[Share] Root Exploiter with out Back Connect - [New Methods]

[Share] Root Exploiter with out Back Connect - [New Methods] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Share] Root Exploiter with out Back Connect - [New Methods] (/showthread.php?tid=5005851)

Pages: Pages 1 2

[Share] Root Exploiter with out Back Connect - [New Methods] - blingbling - Sep 30, 2015

[img=555x347]http://mukarramkhalid.com/wp-content/uploads/2015/09/main_screen.png[/img]

Hello Hackforums.

My first post here.
I want to share these articles written by a friend.

From the BlogPost

Introduction:

Have you ever had any of the following issues?

Shell access to a vulnerable (Rootable) server with a known root exploit but no reverse or back connection.
Shell access to a server and you know the root login credentials but no SSH or any other means to connect.
Issues with port forwarding and back connect.

This article has 2 parts.
Part 1 - [PHP][Python] Root Exploiter – No Back-Connect
Part 2 - [PHP][C++] Root Exploiter (Part 2) – No Back-Connect

Video Demos:
Part 1
Part 2

Credits to the author of : http://mukarramkhalid.com

* - CIA Insider - Sep 30, 2015

Surprised that this gets no love. Seems like quality. Great post.

* - EbonCipher - Sep 30, 2015

Tested it out. Works well. Thanks for the share.

* - Aur3xis - Sep 30, 2015

Wow, a quality share from a newb on here?
Stay HQ my friend.

* - HaxOr❤ - Sep 30, 2015

Nice share mate, thanks for posting.

* - Im gone brah - Sep 30, 2015

If really doesn't have the resources or can't bother to back-connect. You are still able to run commands through the shell as root and by using a pipe.

Code 
Root@doge:~# echo 'exploit goes here, hello, hello, hello'  | ./exploitname123

Do demonstrate the use of the pipe.

Code 
root@doge:~# echo zeroisabeaver | base64

emVyb2lzYWJlYXZlcgo=

Hell you can even add another pipe if you want to run something else. A stupid example of first encoding the string in base64 then decode it.

Code 
root@doge:~# echo zeroisabeaver | base64 | base64 --decode

zeroisabeaver

Another example of using the pipe operator.

Code 
root@doge:~# echo zeroisabeaver | base64 | cat logfile.log

zeroisabeaver 

64 bytes from 6.6.6 (127.0.0.1): icmp_req=31359 ttl=50 time=10.4 ms

* - blingbling - Sep 30, 2015

(Sep 30, 2015 01:45 PM)Zayne Wrote: If really doesn't have the resources or can't bother to back-connect. You are still able to run commands through the shell as root and by using a pipe.
...
...
...

Thanks for the info. 👍. The Part 1 of this article covers another aspect. What if we have login credentials of the root user or any other user and we don't have any means to connect to the server, just a php interface. Can we do something like this with pipes?

Code 
su - someUser

passwd: pass_of_someUser

Successfully logged in. 

someUser@mylinuxBox~# (Waiting for the next command as someUser)

I guess no.

* - hahdbwoannniabs - Sep 30, 2015

Nice share. I've given up several boxes in the past because I couldn't obtain a shell.

* - Meowie - Oct 1, 2015

(Sep 30, 2015 01:45 PM)Zayne Wrote: If really doesn't have the resources or can't bother to back-connect. You are still able to run commands through the shell as root and by using a pipe.

Code
Root@doge:~# echo 'exploit goes here, hello, hello, hello' | ./exploitname123

Do demonstrate the use of the pipe.

Code
root@doge:~# echo zeroisabeaver | base64 emVyb2lzYWJlYXZlcgo=

Hell you can even add another pipe if you want to run something else. A stupid example of first encoding the string in base64 then decode it.

Code
root@doge:~# echo zeroisabeaver | base64 | base64 --decode zeroisabeaver

Another example of using the pipe operator.

Code
root@doge:~# echo zeroisabeaver | base64 | cat logfile.log zeroisabeaver 64 bytes from 6.6.6 (127.0.0.1): icmp_req=31359 ttl=50 time=10.4 ms

You cannot interact with a process via PHP (at least to my knowledge).
If you want to, you can go ahead and try executing gdb and inputting something via PHP.

@OP, Nice! I really like this.
Finally something new in here.

* - Im gone brah - Oct 1, 2015

(Oct 1, 2015 07:50 AM)Meowie Wrote: You cannot interact with a process via PHP (at least to my knowledge).
If you want to, you can go ahead and try executing gdb and inputting something via PHP.

@OP, Nice! I really like this.
Finally something new in here.

Where the hell did I mention anything regarding PHP completely not relevant to what I posted?

* - Meowie - Oct 1, 2015

(Oct 1, 2015 07:57 AM)Zayne Wrote: Where the hell did I mention anything regarding PHP completely not relevant to what I posted?

You mentioned piping, I just mentioned PHP.
Piping happens to be exactly like PHP in the regard that you cannot interact with a program.

* - Im gone brah - Oct 1, 2015

(Oct 1, 2015 08:03 AM)Meowie Wrote: You mentioned piping, I just mentioned PHP.
Piping happens to be exactly like PHP in the regard that you cannot interact with a program.

I told him another way to possibly gain root without using a back-connection and neither a reverse-connection. (relying on that the exploit works)

You on the other hand mentioned this and quoted me on it.

Quote:You cannot interact with a process via PHP

Quote:Piping happens to be exactly like PHP in the regard that you cannot interact with a program.

Howerver, I never stated that you can interact with a process through either php or a pipe. What I did state here is that bin/sh will allow the individual to redirect an output of commands into other commands through a pipe.

Quote:interact
ɪntərˈakt
verb
act in such a way as to have an effect on each other.
"all the stages in the process interact"
communicate or be involved directly.
"the user interacts directly with the library"

You can actually have an effect on a process for example by killing it through using the php function posix_kill()

Posix_kill will send a signal to the proccess

* - Meowie - Oct 1, 2015

(Oct 1, 2015 08:49 AM)Zayne Wrote: I told him another way to possibly gain root without using a back-connection and neither a reverse-connection. (relying on that the exploit works)

You on the other hand mentioned this and quoted me on it.

Howerver, I never stated that you can interact with a process through either php or a pipe. What I did state here is that bin/sh will allow the individual to redirect an output of commands into other commands through a pipe.

You can actually have an effect on a process for example by killing it through using the php function posix_kill()

Posix_kill will send a signal to the proccess

I said interact
And have you tested what happens if you run a local root exploit without a reverse or bind shell?
Yeah, it doesn't really work unless you make the exploit do something like write an suid root file.

* - Im gone brah - Oct 1, 2015

(Oct 1, 2015 09:00 AM)Meowie Wrote: I said interact
And have you tested what happens if you run a local root exploit without a reverse or bind shell?
Yeah, it doesn't really work unless you make the exploit do something like write an suid root file.

You said interact and I gave you the definition of it with an example. I also never stated anything about a local root exploit now did I?

* - Meowie - Oct 1, 2015

(Oct 1, 2015 09:04 AM)Zayne Wrote: You said interact and I gave you the definition of it with an example. I also never stated anything about a local root exploit now did I?

Haha, okay okay.
I'll let you have this one.