Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: January 23, 2026 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 111 Members: 0 Total: 111 Full disclosure Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group) OpenMetadata <= 1.11.3 Authenticated SQL Injection [REVIVE-SA-2026-001] Revive Adserver Vulnerabilities Defense in depth -- the Microsoft way (part 95): the (shared)"Start Menu" is dispensable Re: Multiple Security Misconfigurations and CustomerEnumeration Exposure in Convercent Whistleblowing Platform(EQS Group) RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction TinyOS 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio TinyOS 2.1.2 printfUART Global Buffer Overflow via UnboundedFormat Expansion KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group) Panda3d v1.10.16 Uncontrolled Format String in Panda3D egg-mkfont Allows Stack Memory Disclosure Panda3d v1.10.16 egg-mkfont Stack Buffer Overflow Panda3d v1.10.16 deploy-stub Unbounded Stack Allocation Leading to Uninitialized Memory MongoDB v8.3.0 Integer Underflow in LMDB mdb_load IT Security and Insecurity Portal www.waraxe.us Forum Index -> Shell commands injection -> etc/passwd - now what? View previous topic :: View next topic etc/passwd - now what? Posted: Wed Jun 20, 2007 12:10 pm blaxenet Active user Joined: Jun 20, 2007 Posts: 26 Hi Guys, I have gotten myself onto a server that has /etc/passwd viewable, just wondering what my next step would be. I've never quite understood this, Fair enough you can upload a php shell such as C99 or R57. You can have a fiddle around providing the permissions are set in your favour, go through config files and connect to the D/B's with the passwords. But is there anything deeper? Hence why I have asked what's next from /etc/passwd Thanks everyone BlaxeNet (I am learning how this works!) Posted: Wed Jun 20, 2007 4:13 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu If you have allready php scripting level and operating system shell level acces to server, then next try to find out operating system and kernel versions and then look for local root exploits. So next you upload that exploit's source code to server and will compile it, or upload allready precompiled exploit. Ultimate goal is to gain root access to server and install backdoor(s). And when you are root, then you can read "etc/shadow" file, so you have changes to crack root password - just for fun. Now, when you have "r00ted" that server, then you can install sniffer and spy network traffic on LAN. If the webserver is connected directly to corporative internal network, then you have possibilities to compromise lots of other computers, rip internal databases etc. But if webserver is located in DMZ, then this needs more work. This was just one scenario. Rooting is considered as serious cybercrime, so I suggest to stay to low-privileges level Posted: Wed Jun 20, 2007 4:46 pm pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria waraxe wrote: Rooting is considered as serious cybercrime, so I suggest to stay to low-privileges level Smile Good idea Posted: Fri Jun 22, 2007 8:23 am blaxenet Active user Joined: Jun 20, 2007 Posts: 26 Hi Waraxe, The system (Server 1) I was looking at doesn't have etc/shadow but rather a file called etc/master.passwd so I am presuming this is what I am looking for. Needless to say, another system (Server 2) I was 'on' last night has etc/shadow so i'll have the chance to 'play' around a bit. Just a quick rundown for you all- **Server 1** Software: Apache/2.2.2 (FreeBSD) mod_ssl/2.2.2 OpenSSL/0.9.7e-p1 DAV/2 PHP/4.4.2 **Server 2** Software: Apache/2.2.2 (Fedora). PHP/5.1.6 On both of these I have the user 'www' access. I'm not lazy so i'll do some research later and see how I go with the above recommendation(s) and see if I can advance any further. Of course, I only want this info for what we call educational purposes Thanks for the info Waraxe! BlaxeNet Posted: Fri Jun 22, 2007 3:49 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu For rooting it is important to know operating system kernel version. In case of Linux you can use this: Code: cat /proc/version http://www.informit.com/articles/article.asp?p=131048&rl=1 etc/passwd - now what? www.waraxe.us Forum Index -> Shell commands injection You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

PCWizardHub - Helping you fix, build, and optimize your PC life
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.051 Seconds