This article is also available in the Computer Security page.
/$$$$$$ /$$$$$$ /$$ /$$$$$$ /$$$$$$
/$$__ $$|_ $$_/ | $$ /$$__ $$|_ $$_/
/$$$$$$ | $$ \__/ | $$ /$$$$$$$ /$$$$$$ | $$ \ $$ | $$ /$$$$$$$
|____ $$| $$ | $$ /$$__ $$ /$$__ $$| $$$$$$$$ | $$ | $$__ $$
/$$$$$$$| $$ | $$ | $$ | $$ | $$ \__/| $$__ $$ | $$ | $$ \ $$
/$$__ $$| $$ $$ | $$ | $$ | $$ | $$ | $$ | $$ | $$ | $$ | $$
| $$$$$$$| $$$$$$/ /$$$$$$| $$$$$$$ | $$ | $$ | $$ /$$$$$$| $$ | $$
\_______/ \______/ |______/ \_______//$$$$$$|__/ |__/ |__/|______/|__/ |__/
|______/
I’m BACK!
-=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=-
____________________________________
| |
| Gaining access to a web machine |
| running Psychostats |
| |
| Author: aCId_rAIn |
|___http://www.electricimpulse.net___|
-=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–
Table of Contents 1. What is Psychostats?
2. Vulnerability.
3. The fix.
3. Reconnaissance.
4. Exploit.
5. Credits.
-=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–=0=–=1=–
Section 1. What is Psychostats?
——————————-
Straight from the site:
“PsychoStats is open source software that creates comprehensive gaming statistics for players and clans for Half-Life and Half-Life 2 based games. This includes games like Counter-Strike, Team Fortress 2, Day of Defeat and GunGame. Support for other games such as Call of Duty 4 and Soldat are also supported.” Examples of websites running Psychostats can be found by searching google or going to the Psychostats website at: http://www.psychostats.com/
Section 2. Vulnerability.
————————-
The vulnerability of psychostats is simple. WEBMASTER ERROR. SOME (Definitely not all) websites can be found with the vulnerability working like a charm. The problem is that finding a site running psychostats as a standalone, instead of a community or organization using some sort of automated website that gives psychostats is hard to find. Although I was successful in finding website that were readily exploitable, the success rate was quite low. The vulnerability comes with the stats.cfg file sitting in the top directory of a new (or even old) installation of Psychostats.
Section 3. The fix.
——————-
The fix is easy. DONT MAKE YOUR PSYCHOSTATS SQL-DB PASSWORD THE SAME AS YOUR WEBSITE PASSWORD. Change your permissions as well through CHMOD to keep random people out of your SQL-DB’s.
Section 3. Reconnaissance
————————-
We gather information about the target we are going to use. For this I am just going to use a fake website for an example. Most shared-hosting websites are the most vulnerable. Shared-hosting websites are normally used by beginning webmasters or smaller companies who cannot invest in high web-security. This isn’t always the case, though.
One of the best ways to understand an application– whether it be web, or an application for the OS is to install it and run it on a web server, or use it on your own system/test system. Learn how the application functions, and how the directory structure works. Once you’ve figured out the directory tree and the operation of that program, you’ll have a basic understanding of how to manipulate its structure or even code. Psychostats’ default install for most webmasters is either:
www.domainnamehere.com/stats
or
www.domainnamehere.com/psychostats
It appeared that some webmasters were smart enough to rename the Psychostats to whatever they wanted. It’s not necessary to do so, but it is highly recommended.
Now, how do we search for people on the web that are running Psychostats?
Google is our best friend:
http://www.google.com/search?q=powered+by+psychostats&btnG=Search&hl=en&sa=2
The term “Powered by Psychostats” is a “branding” that just gives us a hand finding nothing but websites running Psychostats. It’s those three words that give us our targets.
Now we have done our recon, and have a website that we want to exploit.
Section 4. Exploit. (not really, more like a URL search…)
——————-
Now that we’ve found our website at www.domainnamehere.com and we see it’s running Psychostats… we need to make sure we aren’t looking at a certain player’s stats, or a weapon’s stats. We need to make sure we’re in the ROOT DIRECTORY that the Psychostats install is in. We can check this by simply using our browser.
We are currently looking at something like this:
www.domainnamehere.com/psychostats/cs/87932845687=oihjhu=player=poop?
We need to get rid of all the extra trailing information and end up with a result like this:
www.domainnamehere.com/psychostats
THIS IS THE ROOT DIRECTORY OF PSYCHOSTATS.
(Remember, as said before, the root directory name isn’t always going to be “Psychostats”. It could be “stats”, or “statistics”, or even the name of the game or mod the webmaster chooses. Keep in mind, for some Apache servers, the trailing directory may be case sensitive.
Now that we’re in the root directory of Psychostats, we exploit by simply adding “stats.cfg” to the end of the URL. Here’s an example:
www.domainnamehere.com/psychostats/stats.cfg
Press enter to confirm the directory change.
If the host is vulnerable, your browser will attempt to download stats.cfg. Download the stats.cfg file, and open it. If the system is not vulnerable and you get a redirect, or a “File not Found”, there are two options you have.
1. Try changing “stats.cfg” to a different name, like “server.cfg” or using the clan’s name, game name, mod name etc. It will always have .cfg at the end no matter what’s before the extension separator.
2. Move on, Jack… the webmaster appears to be smart enough to know how to safeguard SQL.
If it just so happens that the system is vulnerable, and you are able to download the stats.cfg file from the web server, once you open the file you should see something like this:
# stats.cfg should ONLY contain basic database settings.
# any other configuration settings will be ignored.
dbtype = mysql
dbhost = mysql302.domainhere.com
dbport = 3306
dbname = dragon_ps3
dbuser = dragon_ps3
dbpass = PSadmin1
dbtblprefix = ps_
Congratulations! You’ve just gained access to an SQL database! If you can access the dbhost via url, can login to the admin section using the dbuser, and dbpass fields. We aren’t done yet.
Most webmasters, including some of the best, use global passwords to help keep memory of logins. SQL database something different than the password to their actual website! 7/10 times the password to the SQL DB is the same as the password to the entire website. Let’s login to the CPANEL! Note that all websites don’t always use CPANEL, but you can use whatever website login feature is available. Sometimes the login panel is on the website of the actual company hosting the website. However, most times if you simply go to the website root… “www.thewebsitenamehere.com/CPANEL” you will get a login request for the Control Panel to the website.
So now we know that www.domainnamehere.com was vulnerable.
We’ve downloaded the “stats.cfg” file from the Psychostats root directory.
We want to go further by getting complete access to the website.
No problem.
www.domainnamehere.com/cpanel
Login box appears.
Enter the dbuser data you got from the “stats.cfg” file into the username field. Be sure to refrain from typing anything after the actual username, which includes _ps3. Anything starting with an underscore that have characters following is not part of the username, but part of the SQL Database. This is how the tables for the database are made. For instance, in this tutorial, our dbname was dragon_ps3. our login for any type of admin, including Psychostats web admin panel would only be “dragon” not “dragon_ps3″.
Now we enter our password we got from the dbpass section in our “stats.cfg” file into our control panel password field.
Press enter.
Wait.
One of two things will happen:
1. User or Password invalid. If this happens, the site isn’t accessible via the information we’ve used. This means the SQL DB user/password is actually different than the user/pass the website is using. Move on, Jack.
2. You get access to the Control Panel and are able to do anything you choose with the website. This is assuming that the privileges are set as root or a superuser.
Now what are the chances you will be able to succeed at one of these exploits.
There’s a 1/40 chance you’ll find someone stupid enough to have done this. However, there are roughly 6,706,993,152 people in the world. That leaves you with about… 167,674,828 chances for success. You had better get started.
Section 5. Credits
———————————————————————————
Email : acid_rain([at])electricimpulse([dot])net
Website: http://www.electricimpulse.net
Twitter: @acid_rain
aCId_rAIn (2009)
