TeamSpeak 3 RFI RCE Directory Traversal vulnerability / exploit

Phyx

Phyx

Member
Oct 21, 2015
33
27
53
You don't even know that %00 is a null character that cuts off the %00 and .jpg, it basically truncates everything in the file name after ".bat" --- for example:
whatever.bat%00.jpg
would turn into:
whatever.bat

Why do you keep trying so hard to prove that Scurippio did something? You act like his cheerleader, are you his mom or are you indeed Scurippio? :D

Bodiga, we already know you are Scurippio and are here to troll. One important thing though. I just came to work over 6 hours ago and you have made it fly by for me. Just like that I have made $$, so thanks for making my time at work seem quick. No one gives a shit what you think you can do, how cool you think you are. You are a pathetic skid trying to build street cred online to be a cool kid. :(
 
Last edited:
JayJax

JayJax

Active Member
Apr 28, 2015
204
109
88
Phyx said:
You don't even know that %00 is a null character that cuts off the %00 and .jpg, it basically truncates everything in the file name after ".bat" --- for example:
whatever.bat%00.jpg
would turn into:
whatever.bat

Why do you keep trying so hard to prove that Scurippio did something? You act like his cheerleader, are you his mom or are you indeed Scurippio? :D

Bodiga, we already know you are Scurippio and are here to troll. One important thing though. I just came to work over 6 hours ago and you have made it fly by for me. Just like that I have made $$, so thanks for making my time at work seem quick. No one gives a shit what you think you can do, how cool you think you are. You are a pathetic skid trying to build street cred online to be a cool kid. :(
Click to expand...
Hes just some noob while i helped a few people out to make it work and they got it to work after i helped them, but its just that i dont want to help people continuously.
But i bet hes just some attention whore like most of them just make a new page, name it wall of shame, and throw his name in their and that scurippio and details what he had done.
Then i can stare at it for a long time and laugh at them twice with my actual mouth and within my brain just to make myself happy.
 
JayJax

JayJax

Active Member
Apr 28, 2015
204
109
88
Bodiga said:
Think what you want, i really don't care :)

CHANNEL DESCRIPTION != USER'S AVATAR

USER'S AVATAR = patched on 3.0.18.1
CHANNEL DESCRIPTION (pwnSpeak scurippio's exploit) = patched on 3.0.18.2

Stop spread false information noob lamer.
Click to expand...

.... Not sure if your brain dead or just blind?
 
JayJax

JayJax

Active Member
Apr 28, 2015
204
109
88
Bodiga said:
but the urlencoding is applied on the path not in the extension.... you really don't understand nothing...

@Derp

hem!! now you belive me? that exploit work! and is not yours ,you and your friends are not able to test/reproduce!
:D
Click to expand...
Ohhhh and btw get rekt m8.
dfb9417b73.png
 
Kaptan647

Kaptan647

Retired Staff
Contributor
Apr 25, 2015
314
395
112
You want proof about who got the exploit first? Ok you will have it.
As you can see scurippio send bug report to seclist.org at 22 oct 2015
YJgoq2.png


And this is a screenshot from my own youtube account.This is the first version of rfi which patched with 3.0.18.1 . Video published at 15 sep 2015
MWdr89.png


And this is another screenshot from my youtube account.This is the second version of rfi which found by us after 6 hours later from 3.0.18.1 patch and scurippio cliams that he found it first.Video published at 11 oct 2015
n2OBQN.png

I can make a thread in vip section if anyone wants to see them(Of course first i must ask to Devteam).If you have any proofs about he found it one year ago, i will apologize from you and him in here or i can start a thread about it if you want but if you dont have any proofs then shut up and stop disgracing yourself
 
Last edited:
0day

0day

Contributor
Oct 16, 2015
140
268
148
Silly kids and their e-fame lol. Le-sigh.
Scuripooopio I bet you have a Mr. Robot tattoo.

Let's be real here, you leaked what you found on these forums to gain some form of internet notoriety and you did not even make a profit.

You obviously did it for gaining this small level of e-fame that nobody will ever know about unless you tell them and link them. They then have to explicitly trust that whatever name that is on those exploit reports, actually belongs to you. - Kinda sad.

Don't get me wrong, I have turned in 0days before but I had never agreed to keep those confidential, I was getting paid to find them and they were mine lol.

You sir are nothing but a tool seeking internet fame. So have fun; I am sure your friends love getting links from you all the time proving how cool you are.

Tool.
 
Last edited:
A

Asphyxia.Cell

Member
Aug 13, 2015
25
28
45
Peter, don't listen to Scur-ipt Kiddie. He is just a fame whore, one without skill. His greatest feat is searching up Google dorks and defacing websites to feel more powerful than he ever will be. Now he has moved on to stealing the security research of others to look cool. :rolleyes:
 
You must log in or register to reply here.
Top