+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: # can't ReaD -> [ /etc/named.conf ] (any bypass?) (/showthread.php?tid=4430431)
# can't ReaD -> [ /etc/named.conf ] (any bypass?) - _AntiHacker_ - Sep 4, 2014
(after shelling a site)
hey all how you all doin?
hope you guys are in a good life and good moods
my question is that after i uploaded my shell
problem #1
i uploaded my tools as usual to get the configs and domain names
so here is what i did step by step
cat /etc/passwd ok that command worked good then after it shows all the passwds i copied them and paste them into
config.php and i used other tools such as config fucker in Webr00t shell but the result is that i don't get the config files
such as wordpress~~1.txt you know what i am saying
also problem #2
is that i used php script such as d0mains.php
and users.perl and other perl tools to grab the domains and the usernames
but it said can't ReAD etc/named.conf ...
-.- now i dont really care about that all i need is to slove the problem #1 which is to get the config files
[+] more info about the server for those who asks
the server has only 3 sites and its linux and for those who say root it i cant because i cant find the local root exploit for this version
id : seiha (user)
$ id
uid=3423253(seiha) gid=1188990(pg2314236) groups=3138390(pg2314236)
id in this server is (user) meaning its not (nobody) , (apache) etc...
i tried most popular symlink tools to grab the configs commands that i tried but it Fails!
cat /etc/valiases/domain.com
ls -a /etc/valiases/domain.com
cat etc/named.conf
using webroot cgi shell i tried
cat /etc/named.conf | grep zone > users.txt but the file users.txt was empty :'(
i went to the etc folder
cd /
cd etc
then
dir
then it displays the folders and files but i cant find named.conf also or the folder valiases
i downloaded some files like userlist.conf from /etc
but still some files from /etc useless at the moment -_____-
even the folder mail in /etc
long story short i'm trying to get the configs (symlink the configs for other sites on the same server) but i CAN'T like i said i tried to symlink the root and lots of things etc... do it any help is appreciated!
anybody can help me in any way i will appreciate just comment or pm me ..
* - Sky - Sep 4, 2014
What year is the server? There's a Symlink bypass for all 2014 servers.
~Arcane 🤝
* - _AntiHacker_ - Sep 6, 2014
2011 x86_64 first serve
2014 x86_64 the second one
but i need the first one for now 2011 x86_64
* - Nitai - Sep 6, 2014
Try to use netcat and than run a rootkit exploit to get full access .
* - tmp2 - Sep 6, 2014
playchu is right, since the server is 2011 , most chances that you can root it with a root exploit kit.
* - 0x77d718fc - Sep 6, 2014
check uname -a, cat /etc/issue => search for a corresponding local exploit.
* - _AntiHacker_ - Sep 6, 2014
(Sep 6, 2014 11:14 AM)0x77d718fc Wrote: check uname -a, cat /etc/issue => search for a corresponding local exploit.
thats what it is Linux james-rock 2.6.32.45-grsec-2.2.2-r3 #8 SMP Mon Oct 10 13:33:17 PDT 2011 x86_64 GNU/Linux
* - josue - Sep 6, 2014
Now Google linux kernel exploit 2.6.32 to verify whether it exists
* - SaxyMadaFaka - Sep 7, 2014
(Sep 4, 2014 05:07 AM)Sky Wrote: What year is the server? There's a Symlink bypass for all 2014 servers.
~Arcane 🤝
LOL really???
~ Bad Boy 🤝
* - _AntiHacker_ - Sep 24, 2014
(Sep 7, 2014 02:00 PM)Anti Terrorist Wrote: LOL really???
~ Bad Boy 🤝
What year is the server? There's a Symlink bypass for all 2014 servers.
i h8 2014 servers
i got more than 5 shells on diff. servers its all 2014
fuuuuck!
* - 133720 - Sep 24, 2014
Use Server to bypass or try using the base64 .
* - _AntiHacker_ - Sep 28, 2014
ppl seem to give up on 2014 servers!
* - WPA2 - Oct 8, 2017
evan though this thread is old and the op is closed&@HF
I would like to bring this up as I Have found a solution if you want to read try using sec-war script it works phenomenal
* - LD_PRELOAD - Oct 9, 2017
(Oct 8, 2017 06:53 PM)WPA2 Wrote: evan though this thread is old and the op is closed&@HF"a solution"
I would like to bring this up as I Have found a solution if you want to read try using sec-war script it works phenomenal
a solution is to use common sense. You don't need named.conf. it's simply used as an automatic template to lay out symlink destination, you can symlink just fine without it assuming you actually know where to go. How do we know where to go? file descriptors, php/mysql/tomcat/cron/any other form of logging, even catting /etc/passwd on most cases will be enough. The only reason this thread exists is because skids can't privesc without their little spoonfeeding tools