Hostbill Source Code Released and 0-Day Exploits Found

[drmike]

Looks like the folks attacking SolusVM have added WHMCS and now Hostbill to their active radar.

-----------------------------------

HOSTBILL SOURCE CODE: https://mega.co.nz/#!xIEnDLKb!FQQ76xpWCDxOCa6PMO3HN0g0i0p6xeJfbLuuW1jSnZw

Exploits spotted: 6
Exploits patched: 0

 

[maounique]

Good, lets see who is dealing with the problem and who is running their PR to damage control only.

 

[Wintereise]

This is basically,

Step 1: Get a copy of the src floating on the net, or use a shitty decoder (which fails miserably, as demonstrated on the WHMCS screenshot)

Step 2: State there are echo mt_rand(5, 50); number of flaws on the product.

Step 3: See everyone lose their minds.

 

[Tux]

Looks like we didn't need that $9990 for a 0-day, right?

 

[Francisco]

Looks like the folks attacking SolusVM have added WHMCS and now Hostbill to their active radar.

-----------------------------------

HOSTBILL SOURCE CODE: https://mega.co.nz/#!xIEnDLKb!FQQ76xpWCDxOCa6PMO3HN0g0i0p6xeJfbLuuW1jSnZw

Exploits spotted: 6

Exploits patched: 0

Only the index file is decoded, the rest are still cubed.

Francisco

 

[concerto49]

This is basically,

Step 1: Get a copy of the src floating on the net, or use a shitty decoder (which fails miserably, as demonstrated on the WHMCS screenshot)

Step 2: State there are echo mt_rand(5, 50); number of flaws on the product.

Step 3: See everyone lose their minds.

http://www.lowendbox.com/blog/a-days-recap-solusvm-exploit-released-ramnode-downtime-and-robert-clarke/#comment-121122

You again!

 

[Wintereise]

http://www.lowendbox.com/blog/a-days-recap-solusvm-exploit-released-ramnode-downtime-and-robert-clarke/#comment-121122

You again!

Hush :x

 

[netnub]

Only the index file is decoded, the rest are still cubed.


Francisco

it appears so, but admin directory is decoded.

 

[Francisco]

it appears so, but admin directory is decoded.

The majority is still compiled though. What is decompiled isn't even source you can throw in and go 'tada!' since

the source is all over the place. There's more than a few spots where you'll see

Exception
new ( )
throw('.......');

Francisco

 

[hook]

unzend.com/#ready

 

[Echelon]

Is there any proof that such a service even works?