possible NATS exploit? - GoFuckYourself.com

gooddomains · 07-08-2006, 03:05 AM

Can anyone confirm or deny this information?

http://www.gofuckyourself.com/showthread.php?t=630815

IceMaster · 07-08-2006, 03:07 AM

I guess that the script connects to a nats site and sponsors get it down for too many requests.

darksoul · 07-08-2006, 03:08 AM

lol, you're so clueless.

themanager · 07-08-2006, 03:08 AM

I have n o idea.

gooddomains · 07-08-2006, 03:08 AM

Sounds more like a more serious problem at first sight

darksoul · 07-08-2006, 03:08 AM

Quote:

Originally Posted by IceMaster

I guess that the script connects to a nats site and sponsors get it down for too many requests.

neh, the database on that server its fucked up.
nothing directly related to nats.

gooddomains · 07-08-2006, 03:09 AM

What about the other programs that also do not seem to work ?

IceMaster · 07-08-2006, 03:10 AM

Anyway its getting popular so everybody will start finding bugs for it soon.

gooddomains · 07-08-2006, 03:11 AM

Quote:

Originally Posted by IceMaster

Anyway its getting popular so everybody will start finding bugs for it soon.

Do you have any more inside knowledge than the rest of us ?

IceMaster · 07-08-2006, 03:12 AM

Quote:

Originally Posted by gooddomains

Do you have any more inside knowledge than the rest of us ?

No, but happens with everything... phpbb... vbulletin... windows...

gooddomains · 07-08-2006, 03:13 AM

Quote:

Originally Posted by IceMaster

No, but happens with everything... phpbb... vbulletin... windows...

oh well, seems hackers are everywhere

Kimo · 07-08-2006, 03:14 AM

is this for real?

gooddomains · 07-08-2006, 03:17 AM

Quote:

Originally Posted by Kimo

is this for real?

Read the other thread

tenderobject · 07-08-2006, 03:20 AM

some nats programs are ok

studiocritic · 07-08-2006, 03:20 AM

Quote:

Originally Posted by IceMaster

No, but happens with everything... phpbb... vbulletin... windows...

NATS isn't open source.. security through obscurity.

There are Zend decoders now, though.

darksoul · 07-08-2006, 03:23 AM

Quote:

Originally Posted by studiocritic

NATS isn't open source.. security through obscurity.

nor is vbulletin or windows

IceMaster · 07-08-2006, 03:23 AM

Quote:

Originally Posted by studiocritic

NATS isn't open source.. security through obscurity.

There are Zend decoders now, though.

I was talking about the posibility, i dont really know how Nats works or what they offer.

gooddomains · 07-08-2006, 03:32 AM

Quote:

Originally Posted by studiocritic

NATS isn't open source.. security through obscurity.

There are Zend decoders now, though.

What has Zend to do with this ?

gooddomains · 07-08-2006, 03:33 AM

Quote:

Originally Posted by tenderobject

some nats programs are ok

ok, so it seems only some programs are having problems. Could this be related to a certain version or is it may be a mysql problem ?

Pimpin_J · 07-08-2006, 03:43 AM

Just a matter of time i think.. all adult-cms had/have bugs..

mpa,sitdepth and so on

gooddomains · 07-08-2006, 03:48 AM

Quote:

Originally Posted by Pimpin_J

Just a matter of time i think.. all adult-cms had/have bugs..

mpa,sitdepth and so on

Has any of them exposed already ?

Pimpin_J · 07-08-2006, 03:54 AM

There wasnt a public advisory as far as i know but i said it here allready http://www.gofuckyourself.com/showthread.php?t=629368

gooddomains · 07-08-2006, 04:07 AM

Thx for the info

Nathan · 07-08-2006, 05:47 AM

This is not a NATS bug, its neither a NATS exploit.

People that do not understand errors should not throw around words like "exploit"... what other programs do not work right now? I only know of this one problem with panchodog.

The error with panchodog is a mysql problem, not a NATS problem. Just because NATS is so nice and actually produces intelligent error displays for the client does not mean its a damn NATS problem or exploit!

stickyfingerz · 07-08-2006, 05:54 AM

Quote:

Originally Posted by Nathan

This is not a NATS bug, its neither a NATS exploit.

People that do not understand errors should not throw around words like "exploit"... what other programs do not work right now? I only know of this one problem with panchodog.

The error with panchodog is a mysql problem, not a NATS problem. Just because NATS is so nice and actually produces intelligent error displays for the client does not mean its a damn NATS problem or exploit!

This is what I was thinking also. lol This whole thread is da silly. Dumbest thread of the day?

darksoul · 07-08-2006, 05:54 AM

Quote:

Originally Posted by Nathan

Just because NATS is so nice and actually produces intelligent error displays for the client does not mean its a damn NATS problem or exploit!

http://affiliates.panchodog.com/signup.php?nats=

Quote:

NATS has found a problem

DB Error: Can't open file: 'accounts.MYI'. (errno: 145)

/usr/home/natsinstall/nats/includes/database.php:430

I wouldn't consider this an intelligent error

Nathan · 07-08-2006, 05:57 AM

Quote:

Originally Posted by darksoul

http://affiliates.panchodog.com/signup.php?nats=

I wouldn't consider this an intelligent error

Lol.. ok, if ya say so...

What would be intelligent?

"Sorry, but there is a problem, please come back later."???

So the client has to sit there and figure out for hours what the issue actually is?

The page tells you EXACTLY what the problem is, thats the whole point of an error. Just because YOU do not understand it does not mean its not a correct error.

darksoul · 07-08-2006, 06:00 AM

Quote:

Originally Posted by Nathan

Lol.. ok, if ya say so...

What would be intelligent?

"Sorry, but there is a problem, please come back later."???

So the client has to sit there and figure out for hours what the issue actually is?

The page tells you EXACTLY what the problem is, thats the whole point of an error. Just because YOU do not understand it does not mean its not a correct error.

haha
listen, now you got me mad,
you're a fucking idiot, I know better than you what that means
You shouldn't disclose informations to the public moron
A message like
"A mysql error was found" would've been more intelligent
than telling all the world where nats is installed so it can be abused
when a bug is found.

That shit is called "path disclosure" look it up genius.

Also, You don't have to display errors on the site for YOUR customer to
see it. Those can be logged separately.

darksoul · 07-08-2006, 06:07 AM

Your error just told me:
the panchodog server is running freebsd
theres a table called accounts in nats
nats is installed in /usr/home/natsinstall
panchodog is running version 3.0.29

Quote:

3. nats_error_handler(256, DB Error: Can't open file: 'accounts.MYI'. (errno: 145), /usr/home/natsinstall/nats/includes/database.php, 430, Array) in :
2. trigger_error(DB Error: Can't open file: 'accounts.MYI'. (errno: 145), 256) in /usr/home/natsinstall/nats/includes/database.php:430
1. nats_db_fetch_assoc() in /usr/home/natsinstall/nats/www/signup.php:45

- this appear to be wrappers around pear functions.

DO YOU REALLY NEED TO GIVE THAT INFO TO THE PUBLIC
YOU are so fucking intelligent and so are your errors

darksoul · 07-08-2006, 06:09 AM

I advice you to not fucking reply to this thread anymore!

Nathan · 07-08-2006, 06:13 AM

Sorry I made you mad, lol...

oppinions, oppinions.. everyone and their mother has one...

We create the errors in this way so the clients notice them, we know our clients... The location disclosure of NATS itself is also no problem because in now-a-days exploits the path can be retreived anyway, its not so hard ya know, people that use exploits will find it fast anyway (in case they even NEED it, which is not even the case)... There is a reason why not even apache has a problem with disclosing full paths to websites, nor does PHP on standard php errors...

We tried many different error displays in the past, we also had it turned off totally for some time and only did logging, we had too many clients get problems because of it and this way simply fixes things faster (98% of the time)...

The errors do not disclose information that could not be retreived in many other ways if you want to exploit someone...

Nathan · 07-08-2006, 06:15 AM

Quote:

Originally Posted by darksoul

I advice you to not fucking reply to this thread anymore!

LOL... you threatening me somehow or what? Chill man, its just an error.. and we have reasons for a backtrace, I'm so sorry that you disagree with how we do things.... live with it...

jimthefiend · 07-08-2006, 06:19 AM

Quote:

Originally Posted by darksoul

Your error just told me:
the panchodog server is running freebsd
theres a table called accounts in nats
nats is installed in /usr/home/natsinstall
panchodog is running version 3.0.29
3. nats_error_handler(256, DB Error: Can't open file: 'accounts.MYI'. (errno: 145), /usr/home/natsinstall/nats/includes/database.php, 430, Array) in :
2. trigger_error(DB Error: Can't open file: 'accounts.MYI'. (errno: 145), 256) in /usr/home/natsinstall/nats/includes/database.php:430
1. nats_db_fetch_assoc() in /usr/home/natsinstall/nats/www/signup.php:45

Dude, that's not exactly difficult to figure out, even without an error message.

darksoul · 07-08-2006, 06:21 AM

I see you ignored my advice.

Quote:

Originally Posted by Nathan

We create the errors in this way so the clients notice them, we know our clients...

You just called your clients idiots, good job! You probably know that for a fact cause they chose you!

Quote:

The location disclosure of NATS itself is also no problem because in now-a-days exploits the path can be retreived anyway, its not so hard ya know, people that use exploits will find it fast anyway (in case they even NEED it, which is not even the case)... There is a reason why not even apache has a problem with disclosing full paths to websites, nor does PHP on standard php errors...

We tried many different error displays in the past, we also had it turned off totally for some time and only did logging, we had too many clients get problems because of it and this way simply fixes things faster (98% of the time)...

The errors do not disclose information that could not be retreived in many other ways if you want to exploit someone...

dude, look at all the data I fetched from a simple error
I don't want to think how much shit can be fetched from your script.

You are supposed to take security seriously and not this fuck it attitude.
Just because it can happen in other ways doesn't mean your script has
to allow it.

darksoul · 07-08-2006, 06:25 AM

Quote:

Originally Posted by jimthefiend

Dude, that's not exactly difficult to figure out, even without an error message.

and you'd know how ?
I'll give you one day to show me that data without using nats.
if not you'll have to build 100 galleries for epictrash

darksoul · 07-08-2006, 06:26 AM

Quote:

Originally Posted by Nathan

LOL... you threatening me somehow or what? Chill man, its just an error.. and we have reasons for a backtrace, I'm so sorry that you disagree with how we do things.... live with it...

the advice was so that you don't get me even more mad and show more about what pos your script is.

Nathan · 07-08-2006, 06:29 AM

I did not call our clients idiots, far from it.. all I said is that we know our clients well, and we know what they want and ask from us ;)

The errors are created like this for a reason, I told you that plenty of times, if you do not understand or agree, thats not my problem, its yours...

The information disclosed in no way is a problem, it only helps us and the client, and thats what it is there for...

BTW, I just looked at axscripts.com, a friendly advice... you might want to reconsider posting here...

Nathan · 07-08-2006, 06:31 AM

Quote:

Originally Posted by darksoul

the advice was so that you don't get me even more mad and show more about what pos your script is.

Again, sorry that I made you mad... kinda sad how easy it is to get you mad though...

And hey, if you know of bugs in NATS (guessing that is what you mean by "what pos your script is"), please do tell! I'd love to know them so we can fix them (in case we have not already in our latest version)

jimthefiend · 07-08-2006, 06:31 AM

Quote:

Originally Posted by darksoul

and you'd know how ?
I'll give you one day to show me that data without using nats.
if not you'll have to build 100 galleries for epictrash

Because I have a working knowledge of php and sql. Considering what you do, I'm shocked as hell you're making such a big deal out of this. Every fucking script I know of displays at least SOME path info in error messages when there are DB issues. There are also 50 million ways to find that info out even without an error.

Your motivations in this are more than a little suspect.

You don't dictate ANYTHING to me, btw.

MaddCaz · 07-08-2006, 06:31 AM

random bump

jimthefiend · 07-08-2006, 06:35 AM

PS, on that lame little support forum for that shitty little trade script you have, there are several posts discussing errors of a similiar nature, AND displaying similiar information. IE. paths, etc.

Does that mean that POS you spam has an exploit?

LMA0

darksoul · 07-08-2006, 06:35 AM

Quote:

Originally Posted by Nathan

Again, sorry that I made you mad... kinda sad how easy it is to get you mad though...

Fact is I prepared a bunch of servers for nats and I know how clueless you are
about servers and when you tell me I dont understand a mysql error yea it gets me mad

Quote:

(in case we have not already in our latest version)

you are so cocky!
but thanks, I've wasted enough time on it.

darksoul · 07-08-2006, 06:37 AM

Quote:

Originally Posted by jimthefiend

Because I have a working knowledge of php and sql. Considering what you do, I'm shocked as hell you're making such a big deal out of this. Every fucking script I know of displays at least SOME path info in error messages when there are DB issues. There are also 50 million ways to find that info out even without an error.

Your motivations in this are more than a little suspect.

You don't dictate ANYTHING to me, btw.

Dude! I didn't said no script has them.
It just give too much information and I don't call that an "intelligent error"

darksoul · 07-08-2006, 06:39 AM

Quote:

Originally Posted by jimthefiend

PS, on that lame little support forum for that shitty little trade script you have, there are several posts discussing errors of a similiar nature, AND displaying similiar information. IE. paths, etc.

Does that mean that POS you spam has an exploit?

LMA0

yup, it has a shit load of bugs.
I coded it in two hours but it wont give away any substantial info if lets say it would be hacked.
Can nats say the same if someone hack them ?

Nathan · 07-08-2006, 06:40 AM

Quote:

Originally Posted by darksoul

Fact is I prepared a bunch of servers for nats and I know how clueless you are
about servers and when you tell me I dont understand a mysql error yea it gets me mad

you are so cocky!
but thanks, I've wasted enough time on it.

LOL, you are funny... I'm curious how _I_ am "clueless" about servers.. not sure how you base this on the fact that you prepared servers for nats before, but thats ok... I'd like to know what you think makes us (as in Too Much Media, yes, this is not a one-man-show, we actually have an office and employees and such) "clueless" about servers... I'm seriously interested in that btw, I like to learn...

and I'm not cocky, I'm just good at what I do.. well.. and I'm german, so my english might not be perfect...

jimthefiend · 07-08-2006, 06:41 AM

Quote:

Originally Posted by darksoul

Dude! I didn't said no script has them.
It just give too much information and I don't call that an "intelligent error"

Dude, seriously. How is it NOT intelligent?

NATS has found a problem

DB Error: Can't open file: 'accounts.MYI'. (errno: 145)

/usr/home/natsinstall/nats/includes/database.php:430

That gives you the db name, error code, file thats making the call and on what LINE of code the call is being made from.

I just don't get you. lol

I don't see how that could be more clear.

Nathan · 07-08-2006, 06:43 AM

Quote:

Originally Posted by darksoul

yup, it has a shit load of bugs.
I coded it in two hours but it wont give away any substantial info if lets say it would be hacked.
Can nats say the same if someone hack them ?

Dude, you give away quite a bit of substantial info, its called SOURCE CODE and its available for the whole damn script of yours...

darksoul · 07-08-2006, 06:48 AM

Quote:

Originally Posted by Nathan

LOL, you are funny... I'm curious how _I_ am "clueless" about servers.. not sure how you base this on the fact that you prepared servers for nats before, but thats ok... I'd like to know what you think makes us (as in Too Much Media, yes, this is not a one-man-show, we actually have an office and employees and such) "clueless" about servers... I'm seriously interested in that btw, I like to learn...

and I'm not cocky, I'm just good at what I do.. well.. and I'm german, so my english might not be perfect...

If you are so good at what you do , do you know how "least privileges" principle
works ?
And if yes, why don't you apply it ?
Why nats gives access to the entire database to the user thats supposed
to fetch only user and passwords ?

(and I have nothing with too much media, this is between you and me cause you started the shit not your company)

darksoul · 07-08-2006, 06:49 AM

Quote:

Originally Posted by Nathan

Dude, you give away quite a bit of substantial info, its called SOURCE CODE and its available for the whole damn script of yours...

its called open source, lol
I dont need to hide my code behind encoders

Nathan · 07-08-2006, 06:54 AM

Quote:

Originally Posted by darksoul

If you are so good at what you do , do you know how "least privileges" principle
works ?
And if yes, why don't you apply it ?
Why nats gives access to the entire database to the user thats supposed
to fetch only user and passwords ?

(and I have nothing with too much media, this is between you and me cause you started the shit not your company)

Yeah, I do.. emm.. and we do not dictate what our clients use in terms of database privileges.. btw, if you think "least privileges" principle is so great, WHY THE FUCK do you tell your axscripts clients to set fucking templates and templates_c to mode 777?!? how is that LEAST PRIVILEGES?!

Seriously, people in a glass house should not throw with stones, you are looking stupid here.

Also, NATS has no single user that only fetches user and password... if you mean SPARTA setups with NATS, we actually tell our clients specifically which tables we need select and which we need update/insert privileges on...

07-08-2006, 03:05 AM	#1
gooddomains Too lazy to set a custom title Join Date: Jul 2003 Location: Netherlands Posts: 10,127	possible NATS exploit? Can anyone confirm or deny this information? http://www.gofuckyourself.com/showthread.php?t=630815

07-08-2006, 03:08 AM	#3
darksoul Confirmed User Join Date: Apr 2002 Location: /root/ Posts: 4,997	lol, you're so clueless. __________________ 1337 5y54\|)m1n: 157717888 BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN Cambooth

07-08-2006, 03:14 AM	#12
Kimo ... Join Date: Jan 2006 Location: Maryland ICQ:87038677 Posts: 11,542	is this for real? __________________ ...

07-08-2006, 03:20 AM	#14
tenderobject Need Designs? 312352846 Industry Role: Join Date: Dec 2004 Location: Somewhere Posts: 11,687	some nats programs are ok __________________ NEED DESIGNS?!?

07-08-2006, 03:43 AM	#20
Pimpin_J Confirmed User Join Date: Jul 2006 Location: SplitInfinity.com Posts: 3,637	Just a matter of time i think.. all adult-cms had/have bugs.. mpa,sitdepth and so on __________________

07-08-2006, 03:07 AM	#2
IceMaster Confirmed User Join Date: Jan 2005 Posts: 8,920	I guess that the script connects to a nats site and sponsors get it down for too many requests.

07-08-2006, 03:08 AM	#4
themanager Confirmed User Join Date: Apr 2006 Location: usa Posts: 508	I have n o idea.

07-08-2006, 03:09 AM	#7
gooddomains Too lazy to set a custom title Join Date: Jul 2003 Location: Netherlands Posts: 10,127	What about the other programs that also do not seem to work ?

07-08-2006, 03:10 AM	#8
IceMaster Confirmed User Join Date: Jan 2005 Posts: 8,920	Anyway its getting popular so everybody will start finding bugs for it soon.

07-08-2006, 03:54 AM	#22
Pimpin_J Confirmed User Join Date: Jul 2006 Location: SplitInfinity.com Posts: 3,637	There wasnt a public advisory as far as i know but i said it here allready http://www.gofuckyourself.com/showthread.php?t=629368 __________________

07-08-2006, 04:07 AM	#23
gooddomains Too lazy to set a custom title Join Date: Jul 2003 Location: Netherlands Posts: 10,127	Thx for the info

07-08-2006, 05:47 AM	#24
Nathan Confirmed User Industry Role: Join Date: Jul 2003 Posts: 3,108	This is not a NATS bug, its neither a NATS exploit. People that do not understand errors should not throw around words like "exploit"... what other programs do not work right now? I only know of this one problem with panchodog. The error with panchodog is a mysql problem, not a NATS problem. Just because NATS is so nice and actually produces intelligent error displays for the client does not mean its a damn NATS problem or exploit! __________________ "Think about it a little more and you'll agree with me, because you're smart and I'm right." - Charlie Munger

07-08-2006, 06:09 AM	#30
darksoul Confirmed User Join Date: Apr 2002 Location: /root/ Posts: 4,997	I advice you to not fucking reply to this thread anymore! __________________ 1337 5y54\|)m1n: 157717888 BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN Cambooth

07-08-2006, 06:13 AM	#31
Nathan Confirmed User Industry Role: Join Date: Jul 2003 Posts: 3,108	Sorry I made you mad, lol... oppinions, oppinions.. everyone and their mother has one... We create the errors in this way so the clients notice them, we know our clients... The location disclosure of NATS itself is also no problem because in now-a-days exploits the path can be retreived anyway, its not so hard ya know, people that use exploits will find it fast anyway (in case they even NEED it, which is not even the case)... There is a reason why not even apache has a problem with disclosing full paths to websites, nor does PHP on standard php errors... We tried many different error displays in the past, we also had it turned off totally for some time and only did logging, we had too many clients get problems because of it and this way simply fixes things faster (98% of the time)... The errors do not disclose information that could not be retreived in many other ways if you want to exploit someone... __________________ "Think about it a little more and you'll agree with me, because you're smart and I'm right." - Charlie Munger

07-08-2006, 06:29 AM	#37
Nathan Confirmed User Industry Role: Join Date: Jul 2003 Posts: 3,108	I did not call our clients idiots, far from it.. all I said is that we know our clients well, and we know what they want and ask from us ;) The errors are created like this for a reason, I told you that plenty of times, if you do not understand or agree, thats not my problem, its yours... The information disclosed in no way is a problem, it only helps us and the client, and thats what it is there for... BTW, I just looked at axscripts.com, a friendly advice... you might want to reconsider posting here... __________________ "Think about it a little more and you'll agree with me, because you're smart and I'm right." - Charlie Munger

07-08-2006, 06:31 AM	#40
MaddCaz Confirmed User Join Date: Mar 2006 Location: Illinois Posts: 9,483	random bump __________________ BigCocks.com - MatureWomen.com - Tranny.com - DrunkGirls.com - TeenGirls.com - MonsterCock.com and many more... Click here to see them all!

07-08-2006, 06:35 AM	#41
jimthefiend So Fucking Banned Join Date: Oct 2003 Location: icq: 121189 Posts: 18,889	PS, on that lame little support forum for that shitty little trade script you have, there are several posts discussing errors of a similiar nature, AND displaying similiar information. IE. paths, etc. Does that mean that POS you spam has an exploit? LMA0