CrackerTracker Exploit False Positives

Support for IntegraMOD 141

Moderator: Integra Moderator

CrackerTracker Exploit False Positives

PostAuthor: Teelk » Thu Jan 18, 2007 5:08 pm

Have you ever gotten this message while trying to do something you know you should be allowed to do?

[align=center]Image[/align]

There is a KB Article located here that will explain how to use the debug mode of CrackerTracker to detect the problem file and give you a solution.

This thread is for those that have already found their solution and want to share it with the rest of the community. So, feel free to share your CrackerTracker Debug Logs with everyone. All verified and validated False Positive fixes will be contained within this first post.

NOTE: Please do not post support questions in this thread, it is only for CT Debug info. If you are having a problem using the debug mod or have another CrackerTracker related question or problem, please start another thread or post in a thread with the same topic material.

Verified Fixes

Tell a Friend fix
OPEN tellafriend.php
FIND
Code: Select all
define('IN_PHPBB', true);
AFTER ADD
Code: Select all
define('CT_SECLEVEL', 'MEDIUM');


Occupation Fix (in profiles)
OPEN profile.php
FIND
Code: Select all
$ct_ignorepvar = array('helpbox','delete','deleteall','phpBBSecurity_question','user_interests');
REPLACE WITH
Code: Select all
$ct_ignorepvar = array('helpbox','delete','deleteall','phpBBSecurity_question','user_interests','user_occ');
Last edited by Teelk on Tue Jan 23, 2007 1:23 am, edited 1 time in total.
User avatar
Teelk
Dev Team
Dev Team
 
Posts: 1309
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Mar 14, 2006 6:25 pm
Cash on hand: 0.00
Location: Canada

PostAuthor: ZacFields » Thu Jan 18, 2007 5:20 pm

When you click the "Tell a Friend" button, you'll get a CrackerTracker error. I have edited the instructions that CrackerTracker gave me to match what you'll actually have to do to fix this.


Open: tellafriend.php
FIND
Code: Select all
define('IN_PHPBB', true);

 
AFTER, ADD
Code: Select all
define('CT_SECLEVEL', 'MEDIUM');


Before it said to look for "define('IN_PHPBB', 1); but in IM 1.4.1 it is "define('IN_PHPBB', true);" so this code will fix the problem.

Zac
Last edited by ZacFields on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

PostAuthor: DDay629 » Fri Jan 26, 2007 12:54 am

For anyone wanting an easy way to make these changes without using a single FTP program, just use the eXtreme Styles template editor. I have for instance created backups in both versions of ctracker/engines/ct_security.php

Hope this helps some of you guys.

DDay
Last edited by DDay629 on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

DDay629
Members
Members
 
Posts: 41
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Jan 17, 2007 11:35 pm
Cash on hand: 0.00

PostAuthor: ZacFields » Fri Jan 26, 2007 11:09 am

One of my users was having trouble updating his information. Seems that the 'user_realname' parameter was causing the trouble. Here is the patch for it (I have altered it to work with the integramod code)
OPEN
/profile.php
##-----[ FIND ]------------------------------------------#
Code: Select all
$ct_ignorepvar = array('helpbox','delete','deleteall','phpBBSecurity_question','user_interests')

##-----[IN-LINE FIND]------------------------------------------#
Code: Select all
 'helpbox','delete','deleteall','phpBBSecurity_question','user_interests'

##-----[ IN-LINE, AFTER, ADD ]------------------------------------------#
Code: Select all
 ,'user_realname'

##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------##
EoM

The whole string of code will look like this after the patch:

$ct_ignorepvar = array
('helpbox','delete','deleteall','phpBBSecurity_question','user_interests','user_realname')

I think this is the right instructions that you'll need. Feel free to alter, it's just important to get the 'user_realname' parameter unblocked.

Zac
Last edited by ZacFields on Sat Jan 27, 2007 2:37 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

PostAuthor: ZacFields » Fri Jan 26, 2007 3:02 pm

I couldn't edit anything in my ACP ==> Configuration area before adding this fix: (Altered to match integramod code)

OPEN
/admin/admin_board.php
-----[ FIND ]------------------------------------------
Code: Select all
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('cookie_name');

-----[ IN-LINE FIND]-----------------------------------------
Code: Select all
 'cookie_name'

-----[ IN-LINE AFTER, ADD]--------------------------------
Code: Select all
 ,'board_email_sig','board_disable_msg'

-----[ SAVE/CLOSE ALL FILES ]----------------------------
EoM


The whole string of code will look like this after the patch:

$ct_ignorepvar = array('cookie_name','board_email_sig','board_disable_msg');

Now as far as I can tell, I can change anything in the configuration section in the ACP.

Zac
Last edited by ZacFields on Sat Jan 27, 2007 2:36 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

PostAuthor: ZacFields » Sat Jan 27, 2007 2:34 pm

To create a forum, there is one minor error that needs to be resolved. Very simple and SMALL problem but here is the patch for it (Altered to match IM code)

-----[ OPEN ]------------------------------------------
admin/admin_forums_extend.php
-----[ FIND ]------------------------------------------

Code: Select all
$ct_ignorepvar = array('create','delete','name','icon');

-----[ IN-LINE, FIND ]------------------------------------------

Code: Select all
'delete','name','icon'

-----[ IN-LINE AFTER, ADD ]------------------------------------------

Code: Select all
,'desc'

-----[ SAVE/CLOSE ALL FILES ]------------------------------------------


The string of code after the fix will look like this:

$ct_ignorepvar = array('create','delete','name','icon','desc');

Once this is fixed, you should be able to create forums just fine.

Zac

*EDIT* This fix seems to also work for creating categories as well.
Last edited by ZacFields on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: DjPorkchop » Tue Jan 30, 2007 1:07 am

Tried Adding a GNU license in downloads and cracker tracker went off. Letting you know so it can be patched when ever and I used ZacFields fixes and my board is alot more free now.
Last edited by DjPorkchop on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
"Don't gain the world and lose your soul, wisdom is better than silver and gold" -Bob Marley

If you build it, I can break it! ~ Whispered in the tone of the movie Field of Dreams.
User avatar
DjPorkchop
Administrator
Administrator
 
Posts: 1591
Likes: 132 posts
Liked in: 26 posts
Images: 0
Joined: Fri Apr 21, 2006 7:59 pm
Cash on hand: 1,570.25
Location: Illinois
IntegraMOD version: phpBB2x

PostAuthor: Dick Dynamite » Tue Jan 30, 2007 1:29 am

Biggest problem I am having right now is on one of my sites, I can't edit style.css sheets on the site itself. I have to download them, edit them on my machine, and submit the edited version. That wouldn't be an issue if I wasn't the kind to try something, and nick and pick at it til I liked it. <img>
Last edited by Dick Dynamite on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
www.dickdynamite.com

Dick Dynamite
Members
Members
 
Posts: 68
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Dec 31, 2006 10:53 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Leadfoot » Tue Jan 30, 2007 1:53 am

ctracker is blocking the cookieMod program. I found the easy go around was to rename ctracker to something else. Run cookieMod and then change the file name back to ctracker.
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

PostAuthor: Dick Dynamite » Tue Jan 30, 2007 2:05 am

The CTracker folder?
Last edited by Dick Dynamite on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
www.dickdynamite.com

Dick Dynamite
Members
Members
 
Posts: 68
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Dec 31, 2006 10:53 am
Cash on hand: 0.00

PostAuthor: Leadfoot » Tue Jan 30, 2007 11:21 am

If you look at the root of your forums you will see a folder called ctracker. It was in the files you uploaded for 141.
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

PostAuthor: ZacFields » Tue Jan 30, 2007 11:59 am

I will take a look at the aforementioned problems and see if we can find a patch for it.

The Devs (and I, the newbie dev) are working on a real patch for crackertracker but we want to make sure we've got most of the major fixes on there before we release it.

I have uploaded a patch that you guys can use in the meantime that will help you be able to do some of the basic stuff like create forums, edit forums, etc.

Zac
Last edited by ZacFields on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

PostAuthor: Dick Dynamite » Tue Jan 30, 2007 1:18 pm

Sorry, Leadfoot, I was asking if you meant the folder itself, or the CTracker_security.php file.
Last edited by Dick Dynamite on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
www.dickdynamite.com

Dick Dynamite
Members
Members
 
Posts: 68
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Dec 31, 2006 10:53 am
Cash on hand: 0.00

PostAuthor: Dick Dynamite » Tue Jan 30, 2007 1:38 pm

Also, now I can't even change those settings at all. [Avatar/Sig, ect.]. I'm tempted to just uninstall ctracker until something is made to work. <img>
Last edited by Dick Dynamite on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
www.dickdynamite.com

Dick Dynamite
Members
Members
 
Posts: 68
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Dec 31, 2006 10:53 am
Cash on hand: 0.00

PostAuthor: ZacFields » Tue Jan 30, 2007 2:52 pm

Dick Dynamite,

Where are you having trouble changing avater/sig info? In your users profile or in your ACP? Be more specific so I can create a patch

Zac
Last edited by ZacFields on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

PostAuthor: Dick Dynamite » Tue Jan 30, 2007 3:53 pm

Well, the fix in the DB worked to fix the avatar/sig problem. Just when I edited the stuff, I had a typo, so it didn't read right. So, nix that.
Last edited by Dick Dynamite on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
www.dickdynamite.com

Dick Dynamite
Members
Members
 
Posts: 68
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Dec 31, 2006 10:53 am
Cash on hand: 0.00

PostAuthor: Leadfoot » Wed Jan 31, 2007 2:28 am

I rename the folder itself
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

PostAuthor: Leadfoot » Thu Feb 01, 2007 1:24 pm

K heres another false positive Teelk

in amod+admin I went to the xtras page and tried to upload changes to the toggle options. I got the dreaded ctracker pink box.

So again as a workaround I renamed the root file "ctracker" to "-ctracker" did my changes to the toggle box and it worked fine.

You will see php errors when u use this methond but scroll to the bottom of them and you will see your page


Edit: I have also found one game that triggers the ctracker warning also. So far WheelofFortune is the only one to trigger it so far. Let me know if u want to know which games trigger it.
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Teelk » Thu Feb 01, 2007 3:27 pm

Sure, if you can post your debug log info concerning Amod, I'm sure it would be very helpful to those who have installed it on 141.
Last edited by Teelk on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
User avatar
Teelk
Dev Team
Dev Team
 
Posts: 1309
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Mar 14, 2006 6:25 pm
Cash on hand: 0.00
Location: Canada

Re: CrackerTracker Exploit False Positives

PostAuthor: ScottDaMan » Sat Feb 03, 2007 12:45 am

When attempting to use General Admin -> Meta Tags+ in ACP, you'll get a false positive. The following debug worked to fix the issue.

Code: Select all
Script-Filename]------------------------------------------#
/forum/admin/admin_meta_tags.php
##-----[ FIND ]------------------------------------------#
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------#
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('meta_de.scription');
##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------##
EoM
Last edited by ScottDaMan on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http]Star Wars United[/url] - My IM141 Board.

ScottDaMan
Members
Members
 
Posts: 46
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Jan 31, 2007 12:40 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Sun Feb 04, 2007 6:54 am

end i've got the following debug
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_hacks_list.php
----------------

Request-Method: GET

Matching rule: select%20
In variable: hack_id

Matching rule: union%20
In variable: hack_id

Matching rule: union%20
In variable: hack_id

Matching rule: %20union
In variable: hack_id

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_hacks_list.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('hack_id');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

PostAuthor: ScottDaMan » Mon Feb 05, 2007 12:29 pm

When posting some acronyms, you'll get a false positive. The following worked to fix it:
Code: Select all
##-----[ OPEN ]------------------------------------------#
/forum/admin/admin_acronyms.php
##-----[ FIND ]------------------------------------------#
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------#
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('de.scription');
Last edited by ScottDaMan on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http]Star Wars United[/url] - My IM141 Board.

ScottDaMan
Members
Members
 
Posts: 46
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Jan 31, 2007 12:40 pm
Cash on hand: 0.00

PostAuthor: ZacFields » Mon Feb 05, 2007 12:38 pm

We really appreciate all the help you guys are giving. Thanks to your efforts Teelk and I have been working to compile a patch for all these errors.

We're truly thankful for your help, and if you notice any other errors please let us know <img>

Zac
Last edited by ZacFields on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Leadfoot » Tue Feb 06, 2007 1:16 pm

ok another false positive here

acp/pcp/pcpwizard/alterformdisplay/submit

when you click on the first submit button u get the ctracker security box

ran debug here are the results


Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename]------------------------------------------#
/forum/admin/admin_pcp_wizard.php
##-----[ FIND ]------------------------------------------#
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------#
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_user_rank_title','style_user_warnings');
##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------##
EoM

RESULTS

Didnt work for me. Where it says:

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);


I dont have that line. My line says:

define('IN_PHPBB', true);

I tried adding the fix after that line and it did not work. So I reran the debug and it came up with this.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_pcp_wizard.php----------------
Request-Method: POST Matching rule: "In variable:  style_usernameIn variable:  style_user_birthdayIn variable:  style_user_my_friendIn variable:  style_user_my_ignoreIn variable:  style_user_pmIn variable:  style_user_emailIn variable:  style_user_websiteIn variable:  style_user_aimIn variable:  style_user_yimIn variable:  style_user_msnmIn variable:  style_user_skypeIn variable:  style_user_icqIn variable:  style_user_album Possible solution:

##-----[ OPEN ]------------------------------------------
/forum/admin/admin_pcp_wizard.php
##-----[ FIND ]------------------------------------------
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_username','style_user_birthday','style_user_my_friend','style_user_my_ignore','style_user_pm','style_user_email','style_user_website','style_user_aim','style_user_yim','style_user_msnm','style_user_skype','style_user_icq','style_user_album');
##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
EoM


So i added those along with the first debug return so now my admin/admin_pcp_wizard.php looks like this

Code: Select all
define('IN_PHPBB', true); 
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_username','style_user_birthday','style_user_my_friend','style_user_my_ignore','style_user_pm','style_user_email','style_user_website','style_user_aim','style_user_yim','style_user_msnm','style_user_skype','style_user_icq','style_user_album');
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('style_user_rank_title','style_user_warnings');



I ran debug again after this and still getting same return as on last run.

If I go into the acp/pcp/pcpwizard/alter page display and i click on the submit button on the default page that pops up all is ok.
But if I navigate to another page such as viewtopic>buttons and hit submit I get the ctracker block.
Last edited by Leadfoot on Tue Feb 06, 2007 2:44 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

PostAuthor: ScottDaMan » Tue Feb 06, 2007 1:23 pm

When a user attempts to add a link to your link directory and they use a site with a .shtml extension, they will get an error.
Code: Select all
Script-Filename]------------------------------------------#/forum/link_register.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('link_desc','link_title','link_url');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


It is important to note:
Original:
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('link_title','link_desc');

New:
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('link_title','link_desc','link_url');
Last edited by ScottDaMan on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http]Star Wars United[/url] - My IM141 Board.

ScottDaMan
Members
Members
 
Posts: 46
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Jan 31, 2007 12:40 pm
Cash on hand: 0.00

PostAuthor: ScottDaMan » Tue Feb 06, 2007 1:32 pm

Same deal for the admin side of the link .script.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_links.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('submit','link_desc','link_title','link_url');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM


Important note:
Original:
$ct_ignorepvar = array('submit','link_desc');

New:
$ct_ignorepvar = array('submit','link_desc','link_title','link_url');
Last edited by ScottDaMan on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http]Star Wars United[/url] - My IM141 Board.

ScottDaMan
Members
Members
 
Posts: 46
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Jan 31, 2007 12:40 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Leadfoot » Tue Feb 06, 2007 2:14 pm

Dam this debugging might get addictive now that I have figured it out. Anyways here is my debug and fix for wheel of fortune. It worked in removing the ctracker error.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/newscore.php----------------  Request-Method: POST  Matching rule: or In variable:   puzzle2In variable:   puzzle65In variable:   puzzle132In variable:   puzzle133In variable:   puzzle144In variable:   puzzle163In variable:   puzzle165In variable:   puzzle166In variable:   puzzle183In variable:   puzzle192  Matching rule: and In variable:   puzzle1In variable:   puzzle2In variable:   puzzle5In variable:   puzzle6In variable:   puzzle25In variable:   puzzle35In variable:   puzzle39In variable:   puzzle56In variable:   puzzle86In variable:   puzzle92In variable:   puzzle113In variable:   puzzle143In variable:   puzzle179In variable:   puzzle184In variable:   puzzle186In variable:   puzzle190In variable:   puzzle195In variable:   puzzle196In variable:   puzzle207In variable:   puzzle223In variable:   puzzle238In variable:   puzzle240In variable:   puzzle244In variable:   puzzle246In variable:   puzzle247In variable:   puzzle252In variable:   puzzle258  Matching rule: id In variable:   puzzle43In variable:   puzzle154In variable:   puzzle226In variable:   puzzle237In variable:   puzzle249  Matching rule: ls In variable:   puzzle27In variable:   puzzle58In variable:   puzzle59In variable:   puzzle140In variable:   puzzle194In variable:   puzzle238  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  chrIn variable:   puzzle70In variable:   puzzle169  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  likeIn variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: like In variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: ping In variable:   puzzle229In variable:   puzzle245Possible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/newscore.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('puzzle2','puzzle65','puzzle132','puzzle133','puzzle144','puzzle163','puzzle165','puzzle166','puzzle183','puzzle192','puzzle1','puzzle5','puzzle6','puzzle25','puzzle35','puzzle39','puzzle56','puzzle86','puzzle92','puzzle113','puzzle143','puzzle179','puzzle184','puzzle186','puzzle190','puzzle195','puzzle196','puzzle207','puzzle223','puzzle238','puzzle240','puzzle244','puzzle246','puzzle247','puzzle252','puzzle258','puzzle43','puzzle154','puzzle226','puzzle237','puzzle249','puzzle27','puzzle58','puzzle59','puzzle140','puzzle194','puzzle71','puzzle193','puzzle70','puzzle169','puzzle29','puzzle42','puzzle73','puzzle94','puzzle229','puzzle245');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Teelk » Tue Feb 06, 2007 7:04 pm

Thanks guys for the contributions, they really are helping out.

For PCP Wizard, try opening up admin/admin_pcp_wizard.php and replacing the MEDIUM with LOW. That may solve all issues with the wizard.
Last edited by Teelk on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
User avatar
Teelk
Dev Team
Dev Team
 
Posts: 1309
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Mar 14, 2006 6:25 pm
Cash on hand: 0.00
Location: Canada

Re: CrackerTracker Exploit False Positives

PostAuthor: Leadfoot » Wed Feb 07, 2007 3:03 am

ok i have done a lot more debugging on the pcp wizard and have a fix that has everything fixed but one thing and I cant seem to get the last part to work. With the debug below everything will work EXCEPT for "alter form display". I keep getting this ctracker debug on this form and it is not working.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/admin/admin_pcp_wizard.php----------------  Request-Method: POST  Matching rule: _phpIn variable:   get_func_phpBBSecurity_questionIn variable:   get_func_phpBBSecurity_answerPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/admin/admin_pcp_wizard.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('get_func_phpBBSecurity_question','get_func_phpBBSecurity_answer');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  



So to get the pcp wizard to work on all pages BUT for the one above this is the working debug

Code: Select all
##-----[ OPEN ]------------------------------------------#/forum/admin/admin_pcp_wizard.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_user_birthday','style_user_my_friend','style_user_my_ignore','style_user_pm','style_user_email','style_user_website','style_user_aim','style_user_yim','style_user_msnm','style_user_skype','style_user_icq','style_user_album','style_user_sig','style_username','style_user_online','style_user_rank_title','style_user_avatar','style_user_from','style_user_regdate','style_user_gender','style_user_age','style_user_posts','style_user_cashtp','style_user_holidays','style_user_country','style_user_warnings','style_user_trophy_topic','get_func_phpBBSecurity_question','get_func_phpBBSecurity_answer');      


Hope this helps.
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: psyperu » Wed Feb 07, 2007 10:48 am

"Leadfoot";p="21534" wrote:Dam this debugging might get addictive now that I have figured it out. Anyways here is my debug and fix for wheel of fortune. It worked in removing the ctracker error.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/newscore.php----------------  Request-Method: POST  Matching rule: or In variable:   puzzle2In variable:   puzzle65In variable:   puzzle132In variable:   puzzle133In variable:   puzzle144In variable:   puzzle163In variable:   puzzle165In variable:   puzzle166In variable:   puzzle183In variable:   puzzle192  Matching rule: and In variable:   puzzle1In variable:   puzzle2In variable:   puzzle5In variable:   puzzle6In variable:   puzzle25In variable:   puzzle35In variable:   puzzle39In variable:   puzzle56In variable:   puzzle86In variable:   puzzle92In variable:   puzzle113In variable:   puzzle143In variable:   puzzle179In variable:   puzzle184In variable:   puzzle186In variable:   puzzle190In variable:   puzzle195In variable:   puzzle196In variable:   puzzle207In variable:   puzzle223In variable:   puzzle238In variable:   puzzle240In variable:   puzzle244In variable:   puzzle246In variable:   puzzle247In variable:   puzzle252In variable:   puzzle258  Matching rule: id In variable:   puzzle43In variable:   puzzle154In variable:   puzzle226In variable:   puzzle237In variable:   puzzle249  Matching rule: ls In variable:   puzzle27In variable:   puzzle58In variable:   puzzle59In variable:   puzzle140In variable:   puzzle194In variable:   puzzle238  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  chrIn variable:   puzzle70In variable:   puzzle169  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  likeIn variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: like In variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: ping In variable:   puzzle229In variable:   puzzle245Possible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/newscore.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('puzzle2','puzzle65','puzzle132','puzzle133','puzzle144','puzzle163','puzzle165','puzzle166','puzzle183','puzzle192','puzzle1','puzzle5','puzzle6','puzzle25','puzzle35','puzzle39','puzzle56','puzzle86','puzzle92','puzzle113','puzzle143','puzzle179','puzzle184','puzzle186','puzzle190','puzzle195','puzzle196','puzzle207','puzzle223','puzzle238','puzzle240','puzzle244','puzzle246','puzzle247','puzzle252','puzzle258','puzzle43','puzzle154','puzzle226','puzzle237','puzzle249','puzzle27','puzzle58','puzzle59','puzzle140','puzzle194','puzzle71','puzzle193','puzzle70','puzzle169','puzzle29','puzzle42','puzzle73','puzzle94','puzzle229','puzzle245');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


Hi but I don't have that archive "newscore.php" in the root of /forum/
Last edited by psyperu on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

psyperu
Newbie
Newbie
 
Posts: 18
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Jun 05, 2006 7:54 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Teelk » Wed Feb 07, 2007 11:30 am

That is only for the "wheel of fortune MOD".
Last edited by Teelk on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
User avatar
Teelk
Dev Team
Dev Team
 
Posts: 1309
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Mar 14, 2006 6:25 pm
Cash on hand: 0.00
Location: Canada

Re: CrackerTracker Exploit False Positives

PostAuthor: Leadfoot » Wed Feb 07, 2007 12:20 pm

actually psypru its for the game "wheel of forune" which is part of the amod arcade mod. Just so you are clear.
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: ScottDaMan » Thu Feb 08, 2007 4:01 pm

Couple false positives related to the qbar.
Script-Filename: /forum/admin/admin_qbar.php

Original:
$ct_ignorepvar = array('url');

New
$ct_ignorepvar = array('url','explain','shortcut');

Here's the debug details:
Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('explain');


and

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('shortcut');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  
Last edited by ScottDaMan on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http]Star Wars United[/url] - My IM141 Board.

ScottDaMan
Members
Members
 
Posts: 46
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Jan 31, 2007 12:40 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Leadfoot » Fri Feb 09, 2007 4:22 pm

Ok have the debug info and fix for cookie mod.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/cookieMOD/cookie.php----------------  Request-Method: POST  Matching rule: _phpIn variable:   cookie_namePossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/cookieMOD/cookie.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('cookie_name');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  



That stopped the cracker tracker error for me.
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: thatjoeguy » Mon Feb 12, 2007 10:41 am

I just tried modiying the Welcome PM through the ACP and got the CTracker warning. Put it into debug and found the possible fix, but it doesn't solve the probem.

The log says:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_wpm.php
----------------

Request-Method: POST

Matching rule: or
In variable: wpm_message

Matching rule: and
In variable: wpm_message

Matching rule: '
In variable: wpm_message

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_wpm.php

#
#-----[ FIND ]------------------------------------------
#
require('./pagestart.' . $phpEx);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


I didn't find:

require('./pagestart.' . $phpEx);

But instead found

require("pagestart.$phpEx");

and inserted the code after that, but it seems to have had no effect.
Last edited by thatjoeguy on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

thatjoeguy
Members
Members
 
Posts: 48
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Thu Apr 06, 2006 4:55 pm
Cash on hand: 0.00

PostAuthor: Leadfoot » Tue Feb 13, 2007 2:39 am

I thought I would go try and see if I could debug it even farther joeguy. But I seemed to also run into other issues which I will put in another post. But try this it may work.

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_wpm.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: BMD » Wed Feb 14, 2007 8:52 am

I just went to change the Welcoming PM and hit a CT issue

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /usr/local/apache/cgi-bin/php.cgi-4.3.1
----------------

Request-Method: POST

Matching rule: or
In variable: wpm_message

Matching rule: and
In variable: wpm_message

Matching rule: "
In variable: wpm_message

Matching rule: '
In variable: wpm_message

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/usr/local/apache/cgi-bin/php.cgi-4.3.1

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM



I get how to edit the code... but I am on a paid host provider server and don't see the referenced path at all, and I believe they use linux

anyone got a clue?

also I already implemented Zack's patch
Last edited by BMD on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

BMD
Members
Members
 
Posts: 84
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Thu Aug 24, 2006 5:12 am
Cash on hand: 0.00

PostAuthor: tekguru » Wed Feb 14, 2007 10:49 am

Once these are all resolved with there be a definitive fix?
Last edited by tekguru on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[size=99px]http][/size]
[url=http][img=left]http://www.4winmobile.com/news/MVP_Horizontal_FullColor.png[/img][/url]
User avatar
tekguru
Sr Integra Member
Sr Integra Member
 
Posts: 329
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Mar 28, 2006 11:29 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Wed Feb 14, 2007 3:33 pm

The following debug worked to me.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/profile.php
----------------

Request-Method: POST

Matching rule: delete
In variable: delete_user

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/profile.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('delete_user');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Wed Feb 14, 2007 6:04 pm

end the following Warning: No ending delimiter '#' found in /var/www/vhosts/johnnytheone.com/httpdocs/home/ctracker/engines/ct_security.php on line 357
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_pa_ug_auth.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_pa_ug_auth.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: Leadfoot » Thu Feb 15, 2007 3:21 pm

Ok one more for you guys

when trying to submit an update to navigation menu I would get ct warning when hitting submit on the edit.

here is the fix

Code: Select all
Script-Filename: /forum/admin/admin_qbar.php----------------  Request-Method: POST  Matching rule: load In variable:   explainPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('explain');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    
Last edited by Leadfoot on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Leadfoot
Integra Member
Integra Member
 
Posts: 131
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Oct 01, 2006 5:02 pm
Cash on hand: 0.00

PostAuthor: sanji » Fri Feb 16, 2007 6:17 am

I can not add an administrator to my board: When going in User Admin -> Permissions, I get a false positive when submitting the name of a user.

OK, I have not find how to solve the problem yet...

sanji
Last edited by sanji on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[img]http://www.secret-japan.com/forum/images/banners/fuji%20secret-japan%2088x31.gif[/img] [url=http]Secret Japan[/url] : discover Japan off the beaten tracks

sanji
Sr Integra Member
Sr Integra Member
 
Posts: 291
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Apr 12, 2006 9:18 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Pogue Moran » Fri Feb 16, 2007 11:49 am

Can anyone help me fix a false positive? I'm trying to get the inline quickediting function of Ajax but I keep getting a false positive everytime I try to save the edit what do I need to do to fix this?

Below is the install file

[url=http]Ajaxed Install Instruction[/url]
Last edited by Pogue Moran on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
User avatar
Pogue Moran
Members
Members
 
Posts: 74
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Jun 24, 2006 5:48 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: fish222222 » Fri Feb 16, 2007 11:59 am

I get false positives on just about everything I do, even with all of the security turned off. I just put 1.4.0 back on and called it good. Too many issues to deal with to mess with it.
Last edited by fish222222 on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

fish222222
Newbie
Newbie
 
Posts: 17
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Jan 22, 2007 5:37 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Khoas » Sat Feb 17, 2007 4:41 am

Adding a banner:

Code: Select all
Possible solution]------------------------------------------#/forum/admin/admin_banner.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('banner_name');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    
Last edited by Khoas on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Khoas
Newbie
Newbie
 
Posts: 1
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Fri May 19, 2006 7:27 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: atomhead » Mon Feb 19, 2007 11:19 am

Code: Select all
##-----[ OPEN ]------------------------------------------#/forums/kb.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('article_desc','message');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


False positive.. applying this fix doesn't get rid of it. Error is when trying to add a KB article.
Last edited by atomhead on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

atomhead
Members
Members
 
Posts: 90
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Apr 08, 2006 6:25 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Tue Feb 20, 2007 8:43 am

and the following debug worked
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_pa_license.php
----------------

Request-Method: POST

Matching rule: or
In variable: form

Matching rule: and
In variable: form

Matching rule: exec
In variable: form

Matching rule: "
In variable: form

Matching rule: into
In variable: form

Matching rule: id
In variable: form

Matching rule: rm
In variable: form

Matching rule: '
In variable: form

Matching rule: rm
In variable: form

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_pa_license.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('form');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: fish222222 » Tue Feb 20, 2007 10:01 pm

I get false positives when I try to edit a template, put a filter in the show only files that contain box, and then try to change directories. It seems to be fine if I don't change directories though. Anyone have a fix for this?
Last edited by fish222222 on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

fish222222
Newbie
Newbie
 
Posts: 17
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Jan 22, 2007 5:37 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Wed Feb 21, 2007 11:15 am

and the following debug worked <img>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/ratings.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/ratings.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: atomhead » Thu Feb 22, 2007 7:56 am

"atomhead";p="22144" wrote:
Code: Select all
##-----[ OPEN ]------------------------------------------#/forums/kb.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('article_desc','message');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


False positive.. applying this fix doesn't get rid of it. Error is when trying to add a KB article.


Same problem with trying to change the Links information in Qbar edit menu. Qbar > Nav Menu (i renamed it from whatever it was before) > Links edit > Submit = borked
Last edited by atomhead on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

atomhead
Members
Members
 
Posts: 90
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Apr 08, 2006 6:25 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: midjam » Fri Feb 23, 2007 2:55 am

Hi guys

I have a problem with deleting the private messages and with the path name in debugging

PMs won`t delete

And when i use the debugger i get

#
#-----[ OPEN ]------------------------------------------
#
/ "never any dir path here just the / "

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

Please help as my inbox is getting big and i can`t delete any posts <img>
Last edited by midjam on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

midjam
Newbie
Newbie
 
Posts: 17
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Jan 28, 2007 2:55 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Tue Feb 27, 2007 11:32 am

and the following debug <img>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_phpbbmyadmin.php
----------------

Request-Method: GET

Matching rule: delete%20
In variable: this_query

Matching rule: '
In variable: this_query

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_phpbbmyadmin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('this_query');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: cobra_pliskin » Fri Mar 02, 2007 5:18 am

I tried every thing but I get always the false positive when I try to check out REQUIRED FIELD in ALTER FORM DISPLAY under PCP.
What else to try?
I tried with a kick ... the only result was to lose a shoe down from the window! :)
Last edited by cobra_pliskin on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

cobra_pliskin
Newbie
Newbie
 
Posts: 5
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Feb 18, 2007 6:51 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Tue Mar 06, 2007 8:45 am

and the following debug
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_extensions.php
----------------

Request-Method: POST

Matching rule: '
In variable: add_extension_group

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_extensions.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('add_extension_group');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: midjam » Tue Mar 06, 2007 9:41 am

Hi again guys

Anyone know why i`m getting no pathname?

#
#-----[ OPEN ]------------------------------------------
#
/ "never any dir path here just the / "

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);
Last edited by midjam on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

midjam
Newbie
Newbie
 
Posts: 17
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Jan 28, 2007 2:55 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Juppertje » Wed Mar 07, 2007 4:27 am

i have simulair problem in forum/admin/admin_users.php

This user is blokked and i can not deblock this member i get message

SECURITY ALERT ÂÂÂ » ÂÂÂ » ÂÂÂ » ÂÂÂ »
CBACK CrackerTracker has detected a potential attack on this site with a worm or exploit .script so the Security System stopped the .script.


If you can see this page after including a new MOD into your board or after clicking on a link please contact the Board Administrator with this error message and a de.scription what you have done before you could see this page, that the Admin has the possibility to fix the problem.
Last edited by Juppertje on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Juppertje
Integra Member
Integra Member
 
Posts: 113
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat May 20, 2006 1:12 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Wed Mar 14, 2007 5:30 pm

the following debug is helpful to those who have installed it on 141
Script-Filename: /home/admin/admin_ina_xtras.php
----------------

Request-Method: POST

Matching rule: or
In variable: challenge_msg
In variable: trophy_msg

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_ina_xtras.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('challenge_msg','trophy_msg');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Juppertje,
read the first post and this http://www.integramod.com/forum/kb.php?mode=article&k=22
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

PostAuthor: richiebgood » Sun Mar 18, 2007 1:33 pm

Tell a friend is still giving me trouble. In the forum, when i want to send a topic that works ok.

On the portal, when i want to send some news articles there is no problem except with a few. Any ideas.

Debug info:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/tellafriend.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/tellafriend.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM



My tellafriend.php file.

<?php
define('IN_PHPBB', true);
define('CT_SECLEVEL', 'LOW');
$ct_ignorepvar = array('message','submit','');
$phpbb_root_path = "./";
include($phpbb_root_path . 'extension.inc');
include($phpbb_root_path . 'common.'.$phpEx);
include($phpbb_root_path . 'includes/functions_post.'.$phpEx);
Last edited by richiebgood on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

richiebgood
Sr Integra Member
Sr Integra Member
 
Posts: 329
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Aug 08, 2006 1:01 am
Cash on hand: 0.00
Location: Ireland

Re: CrackerTracker Exploit False Positives

PostAuthor: shaythong » Sun Mar 18, 2007 4:15 pm

"JohnnyTheOne";p="22424" wrote:and the following debug <img>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_phpbbmyadmin.php
----------------

Request-Method: GET

Matching rule: delete%20
In variable: this_query

Matching rule: '
In variable: this_query

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_phpbbmyadmin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('this_query');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


This doesn't work?
Last edited by shaythong on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

shaythong
Newbie
Newbie
 
Posts: 15
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Mar 18, 2007 10:25 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Wiked » Mon Mar 19, 2007 5:17 am

This CtackerTracker is more trouble than its worth IMO.

Until someone comes up with a way to to fix these errors that actually work then I think I will re upload 140 to my site.

Turning on debug mode and using logmanager, viewing the code to add to fix these errors doesn't work at all for me.
Last edited by Wiked on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Wiked
Newbie
Newbie
 
Posts: 21
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Apr 08, 2006 8:21 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: eivind » Mon Mar 19, 2007 10:02 am

Hello.......

I also think about to reupload my 1.4.0 version. I am going mad of all this fake warnings, debug and so on. I realy like integramod so i hope the folks here at integrmod find a solution of this problem soon.... I also know that security is very important and it is a lot of people that like to destroy other's work.......


eivind
Last edited by eivind on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
User avatar
eivind
Newbie
Newbie
 
Posts: 14
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Feb 21, 2007 11:16 pm
Cash on hand: 0.00

PostAuthor: odius » Tue Mar 20, 2007 12:28 am

there's an easy way mentioned on this site somewhere that says how to quick and easily disable ctracker, quit bitchin lol, these guys put a lotta work in, appreciate what they've tried to do at least which is to offer the best they could

http://www.integramod.com/forum/viewtop ... ctrack+fix
Last edited by odius on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

odius
Newbie
Newbie
 
Posts: 28
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue May 02, 2006 1:14 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: eivind » Tue Mar 20, 2007 12:36 am

We appreciate the work very mutch, but we also have be alowed to say what we meen about things.

<img>
Last edited by eivind on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
User avatar
eivind
Newbie
Newbie
 
Posts: 14
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Feb 21, 2007 11:16 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: odius » Tue Mar 20, 2007 12:45 am

I think this forum is just for debug, no offense or anythin, first post says
"NOTE: Please do not post support questions in this thread, it is only for CT Debug info."
[hr:178dld48]
when editing a photo album catagory from admin panel, (album > catagory > edit) the 'view level' and 'parent catagory'
error and this debug fix which does NOT work.

turned the setting to LOW as a work around


Script-Filename: /admin/admin_album_cat.php
----------------

Request-Method: POST

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_album_cat.php

#
#-----[ FIND ]------------------------------------------
#
require('./pagestart.' . $phpEx);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM



[hr:178dld48]

Making a new album folder in user's personal album returns the red flag,

had to turn this to LOW aswell


Script-Filename: /album_personal_cat_admin.php
----------------

Request-Method: POST

Matching rule: create
In variable: addcategory

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_personal_cat_admin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('addcategory');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by odius on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

odius
Newbie
Newbie
 
Posts: 28
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue May 02, 2006 1:14 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: .QUACK.Major.Pain » Wed Mar 21, 2007 1:48 pm

I have found also that the debug doesn't fix the problem.
You may have to do like I have for many of the debugs I had and change the security from MEDIUM to LOW.
This has fixed it for me and allowed me to edit my forum as needed. You can then later go back when your done editting and change the security back to MEDIUM.
If problem still continues like I had with uploading photos to the album, I left security at LOW and haven't had a problem since.
Last edited by .QUACK.Major.Pain on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

.QUACK.Major.Pain
Sr Integra Member
Sr Integra Member
 
Posts: 986
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Jan 27, 2007 11:15 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Fri Mar 23, 2007 7:46 am

and the following
Script-Filename: /home/portal.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/portal.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: melamkish » Sun Mar 25, 2007 7:20 am

Trying to add KB category.

Script-Filename: admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: and
In variable: submit

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('submit');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


And another one

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: and
In variable: catdesc

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catdesc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by melamkish on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Too many projects, too little time.
User avatar
melamkish
Newbie
Newbie
 
Posts: 28
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Fri Jul 21, 2006 4:46 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Jerkie » Sun Mar 25, 2007 10:47 am

This is all just too rediculous, I haven't seen any mention of Downloads yet, this is my biggest problem, I can't add downloads or change categories or ANYTHING, I too think I will be deleting the whole 1.4.1 and going back to 1.4.0 this 1.4.1, just shouldn't have been released yet.. I get the dreaded Pink box with EVERYTHING I DO, I have added about ALL the fixes / patches found here and it still sucks... down with cTracker..... for now. <img>
Last edited by Jerkie on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Jerkie
Newbie
Newbie
 
Posts: 1
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Sep 13, 2006 12:20 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: .QUACK.Major.Pain » Sun Mar 25, 2007 2:11 pm

Holy crap!!! That's a crappy attitude. How much you pay for 141??? You should be appreciative that it's offered at no charge. Your taking the wrong road with this. You have to consider us all as Beta testers. If we didn't report the problems, they would never get fixed. Maybe you should go back to 140 and come back and download 141 when they release 142. I have to say that this group guys (and gals if any) do a hell of a job assistting everyone with their problems. They are quick to respond and generally help you fix things within days. I've never come across people who assist you 24/7 as quick as they do.

Disappointing to see you bite of the hand that gives you a hand out. These things are a work in progress. Theirs a time when it's felt all the bugs have been worked out and a product is good to go for release. At times errors do come up. Sometimes few, sometimes many.

Stick around and be part of a team working together to perfect a great thiing.
Last edited by .QUACK.Major.Pain on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

.QUACK.Major.Pain
Sr Integra Member
Sr Integra Member
 
Posts: 986
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Jan 27, 2007 11:15 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: melamkish » Sun Mar 25, 2007 6:37 pm

I agree. I waited patiently for this version which runs on PHP5 so I could use it. Though I only know the basics of PHP I have dug in to help. Love this version, and my hats off to the team for all the hard work. <img>



Setting up my photo album here is what I have so far.

Album Categories fix
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_album_cat.php
----------------

Request-Method: POST

Matching rule: create
In variable: submit

Matching rule: or
In variable: cat_desc

Matching rule: and
In variable: cat_title

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_album_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('submit','cat_desc','cat_title');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Album upload

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /album_upload.php
----------------

Request-Method: POST

Matching rule: or
In variable: pic_desc

Matching rule: and
In variable: pic_desc

Matching rule: "
In variable: pic_desc

Matching rule: ls
In variable: pic_desc

Matching rule: '
In variable: pic_title

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_upload.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('pic_desc','pic_title');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Album edit

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /album_edit.php

(sorry, didn't copy the matching rule part)
----------------
Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_edit.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('pic_desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by melamkish on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Too many projects, too little time.
User avatar
melamkish
Newbie
Newbie
 
Posts: 28
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Fri Jul 21, 2006 4:46 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: melamkish » Mon Mar 26, 2007 10:13 am

Download fixes

There are a couple of fixes I did before I started copying each CT suggested fix. A couple may not have the failure mode, but the fix is included.

Setting the database name

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_pa_file.php
----------------

Request-Method: POST

Matching rule: or
In variable: short_desc

Matching rule: and
In variable: long_desc
/admin/admin_pa_settings.php


define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('settings_dbname');

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_pa_file.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('short_desc','long_desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Add Categories

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_pa_category.php
----------------


Possible solution:
------------------
#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_pa_category.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('addcategory');
#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Download de.scriptions

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /LOTL/admin/admin_pa_file.php
----------------

Request-Method: POST

Matching rule: or
In variable: short_desc

Matching rule: and
In variable: long_desc
/admin/admin_pa_settings.php

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/LOTL/admin/admin_pa_file.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('short_desc','long_desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Add download license

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /LOTL/admin/admin_pa_license.php
----------------

Request-Method: POST

Matching rule: create
In variable: form

Matching rule: or
In variable: form

Matching rule: and
In variable: form

Matching rule: load
In variable: form

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/LOTL/admin/admin_pa_license.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('form');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


This is getting to be addictive <img>
Last edited by melamkish on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Too many projects, too little time.
User avatar
melamkish
Newbie
Newbie
 
Posts: 28
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Fri Jul 21, 2006 4:46 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: mRvMan » Fri Mar 30, 2007 9:46 am

So Ctracker is a little "paranoid" and gives you a few delays in getting things working just the way you want them...

As with ANY process, plan, software, idea, concept, etc, that involves the protection, prevention and anticipation of some sort of attack, violation, hack...the idea is to start with maximum security, as it were and set those things you wish to allow.

In essence you can consider yourself to be "teaching" CTracker how best to serve your board.

How long did it take you to learn to configure a board? It took some amount of time and effort - and there were mistakes made along the way.
Still, you learned from that, gained wisdom.

So now, you impart that onto CTracker.

And as was already stated here: IMod is a work in progress, ever evolving and improving with the help of us, its users.
If you feel you just "cannot wait.." then consider paying for a "finished product".
But when you do, remember, even they are consistently updating their product. Only now you will have paid money, on top of your time and effort.

Of all the different manifestations and "flavors" of php-based boards and forums, IMod is hands down by far the best one, with little "extra fat" - all of its mods have purpose and utility.
Though this is just my opinion, it is based on my humble experience of installing boards and forums since 1996.

Lastly, the more we all contribute to its improvement, bug-fixes, etc, the sooner we will all enjoy of one hell of a board <img>
Last edited by mRvMan on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
User avatar
mRvMan
Newbie
Newbie
 
Posts: 14
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Fri Jun 09, 2006 6:27 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: odius » Fri Mar 30, 2007 1:55 pm

outta no where (that i know of) ctrack is now stoppin me from adding a new portal page, which i did fine before. all i can think of is that maybe cuz there's more than one user on my site now (a guest).. dont know what else could be different


this is weird cuz im addin a portal page, not a photo album.. also it says set to medium but it's already set to low, and I just got past the block by adding the page with only one word name "lipid" cuz anything else like "lipid peroxidation" with or without being followed by " - free radical" is blocked

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /album_personal_cat_admin.php
----------------

Request-Method: POST

Matching rule: create
In variable: addcategory

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_personal_cat_admin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('addcategory');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by odius on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

odius
Newbie
Newbie
 
Posts: 28
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue May 02, 2006 1:14 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: JohnnyTheOne » Thu Apr 12, 2007 2:42 pm

and the following
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/calendar_scheduler.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/calendar_scheduler.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by JohnnyTheOne on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
JohnnyTheOne
Development and exploitation of Websites
http://www.johnnytheone.com
User avatar
JohnnyTheOne
Members
Members
 
Posts: 78
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Tue Apr 18, 2006 8:35 am
Cash on hand: 0.00
Location: Hengelo (ov)

Re: CrackerTracker Exploit False Positives

PostAuthor: geoff1 » Tue Apr 17, 2007 12:35 am

One for deleting download categories

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/admin/admin_pa_category.php
----------------

Request-Method: POST

Matching rule: delete
In variable: submit

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/admin/admin_pa_category.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('submit');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Be warned tho, although it does work properly it gives this error after you've deleted the category:

Warning: Invalid argument supplied for foreach() in /home/sfiregi/public_html/forums/pafiledb/includes/functions_pafiledb.php on line 1365

I'll ask about this in a new topic <img> The link to it is:

http://www.integramod.com/forum/viewtop ... 4114#24114
Last edited by geoff1 on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Geoff 'Lonewolf' Upton

'miracle worker extroardinaire'

Insanity is a state of mind... your mad to think otherwise!
User avatar
geoff1
Members
Members
 
Posts: 97
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Jul 10, 2006 2:09 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: geoff1 » Tue Apr 17, 2007 3:43 am

One for altering the group de.scriptions:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/admin/admin_groups.php
----------------

Request-Method: POST

Matching rule: or
In variable: group_de.scription

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/admin/admin_groups.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('group_de.scription');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM
Last edited by geoff1 on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Geoff 'Lonewolf' Upton

'miracle worker extroardinaire'

Insanity is a state of mind... your mad to think otherwise!
User avatar
geoff1
Members
Members
 
Posts: 97
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Jul 10, 2006 2:09 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Helter » Tue Apr 17, 2007 7:58 am

this is what I have for admin_pa_catagory

Code: Select all
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('addcategory','submit');


and for admin_groups

Code: Select all
define('CT_SECLEVEL', 'LOW');$ct_ignorepvar = array('new','group_name','group_de.scription','username');
Last edited by Helter on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
"Success is getting what you want. Happiness is wanting what you get." - Dale Carnegie
User avatar
Helter
Administrator
Administrator
 
Posts: 4553
Likes: 40 posts
Liked in: 115 posts
Images: 0
Joined: Sat Mar 11, 2006 4:46 pm
Cash on hand: 1,954.10
Location: Seattle Wa
IntegraMOD version: phpBB2x

Re: CrackerTracker Exploit False Positives

PostAuthor: zenrei » Sat Apr 28, 2007 4:05 pm

"Teelk";p="21549" wrote:Thanks guys for the contributions, they really are helping out.

For PCP Wizard, try opening up admin/admin_pcp_wizard.php and replacing the MEDIUM with LOW. That may solve all issues with the wizard.


what medium??

I just went into the php in edit mode and there isn't anything that says MEDIUM
Last edited by zenrei on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
IntegraMOD 141 RULES!!
[img=left]http://www.falloutzone.net/foz/images/smiles/attentionwhore.gif[/img]

[url=http]Click here to go to my site built with IntegraMOD 141[/url] <img>
User avatar
zenrei
Sr Integra Member
Sr Integra Member
 
Posts: 286
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Oct 09, 2006 8:36 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: CaNNon » Sat May 05, 2007 9:16 am

That was done in 2 parts, they added the medium then dropped it to low.
combined it should be like this.

Find ---> define('IN_PHPBB', 1);
Then add ---> define('CT_SECLEVEL', 'LOW');
Last edited by CaNNon on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Image
Image
User avatar
CaNNon
Sr Integra Member
Sr Integra Member
 
Posts: 750
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Thu Apr 19, 2007 12:15 pm
Cash on hand: 0.00

PostAuthor: zenrei » Sat May 05, 2007 9:26 am

yeah... thanks <img> i didn't figure that out until later... i was having one of my dork moments
Last edited by zenrei on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
IntegraMOD 141 RULES!!
[img=left]http://www.falloutzone.net/foz/images/smiles/attentionwhore.gif[/img]

[url=http]Click here to go to my site built with IntegraMOD 141[/url] <img>
User avatar
zenrei
Sr Integra Member
Sr Integra Member
 
Posts: 286
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Oct 09, 2006 8:36 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Juppertje » Sun May 06, 2007 4:06 pm

every whee is see here

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);



But i only have


define('IN_PHPBB', true);

so is this the same or have i also to replace define('IN_PHPBB', true); with define('IN_PHPBB', 1); ????
Last edited by Juppertje on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Juppertje
Integra Member
Integra Member
 
Posts: 113
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat May 20, 2006 1:12 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: CaNNon » Mon May 07, 2007 2:35 pm

1 and true are the same, just add the line after it.
Last edited by CaNNon on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Image
Image
User avatar
CaNNon
Sr Integra Member
Sr Integra Member
 
Posts: 750
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Thu Apr 19, 2007 12:15 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Juppertje » Mon May 07, 2007 2:55 pm

"CaNNon";p="24912" wrote:1 and true are the same, just add the line after it.


okay txs
Last edited by Juppertje on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Juppertje
Integra Member
Integra Member
 
Posts: 113
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat May 20, 2006 1:12 pm
Cash on hand: 0.00

PostAuthor: nGAGE » Wed May 09, 2007 12:53 pm

Just wondering... with all these fixes being posted... WHY do these problems happen in the first place? Shouldn't there be a patch to fix what's necessary if it's such a common problem? or are these problems not applicable on every install?
I (to be honest) find it an extreme pain in my behind and it takes me more time to fix this crap-tracker then to design an entire theme. Please find a solution for this! If necessary, post a tutorial on uninstalling crap-tracker from IM... as I've only had useless problems with it constantly banning my members for no reason or blocking me from doing the most common/basic admin tasks! This only prevents me from managing my site properly and I've got other things to do as well then to check .scripts everytime a function fails to co-operate.

Don't get me wrong! I love IM and I intend on using it, but the crap-tracker is more of a pain in the behind then it does good to me.
Last edited by nGAGE on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http][img=left]http://www.net-clan-gaming.eu/ftp/ngage/images/nEt_v3_sig.png[/img][/url]
User avatar
nGAGE
Sr Integra Member
Sr Integra Member
 
Posts: 248
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Mar 27, 2006 7:28 am
Cash on hand: 0.00

PostAuthor: ZacFields » Wed May 09, 2007 1:01 pm

ngage,

Not sure if you've tried my patch yet. There is a patch out there but it is very much a work-in-progress. I haven't updated it in a while but it solves the most basic problems with crackertracker. Mainly the admin-side stuff.

http://www.integramod.com/forum/viewtopic.php?t=2830

Zac
Last edited by ZacFields on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

ZacFields
Sr Integra Member
Sr Integra Member
 
Posts: 426
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed May 24, 2006 11:14 pm
Cash on hand: 0.00

PostAuthor: nGAGE » Wed May 09, 2007 3:17 pm

Thnx... Truly appreciate that link. Missed that post! I'll surely post if I encounter anymore problems <img>
Last edited by nGAGE on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http][img=left]http://www.net-clan-gaming.eu/ftp/ngage/images/nEt_v3_sig.png[/img][/url]
User avatar
nGAGE
Sr Integra Member
Sr Integra Member
 
Posts: 248
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Mar 27, 2006 7:28 am
Cash on hand: 0.00

PostAuthor: nGAGE » Mon May 14, 2007 10:54 am

ADDING ALLOWED HTML-Code

OPEN admin/admin_board.php

FIND
Code: Select all
 define('IN_PHPBB', 1);  


AFTER ADD
Code: Select all
 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('allow_html_tags',);  


IF $ct_ignorepvar EXISTS]  $ct_ignorepvar = array('***');  [/php]

*** = Being any code existing already

INLINE, FIND
Code: Select all
 );  


INLINE, REPLACE
Code: Select all
 ,'allow_html_tags');  
Last edited by nGAGE on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http][img=left]http://www.net-clan-gaming.eu/ftp/ngage/images/nEt_v3_sig.png[/img][/url]
User avatar
nGAGE
Sr Integra Member
Sr Integra Member
 
Posts: 248
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Mar 27, 2006 7:28 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: .QUACK.Major.Pain » Mon May 14, 2007 3:10 pm

I checked that file and already in my file from my original install.
Think someone beat you to it .

I'm still waiting for a fix to use html in posts. Trying to use paypal Buy Now button but only offered in html.
Last edited by .QUACK.Major.Pain on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

.QUACK.Major.Pain
Sr Integra Member
Sr Integra Member
 
Posts: 986
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Jan 27, 2007 11:15 am
Cash on hand: 0.00

PostAuthor: nGAGE » Mon May 14, 2007 3:36 pm

Maybe I've overlooked it with the previous fixes posted here, but I've just been trying to make a collection of all of them on my own site as well, as I still have a theory about the patch mentioned somewhere that overwrites only the ctracker/engines/ct_security.php file to fix a lot of the CT issues.

It seems to me that it just adds all this stuff to be "Ignored" and I'm not sure that could have a "Global" effect and effect on the security itself! Fixing the individual files that actually cause problems seems a better bet to me, but ok... I'm not knowledgeable enough with php to make a proper statement!

Will try to find out more about that theory though and keep you all posted.
Last edited by nGAGE on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http][img=left]http://www.net-clan-gaming.eu/ftp/ngage/images/nEt_v3_sig.png[/img][/url]
User avatar
nGAGE
Sr Integra Member
Sr Integra Member
 
Posts: 248
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Mar 27, 2006 7:28 am
Cash on hand: 0.00

PostAuthor: nGAGE » Wed May 16, 2007 3:52 pm

Could be that I've overlooked this one somewhere, but still... here we go:

Creating KnowledgeBase Types

OPEN /admin/admin_kb_types.php

FIND
Code: Select all
 if ( file_exists( './../viewtopic.php' ) ){     define( 'IN_PHPBB', 1 );     define( 'IN_PORTAL', 1 );     define( 'MXBB_MODULE', false );  


AFTER ADD
Code: Select all
 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('create','edit','delete');  


IF $ct_ignorepvar EXISTS
FIND / INLINE, FIND
Code: Select all
 $ct_ignorepvar = array(  


INLINE, AFTER ADD
Code: Select all
 'create','edit','delete',  




PS]http://www.net-clan-gaming.com/viewforum.php?f=54[/url]
Last edited by nGAGE on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http][img=left]http://www.net-clan-gaming.eu/ftp/ngage/images/nEt_v3_sig.png[/img][/url]
User avatar
nGAGE
Sr Integra Member
Sr Integra Member
 
Posts: 248
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Mar 27, 2006 7:28 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: TheJT » Sat May 26, 2007 4:04 am

i always get an allert in acp->Forum Admin->Management + -> Creat New Forum

sometimes when i try to write something under "De.scription" i get this allert
Last edited by TheJT on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

TheJT
Members
Members
 
Posts: 55
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat May 06, 2006 2:12 am
Cash on hand: 0.00

PostAuthor: nGAGE » Sat May 26, 2007 10:23 pm

There is a fix for that already, but nobody really posted here anymore... so I don't have my bookmarks to the patch anymore :-? ) It will have the fix though to solve your specifig issue and most of the common ones!
You may simply want to use the "Patch"-like edit, or do all the individual edits, either way... a lot of problems with CT will be solved. Personally I prefer editing the individual files, as I will then be assured that I only change something for that specific file and not globally, like the patch might do (not sure though).

Anyhow... have fun creating forums after this 8)
Last edited by nGAGE on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[url=http][img=left]http://www.net-clan-gaming.eu/ftp/ngage/images/nEt_v3_sig.png[/img][/url]
User avatar
nGAGE
Sr Integra Member
Sr Integra Member
 
Posts: 248
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Mon Mar 27, 2006 7:28 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: Michalis » Mon Jul 02, 2007 6:46 am

Hi guys.
Just wanted to say a few things. This integramod 1.4.1 is awsome. it has to be one of the best moded php i have come accross recently.
I have been a fan of & using in the past PHPBB2+. This Integramod 1.4.1 has opened my eyes & made my board more popular with its features in place.

I di have a few probs atm with the ct tracker on the board, I have searched on this forum for individual examples that effect me to & with no luck I did not find any help.

Also just to point out I have added the new ctracker patches & unfortunately my small problems are not fixed.

The problems I have are as follows.

1. Links SOLVED
I have added 2 links already to my board thru the ACP with no problem, but adding any more I get the dreaded pink box from the C Tracker. I really dont understand why this is causing me problems. (remember i have added the latest CT patch.).

1. Downloads SOLVED After making the catorgories for the Download section of the board I have come accross with another dreaded pink box when trying to ad info & files in file management.

Is there any individual fixes for the problems I have or can someone kindly help me resolve these issues. This has been bugging me for some time, I have been very patient in searching this forum for resolutions.

Thanx guys for reading this & hope someone maybe able to help.

Integramod definately rocks php
Last edited by Michalis on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[img=left]http://www.houseofdance.net/images/Banners/HoDbanner2008.gif[/img]
User avatar
Michalis
Integra Member
Integra Member
 
Posts: 138
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Jun 16, 2007 5:37 pm
Cash on hand: 0.00
Location: UK

Re: CrackerTracker Exploit False Positives

PostAuthor: Michalis » Tue Jul 10, 2007 12:03 pm

Well I have to say the following:

I finally managed to read all the posts in this perticular section & must say that i finally got round to understanding some of the fixes that most of you sorted.

I must admin this section does actually work, especially if somke of the members who post in this section could actually put the title what the debug or fix is for.
But anyway I managed to go thru this section & payed attention to the problems that i faced too. I went out of my way & followed the instruction of the fixes I needed to do. I must say thanx to all in this section for you effort in reporting the debugs / fixes that we have with the cool CTracker. I actually managed to fix some of my board with the advice here.

Links
Banners
Downloads

I still have a few minor probs now which have not been answered or have popped up again with a fault.

one of them is to do with the index permissions
http://www.integramod.com/forum/viewtop ... highlight=

& unread messages
http://www.integramod.com/forum/viewtop ... highlight=

also some of my members cannot enter registration cause they get the pink box & when I add them thru the ACP & they try to enter the forum again to login the box appears again. so that one has confused me alot..

But besides all that I really do love this new php version (integramod) real quality. I also noticed in this section a few members were impatient.
This is a shame because the main members who do all of this & give helpful advise are not robots, but human being who do need rest on a few occasions. Plus these fixes cannot be known unless people tell. But take it in mind this integramod is free of charge & we should be thankful that it is shared to the public.

So guys lets be patient if there is no fix on the other section of this board then this section may have your answer if not then relax & wait .

Thanx again for all your help that u have provided me in some of the fixes/help I needed. very much obliged...
Last edited by Michalis on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
[img=left]http://www.houseofdance.net/images/Banners/HoDbanner2008.gif[/img]
User avatar
Michalis
Integra Member
Integra Member
 
Posts: 138
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Jun 16, 2007 5:37 pm
Cash on hand: 0.00
Location: UK

Re: CrackerTracker Exploit False Positives

PostAuthor: Juppertje » Wed Jul 18, 2007 12:38 pm

I have done what is mentiomet below and afther i edited the file i still get


SECURITY ALERT ÂÂ » ÂÂ » ÂÂ » ÂÂ »
CBACK CrackerTracker has detected a potential attack on this site with a worm or exploit .script so the Security System stopped the .script.


If you can see this page after including a new MOD into your board or after clicking on a link please contact the Board Administrator with this error message and a de.scription what you have done before you could see this page, that the Admin has the possibility to fix the problem.



So now what?

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: rm
In variable: catname

Matching rule: rm
In variable: catname

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catname');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: rm
In variable: catname

Matching rule: rm
In variable: catname

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catname');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Here is the full admin_kb_cat.php file

Code: Select all
<php>sql_query( $sql ) )     {         message_die( GENERAL_ERROR, "Couldn't get list of forums", "", __LINE__, __FILE__, $sql );     }       $forumlist = '<select>';       if ( $sel_id == 0 )     $forumlist .= '<option> Select a Forum !</option>';         while ( $row = $db->sql_fetchrow( $result ) )     {         if ( $sel_id == $row['forum_id'] )         {             $status = "selected";         }         else         {             $status = '';         }         $forumlist .= '<option>' . $row['forum_name'] . '</option>';     }       $forumlist .= '</select>';       return $forumlist;}    if ( isset( $HTTP_POST_VARS['mode'] ) || isset( $HTTP_GET_VARS['mode'] ) ){     $mode = ( isset( $HTTP_POST_VARS['mode'] ) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];}else{     if ( $create )     {         $mode = 'create';     }     else if ( $edit )     {         $mode = 'edit';     }     else if ( $delete )     {         $mode = 'delete';     }     else     {         $mode = '';     }}  switch ( $mode ){     case ( 'create' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $new_cat_name = stripslashes( $HTTP_POST_VARS['new_cat_name'] );                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_edit_body.tpl' )                 );               $template->assign_block_vars( 'switch_cat', array() );               $template->assign_vars( array( 'L_EDIT_TITLE' => $lang['Create_cat'],                     'L_EDIT_DESCRIPTION' => $lang['Create_de.scription'],                     'L_CATEGORY' => $lang['Category'],                     'L_DESCRIPTION' => $lang['Article_de.scription'],                     'L_NUMBER_ARTICLES' => $lang['Articles'],                     'L_CAT_SETTINGS' => $lang['Cat_settings'],                     'L_CREATE' => $lang['Create'],                     'L_PARENT' => $lang['Parent'],                     'L_NONE' => $lang['None'],                       'PARENT_LIST' => get_kb_cat_list( '', 0, 1, 0, 0, true ),                       'L_FORUM_ID' => $lang['Forum_id'],                     'L_FORUM_ID_EXPLAIN' => $lang['Forum_id_explain'],                     'FORUM_LIST' => get_forums( ),                       'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=create" ),                     'CAT_NAME' => $new_cat_name,                     'DESC' => '',                     'NUMBER_ARTICLES' => '0',                                         // Category permissions                     'L_CAT_PERMISSIONS' => $lang['Category_Permissions'],                     'L_VIEW_LEVEL' => $lang['View_level'],                     'L_UPLOAD_LEVEL' => $lang['Upload_level'],                     'L_RATE_LEVEL' => $lang['Rate_level'],                     'L_COMMENT_LEVEL' => $lang['Comment_level'],                     'L_EDIT_LEVEL' => $lang['Edit_level'],                     'L_DELETE_LEVEL' => $lang['Delete_level'],                     'L_APPROVAL_LEVEL' => $lang['Approval_level'],                     'L_APPROVAL_EDIT_LEVEL' => $lang['Approval_edit_level'],                     'L_GUEST' => $lang['Forum_ALL'],                     'L_REG' => $lang['Forum_REG'],                     'L_PRIVATE' => $lang['Forum_PRIVATE'],                     'L_MOD' => $lang['Forum_MOD'],                     'L_ADMIN' => $lang['Forum_ADMIN'],                                         'L_DISABLED' => $lang['Disabled'],                                       'VIEW_GUEST' => 'selected="selected"',                     'UPLOAD_REG' => 'selected="selected"',                     'RATE_REG' => 'selected="selected"',                     'COMMENT_REG' => 'selected="selected"',                     'EDIT_REG' => 'selected="selected"',                     'DELETE_MOD' => 'selected="selected"',                     'APPROVAL_DISABLED' => 'selected="selected"',                                         'S_GUEST' => AUTH_ALL,                     'S_USER' => AUTH_REG,                     'S_PRIVATE' => AUTH_ACL,                     'S_MOD' => AUTH_MOD,                     'S_ADMIN' => AUTH_ADMIN                      ) );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $cat_name = trim( $HTTP_POST_VARS['catname'] );               if ( !$cat_name )             {                 echo "Please put a category name in!";             }               $cat_desc = $HTTP_POST_VARS['catdesc'];             $parent = intval( $HTTP_POST_VARS['parent'] );             $comments_forum_id = intval( $HTTP_POST_VARS['forum_id'] );                         if ( $comments_forum_id == 0 )             {                 mx_message_die(GENERAL_MESSAGE , 'Select a Forum');               }             $view_level = intval( $HTTP_POST_VARS['auth_view'] );             $post_level = intval( $HTTP_POST_VARS['auth_post'] );             $rate_level = intval( $HTTP_POST_VARS['auth_rate'] );             $comment_level = intval( $HTTP_POST_VARS['auth_comment'] );             $edit_level = intval( $HTTP_POST_VARS['auth_edit'] );             $delete_level = intval( $HTTP_POST_VARS['auth_delete'] );             $approval_level = intval( $HTTP_POST_VARS['auth_approval'] );             $approval_edit_level = intval( $HTTP_POST_VARS['auth_approval_edit'] );               $sql = "SELECT MAX(cat_order) AS cat_order             FROM " . KB_CATEGORIES_TABLE . " WHERE parent = $parent";             if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, 'Could not obtain next type id', '', __LINE__, __FILE__, $sql );             }               if ( !( $id = $db->sql_fetchrow( $result ) ) )             {                 mx_message_die( GENERAL_ERROR, 'Could not obtain next type id', '', __LINE__, __FILE__, $sql );             }             $cat_order = $id['cat_order'] + 10;               $sql = "INSERT INTO " . KB_CATEGORIES_TABLE . " ( category_name, category_details, number_articles, parent, cat_order, auth_view, auth_post, auth_rate, auth_comment, auth_edit, auth_delete, auth_approval, auth_approval_edit, comments_forum_id)" . " VALUES                                                             ( '$cat_name', ' $cat_desc', '0',                 '$parent', '$cat_order', '$view_level', '$post_level', '$rate_level', '$comment_level', '$edit_level', '$delete_level', '$approval_level', '$approval_edit_level', '$comments_forum_id')";               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not create category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_created'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               message_die( GENERAL_MESSAGE, $message );         }         break;       case ( 'edit' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $cat_id = intval( $HTTP_GET_VARS['cat'] );               $sql = "SELECT * FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = " . $cat_id;               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );             }             if ( $kb_cat = $db->sql_fetchrow( $results ) )             {                 $cat_name = $kb_cat['category_name'];                 $cat_desc = $kb_cat['category_details'];                 $number_articles = $kb_cat['number_articles'];                 $parent = $kb_cat['parent'];                 $comments_forum_id = $kb_cat['comments_forum_id'];             }                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_edit_body.tpl' )                 );               $template->assign_block_vars( 'switch_cat', array() );             $template->assign_block_vars( 'switch_cat.switch_edit_category', array() );               $template->assign_vars( array( 'L_EDIT_TITLE' => $lang['Edit_cat'],                     'L_EDIT_DESCRIPTION' => $lang['Edit_de.scription'],                     'L_CATEGORY' => $lang['Category'],                     'L_DESCRIPTION' => $lang['Article_de.scription'],                     'L_NUMBER_ARTICLES' => $lang['Articles'],                     'L_CAT_SETTINGS' => $lang['Cat_settings'],                     'L_CREATE' => $lang['Edit'],                       'L_PARENT' => $lang['Parent'],                     'L_NONE' => $lang['None'],                       'PARENT_LIST' => get_kb_cat_list( '', $parent, $parent, true, 0, true ),                       'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=edit" ),                     'CAT_NAME' => $cat_name,                     'CAT_DESCRIPTION' => $cat_desc,                     'NUMBER_ARTICLES' => $number_articles,                       'L_FORUM_ID' => $lang['Forum_id'],                     'L_FORUM_ID_EXPLAIN' => $lang['Forum_id_explain'],                     'FORUM_LIST' => get_forums( $comments_forum_id ),                                         // Cat permissions                     'L_CAT_PERMISSIONS' => $lang['Category_Permissions'],                     'L_VIEW_LEVEL' => $lang['View_level'],                     'L_UPLOAD_LEVEL' => $lang['Upload_level'],                     'L_RATE_LEVEL' => $lang['Rate_level'],                     'L_COMMENT_LEVEL' => $lang['Comment_level'],                     'L_EDIT_LEVEL' => $lang['Edit_level'],                     'L_DELETE_LEVEL' => $lang['Delete_level'],                     'L_APPROVAL_LEVEL' => $lang['Approval_level'],                     'L_APPROVAL_EDIT_LEVEL' => $lang['Approval_edit_level'],                     'L_GUEST' => $lang['Forum_ALL'],                     'L_REG' => $lang['Forum_REG'],                     'L_PRIVATE' => $lang['Forum_PRIVATE'],                     'L_MOD' => $lang['Forum_MOD'],                     'L_ADMIN' => $lang['Forum_ADMIN'],                                         'L_DISABLED' => $lang['Disabled'],                                         'VIEW_GUEST' => ( $kb_cat['auth_view'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'VIEW_REG' => ( $kb_cat['auth_view'] == AUTH_REG ) ? 'selected="selected"' : '',                     'VIEW_PRIVATE' => ( $kb_cat['auth_view'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'VIEW_MOD' => ( $kb_cat['auth_view'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'VIEW_ADMIN' => ( $kb_cat['auth_view'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'UPLOAD_GUEST' => ( $kb_cat['auth_post'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'UPLOAD_REG' => ( $kb_cat['auth_post'] == AUTH_REG ) ? 'selected="selected"' : '',                     'UPLOAD_PRIVATE' => ( $kb_cat['auth_post'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'UPLOAD_MOD' => ( $kb_cat['auth_post'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'UPLOAD_ADMIN' => ( $kb_cat['auth_post'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'RATE_GUEST' => ( $kb_cat['auth_rate'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'RATE_REG' => ( $kb_cat['auth_rate'] == AUTH_REG ) ? 'selected="selected"' : '',                     'RATE_PRIVATE' => ( $kb_cat['auth_rate'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'RATE_MOD' => ( $kb_cat['auth_rate'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'RATE_ADMIN' => ( $kb_cat['auth_rate'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'COMMENT_GUEST' => ( $kb_cat['auth_comment'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'COMMENT_REG' => ( $kb_cat['auth_comment'] == AUTH_REG ) ? 'selected="selected"' : '',                     'COMMENT_PRIVATE' => ( $kb_cat['auth_comment'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'COMMENT_MOD' => ( $kb_cat['auth_comment'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'COMMENT_ADMIN' => ( $kb_cat['auth_comment'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'EDIT_REG' => ( $kb_cat['auth_edit'] == AUTH_REG ) ? 'selected="selected"' : '',                     'EDIT_PRIVATE' => ( $kb_cat['auth_edit'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'EDIT_MOD' => ( $kb_cat['auth_edit'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'EDIT_ADMIN' => ( $kb_cat['auth_edit'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'DELETE_REG' => ( $kb_cat['auth_delete'] == AUTH_REG ) ? 'selected="selected"' : '',                     'DELETE_PRIVATE' => ( $kb_cat['auth_delete'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'DELETE_MOD' => ( $kb_cat['auth_delete'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'DELETE_ADMIN' => ( $kb_cat['auth_delete'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'APPROVAL_DISABLED' => ( $kb_cat['auth_approval'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'APPROVAL_MOD' => ( $kb_cat['auth_approval'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'APPROVAL_ADMIN' => ( $kb_cat['auth_approval'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                                             'APPROVAL_EDIT_DISABLED' => ( $kb_cat['auth_approval_edit'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'APPROVAL_EDIT_MOD' => ( $kb_cat['auth_approval_edit'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'APPROVAL_EDIT_ADMIN' => ( $kb_cat['auth_approval_edit'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                                     'S_GUEST' => AUTH_ALL,                     'S_USER' => AUTH_REG,                     'S_PRIVATE' => AUTH_ACL,                     'S_MOD' => AUTH_MOD,                     'S_ADMIN' => AUTH_ADMIN,                         'S_HIDDEN' => '<input>' )                 );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $cat_id = intval( $HTTP_POST_VARS['catid'] );             $cat_name = trim( $HTTP_POST_VARS['catname'] );             $cat_desc = $HTTP_POST_VARS['catdesc'];             $number_articles = intval( $HTTP_POST_VARS['number_articles'] );             $parent = intval( $HTTP_POST_VARS['parent'] );             $comments_forum_id = intval( $HTTP_POST_VARS['forum_id'] );                         $view_level = intval( $HTTP_POST_VARS['auth_view'] );             $post_level = intval( $HTTP_POST_VARS['auth_post'] );             $rate_level = intval( $HTTP_POST_VARS['auth_rate'] );             $comment_level = intval( $HTTP_POST_VARS['auth_comment'] );             $edit_level = intval( $HTTP_POST_VARS['auth_edit'] );             $delete_level = intval( $HTTP_POST_VARS['auth_delete'] );             $approval_level = intval( $HTTP_POST_VARS['auth_approval'] );             $approval_edit_level = intval( $HTTP_POST_VARS['auth_approval_edit'] );                 if ( !$cat_name )             {                 echo "Please put a category name in!";             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET category_name = '" . $cat_name . "', category_details = '" . $cat_desc . "', number_articles = '" . $number_articles . "', parent = '" . $parent . "', auth_view = '" . $view_level . "', auth_post = '" . $post_level . "', auth_rate = '" . $rate_level . "', auth_comment = '" . $comment_level . "', auth_edit = '" . $edit_level . "', auth_delete = '" . $delete_level . "', auth_approval = '" . $approval_level . "', auth_approval_edit = '" . $approval_edit_level . "', comments_forum_id = '" . $comments_forum_id . "' WHERE category_id = " . $cat_id;               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_edited'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               mx_message_die( GENERAL_MESSAGE, $message );         }         break;       case ( 'delete' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *                 FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '" . $cat_id . "'";               if ( !( $cat_result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $cat_result ) )             {                 $cat_name = $category['category_name'];             }                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_del_body.tpl' )                 );               $template->assign_vars( array( 'L_DELETE_TITLE' => $lang['Cat_delete_title'],                     'L_DELETE_DESCRIPTION' => $lang['Cat_delete_desc'],                     'L_CAT_DELETE' => $lang['Cat_delete_title'],                     'L_DELETE_ARTICLES' => $lang['Delete_all_articles'],                       'L_CAT_NAME' => $lang['Article_category'],                     'L_MOVE_CONTENTS' => $lang['Move_contents'],                     'L_DELETE' => $lang['Move_and_Delete'],                       'S_HIDDEN_FIELDS' => '<input>',                     'S_SELECT_TO' => get_kb_cat_list( '', $cat_id, 0, true, 0, true ),                     'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=delete" ),                       'CAT_NAME' => $cat_name )                 );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $new_category = $HTTP_POST_VARS['move_id'];             $old_category = $HTTP_POST_VARS['catid'];               if ( $new_category != '0' )             {                 $sql = "UPDATE " . KB_ARTICLES_TABLE . " SET article_category_id = '$new_category'                WHERE article_category_id = '$old_category'";                   if ( !( $move_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not move articles", '', __LINE__, __FILE__, $sql );                 }                   $sql = "SELECT *                    FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '$new_category'";                   if ( !( $cat_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );                 }                   if ( $new_cat = $db->sql_fetchrow( $cat_result ) )                 {                     $new_articles = $new_cat['number_articles'];                 }                   $sql = "SELECT *                    FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '$old_category'";                   if ( !( $oldcat_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );                 }                   if ( $old_cat = $db->sql_fetchrow( $oldcat_result ) )                 {                     $old_articles = $old_cat['number_articles'];                 }                   $number_articles = $new_articles + $old_articles;                   $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET number_articles = '" . $number_articles . "' WHERE category_id = " . $new_category;                   if ( !( $number_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not update articles number", '', __LINE__, __FILE__, $sql );                 }             }             else             {                 $sql = "DELETE FROM " . KB_ARTICLES_TABLE . "                         WHERE article_category_id = " . $old_category;                 if ( !( $delete__articles = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not delete articles", '', __LINE__, __FILE__, $sql );                 }             }               $sql = "DELETE FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = $old_category";               if ( !( $delete_result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not delete category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_deleted'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               mx_message_die( GENERAL_MESSAGE, $message );         }         break;       default:           if ( $mode == "up" )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *              FROM " . KB_CATEGORIES_TABLE . "            WHERE category_id = $cat_id";               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $result ) )             {                 $parent = $category['parent'];                 $old_pos = $category['cat_order'];                 $new_pos = $old_pos-10;             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $old_pos . "'            WHERE parent = " . $parent . " AND cat_order = " . $new_pos;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $new_pos . "'            WHERE category_id = " . $cat_id;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }         }           if ( $mode == "down" )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *              FROM " . KB_CATEGORIES_TABLE . "            WHERE category_id = $cat_id";               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $result ) )             {                 $parent = $category['parent'];                 $old_pos = $category['cat_order'];                 $new_pos = $old_pos + 10;             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $old_pos . "'            WHERE parent = " . $parent . " AND cat_order = " . $new_pos;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $new_pos . "'            WHERE category_id = " . $cat_id;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }         }                 // Generate page                 $template->set_filenames( array( 'body' => 'admin/kb_cat_admin_body.tpl' )             );           $template->assign_vars( array( 'L_KB_CAT_TITLE' => $lang['Cat_man'],                 'L_KB_CAT_DESCRIPTION' => $lang['KB_cat_de.scription'],                   'L_CREATE_CAT' => $lang['Create_cat'],                 'L_CREATE' => $lang['Create'],                 'L_CATEGORY' => $lang['Article_category'],                 'L_ACTION' => $lang['Art_action'],                 'L_ARTICLES' => $lang['Articles'],                 'L_ORDER' => $lang['Update_order'],                   'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=create" ) )             );         // get categories         $sql = "SELECT *                 FROM " . KB_CATEGORIES_TABLE . "             WHERE parent = 0 ORDER BY cat_order ASC";           if ( !( $cat_result = $db->sql_query( $sql ) ) )         {             mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );         }           $ss = 0;         while ( $category = $db->sql_fetchrow( $cat_result ) )         {             $category_details = $category['category_details'];             $category_articles = $category['number_articles'];               $category_id = $category['category_id'];             $category_name = $category['category_name'];             $temp_url = append_sid( $module_root_path . "kb.$phpEx?mode=cat&cat=$category_id" );             $category_link = '<a>' . $category_name . '</a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=edit&cat=$category_id" );             $edit = '<a><img></a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=delete&cat=$category_id" );             $delete = '<a><img></a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=up&cat=$category_id" );             $up = '<a>' . $lang['Move_up'] . '</a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=down&cat=$category_id" );             $down = '<a>' . $lang['Move_down'] . '</a>';               $row_color = ( !( $ss % 2 ) ) ? $theme['td_color1'] : $theme['td_color2'];             $row_class = ( !( $ss % 2 ) ) ? $theme['td_class1'] : $theme['td_class2'];               $template->assign_block_vars( 'catrow', array( 'CATEGORY' => $category_link,                     'CAT_DESCRIPTION' => $category_details,                     'CAT_ARTICLES' => $category_articles,                       'U_EDIT' => $edit,                     'U_DELETE' => $delete,                     'U_UP' => $up,                     'U_DOWN' => $down,                       'ROW_COLOR' => '#' . $row_color,                     'ROW_CLASS' => $row_class )                 );               $i++;             $ss++;             $ss = get_kb_cat_subs_admin( $category_id, '1', '    ', $ss );         }         break;}  $template->pparse( 'body' );include_once( $mx_root_path . 'admin/page_footer_admin.' . $phpEx );  ?>
Last edited by Juppertje on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

Juppertje
Integra Member
Integra Member
 
Posts: 113
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat May 20, 2006 1:12 pm
Cash on hand: 0.00

PostAuthor: Master Dwarf » Sat Aug 18, 2007 7:38 am

For Merging Topics

#
#-----[ OPEN ]------------------------------------------
#
/yourportalroot/merge.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', True);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('topic_title');
Last edited by Master Dwarf on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Sean Kelley
http://www.GrumblingDwarf.com
Wisconsin Region Game Site
User avatar
Master Dwarf
Integra Supporter
Integra Supporter
 
Posts: 102
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sun Apr 09, 2006 9:26 am
Cash on hand: 0.00
Location: Madison, WI

Re: CrackerTracker Exploit False Positives

PostAuthor: jomasaco » Mon Oct 01, 2007 3:33 am

And for the global news on Crack Tracker.
when i try to put a msg always gives me that stupid error, and i canÂÂ ´t pass this out.
what is the fix?
Last edited by jomasaco on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

jomasaco
Members
Members
 
Posts: 31
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Wed Jun 20, 2007 2:16 am
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: salmercker » Tue Nov 06, 2007 2:24 pm

ok deos anyone have the fix for the album_cat ? i did what ctracker told me and im still getting that error. everytime i try to create a new catagory. im about to just say screw it and do a work around by renaming the folder lol

also not sure if this is conserning ctracker or not but also get this error after i try to view a photo uploaded.

Fatal error: Cannot redeclare acronym_pass() (previously declared in /home/dragosia/public_html/album_mod/album_bbcode.php:3597) in /home/dragosia/public_html/includes/bbcode.php on line 1422
Last edited by salmercker on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

salmercker
Members
Members
 
Posts: 42
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Sep 01, 2007 9:42 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: CaNNon » Tue Nov 06, 2007 6:07 pm

I didn't need any for that file, could you post your debug info?
Last edited by CaNNon on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.
Image
Image
User avatar
CaNNon
Sr Integra Member
Sr Integra Member
 
Posts: 750
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Thu Apr 19, 2007 12:15 pm
Cash on hand: 0.00

Re: CrackerTracker Exploit False Positives

PostAuthor: ThePlague » Sat Nov 10, 2007 10:32 am

Trying to set avtars to display as always because non members cannot see them.
PCP Wizzard >> Alter Page Display >> user_avatar


Debug Info:

Code: Select all
   ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/admin/admin_pcp_wizard.php  ##-----[ FIND ]------------------------------------------#require('./pagestart.' . $phpEx);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_user_rank_title','style_user_warnings');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    



Debug Does Not Work. Anyone Have A Fix?
Last edited by ThePlague on Wed Dec 31, 1969 5:00 pm, edited 1 time in total.

ThePlague
Newbie
Newbie
 
Posts: 15
Likes: 0 post
Liked in: 0 post
Images: 0
Joined: Sat Nov 10, 2007 5:25 am
Cash on hand: 0.00

Next

Return to IntegraMOD 141

Who is online

Registered users: App360MonitorBot, Bing [Bot], Google [Bot], Majestic-12 [Bot]