View Full Version : THREADS MERGED - Neocron Username and Pass website exploit
Original monk
19-09-03, 14:47
Anyone have a bit more info about this anouncement ? like what kind of websites or any other measures that can be taken ? Ty in advance...
anouncement (http://neocron.jafc.de/announcement.php?s=&forumid=2)
Q`alooaith
19-09-03, 14:51
I'm a little upset about having to change my password.. nothing ya could have done...
will the next retail patch be anytime soon, I'd not like to have to use the alt password my randomiser threw up too often, it's alittle hard to type..
http://neocron.jafc.de/announcement.php?s=&forumid=2
DaFire in this thread, what exactly are the website's that your referring to, are they neocron related ?
Dribble Joy
19-09-03, 14:53
Nice news, but one thing.
How do I change my password?
<a href="http://neocron.jafc.de/announcement.php?s=&forumid=2">announcment</a>
neocron.com - account something - change password
https://www.neocron.com/account :p
SilentGravity
19-09-03, 16:15
I guess it was not "human error" after all :rolleyes:
..more like "KK Error"...
Mighty Max
19-09-03, 16:21
Its german tho, but pretty good demonstrated, that you have no chance atm.
Norten Antivirus 2003 tho seems to work against it.
http://www.heise.de/security/dienste/browsercheck/demos/ie/htacheck.shtml
:edit: that prog thats coming up, sais "You are vulnerable!" (in german of corse)
Its an Internet Explorer exploit, not a Neocron sepcific one.
By putting some code in a webpage (ANY webpage) you can make IE download a file and run it. If the file was to read your registry, it could, theoretically take your password and send it to someone.
Ive messed about with the explot and it is very easy to modify the 'Proof of concept' code that was released, into something that could log keys pressed and allsorts. Like I said, the code can be placed in ANY webpage with minimal effort.
All it would take is for someone to write a registry sniffer, chuck it on a site with this code and they could take the password straight from your registry.
Not nice stuff.
There is a NON-OFFICIAL fix available. Its not created OR supported by Microsoft, but in my testing it stopped the explit working.
= DISCLAIMER =
Myself, KK, nor anyone else cant be held responsible if the following screws your PC. It worked for me it may not for you. It'd be wise to take a backup of the registry before attempting this.
Save the following into a file called ExplotFix.reg and then run it
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}]
"Compatibility Flags"=dword:00000400
As stated, in my limited testing, that prevented the exploit from working. It prevents the explotable component from running on a webpage, which it shouldnt do anyway.
Delete the file after running it.
Hope this helps :)
even more interesting is the fact you can use client side vb script and have the webserver email you everything even if its a linux server.
IE: i could copy and paste some vbscript into this forum input box right now and it`d email me the complete registry of everyone who viewed this post.
(i havent btw incase your being paranoid)
Spectra260
19-09-03, 16:31
maybe this will make them hurry up a little faster with the next patch...
This explot and its proof if concept code has been available since the 14th Sept BTW.
@hinch : Yep, exactly what I tried, simple, effective and scarily easy.
Spectra260
19-09-03, 16:35
i wonder if KK still thinks that all those people who said there char was missing stuff/it was deleted were lying...
its actually been around for about 2 years we used to use it in pa to get peoples pa passwords :)
other one is to create a proper script like
banner.asp for example which displays an image to the user but as it loads off the remote server grabs all user details
but thats very norty and would never be done with a signautre banner .
Originally posted by hinch
its actually been around for about 2 years we used to use it in pa to get peoples pa passwords :)
other one is to create a proper script like
banner.asp for example which displays an image to the user but as it loads off the remote server grabs all user details
but thats very norty and would never be done with a signautre banner .
nothing personal :p but you wont see me you your website.... again :p
you just loaded my banner all done for meh :)
*laughs*
Gotta love PHP and .htaccess files
Rewrite an Apache rule here and there, rename a php to a jpg and your away :D
Your banner like _never_ loads man, or is it intentionally a white box with a red X in it ? Come to think of it Hivemind's hasnt actually loaded up for a few weeks now either o_O
Originally posted by NeoLojik
*laughs*
Gotta love PHP and .htaccess files
Rewrite an Apache rule here and there, rename a php to a jpg and your away :D
basically yeah :)
though i tend to use asp or aspx since my ms languages > my php
@fenix strange that i can never load stuff stored on wazzzup either anymore but my banner loads fine how odd
Original monk
19-09-03, 16:46
Thanx for all the info and for the fix wich i gonna try the second im home, all this things are making me even more paranoid then i allready am to be honest ...
Originally posted by Spectra260
maybe this will make them hurry up a little faster with the next patch...
YEAH U KK FUCKAS BETTER HURRY UP AND FIX INTERNET EXPLORER!!!! WHATCHU MEAN YOU HAVE NOTHING TO DO WITH IT?!!!!!! I PAY FOR THIS, GODDAMN FIX INTERNET EXPLORER OR IM QUITTING MAH ACCOUNT AND MY ENTIRE CLAN TOO!!!!!!QQQQ!!!!!1111neoneoenoenoneoneoneoneneoenoenoneoe
Originally posted by NeoLojik
*laughs*
Gotta love PHP and .htaccess files
Rewrite an Apache rule here and there, rename a php to a jpg and your away :D
Never going you YOUR site again...
Now where's that hat-grade tinfoil gone?
Shock.
Originally posted by Tazo
*snip*o_O I, erm.. I know the number of a good mental hospital m8...
@Shockwave
*whistles innocently while walking away*
Oh, and check ur PN's :p
Originally posted by NeoLojik
o_O I, erm.. I know the number of a good mental hospital m8...
ye cheeky git you, i use'd *snip* earlier one someone's post that made absolutely no sence. stop copying me :(
Originally posted by Nidhogg
Threads merged.
N Wondered why when I refreshed the page, the amount of posts on the second page had doubled lol.
Originally posted by NeoLojik
@Shockwave
*whistles innocently while walking away*
Enjoy those CDs I sent you a while back, BTW? Purely out of interest...
Goddamnit, Windows sucks! If Bill Gates were here right now I'd give him SUCH a Chinese Burn! :mad:
(Paranoid now... :/ )
Shock.
Originally posted by Shockwave
Enjoy those CDs I sent you a while back, BTW? Purely out of interest...
Goddamnit, Windows sucks! If Bill Gates were here right now I'd give him SUCH a Chinese Burn! :mad:
(Paranoid now... :/ )
Shock. *nods much while grinning* :D
Got a CD to send you soon, just need to find the time :(
Anyway, back on topic *looks in fear at Nidhogg and his crossed arms*
SilentGravity
20-09-03, 00:33
Not exactly, you see KK ethier does not A. Has no encryption B. Has leaked how the encryption works and has known about it for some time.
I am not sure which is worse.
Powered by vBulletin® Version 4.2.3 Copyright © 2024 vBulletin Solutions, Inc. All rights reserved.