Waraxe IT Security Portal

revenant · Regular user

Okay, so I'm kind of amateur. And by amateur I mean I know how to use Unix profficiently, in addition to Basic, html, Ruby, a small amount of C++ and the basic of many other languages. I only two days ago started looking into web programming and hacking on a whim, and ive been hooked. So, I was lookin for an idea, and one of my friends wants my help. The admin of the following forum has hacked his new site, and he wants revenge. Nothing much, honestly.

Anyways, I've tried running PHP through EXIF data on a jpeg, but it seems to rename all the avatars so it didnt work, and dont run as php ( i may just be doing this wrong. If anyone could tell me where to look or if any exploits or cookie hacks exist, id be very appreciative.

[[ edited by waraxe: no sensitive data in postings! ]]

waraxe · Site admin

This version of phpbb is hard to hack. Better solution will be getting in through the hosting neighbours. First try to resolve that domain name and you will get webserver's ip address. Next find out, what other websites are hosted on same server. Example:

http://search.msn.com/results.aspx?q=ip%3A216.45.56.11&FORM=MSNH11

Now you need to find some websites with known security holes. Cutenews, wordpress, phpnuke, mybb ... there is lots of software waiting for exploitation. And after you are in, try to get over webserver's cross-host security and in case of success you can have access to target forum database and files. You can download user data, modify or drop table, etc. And target admins don't even know, who's hitting them Smile

revenant · Regular user

Your basically saying use XSS. Only problem is I don't know if this guy has any other sites hosted on his server. To get his IP, should I (im running mac) just use WHOIS, Lookup and Traceroute?

Edit: Lookup and all the online IP lookups i've tried dont return anything. They say it was not permitted. Can I monitor the packets and stuff like that going between my computer and the site (Tamper Data FF3 plugin)? Will that be an accurate one?

Edit: Traceroute returned 216.45.56.11 as the site IP. Can you confirm this?

Edit: Lookup on this IP turns up Juliet.made2own.com. This happens to be cheap cPanel hosting, which is what you get when you go to http://216.45.56.11

waraxe · Site admin

1. this was not XSS i was talking about in previous post.
2. look the link i gave you before:

http://search.msn.com/results.aspx?q=ip%3A216.45.56.11&FORM=MSNH11

revenant · Regular user

Those don't seem to have anything to do with his site...also, none of them are opening.

This might help. site:[[sitename]] in google returns that [[sitename]] has a wiki on it.

I can't access the site. Only through a proxy server. The admin has been known to be a JA, and a freak when it comes to computers.

Also, when looked up or tracerouted, none of these sites have the same ip!

Regardless, do you know any mediawiki exploits?

waraxe · Site admin

revenant · Regular user

I'm thinking that if you find a vulnerability in one of them, its likely they could be used as backdoors, or could contain sensitive information you could use to access the main site. The problem is, those sites have totally different IPs!

Also, it seems the entire server had blocked me out. I can't access any of those sites, except with a proxy.

waraxe · Site admin

revenant · Regular user

Heh, thats strange, now they do resolve correctly. Before I got a 117.***.***.*** IP for a couple. Still, the problem remains. I can't access anything on that server anymore (did i get banned for pinging them?)

waraxe · Site admin

So ... look for some known-to-be-exploitable software on that server:

http://search.msn.com/results.aspx?q=ip%3A216.45.56.11+cutenews&go=&form=QBRE

revenant · Regular user

Great thanks! but i still can't access the site. Is there any way to mask my IP without going through an online proxy with the messed up urls? TOR is too slow.

Edit: I can get in again! Weird.

Im going to sound like an idiot, but I may need some advice/guidance on how to hack the site in those first two results. Apparently it doesnt filter POST and cookies correctly, and there is an exploit coded in php on the internet, not that i know how to use it...

It says execute from apache. How am i supposed to execute it from apache if i dont have access to the apache!

http://www.securiteam.com/exploits/5KP0D2KGUI.html

Heeeey! You wrote this one!

http://www.milw0rm.com/exploits/4779

waraxe · Site admin

Install php to your PC and run exploit form command line. And one more thing - thor is slow, but without any ip hiding you are playing with fire.
So ... if you are lucky, then that exploit can give you admin's md5 hash, next step is cutenews admin and from that you have aeasy access to php code execution. Just search this forum, if you need help - there is more than one thread about cutenews exploitation.

revenant · Regular user

Last thing, which parts of your code do i substitute with parts from the site, and how?

Do I just replace localhost with the host of the site? Im sorry, im a bit confused.

(Im compiling php right now [im on a mac])

waraxe · Site admin

http://www.********.com/cutenews/search.php

Just replace "*"-s with needed domain name.

revenant · Regular user

How do I get php cli? Im on mac. Im going to try running it from the terminal. (I also need a decent code editor, TextMate's demo ran out)

nmd! I got the username, now for the hash!

edit: hash retrieved.

bcc6d350f424f4b07ddcc6c64cf61dc3

Any help cracking it? I'm on a mac. Any ideas?