All about SHELLS - AoEMonk - Jun 18, 2011
Welcome to my tutorial: All about SHELLS!
I am sure many have you have read about "Hacked / Defaced with shells", So I am pretty sure that the first thing that comes to your mind is "What the heck are these shells?" . So this article would give you complete idea about shells and its use.
Difference between FTP & Shells:
Many times I see that some of us know how to use the shell but once they have uploaded they get confused. So to start with, Let me give you some information about FTP:
File Transfer Protocol
Whenever you want to open your website, the first thing you will do is to get some web hosting for your self. That cud be either free or paid. When your get your hosting services, you create a website on your computer first and then upload it to your hosting server so it becomes a World Wide Web. This process of uploading the documents from your computer to your hosting server is done through FTP [File Transfer Protocol]. It basically looks like a program with 2 columns, one column shows your computer files and another shows your servers files. Just like when you copy the stuffs from some USB drive to your computer. So here, I will show you an example is how you would connect if you own go4expert. So when you want to connect your self to your web hosting server, following information is required in order to authenticate yourself:
Server : ftp.go4expert.com
Username: shabbir
password: whatever
So, once you put in this information, server understands that you are shabbir and gives you access to all the files on the server so you can work on it.
Shells:
Since you understand the FTP now, we know that none of us will get access to Go4expert's server because we don't have the username and password authenticate yourself. Somehow we can manage to get the access to G4E's FTP we can easily remove/edit/replace files. So we can destroy this entire forum and upload our own stuffs. That is when shells comes into the picture. Shells are a malicious PHP files which you will need to upload to any website, and once you execute it you will get access to its server directly WITHOUT authenticating your self.
Logic
Shell is not a tool that you can run and complete your work. As I said, its just a normal ".php" file, you have to find a way in any website to upload that shell. The Idea is, you upload the shell to any website so it will be saved on their server and it will give you the access to it.
Phase 1 : Uploading a shell:
Suppose you want to hack "something.com". So the first thing that you will do is, open up "something.com", and try to find some place from where you can upload the files on the website. There are many such places for example, "file uploads, avatars, resume upload, cooking recipe uploads, upload your photo". So these are the places which will give you an opportunity to upload your shell. All you have to do is, try to upload the shell.php which is located in your computer and click on submit. So suppose you went to the webpage "something.com/submit_resume.php" and you uploaded your resume.
Phase 2 : Executing your uploaded shelll:
Once we have uploaded the shell as shown in "Phase:1", we know that its sitting on the server. The only thing we need to do now is to execute the shell from a browser so we get access to it.
Example:
So suppose i uploaded my shell as an attachment in THIS THREAD. SO now taht attachment is sitting on G4E's server. Now if we want to executive it, we will use following URL:
Code http://www.go4expert.com/forums/attachment.php?attachmentid=456&d=1249607339
Phase 3 : Defacing:
Defacing is a word which means "replacing the current index file with our own index with our motive and slogan on it. So once you have access to the server, you are the king.
Different types of shells:
There are many shells available, most of them are public and some of them are private. Most of them does the samething to give you the access of the server. "c99, r57, b0yzone, j32" are some very common and easily available shells.
Important Piece of advice:
I would suggest you to download Code http://www.wampserver.com/en/
Thanks for your time reading the article. Hope you liked it.
Also guys, I'm taking suggestions on what to make a new tutorial :)
* - Dead_Status - Jun 18, 2011
Excellent tutorial! It really helped to understand shells and how they work. I could never find a guide or tutorial. Thanks.
* - AoEMonk - Jun 18, 2011
No problem and thanks :) If you got any requests I'll gladly do a tutorial about it.
* - Dead_Status - Jun 18, 2011
Alright, i'll remember to keep that in mind.
* - PregoPastaSauce - Jun 23, 2011
I would love a tutorial on the how to make some private shells :) PM me about it? :D
* - rubanrecobath - Jun 23, 2011
awsome tutorial man great job
* - AoEMonk - Jun 23, 2011
Thanks for the great feedback guys :)
* - Johnny87au - Jun 23, 2011
awesome write up dude, could you explain in a full detailed tutorial how to do everything though ???? Check your pm box also hehe
* - depojones - Jun 23, 2011
Great tutorial! Didn't know the difference until now :)
* - zacharyfxx - Jun 23, 2011
Bumpity Bump Bumped nice tut
* - Frostbite™ - Jun 23, 2011
Wow amazing thread, I didn't know what they were before. I'll definitely be using them a lot more now :)
* - Obi-Wan Cannabis - Jun 23, 2011
I was just about to go search on wikipedia what were shells. The first thing I found was that shitty turtle of Mario Games. :D
Thanks for the tutorial!
* - AoEMonk - Jun 23, 2011
Lol. Thanks for the feedback guys :)
* - thestapler42 - Jun 24, 2011
great tut! love the practice website download haha ill definitely try it there!
* - !ron m@n - Jun 24, 2011
N1ce tutorial keep it bro :)
|
