Competitie: gaseste vulnerabilitatile

[secure]

Site webcamnow.com

Challenge:

- aflarea adresei de mail a oricarui user existent

- aflarea parolei in plaintext a oricarui user existent

In situatia de fata gasiti adresa de mail si parola userului _admin_

Nivel: easy

Raspunsurile le puteti da si aici.

Edited May 24, 2012 by secure

[secure]

Sa punem si o mica recompensa. 10 shelluri fresh pentru castigator.

Hint: nu e sql injection

[Paul4games]

Nu stiu daca se pune dar am gasit mai multe emailuri de inregistrare de genul:

https://www.webcamnow.com/reg/confirm?t=40c575e47a178e4f

[secure]

Nu se pune.

[DreptulLaReplica]

mail: sdb2343@freecamdates.com

revin cu pass

[secure]

E bine pana aici.

[Guest Kovalski]

------------------------------------------------------------------

- EXPL-A-2003-005 exploitlabs.com Advisory 005

------------------------------------------------------------------

-= Webcam Now =-

morning_wood

June 10, 2003

Vunerability(s):

----------------

1. Cleartext Passwords in Windows registry

Product:

--------

Webcam Now Broadcaster

WebcamNow Free Video Chat

http://www.webcamnow.com/download.html

Reviews:

--------

Description of product:

-----------------------

"WebcamNow provides free Internet video

broadcasting service (software and hosting) for personal use.

Live video can be broadcast from virtually any PC camera or video

capture device by simply creating an ID and start the WebcamNow

Video Broadcaster. Additionally, the video is accompanied by real-time

communication through text and voice chat. Live webcam broadcasts

can be viewed through any current browser that supports Java by

going to the Videochat start page or the WebcamNow home page"

VUNERABILITY

=============

Local:

------

View user / password in these registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\WebCamNow\Users\Name

HKEY_LOCAL_MACHINE\SOFTWARE\WebCamNow\Users\Password

there is no excuse for a plaintext passsword in the windows registry file

period.

Any computer with multiple users is vunerable to password discovery and

disclosure. hint - hash yer pass

Remote:

-------

none

( unless remote registry is enabled or a intranet / lan topology [or

previous remote compromise] )

Vendor Fix:

-----------

No fix on 0day

Vendor Contact:

---------------

[email PROTECTED] - Concurrent with this advisory

Credits:

--------

Credits:

--------

Donnie Werner

Exploitlabs "were finding your holes"

se pune?

[DreptulLaReplica]

------------------------------------------------------------------

- EXPL-A-2003-005 exploitlabs.com Advisory 005

------------------------------------------------------------------

-= Webcam Now =-

morning_wood

June 10, 2003

Vunerability(s):

----------------

1. Cleartext Passwords in Windows registry

Product:

--------

Webcam Now Broadcaster

WebcamNow Free Video Chat

http://www.webcamnow.com/download.html

Reviews:

--------

Description of product:

-----------------------

"WebcamNow provides free Internet video

broadcasting service (software and hosting) for personal use.

Live video can be broadcast from virtually any PC camera or video

capture device by simply creating an ID and start the WebcamNow

Video Broadcaster. Additionally, the video is accompanied by real-time

communication through text and voice chat. Live webcam broadcasts

can be viewed through any current browser that supports Java by

going to the Videochat start page or the WebcamNow home page"

VUNERABILITY

=============

Local:

------

View user / password in these registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\WebCamNow\Users\Name

HKEY_LOCAL_MACHINE\SOFTWARE\WebCamNow\Users\Password

there is no excuse for a plaintext passsword in the windows registry file

period.

Any computer with multiple users is vunerable to password discovery and

disclosure. hint - hash yer pass

Remote:

-------

none

( unless remote registry is enabled or a intranet / lan topology [or

previous remote compromise] )

Vendor Fix:

-----------

No fix on 0day

Vendor Contact:

---------------

[email PROTECTED] - Concurrent with this advisory

Credits:

--------

Credits:

--------

Donnie Werner

Exploitlabs "were finding your holes"

se pune?

e veche si pusa pe toate site-urile, normal ca se pune:))

[AMD]

https://www.webcamnow.com/reg/prethankyou?u=_admin_

ID Name Reserved _admin_

Confirmation sent to sdb2343@freecamdates.com

si parola este: wcn6-first

[AhEaD]

se pune daca postez eu ?

User: Marcel
Pass: lecram

https://www.webcamnow.com/reg/prethankyou?u=_admin_

ID Name Reserved _admin_

Confirmation sent to sdb2343@freecamdates.com

si parola este: wcn6-first

Nu e aia parola

[Zatarra]

Marcel ii contul lui Ahead, nu se pune. )))

[AMD]

daca ii dai la "I forgot my password" o sa vezi ca trimite mereu aceeasi parola

[noVaLue]

nu prea cred :/ mie imi trimite corect

[secure]

Hai ca e foarte simplu

[noVaLue]

http://webcamnow.com/wlogin?un=noVaLue&pw=crackm3&t=1337876303779

_admin_

hooper

Incercase-m si asta http://webcamnow.com/api/acctstatus?un=, numai ca nu stiu sa-l parsez, doar daca as avea cont de admin, as putea sa-l prind in TamperData

Le: iar daca te loghezi cu acel user e normal sa vezi

sdb2343@freecamdates.com

Edited May 24, 2012 by noVaLue

[secure]

DreptulLaReplica primeste 5 shelluri si noValue 5 shelluri pentru ca fiecare dintre ei a gasit primul una din "vulnerabilitati". Va dau la noapte pm cu shellurile.

[DreptulLaReplica]

DreptulLaReplica primeste 5 shelluri si noValue 5 shelluri pentru ca fiecare dintre ei a gasit primul una din "vulnerabilitati". Va dau la noapte pm cu shellurile.

Nu merci, le donez lu noValue, el le merita, si oricum nu as avea ce face cu ele.

[noVaLue]

Stai sa vezi belea, ma uit in ele 5 min si le donez, daca nu gasesc nimic interesant... Eu am vrut sa scot mai mult din challenge, dar nu s-a putut

[Guest Kovalski]

eu ma uitam dupa avioane in sloboz

/admin/user_list

/index.old

/index.bak

/users/backup

/backup/

alte cretinisme.. nu mi-a trecut si nu mi-ar fi trecut niciodata prin cap de swf..

felicitarile mele Value.

Edited May 24, 2012 by ps-axl