, throw a tantrum. I don't care. Because I, unlike you, know how to ignore such childish outbursts, and act like an adult about them.

Back to your regularly scheduled insanity.


Justice 4 Pat Richard

quote:

---

_Mauro said:

Still, the pomposity of the bastard who bites the hand that feeds...

---

you are quite well aquainted with that concept...

As I said: get over yourself mauro. If anyone has needed to show patience, it has been the general public at the Asylum - patience for your absurdly ego-laden outbursts laced with self congratulations on how 'patient' and 'gifted' you are. And then breaking down into the temper-tantrum of a 3 year old.

Sooner or later, you will need to accept the fact that your presence is not a gift to the world to be adored. The universe is quite ready to go on its way with or without you.

quote:

---

All I did was typo-ing two slashes instead of one at the end of www.ozoneasylum.com

There was no intent to attack, that's why I made the investigation report public - because it happened, and I was just witnessing and exploring
what he had deliberately - or by pure idiocy - decided to give away.

---

Blocks are mine.

quote:

---

Found tp's addy.

And more bad news. Patch. Patch. Patch.

Because I am in. At the forum level. Haven't made the move and won't.
Have the exploit source code before my eyes.

And I confirm that the road to web server root continues.
1) Upgrade php to the next minor build, at all costs.

the rest seems a tad more difficult. Just a tad. Gosh... It's getting easy.

---

I must say Ini, that the above does not look like "a genuine mistake" in persuing the issue further. I can see that such could happen at the beginning. However, wasn't that enough? Why persue the issue further?

I think you got caught up in the moment and forgot to think about what you were doing. Needless to say, I think you went too far on this one. Throwing around insults hasn't made the situation any better, either.

WebShaman | The keenest sorrow (and greatest truth) is to recognize ourselves as the sole cause of all our adversities.
- Sophocles

... No, I am no genius, gifted at best, and academically trained and grown to be part of the tech elite, these are the basic principles
that make the difference between a self-trained kiddie and a developper, and that's all.

Part of the tech elite? What's the weather like on your planet?

(Edited by Jestah on 10-07-2006 06:57)

quote:

---

However, wasn't that enough? Why persue the issue further?

---

Because the turd who is in charge of the security was not able, and still isn't:
this is called an Audit - touching the most obvious flaw was not enough to help make this place secure,
but given the self-confidence of that turd, even showing him the real dangers wasn't enough.

He'll need the Asylum data destroyed permanently to admit, so, fine by me, what goes around...

I am sad you end up displaying such a lack of understanding, webbie, but to educate rather than anyhting else, because I have nothing to win or lose around since morons have taken over,
why on earth do you think I would have bothered -posting- about doing it -while-
I was doing it?

I bet a babboon could see a willingness to be transparent -during- action.

@Buffon, tech-elite as currently in a dangerous country for the EU government's sake,
as a consultant for Philip Morris. You know, that ultra-dynamic company facing difficult, world-wide
challenges daily, which requires a palette of skills that allow standing light-speed development support
tasks on a daily basis.

But I am not around throwing insults at the genetically deficient for the sole pleasure of speaking my mind:
each one of my words is -facts based- and the more you require me to bring you facts, the more you challenge...

The sweetest my delight when I'll shit on your digital grave.

Keep it up. Make my day.

JK. JUST KIDDING? Now that tops all possible insults.

Just noticed that.... and you think your "snide remarks" will get away with a JK?

I am soooo looking forward to taking the time to patiently perform the long task of cheking how
I should remove my traces, which is the only area left to cover.

...

I hate you, really, all of you. You make me ashamed of manking with your "snide remarks".
Anyone equipped with a brain should be ashamed of using it so poorly.

"Discreet" as in I am WARNING because I couldn't find your email addy, as stated,
and had to -at least- inform -any- mad sci rapidly.

....Ow, pardon me, I forgot to ponder your JK and go UHUHUH.

I am pragmatic. Large ego or not, I am a purist, I have standards, up to which I deliver,
and am prone to help in most cases, even if the people on the other side don't deserve it,
but you....

The whole of you in this thread, you have deserved, chosen, and called for being treated like animals.

Snide remark my ass. Sissy TP taking revenge on ME for having been stupid enough
to leave a backdoor through an htaccess directive AND a phpinfo AND php snippets all over the place.

Why don't you blame the irresponsible moron, eg. YOURSELF, and take action, the ones I recommended - and stroke the fact I recommended you the solutions PRIVATELY instead
of stroking the fact I "called for a thank you" and disclosing PRIVATE communication?

"Way too seriously"? I love mankind and good people, with love, care, a true sense of respect, who take positive action towards others.
Pollution to the genome should be judged based on acts, and removed.

There are current backups.
Please destroy the Asylum.

quote:

---

I hate you, really, all of you. You make me ashamed of manking with your "snide remarks".
Anyone equipped with a brain should be ashamed of using it so poorly.

---

quote:

---

The whole of you in this thread, you have deserved, chosen, and called for being treated like animals.

---

I take it that you are being serious here and truly mean what you have wrote. Burning some major bridges here, Ini. Are you certain you want that?

WebShaman | The keenest sorrow (and greatest truth) is to recognize ourselves as the sole cause of all our adversities.
- Sophocles

Thats what he wants, and thats what this idiot deserves. Let him threat, just let him threat...he'll taste the aftermath.

The Space Between Us | My Blog: lukas.grumet.at

quote:

---

Tyberius Prime said:

There are current backups.
Please destroy the Asylum.

---

LMFAO!! I can't beleive this is still going on.

Later,

C:\

There really are up to the minute backups.
Go ahead InI. Show me the error of my ways.

cool! I wanna jump in and add to the fire!!!

Do it ... come on ... do it ... just do it

Later,

C:\

To wrap it all up.... it was so easy from the start, but the fact is... you dipshits deserve something like
this instead.

<....ponders posting the full server info all around the web, not the easy to get bullshit. Watches Cprompt and others spanking the monkey and salivating. Decides to show mercy to those turds,
in the vein of "how should I punish my retarded son if he was to rape a goat"? Looks at the morons salivating again. Decides not to lower down to helping them fill theyre lives up, steps back from the crowd of goat addicts....

And to wash away the shame of seeing mankind degenerate your way.>


The Asylum died a long time ago already, anyway.

quote:

---

_Mauro said:
The Asylum died a long time ago already, anyway.

---

So you're beating a dead horse then, that about sums your stay up man. Considering the way people here have bent over backwards to accomodate your eccentric (at best) style and conversely the way you continue to continue to rail against those very people, I'm suprised noone's hired a bot herder to ass rape the interweb properties of PM and put your name on the rubble.

Your skills have always been respected here, your self absorption and elitist yammerings inspire the backlash, and you can't really blame anyone but yourself for that. Those are the facts. Threats are just way outside the boundaries of what's normally allowed here. I assume it's a testiment to the good Doctor's nature that you're still allowed to post a thing.

You can't see this apparently, and this is where DL's (and others over the years) advice sounds all the more relevant. Get some help and be well. Smellthe roses and whatnot.

I usually stay out of these ego-fests, because they are so retarded, but Ini, you really are a POS.

quote:

---

I hate you, really, all of you. You make me ashamed of manking with your "snide remarks".
Anyone equipped with a brain should be ashamed of using it so poorly.

---

Then why do you keep coming back ? So we can worship you ? Maybe NOT.

quote:

---

The whole of you in this thread, you have deserved, chosen, and called for being treated like animals

---

Yea, real adult. I bet Phillip Morris would be very proud of this thread.

quote:

---

Way too seriously"? I love mankind and good people, with love, care, a true sense of respect, who take positive action towards others.
Pollution to the genome should be judged based on acts, and removed.

---

You`ve certainly dropped your share of pollution here, haven`t you ?

quote:

---

I am pragmatic. Large ego or not, I am a purist, I have standards, up to which I deliver,
and am prone to help in most cases, even if the people on the other side don't deserve it,

---

You could make a lot of peoples lives better if you would take your overblown ego, your standards, your help and go the f*ck away. Even if we don`t deserve it.
Whiney bitch.

(Edited by docilebob on 11-20-2006 10:23)

pfft....I say "Don't feed the trolls". Maybe this one will go away like rest of the POS's that have came and gone.

Later,

C:\