Since that thread died...
And we discussed full disclosure earlier:
Quote:
Okay so recently I dumped the database of a forum with a few exploits. I did it because there was software on the forum that was hidden and protected because they want you to pay for it. But why pay when you can get it for free? isn't that why we all download warez and music?
Stealing software is bad.
Quote:
Well I got the files I needed, but, anyways, even though that's pretty much all I needed to get done so far, I'd still like to crack a few of the passwords of the admins from the board so I could keep an eye on whats going on there in the future. Of course, they are encrypted in md5. Now here is my idea, instead of cracking the pw hashes with rainbow tables or something of the likes, could you go into the database, and switch the password hash of your account, with one of the admins. So you could do that, upload the database. Do a "Forgot your password?" routine on the forum with your account, and then boom it emails you the admin password just like that. Or I guess even you could just change the emails to the accounts around... Anyways, anyone tried that on a phpbb forum before? Did it work? I would just upload the database to my own server but I don't have the resources to do that =( anyone wanna help?
Yes, I've done that to my own PHPBB installs.
All you need is some SQL like:
PHP Code:
UPDATE usertable SET passwordfield = MD5('newpassword') WHERE username = 'targetuser'
Changing usertable, passwordfield, username, and 'targetuser' to suit the DB. Now, note this won't actually help you break into said system (unless it's still vulnerable), nor will it help you get the admin password.
In any event, rest assured your traffic will be logged and you'll likely be contacted by the authorities. Don't say nobody warned ya.
