[Article] Reverse shells...

Ok. So I wrote a short article yesterday showing off a few reverse shell tricks and demoing them on a vulnerable web app using a Command Injection vulnerability.

Some people were asking "why it so basic?" and here is why: The idea of the article is not to provide script kids/blackhats with new info - it is well known - but to demonstrate how one can go from a small PHP bug to a full blown reverse shell.

I will be working up SNORT IDS Signatures for them all based on how they throw a shell back, just have to get some nice .pcaps of it first. I plan to also find a way to "signature" the IDS evading shellcode I wrote - and so kind of have an "arms race" with myself...

Article on Insecurety.net

Web Malware Collection Updated

Ok, quick post. The Web Malware Collection has had some updates done, and I am *Still* busy sorting samples to commit.

Currently it has 443 samples (according to this "find . -type f | wc -l" command)

Project Page: http://insecurety.net/projects/web-malware/
GoogleCode: http://code.google.com/p/web-malware-collection/

SVN repo is on googlecode so SVN up :D

Web Backdoors: Video

This is a video I made to quickly demonstrate some Web App Backdoors.
I demonstrate Weevely; FireInTheHole.py; PHPSploit; and two standard "web shells", the WSO2.php shell and the ITSecTeam shell.

I occasionally comment on each ones shortfalls, but here is the simple TL;DR one.

Weevely is amazing to use, has LOADS of features, the netcat bind and backconneect shells work perfectly, but it is slightly confusing for the first time user. It also remembers your current working dir and has a very intuitive shell (just like BASH) and fairly good error handling.
You can get it HERE: Weevely

FireInTheHole.py is fast, simple to use, uses both POST and/or GET and gives a terminal like session. It has no advanced features but has a couple of bugs, namely its non-interactive state. It *does* remember your current working dir however, which is very advantageous.
You can download it HERE: Fireinthehole.py

PHPSploit is a VERY nice "framework" which is currently in beta and has great potential. It looks a LOT like Metasploit, and I envision it becoming popular sometime in the future. It works fine, allows you to pull a lot of info, however it has some issues. It does not remember current working dir at all, so it can be rather annoying to "stack" commands for different dirs.
You can download it HERE: PHPSploit

I then demo the WSO2 PHP backdoor, which was failing pretty hard (some functions missing) and the ITSecTeam PHP backdoor, which seems designed to be "skid friendly" and has loads of features. I suspect both may be backdoored but have not investigated... YET. Neither had a functional backconnect or bindshell, and had a load of errors/bugs. I recommend *not* using these. You may find examples on google, and I plan to upload them myself later.

Now its video time!

 

802.11 Race Condition Exploitation

802.11 Race Condition Exploitation

This post is about the Race Condition Exploitation method for "hijacking" WiFi clients.

Basically how it works is, the client sends a GET request for whatever. You respond with a 301 redirect to your content.

How you do this is by sniffing the traffic, and when you see a GET you inject a 301 to the client and a FIN or RST to the AP. You essentially pretend to be the access point for a second.

SO far there are several variants out there, including a Metasploit module. It can be found in auxiliary/spoof/wifi/airpwn

The technique was originally demoed by "toast" at DEFCON 12, and used to replace images with shock porn like Goatse or Tubgirl.

Some links of interest...

http://evilscheme.org/defcon/
http://airpwn.sourceforge.net/Airpwn.html
http://sourceforge.net/projects/airpwn/
http://securitysumo.wordpress.com/2008/04/22/running-airpwn/

Aaaaand some video...

So naturally, I wondered. I can inject images and javascript... So what about executables? (you see where I am going...)

Then I found someone else was doing this exact thing with updates. Hijacking them ala airpwn. Their tool is named "IPPON", and is very interesting, albeit buggy as fuck. If you can make it work, please god message me!

Here be their presentation from DEFCON 17, and their code!
http://www.slideshare.net/itzikk/ippondefcon17
http://code.google.com/p/ippon-mitm/

Now on to the best of the bunch (IMO). RCX. Developed by Melchi Salins, it allows you to do *anything*, is written in Python using SCAPY, and generally is fucking BADASS! With it, you can redirect ANYTHING to ANYTHING.

http://rcx.sourceforge.net/rcx.html

Coming Soon... The RCX config file for mass update hijacking!

##

Ok. Comments were asking for how to install AirPwn in Ubuntu 10.04/Back Track 5.

Here is how it is SUGGESTED to do it...

http://www.timashley.me/node/718


Now I found the second part of that (install lorcon + airpwn) did not work for me. So... I did things a bit differently.

Check out this LaunchPad: https://launchpad.net/~nagos/+archive/ppa?field.series_filter= 

Now, I simply grabbed the .deb files for Airpwn and Liblorcon from there.
Install Liblorcon FIRST. Then Airpwn.

However, this PPA should work fine also: ppa:nagos/ppa

It just didn't work for me :P

Collection of web app backdoors (v1)

This is a collection of the common PHP (and ASP if I find them) backdoors used by malicious hackers to take over servers.
I am NOT responsible for your use of this!


Warning: There is every possibility these backdoors may be backdoored. I am going to eventually sort them into two folders - backdoored backdoors and clean backdoors. Then I can sit back and watch y'all go apeshit at some skiddies who backdoor their backdoors :D


Download the list here...Web Backdoors