Access Technology

Status
Not open for further replies.
Joined
Nov 18, 2008
Messages
4
Reaction score
0
Smeraldo - Access Technology - RaGEZONE Forums

With this simple tool created by me, you can access the hotel from any person is registered to your database. In fact just set some basic information for the connection and you're done. Just enter the name of the character that you want to access and press ENTER.
cerca

Smeraldo - Access Technology - RaGEZONE Forums


The system creates an SSO - Ticket who identifies with the character. The only information you need to know to get is the name of the character.
Once logged in you will get a screen like this:

Smeraldo - Access Technology - RaGEZONE Forums


SOURCE file to save in nomefile.php

PHP:
<?php
/*======================================================================*\
|| #################################################################### ||
|| # LiveXenon Group Accesso                                            ||
|| # ---------------------------------------------------------------- # ||
|| # Copyright 2007-2009 LievXenon Group. All Rights Reserved.          ||
|| # This file may not be redistributed in whole or significant part. # ||
|| # --------------- LIVEXENON IS A PRIVATE SOFTWARE ---------------- # ||
|| #################################################################### ||
\*======================================================================*/

//CONFIGURAZIONE DATABASE

$host = "localhost"; //HOST Piattaforma
$nome = "root"; //Nome Utente Database
$pasw = ""; //Password Database
$data = ""; //Nome Database Hotel

//CONFIGURAZIONE SERBER

$ipserver = "127.0.0.1"; //IP Server
$portserver = "21"; //Porta Server
$portmus = "22"; //MUS Porta
$dcr = ""; //DCR
$var = ""; //External Variables
$tex = ""; //External Texts


$connessione = mysql_connect($host, $nome, $pasw);
$database = mysql_select_db($data,$connessione);


if($_GET['login']){
  $errore = FALSE;
  ?><center><?
  if($_POST['username'] == ""){
  echo "Inserisci un nome utente!";
  $errore = TRUE;
  ?><title>LiveXenon Accesso ~ ERRORE</title><?
  }
  if($_POST['username']){
    $ricerca = mysql_query("SELECT name FROM users WHERE name = '".$_POST['username']."'");
    $ricerca = mysql_num_rows($ricerca);
    if($ricerca <= 0){
      echo "Questo utente non esiste!";
      $errore = TRUE;
      ?><title>LiveXenon Accesso ~ ERRORE</title><?
    }
  }
  
  if($errore == FALSE){

$sso = rand (1, 1000);
mysql_query("UPDATE users SET ticket_sso = '".$sso."', ipaddress_last = '".$_SERVER['REMOTE_ADDR']."' WHERE name = '".$_POST['username']."'");
?>

<object classid="clsid:166B1BCA-3F9C-11CF-8075-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab#version=10,0,0,0" id="Xenon" width="960" height="540">
<param name="src" value="<? echo $dcr; ?>">
<param name="swRemote" value="swSaveEnabled='true' swVolume='true' swRestart='false' swPausePlay='false' swFastForward='false' swTitle='Xenon Hotel' swContextMenu='true' ">
<param name="swStretchStyle" value="stage">
<param name="swText" value="">
<param name="bgColor" value="#000000">
      <param name="sw6" value="client.connection.failed.url=http://localhost<? echo $_SERVER["PHP_SELF"]; ?>;external.variables.txt=<? echo $var; ?>">
   <param name="sw8" value="use.sso.ticket=1;sso.ticket=<? echo $sso; ?>">
   <param name="sw2" value="connection.info.host=<? echo $ipserver; ?>;connection.info.port=<? echo $portserver; ?>">
   <param name="sw4" value="site.url=http://livexenon.altervista.org/;url.prefix=http://livexenon.altervista.org//">
   <param name="sw3" value="connection.mus.host=<? echo $ipserver; ?>;connection.mus.port=<? echo $portmus; ?>">
   <param name="sw1" value="client.allow.cross.domain=1;client.notify.cross.domain=0">
   <param name="sw7" value="external.texts.txt=<? echo $tex; ?>;user_isp=127.0.0.1">
   <param name="sw5" value="client.reload.url=http://localhost/hotel/XenonCMS/client.php?x=reauthenticate;client.fatal.error.url=http://localhost/hotel/XenonCMS/clientutils.php?key=error">
<!--[if IE]>client.pluginerror.message<![endif]-->
<embed src="<? echo $dcr; ?>" bgColor="#000000" width="960" height="540" swRemote="swSaveEnabled='true' swVolume='true' swRestart='false' swPausePlay='false' swFastForward='false' swTitle='Xenon Hotel' swContextMenu='true'" swStretchStyle="stage" swText="" type="application/x-director" pluginspage="http://www.macromedia.com/shockwave/download/"
    sw6="client.connection.failed.url=http://localhost/hotel/XenonCMS/clientutils.php?key=connection_failed;external.variables.txt=<? echo $var; ?>"
    sw8="use.sso.ticket=1;sso.ticket=<? echo $sso; ?>"
    sw2="connection.info.host=<? echo $ipserver; ?>;connection.info.port=<? echo $portserver; ?>"
    sw4="site.url=http://livexenon.altervista.org/;url.prefix=http://livexenon.altervista.org/"
    sw3="connection.mus.host=<? echo $ipserver; ?>;connection.mus.port="
    sw1="client.allow.cross.domain=1;client.notify.cross.domain=0"
    sw7="external.texts.txt=<? echo $tex; ?>;user_isp=127.0.0.1"
	    sw5="client.reload.url=http://localhost<? echo $_SERVER["PHP_SELF"]; ?>;client.fatal.error.url=http://localhost<? echo $_SERVER["PHP_SELF"]; ?>" ></embed>
<noembed>client.pluginerror.message</noembed>
</object>
<p><a href="<? echo $_SERVER["PHP_SELF"]; ?>">ESCI</a> - <font size="2">Powered by LiveXenon Group</font></p>
</center>

<title>LiveXenon Accesso ~ <? echo $_POST['username']; ?></title>

<?

}
}

?>


<? if(!$_GET['login']){ ?>
<title>LiveXenon Accesso</title>
<center>
<p>LiveXenon Accesso</p>
<form method="post" action="<? echo $_SERVER["PHP_SELF"]; ?>?login=true">
<input style="border: solid 1px #000000; width: 150px;" type="text" name="username">
<input type="submit" value="ENTRA">
</form>
<p><font size="2">Powered by LiveXenon Group</font></p></center>
<? } ?>

Good Fun
 
So basically, all you've done is coded an 'exploit' which is essentially a login but with no password, making a server's CMS much weaker in security?

Great.

If you are an admin worthy of being able to access the database, why not just use their password and login the normal way?
 
If you are an admin worthy of being able to access the database, why not just use their password and login the normal way?
Because any good CMS hash's there password?

But i agree about making the site more insecure, id only run this on a local box for testing.
 
So basically, all you've done is coded an 'exploit' which is essentially a login but with no password, making a server's CMS much weaker in security?

Great.

If you are an admin worthy of being able to access the database, why not just use their password and login the normal way?

This is only for the admin to localhost. Also because the passwords are encrypted and can not access their accounts.
 
So basically, all you've done is coded an 'exploit' which is essentially a login but with no password, making a server's CMS much weaker in security?

Great.

If you are an admin worthy of being able to access the database, why not just use their password and login the normal way?

Passwords are hashed - this would only work if you know the database details.
 
Status
Not open for further replies.
Back