[blingbling]

[img=555x347]http://mukarramkhalid.com/wp-content/uploads/2015/09/main_screen.png[/img]

Hello Hackforums.

My first post here.
I want to share these articles written by a friend.

From the BlogPost

Introduction:

Have you ever had any of the following issues?

• Shell access to a vulnerable (Rootable) server with a known root exploit but no reverse or back connection.
  
• Shell access to a server and you know the root login credentials but no SSH or any other means to connect.
  
• Issues with port forwarding and back connect.
  

This article has 2 parts.
Part 1 - [PHP][Python] Root Exploiter – No Back-Connect
Part 2 - [PHP][C++] Root Exploiter (Part 2) – No Back-Connect

Video Demos:
Part 1
Part 2

Credits to the author of : http://mukarramkhalid.com

[CIA Insider]

Surprised that this gets no love. Seems like quality. Great post.

[EbonCipher]

Tested it out. Works well. Thanks for the share.

[Aur3xis]

Wow, a quality share from a newb on here?
Stay HQ my friend.

[HaxOr❤]

Nice share mate, thanks for posting.

[Im gone brah]

If really doesn't have the resources or can't bother to back-connect. You are still able to run commands through the shell as root and by using a pipe.

Code

Root@doge:~# echo 'exploit goes here, hello, hello, hello'  | ./exploitname123

Do demonstrate the use of the pipe.

Code

root@doge:~# echo zeroisabeaver | base64
emVyb2lzYWJlYXZlcgo=

Hell you can even add another pipe if you want to run something else. A stupid example of first encoding the string in base64 then decode it.

Code

root@doge:~# echo zeroisabeaver | base64 | base64 --decode
zeroisabeaver

Another example of using the pipe operator.

Code

root@doge:~# echo zeroisabeaver | base64 | cat logfile.log
zeroisabeaver
64 bytes from 6.6.6 (127.0.0.1): icmp_req=31359 ttl=50 time=10.4 ms

[blingbling]

If really doesn't have the resources or can't bother to back-connect. You are still able to run commands through the shell as root and by using a pipe.
...
...
...

Thanks for the info. 👍. The Part 1 of this article covers another aspect. What if we have login credentials of the root user or any other user and we don't have any means to connect to the server, just a php interface. Can we do something like this with pipes?

Code

su - someUser
passwd: pass_of_someUser
Successfully logged in.
someUser@mylinuxBox~# (Waiting for the next command as someUser)

I guess no.

[hahdbwoannniabs]

Nice share. I've given up several boxes in the past because I couldn't obtain a shell.

[Meowie]

If really doesn't have the resources or can't bother to back-connect. You are still able to run commands through the shell as root and by using a pipe.

Code

Root@doge:~# echo 'exploit goes here, hello, hello, hello'  | ./exploitname123

Do demonstrate the use of the pipe.

Code

root@doge:~# echo zeroisabeaver | base64
emVyb2lzYWJlYXZlcgo=

Hell you can even add another pipe if you want to run something else. A stupid example of first encoding the string in base64 then decode it.

Code

root@doge:~# echo zeroisabeaver | base64 | base64 --decode
zeroisabeaver

Another example of using the pipe operator.

Code

root@doge:~# echo zeroisabeaver | base64 | cat logfile.log
zeroisabeaver
64 bytes from 6.6.6 (127.0.0.1): icmp_req=31359 ttl=50 time=10.4 ms

You cannot interact with a process via PHP (at least to my knowledge).
If you want to, you can go ahead and try executing gdb and inputting something via PHP.

@OP, Nice! I really like this.
Finally something new in here.

[Im gone brah]

You cannot interact with a process via PHP (at least to my knowledge).
If you want to, you can go ahead and try executing gdb and inputting something via PHP.

@OP, Nice! I really like this.
Finally something new in here.

Where the hell did I mention anything regarding PHP completely not relevant to what I posted?

[Meowie]

Where the hell did I mention anything regarding PHP completely not relevant to what I posted?

You mentioned piping, I just mentioned PHP.
Piping happens to be exactly like PHP in the regard that you cannot interact with a program.

[Im gone brah]

You mentioned piping, I just mentioned PHP.
Piping happens to be exactly like PHP in the regard that you cannot interact with a program.

I told him another way to possibly gain root without using a back-connection and neither a reverse-connection. (relying on that the exploit works)

You on the other hand mentioned this and quoted me on it.

You cannot interact with a process via PHP

Piping happens to be exactly like PHP in the regard that you cannot interact with a program.

Howerver, I never stated that you can interact with a process through either php or a pipe. What I did state here is that bin/sh will allow the individual to redirect an output of commands into other commands through a pipe.

interact
ɪntərˈakt
verb
act in such a way as to have an effect on each other.
"all the stages in the process interact"
communicate or be involved directly.
"the user interacts directly with the library"

You can actually have an effect on a process for example by killing it through using the php function posix_kill()

Posix_kill will send a signal to the proccess

[Meowie]

I told him another way to possibly gain root without using a back-connection and neither a reverse-connection. (relying on that the exploit works)

You on the other hand mentioned this and quoted me on it.



Howerver, I never stated that you can interact with a process through either php or a pipe. What I did state here is that bin/sh will allow the individual to redirect an output of commands into other commands through a pipe.



You can actually have an effect on a process for example by killing it through using the php function posix_kill()

Posix_kill will send a signal to the proccess

I said interact
And have you tested what happens if you run a local root exploit without a reverse or bind shell?
Yeah, it doesn't really work unless you make the exploit do something like write an suid root file.

[Im gone brah]

I said interact
And have you tested what happens if you run a local root exploit without a reverse or bind shell?
Yeah, it doesn't really work unless you make the exploit do something like write an suid root file.

You said interact and I gave you the definition of it with an example. I also never stated anything about a local root exploit now did I?

[Meowie]

You said interact and I gave you the definition of it with an example. I also never stated anything about a local root exploit now did I?

Haha, okay okay.
I'll let you have this one.