Re: CrackerTracker Exploit False Positives

[sirap]

Hi Teelk,
I did follow the steps in KB, but I still cannot change my board configuration.
This is the DebugMode log :

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /admin/admin_board.php----------------  Request-Method: POST  Matching rule: mail In variable:   board_email_sigPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/admin/admin_board.php  ##-----[ FIND ]------------------------------------------#require('./pagestart.' . $phpEx);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('board_email_sig');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

I've add those two lines accordingly..but still not working.
Please help.

[Dioncecht]

Whenever possible, when configuring things in ACP, use '&' instead of the word 'and'. I've noticed that Cracker Tracker gets really upset if you use 'and' for whatever reason and doesn't really care about '&'. So if you wanna avoid making it angry, use a '&' instead.

[Helter]

Hi Teelk,
I did follow the steps in KB, but I still cannot change my board configuration.
This is the DebugMode log :

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /admin/admin_board.php----------------  Request-Method: POST  Matching rule: mail In variable:   board_email_sigPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/admin/admin_board.php  ##-----[ FIND ]------------------------------------------#require('./pagestart.' . $phpEx);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('board_email_sig');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

I've add those two lines accordingly..but still not working.
Please help.

change "define('CT_SECLEVEL', 'MEDIUM');"
to "define('CT_SECLEVEL', 'LOW);"

[Drop-Forged]

Hi Teelk,
I did follow the steps in KB, but I still cannot change my board configuration.
This is the DebugMode log :

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /admin/admin_board.php----------------  Request-Method: POST  Matching rule: mail In variable:   board_email_sigPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/admin/admin_board.php  ##-----[ FIND ]------------------------------------------#require('./pagestart.' . $phpEx);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('board_email_sig');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

I've add those two lines accordingly..but still not working.
Please help.

change "define('CT_SECLEVEL', 'MEDIUM');"
to "define('CT_SECLEVEL', 'LOW);"

Ok, for me the file edits dont work at all, and from some of the post I have seen I dont think Im the only one with this issue.


The only way I can get Cracker Tracker to ignore certain fields is to set the fields in the à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€¦Ã¢â‚¬Å“ $unchecked_post_fields à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€¦Ã¢â‚¬Å“ line in ct_security.php



Here is how to add unchecked fields in the ct_security.php


Open /ctracker/engines/ ct_security.php

Find]// Some fields in $HTTP_POST_VARS don't get checked to prevent wrong detection$unchecked_post_fields   = array('username', 'password', 'subject', 'message',                                 'poll_title', 'poll_option', 'poll_delete',                                 'email', 'confirm_code', 'aim', 'msn', 'yim',                                 'interests', 'occupation', 'signature', 'website',                                 'location', 'search', 'sitename', 'word',                                 'replacement', 'help', 'last_msg', 'quote', 'dl',                                 'preview', 'post', 'mode', 'content', 'server_name',                                 '.script_path', 'sitename', 'site_desc', 'disable_reg_msg',                                 'disable_msg', 'cookie', 'avatar', 'file', 'picture',                                 'filter', 'xs', 'edit', 'content', 'fileupload', 'filecomment',                                 'comment', 'rate', 'pic', 'search_author', 'add_poll_option_text' [/code]




After add the fields that you need to be unchecked.


So if your log file says ]------------------------------------------
#
require('./pagestart.' . $phpEx);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('long_desc','download_url');


You would add 'long_desc', 'download_url' as the fields that you want to be unchecked.



Note] Make sure you follow the format of the ct_security.php file, notice that there are [color=red]spaces after the commas; also you should make a backup copy of your original ct_security.php before doing any editing.


From what I can tell from going over this file, this is actually the correct place to be adding fields that you dont want Cracker Tracker to check them when you add a mod.





You can also remove words trigger words such as à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€¦Ã¢â‚¬Å“andà¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€š

[sirap]

argghh... now i got critical error after add the $unchecked_post_fields...:

phpBB : Critical Error

Could not get theme data for themes_id [9]

I've tried to restore my backup ct_security.php but still cannot go inside my board.

Before this, I changed the "define('CT_SECLEVEL', 'MEDIUM');" to "define('CT_SECLEVEL', 'LOW');"
but still not working.

someone please help..

[Helter]

phpBB : Critical Error

Could not get theme data for themes_id [9]

for this error, check that your includes/def_themes.php is chmodded to 666. If it is already, back it up and replace it with a new one from the IM140 package and chmod it to 666. delete your browser cache and your cookie for your site.

[sirap]

I did that (reupload the def_themes.php and change the permission to 666...but still give me the same result..

[Drop-Forged]

argghh... now i got critical error after add the $unchecked_post_fields...:

phpBB : Critical Error

Could not get theme data for themes_id [9]

I've tried to restore my backup ct_security.php but still cannot go inside my board.

Before this, I changed the "define('CT_SECLEVEL', 'MEDIUM');" to "define('CT_SECLEVEL', 'LOW');"
but still not working.

someone please help..

I had something similar happen when I first upgraded, and then uninstalled my old 1.4.0 themes, but mine was actually theme [1].


For me, I replaced all my files, and it worked again.

Not sure what file was causing the issue, it wasnt in the templates directory, or in the DB, and I dont think it was a cache file, but maybe I missed one somewhere.




I had something similar happen when I first upgraded, and then uninstalled my old 140 themes, but mine was actually theme [1].


For me, I replaced all my files, and it worked again.

Not sure what file was causing the issue, it wasnt in the templates directory, or in the DB, and I dont think it was a cache file, but maybe I missed one somewhere.

I dont think an edit to the ct_security.php would cause that theme issue, unless you were to actually block the themes fields.

But even then replacing the file with the original should solve that.

[color=red]EDIT] I think I found another fix, I will post shortly.

[Fallen]

Im not professional, and I can see how your fix would work. I noticed something though in the ct_security.php file That in a way explains why you can put

Code: Select all

define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('long_desc','download_url');

If you notice when you get an error sometimes it has $ct_ignorepvar and sometimes it has $ct_ignoregvar. Your fix is missing the get part I think. So an error is still possible.

Also when adding the fix to your page. Note if its a ingoreg or ignorep. I only know this due to having the error show after both instances of 'post' and 'get'

Code: Select all

 // Maybe also some new $_POST fields to ignore?$ct_ignorepvar = array_diff((array) $ct_ignorepvar, $unchecked_post_fields);$unchecked_post_fields = array_merge($unchecked_post_fields, $ct_ignorepvar);  // Last but not least the same with $_GET$ct_ignoregvar = array_diff((array) $ct_ignoregvar, $unchecked_get_fields);$unchecked_get_fields = array_merge($unchecked_get_fields, $ct_ignoregvar);}

is the actual code from lines 187 - 194. Take the commands here and put them into context of what your fix is on your page.

Like profile.php for instance in my particular case (a different portal) I had added custom fields to the profile and had to make sure the ctracker didn't hate me.

so under

Code: Select all

define('IN_PHPBB', 1);   // or true instead of 1 //  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('desc');

in the array('putyourfieldhere') and if you still get errors make sure its not the get that is the issue. This way your not modifying your ct_security. These will be the others to be ignored per lines 187 -194

Ok I think I bored myself.