Simple linkex exploit. BEWARE. - GoFuckYourself.com

fluffygrrl · 08-26-2007, 07:58 AM

Find someone using linkex, note down his url.

Make a simple webpage, containing just one link to his url.

Open his linkex, enter the url of the webpage you made, and for an anchor, try

Code:

<?php echo 'hi'; ?>

Check out his links, especially if he auto-adds stuff.

You can take it from there, I guess, I'm not going to publish working exploits. The linkex people need to fix their script, I would have provided a fix but not for such bullshit code without indentation.

Right now, running linkex = running a rootkit. Beware.

Basic_man · 08-26-2007, 08:00 AM

Why posting it in public? Dumpass.. Email the owner!

fluffygrrl · 08-26-2007, 08:03 AM

I would have, had he had the courtesy of releasing his source in some sort of readable format.

Intricate · 08-26-2007, 08:06 AM

Are you kidding me, why would you post this here where there are so many known spammers/scammers around?

I hope a mod removes this...

4Pics · 08-26-2007, 08:59 AM

why not post the fix?

It isn't the people who run the scripts fault for the exploit.

jeez

geeknik · 08-26-2007, 09:03 AM

Why oh why does GFY always attract the biggest morons?

ridikuloz · 08-26-2007, 09:04 AM

it's hax0ring time!

teg0 · 08-26-2007, 09:11 AM

The normal order of events is that you inform the developer. Give them at least a month to fix it, and if they don't then you can post the a notice bout the exploit. Public disclosure gets the developers off their ass and makes everyone away to either secure their shit or remove it.

If you're running linkex right now just log in and go to settings and disable the public form for now.

fluffygrrl · 08-26-2007, 09:24 AM

Quote:

Originally Posted by teg0

The normal order of events is that you inform the developer. Give them at least a month to fix it, and if they don't then you can post the a notice bout the exploit. Public disclosure gets the developers off their ass and makes everyone away to either secure their shit or remove it.

If you're running linkex right now just log in and go to settings and disable the public form for now.

What he said. Get snapping.

teg0 · 08-26-2007, 09:27 AM

lol after reading my post i realized that I needed a coffee.

Lycanthrope · 08-26-2007, 09:28 AM

I notified the developer and sent him a link to this thread (he is not online at the moment).

I did not try what you posted, but I'll take your word on it. For now, everyone should just set their permissions on /linkex/index.php to 0.

fluffygrrl · 08-26-2007, 09:36 AM

You can easily try it on your own site. echo 'hi'; as posted is obviously safe.

Vick! · 08-26-2007, 11:29 AM

wtf? I am not impressed with your programming expertise. You could have emailed the owner instead of posting details here. If you still wanted to show how cool you are at catching exploits, just tell that you found a bug and want the owner to contact you for details.

teg0 · 08-26-2007, 11:31 AM

someone could just easily do a php header redirect, if their url was short enough. Definitely a problem that needs to be fixed.

SmokeyTheBear · 08-26-2007, 11:43 AM

thanks for the heads up..

i'm on the fence about people reporting exploits this way ..

i do believe its nice to inform the script owners first but i have to disagree with others about not reporting it on gfy..

gfy is often the quickest way to solve these kinds of problems..

exploits such as this are often slow to be fixed ( or ignored ) by the owners if left entirely up to them, a push is helpfull.

fluffygrrl · 08-26-2007, 11:48 AM

Again. I would have emailed the guy a fix. EXCEPT, have you looked at his code ? There is not a single line feed or tab in there. I mean, okay, so he doesn't comment his code as he should on anything publicly released. Fine. But take out the line feeds ? That in my book is douchebaggery.

cykoe6 · 08-26-2007, 11:54 AM

Quote:

Originally Posted by teg0

If you're running linkex right now just log in and go to settings and disable the public form for now.

I just did that for all my sites. Does that mean they should be safe now or do I need to do something else?

fluffygrrl · 08-26-2007, 11:59 AM

If you've disabled the public form (ie people can't type in anchors that you include anymore) you should be safe.

May be worth your time to go through the 1001 or whatever the file you include is called and make sure there's nothing but url's and plain text in there. anything between <? and ?> is evil. anything reading "text/javascript" is also evil.

crockett · 08-26-2007, 12:16 PM

Quote:

Originally Posted by Basic_man

Why posting it in public? Dumpass.. Email the owner!

Why do most people publish the exploits they find? Why because it allows users to know it there and also forces the authors to fix their shit.

Making exploits public knowledge is a common practice..

hungry hungry hippy · 08-26-2007, 01:00 PM

so kind of you to post this as there are 18,700 sites using it ....

it's common to go public with exploits, AFTER you have notified the company and given them time to fix it.

polle54 · 08-26-2007, 01:10 PM

Narcissistic jerk

glad no one is giving you credit

Libertine · 08-26-2007, 01:13 PM

Quote:

Originally Posted by SmokeyTheBear

thanks for the heads up..

i'm on the fence about people reporting exploits this way ..

i do believe its nice to inform the script owners first but i have to disagree with others about not reporting it on gfy..

gfy is often the quickest way to solve these kinds of problems..

exploits such as this are often slow to be fixed ( or ignored ) by the owners if left entirely up to them, a push is helpfull.

I'm on the fence, too.

On one side, GFY is quicker than emailing them, plus it probably reaches more users than an upgrade of their script would (hell, I'm pretty sure that months from now, most users will still use the exploitable version).

On the other side, this ensures that within a week, hundreds if not thousands of sites will be exploited.

Then, on yet another side... anyone who uses that crappy script kinda deserves whatever happens. Linkex is a complete piece of shit, and always has been.

ZCurve · 08-26-2007, 01:26 PM

I am a newbie and I am not a programmer. So could you please explian to me in simple english what does the exploite do...how does it harm/hurt my site?

polle54 · 08-26-2007, 01:29 PM

Quote:

Originally Posted by polle54

Narcissistic jerk

glad no one is giving you credit

It is good to know that there is a exploit but you write down how to use it..... it's really not nice here on gfy.

fluffygrrl · 08-26-2007, 01:33 PM

Quote:

Originally Posted by polle54

Narcissistic jerk

glad no one is giving you credit

Listen blockhead. You need to comprehend a few points.

1. I don't owe you, or any dude running some script, or any dude putting up scripts for download, jack shit. The day you, or those other dudes have me on their payroll, you can raise this point again. Till then, chuck it.

1.1. I might, might mind you, out of the kindness of my heart, and because I'm such a nice fellow, given the author of the shoddy script a fix, provided he wasn't the sort of douchebag that deliberately makes his "code" hard to read. Call this a lesson in the theory of "karma's a bitch", maybe next time he releases code, he follows standards.

2. Responsibility for computer code at all times remains with the USER of such code. If you install and run some script you haven't completely read and understood, heck. Your bubblings to the contrary are really akin to the idiots wanting me to keep their children off the "dangerous internet". The internet is for grown-ups. Grown-ups are those people who understand where responsibility lies. Letting children, and you, run amok on the internet is fine, as far as I'm concerned, but their safety is not my problem.

3. Information belongs out in the open. That Bush, Cheney, and you think it's best to try and restrict the flow of information is exactly your problem, much like the belief in a flat earth and an omnipotent benevolent god is the believer's problem. If some women get butchered in China or if some shitty script has a hole in it, the public has a right to know, and you don't have a right to have an oppinon on the matter.

Bloody hell.

woj · 08-26-2007, 01:33 PM

sucks to be running linkex now, heh... I bet ya at least few blackhatters from here are exploiting it hard now...

ZCurve · 08-26-2007, 01:44 PM

Quote:

Originally Posted by fluffygrrl

Listen blockhead. You need to comprehend a few points.

3. Information belongs out in the open. That Bush, Cheney, and you think it's best to try and restrict the flow of information is exactly your problem, much like the belief in a flat earth and an omnipotent benevolent god is the believer's problem. If some women get butchered in China or if some shitty script has a hole in it, the public has a right to know, and you don't have a right to have an oppinon on the matter.

Bloody hell.

I like fluffygrrl

greg80 · 08-26-2007, 01:57 PM

deamn. How low can you be to steal traffic like that?

cykoe6 · 08-26-2007, 04:01 PM

So the result of the exploit is that someone could redirect your links to their own sites..... or is it something worse than that?

u-Bob · 08-26-2007, 04:17 PM

Quote:

Originally Posted by cykoe6

So the result of the exploit is that someone could redirect your links to their own sites..... or is it something worse than that?

yep... running arbitrary code on your box

Cum&Spam · 08-26-2007, 04:49 PM

Whoever does that in my blogs will not gonna work...
because i check links manually in their sites every now and then hahahahahahah

StarkReality · 08-26-2007, 05:35 PM

Quote:

Originally Posted by ZCurve

I am a newbie and I am not a programmer. So could you please explian to me in simple english what does the exploite do...how does it harm/hurt my site?

It simply means that any code/script can be inserted via the exploit with as many characters in total as the anchor text field allows, and inserting a redirect is certainly one of the less evil things I could imagine.

As for making exploits public: It's often the only way to get things fixed fast, a little public pressure works wonders. It may not be nice, but it's effective.

bl4h · 08-26-2007, 06:21 PM

This is dumb. You should have first given the author the chance to warn people and send out a patch. This isn't about teh script author, you fucked over the webmaster. Nice

v0id · 08-27-2007, 01:37 AM

Hi guys,
I have just released a fix for this exploit.

linkex.dk/forums/t1244-exploit-in-linkex-please-be-aware.html

- v0id

fluffygrrl · 08-27-2007, 01:57 AM

Nice.

Did you stick the spacing back in too ?

cykoe6 · 08-27-2007, 03:39 AM

Quote:

Originally Posted by LinkEX

Hi guys,
I have just released a fix for this exploit.

linkex.dk/forums/t1244-exploit-in-linkex-please-be-aware.html

- v0id

Thanks for fixing that so quickly.

fluffygrrl · 08-27-2007, 03:50 AM

neeevermind.

fluffygrrl · 08-27-2007, 03:55 AM

Actually. The "fix" doesn't fix the problem, from what I can see. Feel free to give it a try yourself, as explained in the original post.

d-null · 08-27-2007, 03:56 AM

most interesting

raven1083 · 08-27-2007, 04:00 AM

thanks for the warning

v0id · 08-27-2007, 04:15 AM

Quote:

Originally Posted by fluffygrrl

Actually. The "fix" doesn't fix the problem, from what I can see. Feel free to give it a try yourself, as explained in the original post.

Not sure what you mean. Can you elaborate?

- v0id

v0id · 08-27-2007, 04:17 AM

Quote:

Originally Posted by fluffygrrl

Actually. The "fix" doesn't fix the problem, from what I can see. Feel free to give it a try yourself, as explained in the original post.

Not sure what you mean. Can you elaborate?
demo.linkex.dk/linkex/data/output/1001

- v0id

fluffygrrl · 08-27-2007, 04:25 AM

Code:

<!-- Output generated by LinkEX (+http://linkex.dk/) -->
<a href="http://lolcunts.org" title="&lt;?php echo'hi'; ?&gt;">&lt;?php echo'hi'; ?&gt;</a><br><br><a href="http://www.teensexvidz.com/" title="Teen Sex Videos">Teen Sex Videos</a><br><br>

does that help ?

cykoe6 · 08-27-2007, 04:32 AM

So has this issue been solved or not.....

GirlsOnYou · 08-27-2007, 04:48 AM

Quote:

Originally Posted by fluffygrrl

Code:

<!-- Output generated by LinkEX (+http://linkex.dk/) -->
<a href="http://lolcunts.org" title="&lt;?php echo'hi'; ?&gt;">&lt;?php echo'hi'; ?&gt;</a><br><br><a href="http://www.teensexvidz.com/" title="Teen Sex Videos">Teen Sex Videos</a><br><br>

does that help ?

You do realize that <?php does nothing whereas <?php does, right?
So that code you just posted cannot be harmful because < is replaced with <.

You might know this and I might have missed the point of your post but I told this just in case.

potter · 08-27-2007, 05:14 AM

Quote:

Originally Posted by fluffygrrl

Listen blockhead. You need to comprehend a few points.

1. I don't owe you, or any dude running some script, or any dude putting up scripts for download, jack shit. The day you, or those other dudes have me on their payroll, you can raise this point again. Till then, chuck it.

1.1. I might, might mind you, out of the kindness of my heart, and because I'm such a nice fellow, given the author of the shoddy script a fix, provided he wasn't the sort of douchebag that deliberately makes his "code" hard to read. Call this a lesson in the theory of "karma's a bitch", maybe next time he releases code, he follows standards.

2. Responsibility for computer code at all times remains with the USER of such code. If you install and run some script you haven't completely read and understood, heck. Your bubblings to the contrary are really akin to the idiots wanting me to keep their children off the "dangerous internet". The internet is for grown-ups. Grown-ups are those people who understand where responsibility lies. Letting children, and you, run amok on the internet is fine, as far as I'm concerned, but their safety is not my problem.

3. Information belongs out in the open. That Bush, Cheney, and you think it's best to try and restrict the flow of information is exactly your problem, much like the belief in a flat earth and an omnipotent benevolent god is the believer's problem. If some women get butchered in China or if some shitty script has a hole in it, the public has a right to know, and you don't have a right to have an oppinon on the matter.

Bloody hell.

That was awesome...

fluffygrrl · 08-27-2007, 05:24 AM

Doh. I was including the wrong file.

So yes, linkex.20070827.tar.gz fixes the hole.

v0id · 08-27-2007, 06:25 AM

so, now everyone have to update their linex!!

KrisKross · 08-27-2007, 06:53 AM

Quote:

Originally Posted by LinkEX

so, now everyone have to update their linex!!

No apologies for shitty code?

teg0 · 08-27-2007, 07:00 AM

Quote:

Originally Posted by KrisKross

No apologies for shitty code?

Windows = shitty code

08-26-2007, 07:58 AM	#1
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	Simple linkex exploit. BEWARE. Find someone using linkex, note down his url. Make a simple webpage, containing just one link to his url. Open his linkex, enter the url of the webpage you made, and for an anchor, try Code: <?php echo 'hi'; ?> Check out his links, especially if he auto-adds stuff. You can take it from there, I guess, I'm not going to publish working exploits. The linkex people need to fix their script, I would have provided a fix but not for such bullshit code without indentation. Right now, running linkex = running a rootkit. Beware.

08-26-2007, 08:00 AM	#2
Basic_man Programming King Pin Industry Role: Join Date: Oct 2003 Location: Montreal Posts: 27,360	Why posting it in public? Dumpass.. Email the owner! __________________ UUGallery Builder - automated photo/video gallery plugin for Wordpress! Stop looking! Checkout Naked Hosting, online since 1999 !

08-26-2007, 08:06 AM	#4
Intricate Confirmed User Join Date: Jun 2007 Location: Quebec City, Quebec Posts: 133	Are you kidding me, why would you post this here where there are so many known spammers/scammers around? I hope a mod removes this... __________________ chesterbanksphp [.at.] gmail.com icq: 350 656 495

08-26-2007, 09:03 AM	#6
geeknik l337 h4x0r!#% Industry Role: Join Date: Feb 2005 Location: OKC, OK, USA Posts: 8,363	Why oh why does GFY always attract the biggest morons? __________________ hacker 4 hire.

08-26-2007, 09:04 AM	#7
ridikuloz Confirmed User Join Date: Jun 2005 Location: ▓NY▓ Posts: 2,080	it's hax0ring time! __________________ Each persons' level of stupidity makes us different.

08-26-2007, 08:03 AM	#3
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	I would have, had he had the courtesy of releasing his source in some sort of readable format.

08-26-2007, 08:59 AM	#5
4Pics Confirmed User Industry Role: Join Date: Dec 2001 Posts: 7,952	why not post the fix? It isn't the people who run the scripts fault for the exploit. jeez

08-26-2007, 09:11 AM	#8
teg0 Confirmed User Join Date: Jan 2006 Location: Gringo in Puerto Rico Posts: 4,197	The normal order of events is that you inform the developer. Give them at least a month to fix it, and if they don't then you can post the a notice bout the exploit. Public disclosure gets the developers off their ass and makes everyone away to either secure their shit or remove it. If you're running linkex right now just log in and go to settings and disable the public form for now. __________________ OV Tube - Tube Script Software

08-26-2007, 09:27 AM	#10
teg0 Confirmed User Join Date: Jan 2006 Location: Gringo in Puerto Rico Posts: 4,197	lol after reading my post i realized that I needed a coffee. __________________ OV Tube - Tube Script Software

08-26-2007, 09:28 AM	#11
Lycanthrope Confirmed User Industry Role: Join Date: Jan 2004 Location: Wisconsin Posts: 4,518	I notified the developer and sent him a link to this thread (he is not online at the moment). I did not try what you posted, but I'll take your word on it. For now, everyone should just set their permissions on /linkex/index.php to 0. __________________

08-26-2007, 09:36 AM	#12
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	You can easily try it on your own site. echo 'hi'; as posted is obviously safe.

08-26-2007, 11:29 AM	#13
Vick! Confirmed User Industry Role: Join Date: Nov 2005 Location: 20 00'24.00" N, 75 09'00.00 W Posts: 6,882	wtf? I am not impressed with your programming expertise. You could have emailed the owner instead of posting details here. If you still wanted to show how cool you are at catching exploits, just tell that you found a bug and want the owner to contact you for details. __________________ Affordable Quality Web Hosting

08-26-2007, 11:31 AM	#14
teg0 Confirmed User Join Date: Jan 2006 Location: Gringo in Puerto Rico Posts: 4,197	someone could just easily do a php header redirect, if their url was short enough. Definitely a problem that needs to be fixed. __________________ OV Tube - Tube Script Software Last edited by teg0; 08-26-2007 at 11:32 AM..

08-26-2007, 11:43 AM	#15
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	thanks for the heads up.. i'm on the fence about people reporting exploits this way .. i do believe its nice to inform the script owners first but i have to disagree with others about not reporting it on gfy.. gfy is often the quickest way to solve these kinds of problems.. exploits such as this are often slow to be fixed ( or ignored ) by the owners if left entirely up to them, a push is helpfull. __________________ hatisblack at yahoo.com

08-26-2007, 11:48 AM	#16
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	Again. I would have emailed the guy a fix. EXCEPT, have you looked at his code ? There is not a single line feed or tab in there. I mean, okay, so he doesn't comment his code as he should on anything publicly released. Fine. But take out the line feeds ? That in my book is douchebaggery.

08-26-2007, 11:59 AM	#18
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	If you've disabled the public form (ie people can't type in anchors that you include anymore) you should be safe. May be worth your time to go through the 1001 or whatever the file you include is called and make sure there's nothing but url's and plain text in there. anything between <? and ?> is evil. anything reading "text/javascript" is also evil.

08-26-2007, 01:00 PM	#20
hungry hungry hippy Confirmed User Join Date: Mar 2007 Posts: 249	so kind of you to post this as there are 18,700 sites using it .... it's common to go public with exploits, AFTER you have notified the company and given them time to fix it.

08-26-2007, 01:10 PM	#21
polle54 Confirmed User Join Date: Jul 2004 Location: The Beach Posts: 4,626	Narcissistic jerk glad no one is giving you credit __________________ ICQ# 143561781

08-26-2007, 01:26 PM	#23
ZCurve Confirmed User Join Date: Jul 2007 Posts: 113	I am a newbie and I am not a programmer. So could you please explian to me in simple english what does the exploite do...how does it harm/hurt my site? __________________ Care to exchange hard links? email me: webmaster at teensweek dot com

08-26-2007, 01:33 PM	#26
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,883	sucks to be running linkex now, heh... I bet ya at least few blackhatters from here are exploiting it hard now... __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

08-26-2007, 01:57 PM	#28
greg80 Confirmed User Industry Role: Join Date: May 2007 Posts: 1,644	deamn. How low can you be to steal traffic like that?

08-26-2007, 04:01 PM	#29
cykoe6 Confirmed User Industry Role: Join Date: Apr 2005 Location: Vegas Posts: 4,499	So the result of the exploit is that someone could redirect your links to their own sites..... or is it something worse than that? __________________ бабки, шлюхи, сила

08-26-2007, 04:49 PM	#31
Cum&Spam Confirmed User Join Date: Mar 2007 Posts: 913	Whoever does that in my blogs will not gonna work... because i check links manually in their sites every now and then hahahahahahah

08-26-2007, 06:21 PM	#33
bl4h Confirmed User Join Date: Jul 2006 Location: Philadelphia Posts: 1,282	This is dumb. You should have first given the author the chance to warn people and send out a patch. This isn't about teh script author, you fucked over the webmaster. Nice

08-27-2007, 01:37 AM	#34
v0id Confirmed User Industry Role: Join Date: Sep 2006 Posts: 43	Hi guys, I have just released a fix for this exploit. linkex.dk/forums/t1244-exploit-in-linkex-please-be-aware.html - v0id

08-27-2007, 01:57 AM	#35
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	Nice. Did you stick the spacing back in too ?

08-27-2007, 03:50 AM	#37
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	neeevermind. Last edited by fluffygrrl; 08-27-2007 at 03:53 AM..

08-27-2007, 03:55 AM	#38
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	Actually. The "fix" doesn't fix the problem, from what I can see. Feel free to give it a try yourself, as explained in the original post.

08-27-2007, 03:56 AM	#39
d-null . . . Industry Role: Join Date: Apr 2007 Location: NY Posts: 13,724	most interesting __________________ __________________ Looking for a custom TUBE SCRIPT that supports massive traffic, load balancing, billing support, and h264 encoding? Hit up Konrad! Looking for designs for your websites or custom tubesite design? Hit up Zuzana Designs Check out the #1 WordPress SEO Plugin: CyberSEO Suite

08-27-2007, 04:00 AM	#40
raven1083 Confirmed User Join Date: Jul 2007 Posts: 7,687	thanks for the warning __________________ Femdom Stories \| Bound BBW Blog and Videos \|Bondage Sex Videos and Pictures Hardcore Japanese Bondage \| BDSM Movies And Galleries Mistress Cuckold CBT

08-27-2007, 04:32 AM	#44
cykoe6 Confirmed User Industry Role: Join Date: Apr 2005 Location: Vegas Posts: 4,499	So has this issue been solved or not..... __________________ бабки, шлюхи, сила

08-27-2007, 05:24 AM	#47
fluffygrrl So Fucking Banned Join Date: May 2006 Posts: 2,187	Doh. I was including the wrong file. So yes, linkex.20070827.tar.gz fixes the hole.

08-27-2007, 06:25 AM	#48
v0id Confirmed User Industry Role: Join Date: Sep 2006 Posts: 43	so, now everyone have to update their linex!!