Hot answers tagged

56

Try sending a HEAD request. I'm assuming that with ascii.txt included, the output of the script is just over a nice number like 4096 bytes, a common output_buffering value. Once the script has written output_buffering bytes, it needs to flush the output buffer before continuing. Normally this works fine and the script continues, but if the request type is ...


31

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), and some autoit scripts which likely include some form of ransomware (all of which names with .jpg extensions on the server they are ...


26

The security flaw isn't in MD5 in this case. And the idea isn't to get if (!isset($_POST['pass']) || md5($_POST['pass'])!='castle') to evaluate in favor of the hacker. The vulnerability appears when you crash the script. The admin privileges are not conditional. No matter what the user gets their permission elevated by setting 1 to $_SESSION['admin_level']. ...


17

I've seen a similar challenge somewhere. Try to send something like 'QNKCDZO' as input. md5('QNKCDZO') is '0e830400451993494058024219903391' (note the 0e prefix in the hash indicating scientific notation of a number) and since the code uses the != operator (instead of the type sensitive !==) PHP (older versions only?) will actually cast it to a number before ...


14

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


12

Yes, it means that in the exploit market that kind of exploit can be sold and bought for something in that range (e.g. $25k-$50k). That website doesn't specifically talk about black market: The ongoing observation of the exploit market structure helps to collect current prices. but, if you don't report vulnerabilities to bug bounties, the market you'll ...


9

I haven't been able to test in PHP 5.5.9, and what I'm going to propose doesn't work on my PHP 5.6.22 (but I might have made some silly mistake). The only workaround I can fathom is if MD5 returns something that is treated as a number. I've Googled and found something which seems germane.


8

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


6

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


6

Start sending a simple PHP file with a command that does not require output, but allows you to determine whether it's been executed or not. Simply run twice the RFI and send from netcat: <?php /* do nothing */ ?> and <?php sleep(10); ?> If the second command has the web site returning the page in a time 10 seconds longer than with the ...


5

There are a lot of ways. Judging by the main features of your website, an attacker could have used: SQL injection: it is not necessary to have direct access to the database. If you want technical details, this question and its answers explain different ways to obtain a shell from a SQL injection; credential theft: the attacker could have stolen or ...


4

I see that you accepted gabedwrds solution (which is excellent, by the way), but I wanted to post one potential solution that I have used in the past when doing some interesting pentesting practice. (I am by no means an expert in that field, but I am sometimes a hobbiest.) If you will notice, the script never sets any policy for handling a user abort. By ...


3

Everything published about this indicates that the FBI seized control of the onion webserver (in doing so, becoming one of the world's largest child porn distributors for a couple weeks, go feds) and then used a combination of drive-by-malware-downloads and known plug-in exploits (like Flash) to bypass Tor, rather than actually breaking it. So, no, the FBI ...


2

I'd recommend looking for non-recent versions of OpenSSH in your search. Since it's a relatively well maintained library, if there's any known exploits, they've likely already been patched. However if you look through the CVE list for working DOS methods on older OpenSSH versions, you'll be able to access all those nasty bugs that have already been patched! ...


2

Search for uploadify on https://www.exploit-db.com and you will notice that the JS-Script is part of your theme and vulnerable to Arbitrary File Upload Vulnerability. You could delete that Script and your theme might still work or better yet use another more secure theme.


2

It can, but not directly. This vulnerability does not inject code on your webserver, rather it injects JavaScript that, when you visit the page, will be executed in your browser. What can happen then is that an attacker steals your session cookies and logs onto your wordpress website or redirects you to a malicious page with malware or a phishing website to ...


2

Is this 100% likely to be a TOR/ Firefox exploit. While nobody except the FBI have the exact details everything known so far suggests that this is an exploit against the browser. It still needs to be delivered to the browser. The website in question is/was on TOR. Would the FBI's 'mystery exploit' work for uncovering the identities of Tor browser user'...


2

So, The issue was: I was running apache on my localhost to host the exploit and was trying to backconnect to myself. (I realized this after I shelled myself once.) After that, I hosted a one liner reverse shell (thanks to the comments by @Michael) on a different machine and spawned a shell on the target machine.


2

I don't think you can get a solid answer for this. But not many are at risk even if they are running at risk versions of ImageMagick. First one would have to be able to figure out how many PHP applications are live with ImageMagick installed and configured. No major CMS or PHP application requires the ImageMagick library. For image manipulation the GD2 ...


2

Similar to what others have said, PHP has a max memory size. If you put in POST data that was JUST big enough to use ALMOST all of PHP's memory up, then it could conceivably crash when it gets exactly to this line if it ran out of memory: echo 'Wrong or empty password.' This is built on three principles: 1) When sessions are enabled, PHP doesn't flush ...


2

It is not possible to encode the exploit as you would encode a payload. The reason is that the data that is part of an exploit is directly processed by the vulnerable application (in this case Flash). The function inside the Flash binary which process the exploit data won't decode it first. In case of payloads we can encode it because when the payload gets ...


1

Assuming you can modify the ./ascii.txt, I would put this text inside: <?php override_function('md5', '$a', 'return "castle";'); And that should work.


1

When you do a penetration test, you do not want (usually) to break your target. This is why you must choose the payload of your attack (what will be sent to the target service) so that it shows you that a vulnerability exists but without breaking anything. The examples you show are typical in the vulnerability analysis part of a pentest: they work when ...


1

DoS is just may request at the same time. Proof of concept is to run many requests to authenticate to one server in some time period. I don't know what more do you want to hear. Current OpenSSH version mitigates this with random early drop if the amount of the connections exceeds some limit and starts rejecting all the connection if the hard limit of ...


1

Exactly what it sounds like - it's the estimated price for an exploit of this kind. Generally a zero-day exploit (e.g. unpatched, and ideally exclusive to buyer), but not always (there is still a small market for patched bugs, where the target is known not to patch in a timely fashion). There are various "black market" sites offering exploits for sale, so ...



Only top voted, non community-wiki answers of a minimum length are eligible