=> Announcements => Topic started by: S-U-P-E-R on February 10, 2008, 05:42:44 AM
Title: Explanation of recent, inexplicable bans!
Post by: S-U-P-E-R on February 10, 2008, 05:42:44 AM
Someone finally waltzed into one of our awful forum script's giant, gaping security holes. Unless you are actually a terrible poster that deserved to be banned, I guess!
Title: Re: Explanation of recent, inexplicable bans!
Post by: Shift Key on February 16, 2008, 05:24:20 AM
Someone finally waltzed into one of our awful forum script's giant, gaping security holes. Unless you are actually a terrible poster that deserved to be banned, I guess!
Yeah, that was my research and investigation that showed it up. Turns out there was a Fusetalk vulnerability that the Bannings page wasn't locked down (which was confirmed by a simple Secunia query a few days later), and any registered user could come in and ban anyone else. I've got the entire hilarious chat log which demonstrated the ability to ban random people, Ty included:
Shifty: ahahahahahahahahaha Shifty: i'm in your ban lists Shifty: can't see anything though Shifty: as in "there's no banned users" which is hard to believe Peeack: aahahah S-U-P-E-R: hrm Peeack: that it is Peeack: well i'm off for a while, i have two OS's to install on this pc! S-U-P-E-R: i have a hunch that there's at least two seperate banlists S-U-P-E-R: like it'll track ones done through the on-page pulldowns separately from the ones through the admin panel Shifty: and now i caused a rails error Shifty: ah S-U-P-E-R: HOWEVER, i don't know this for sure Shifty: that's probabl why, as i'm running this from the forums main page Shifty: urg, admin login page. Shifty: can't get past you just yet Infernal Monkey: hahahah Shifty: lets see if i can ban someone randomly Shifty: awesome, i just banned PIAC from somewhere S-U-P-E-R: ahahah are you serious Shifty: reason: FREE KEVIN Shifty: yeah, see if you can track it down Shifty: because i can basically cruise to www.nintendoworldreport.com/forums/banning.cfm and do just that Infernal Monkey: hahahahahahhaha Berto2K: hahaha S-U-P-E-R: ahahah holy **** S-U-P-E-R: the pulldown menu banlist was cleared Shifty: did i do that? S-U-P-E-R: maybe that happened when the server moved S-U-P-E-R: and yeah, piac is the only one on it S-U-P-E-R: LOLLLL Shifty: hahahahaha do i win the internet? Shifty: ****, i'm getting a beer for that Shifty: who else deserves a ban? S-U-P-E-R: i don't think you did S-U-P-E-R: every active poster and admin S-U-P-E-R: do it and maybe we can get the new forum up this week so "this doesn't happen again" Shifty: ban someone noteworthy? S-U-P-E-R: every active poster and admin S-U-P-E-R: just camp out the online user list and ban everyone that logs on Infernal Monkey: looooool S-U-P-E-R: and i'll not know about it S-U-P-E-R: p.s. i have warned the entire staff several times of exploits Shifty: oh, but that's cos you'll get banned to oh wait surprised ruined S-U-P-E-R: that's fine i don't care S-U-P-E-R: besides i think i have parachute accounts Shifty: GP has been banned Infernal Monkey: yes! S-U-P-E-R: hahahahahahahahahahah holy **** S-U-P-E-R: i can't login to the admin page anymore S-U-P-E-R: double lollllllllllllllllllllllllllll Shifty: HAHAHAHHAHAHAHA Hybrid Hunter: LOL Infernal Monkey: NWR quality internets Shifty: and that was an easy effort S-U-P-E-R: how long did this take you, like 30 minutes to destroy the forum Hybrid Hunter: can they trace it to you shifty? Infernal Monkey: hahahahahahhaahha S-U-P-E-R: who gives a **** what are they gonna do Shifty: it took me two minutes of reading scripts and then i went straight to the page Hybrid Hunter: blame australia S-U-P-E-R: banning *!*@*.au Infernal Monkey: they'll chuck publisher press releases at you shifty, watch out Shifty: acutally, lets see if i even need a login to do this Shifty: yeah, i need to supply a login S-U-P-E-R: make sure you get every admin Shifty: hahahaha S-U-P-E-R: i'm going to be the first person that gets aimed about this by the other staff
After that it degenerated into chaos once RABicle and PIAC heard about their unbannings...
So yes, that was why the forums were down. At least it was acted on promptly and resolved quickly. Thanks staffers!
Title: Re: Explanation of recent, inexplicable bans!
Post by: Caliban on February 16, 2008, 05:30:24 AM
Hilarious.
Title: Re: Explanation of recent, inexplicable bans!
Post by: MegaByte on February 16, 2008, 09:04:49 AM