Sunday, January 28, 2024

Linux Stack Protection By Default

Modern gcc compiler (v9.2.0) protects the stack by default and you will notice it because instead of SIGSEGV on stack overflow you will get a SIGABRT, but it also generates coredumps.




In this case the compiler adds the variable local_10. This variable helds a canary value that is checked at the end of the function.
The memset overflows the four bytes stack variable and modifies the canary value.



The 64bits canary 0x5429851ebaf95800 can't be predicted, but in specific situations is not re-generated and can be bruteforced or in other situations can be leaked from memory for example using a format string vulnerability or an arbitrary read wihout overflowing the stack.

If the canary doesn't match, the libc function __stack_chck_fail is called and terminates the prorgam with a SIGABORT which generates a coredump, in the case of archlinux managed by systemd and are stored on "/var/lib/systemd/coredump/"


❯❯❯ ./test 
*** stack smashing detected ***: terminated
fish: './test' terminated by signal SIGABRT (Abort)

❯❯❯ sudo lz4 -d core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000.lz4
[sudo] password for xxxx: 
Decoding file core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 
core.test.1000.c611b : decoded 249856 bytes 

 ❯❯❯ sudo gdb /home/xxxx/test core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 -q 


We specify the binary and the core file as a gdb parameters. We can see only one LWP (light weight process) or linux thread, so in this case is quicker to check. First of all lets see the back trace, because in this case the execution don't terminate in the segfaulted return.




We can see on frame 5 the address were it would had returned to main if it wouldn't aborted.



Happy Idea: we can use this stack canary aborts to detect stack overflows. In Debian with prevous versions it will be exploitable depending on the compilation flags used.
And note that the canary is located as the last variable in the stack so the previous variables can be overwritten without problems.




Read more
  1. Hack Tools 2019
  2. Hack Website Online Tool
  3. Easy Hack Tools
  4. Hacker Tools Hardware
  5. Hack Tools For Ubuntu
  6. Nsa Hack Tools
  7. Pentest Tools Windows
  8. Hacking Tools For Windows
  9. Github Hacking Tools
  10. Hacking Tools 2020
  11. Growth Hacker Tools
  12. Hack Tools Mac
  13. Hack Tool Apk No Root
  14. Hacking App
  15. Hacking Tools For Windows 7
  16. Hacking Tools Mac
  17. Pentest Tools List
  18. Hacking Apps
  19. Pentest Tools Android
  20. Hacking Tools 2019
  21. Hacker Tools List
  22. Free Pentest Tools For Windows
  23. Hacking Tools Usb
  24. Nsa Hack Tools Download
  25. Underground Hacker Sites
  26. Hack Tools Github
  27. Pentest Tools Website
  28. Hacker Tools
  29. Hack Tools For Windows
  30. Pentest Tools Nmap
  31. Hacker Tools Apk
  32. Pentest Tools Find Subdomains
  33. Hacker Tools For Ios
  34. Nsa Hack Tools Download
  35. How To Hack
  36. Nsa Hack Tools Download
  37. Pentest Tools Url Fuzzer
  38. Hacker Tools Online
  39. Hack Tools Pc
  40. Hacker Search Tools
  41. Hacking Tools Windows 10
  42. Best Hacking Tools 2019
  43. Tools Used For Hacking
  44. Hacker Hardware Tools
  45. Hacking Tools 2019
  46. Free Pentest Tools For Windows
  47. Hacker Tools Free
  48. Top Pentest Tools
  49. Hak5 Tools
  50. Pentest Tools
  51. Pentest Tools Subdomain
  52. Pentest Automation Tools
  53. Pentest Tools Download
  54. Pentest Tools Alternative
  55. Hacker Tools Apk
  56. Hack And Tools
  57. Pentest Tools For Mac
  58. Hack Rom Tools
  59. Hacking Tools For Windows 7
  60. Tools For Hacker
  61. Pentest Tools Alternative
  62. Hacking Tools Online
  63. Ethical Hacker Tools
  64. Hacker Tools Free Download
  65. Pentest Tools Open Source
  66. Pentest Tools Linux
  67. Hacking Tools 2019
  68. Best Hacking Tools 2019
  69. Pentest Reporting Tools
  70. Pentest Tools Framework
  71. Hack Rom Tools
  72. Hack Tools
  73. Hacking Tools Mac
  74. Hack Tools Pc
  75. Hacking Tools For Mac
  76. Hack Tool Apk No Root
  77. What Are Hacking Tools
  78. Pentest Tools
  79. Tools 4 Hack
  80. Best Hacking Tools 2019
  81. Tools Used For Hacking
  82. Hacking Tools Download
  83. Hacking Tools For Pc
  84. Tools 4 Hack
  85. How To Hack
  86. Pentest Automation Tools
  87. Android Hack Tools Github
  88. Hacker Tools Hardware
  89. Hack And Tools
  90. Hack Tools Github
  91. Usb Pentest Tools
  92. Hacking Tools For Games
  93. Nsa Hack Tools Download
  94. Hack Tools Online
  95. Hack Tools For Mac
  96. Hack Apps
  97. Pentest Tools For Ubuntu
  98. Hacks And Tools
  99. Hacking Tools Free Download
  100. Hacking Tools Online
  101. Hack Tools Mac
  102. Hack Tools For Windows
  103. Hacking Apps
  104. Hacking Tools For Windows
  105. Free Pentest Tools For Windows
  106. Hacker Tools For Pc
  107. Android Hack Tools Github
  108. Pentest Tools Download
  109. Hacker Tools Free
  110. Hacker Security Tools
  111. Hacker Tools 2019
  112. Hacking Tools For Kali Linux
  113. Underground Hacker Sites
  114. Pentest Tools Apk
  115. Pentest Tools Download
  116. Hacking Tools For Beginners
  117. Hack Tools
  118. Hack Tools For Windows
  119. Nsa Hacker Tools
  120. Hack Tool Apk
  121. Pentest Box Tools Download
  122. Usb Pentest Tools
  123. Pentest Tools Url Fuzzer
  124. Hacking Tools Kit
  125. Underground Hacker Sites
  126. Pentest Tools Review
  127. Hacking Tools Windows 10
  128. Pentest Tools Open Source
  129. Wifi Hacker Tools For Windows
  130. New Hacker Tools

Ethical Hackers Platform: How To Install A bWAPP In Windows 2018


bWAPP, or a buggy web application, is a free and open source deliberately insecure web application. It helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities. bWAPP prepares one to conduct successful penetration testing and ethical hacking projects.

What makes bWAPP so unique? Well, it has over 100 web vulnerabilities!
It covers all major known web bugs, including all risks from the OWASP Top 10 project.  bWAPP is for web application security-testing and educational purposes only.

Have fun with this free and open source project!
bWAPP is a PHP application that uses a MySQL database. It can be hosted on Linux/Windows with Apache/IIS and MySQL. It can also be installed with WAMP or XAMPP. Another possibility is to download the bee-box, a custom Linux VM pre-installed with bWAPP.

First of all you have need to install a local server over system that may be XAMPP, WAMP or LAMP. These servers are totally free of cost you can freely download from the internet. Mostly XAMPP is used because it has more functionalities than others on the other hand WAMP is also a simple platform for PHP while, LAMP is used over the Linux distributions. After downloading any one of them you have need to install that first after that you'll be able to configure bWAPP over your system.

Why we use the software application for configuring this bWAPP? As we know PHP is a server side language and there must be a server to read the PHP script. Without using any server we can't do programming with PHP. If you have a little piece of code of PHP you must install a server in your system for running that PHP script.



Ethical Hackers Platform: How to Install a bWAPP In Windows 2018. Free source for exploring things related to an Ethical Hacking.

Related word


Saturday, January 27, 2024

Learning Web Pentesting With DVWA Part 6: File Inclusion

In this article we are going to go through File Inclusion Vulnerability. Wikipedia defines File Inclusion Vulnerability as: "A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic directory traversal attack, in that directory traversal is a way of gaining unauthorized file system access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application."
There are two types of File Inclusion Vulnerabilities, LFI (Local File Inclusion) and RFI (Remote File Inclusion). Offensive Security's Metasploit Unleashed guide describes LFI and RFI as:
"LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privileges, the attacker may gain access to sensitive information. If the attacker is able to place code on the web server through other means, then they may be able to execute arbitrary commands.
RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine."
In simpler terms LFI allows us to use the web application's execution engine (say php) to execute local files on the web server and RFI allows us to execute remote files, within the context of the target web server, which can be hosted anywhere remotely (given they can be accessed from the network on which web server is running).
To follow along, click on the File Inclusion navigation link of DVWA, you should see a page like this:
Lets start by doing an LFI attack on the web application.
Looking at the URL of the web application we can see a parameter named page which is used to load different php pages on the website.
http://localhost:9000/vulnerabilities/fi/?page=include.php 
Since it is loading different pages we can guess that it is loading local pages from the server and executing them. Lets try to get the famous /etc/passwd file found on every linux, to do that we have to find a way to access it via our LFI. We will start with this:
../etc/passwd 
entering the above payload in the page parameter of the URL:
http://localhost:9000/vulnerabilities/fi/?page=../etc/passwd 
we get nothing back which means the page does not exist. Lets try to understand what we are trying to accomplish. We are asking for a file named passwd in a directory named etc which is one directory up from our current working directory. The etc directory lies at the root (/) of a linux file system. We tried to guess that we are in a directory (say www) which also lies at the root of the file system, that's why we tried to go up by one directory and then move to the etc directory which contains the passwd file. Our next guess will be that maybe we are two directories deeper, so we modify our payload to be like this:
../../etc/passwd 
we get nothing back. We continue to modify our payload thinking we are one more directory deeper.
../../../etc/passwd 
no luck again, lets try one more:
../../../../etc/passwd 
nop nothing, we keep on going one directory deeper until we get seven directories deep and our payload becomes:
../../../../../../../etc/passwd 
which returns the contents of passwd file as seen below:
This just means that we are currently working in a directory which is seven levels deep inside the root (/) directory. It also proves that our LFI is a success. We can also use php filters to get more and more information from the server. For example if we want to get the source code of the web server we can use php wrapper filter for that like this:
php://filter/convert.base64-encode/resource=index.php 
We will get a base64 encoded string. Lets copy that base64 encoded string in a file and save it as index.php.b64 (name can be anything) and then decode it like this:
cat index.php.b64 | base64 -d > index.php 
We will now be able to read the web application's source code. But you maybe thinking why didn't we simply try to get index.php file without using php filter. The reason is because if we try to get a php file with LFI, the php file will be executed by the php interpreter rather than displayed as a text file. As a workaround we first encode it as base64 which the interpreter won't interpret since it is not php and thus will display the text. Next we will try to get a shell. Before php version 5.2, allow_url_include setting was enabled by default however after version 5.2 it was disabled by default. Since the version of php on which our dvwa app is running on is 5.2+ we cannot use the older methods like input wrapper or RFI to get shell on dvwa unless we change the default settings (which I won't). We will use the file upload functionality to get shell. We will upload a reverse shell using the file upload functionality and then access that uploaded reverse shell via LFI.
Lets upload our reverse shell via File Upload functionality and then set up our netcat listener to listen for a connection coming from the server.
nc -lvnp 9999 
Then using our LFI we will execute the uploaded reverse shell by accessing it using this url:
http://localhost:9000/vulnerabilities/fi/?page=../../hackable/uploads/revshell.php 
Voila! We have a shell.
To learn more about File Upload Vulnerability and the reverse shell we have used here read Learning Web Pentesting With DVWA Part 5: Using File Upload to Get Shell. Attackers usually chain multiple vulnerabilities to get as much access as they can. This is a simple example of how multiple vulnerabilities (Unrestricted File Upload + LFI) can be used to scale up attacks. If you are interested in learning more about php wrappers then LFI CheetSheet is a good read and if you want to perform these attacks on the dvwa, then you'll have to enable allow_url_include setting by logging in to the dvwa server. That's it for today have fun.
Leave your questions and queries in the comments below.

References:

  1. FILE INCLUSION VULNERABILITIES: https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
  2. php://: https://www.php.net/manual/en/wrappers.php.php
  3. LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/
  4. File inclusion vulnerability: https://en.wikipedia.org/wiki/File_inclusion_vulnerability
  5. PHP 5.2.0 Release Announcement: https://www.php.net/releases/5_2_0.php


Related posts


  1. Hacker Tools
  2. Hack Tool Apk No Root
  3. Pentest Tools Find Subdomains
  4. Hacking Apps
  5. Wifi Hacker Tools For Windows
  6. Hak5 Tools
  7. Android Hack Tools Github
  8. Hak5 Tools
  9. Pentest Box Tools Download
  10. Hack Tools Mac
  11. Hacking Tools Windows 10
  12. Hacker Tools Github
  13. Pentest Tools
  14. Best Pentesting Tools 2018
  15. Hacking Tools
  16. Hack Tools 2019
  17. Pentest Tools List
  18. Hacker Tools Software
  19. Pentest Box Tools Download
  20. Pentest Tools Nmap
  21. Hacker
  22. Hackers Toolbox
  23. Hacking Tools 2020
  24. Pentest Tools For Android
  25. Hacker Tools 2020
  26. Hacker Search Tools
  27. Hack Tools For Mac
  28. Pentest Tools Tcp Port Scanner
  29. Hacker Tools 2019
  30. Pentest Recon Tools
  31. Hack Tools Github
  32. Tools 4 Hack
  33. Growth Hacker Tools
  34. Ethical Hacker Tools
  35. Hacking Apps
  36. Hacking Tools For Games
  37. Hack Website Online Tool
  38. Hacking Tools Kit
  39. Pentest Tools Framework
  40. Hacker Tools Apk Download
  41. Hacker Tools Hardware
  42. Hacking Tools For Kali Linux
  43. Hacking Tools Online
  44. Hack Tool Apk
  45. Pentest Tools Kali Linux
  46. Hack App
  47. Pentest Tools Find Subdomains
  48. New Hack Tools
  49. Hack Tools Download
  50. Game Hacking
  51. Pentest Automation Tools
  52. Pentest Tools Subdomain
  53. Hacker Tools For Pc
  54. Hack And Tools
  55. Hacking Tools Pc
  56. Hacker Tools Hardware
  57. Pentest Tools Framework
  58. Hacking Tools Windows 10
  59. Pentest Tools Tcp Port Scanner
  60. Nsa Hacker Tools
  61. Hacking Tools 2019
  62. How To Make Hacking Tools
  63. Best Hacking Tools 2020
  64. Hack Tools For Pc
  65. Best Hacking Tools 2019
  66. Hackers Toolbox
  67. Pentest Tools Download
  68. Hacker Tools Free Download
  69. Pentest Tools Free
  70. Hacking Tools Download
  71. How To Make Hacking Tools
  72. Hacker Tools Linux
  73. Pentest Tools Find Subdomains
  74. Hacking Tools Name
  75. Tools Used For Hacking
  76. Hacking Tools For Windows Free Download
  77. Hacking Apps
  78. Pentest Recon Tools
  79. Hacker Tools 2019
  80. Tools For Hacker
  81. Pentest Tools
  82. Pentest Tools For Android
  83. Pentest Tools Free
  84. Growth Hacker Tools
  85. Blackhat Hacker Tools
  86. Termux Hacking Tools 2019
  87. Pentest Tools Url Fuzzer
  88. Hacker Tools For Ios
  89. Hacker Search Tools
  90. Hacker Tools Github
  91. Pentest Tools For Mac
  92. Underground Hacker Sites
  93. Hacker Tools Free Download
  94. Hacks And Tools
  95. What Are Hacking Tools
  96. Hack Tools Mac
  97. Hacker Tools For Ios
  98. Pentest Recon Tools
  99. Bluetooth Hacking Tools Kali
  100. Hacker Tool Kit
  101. Hacking Tools Mac
  102. Hacker Tools Hardware
  103. Hacks And Tools
  104. Tools Used For Hacking
  105. Pentest Tools Free
  106. Hacker Search Tools
  107. Hacking Tools Kit
  108. Hacking Tools Software
  109. Pentest Tools Apk
  110. Pentest Tools Bluekeep
  111. Pentest Tools Free

Files Download Information




After 7 years of Contagio existence, Google Safe Browsing services notified Mediafire (hoster of Contagio and Contagiominidump files) that "harmful" content is hosted on my Mediafire account.

It is harmful only if you harm your own pc and but not suitable for distribution or infecting unsuspecting users but I have not been able to resolve this with Google and Mediafire.

Mediafire suspended public access to Contagio account.

The file hosting will be moved.

If you need any files now, email me the posted Mediafire links (address in profile) and I will pull out the files and share via other methods.

P.S. I have not been able to resolve "yet" because it just happened today, not because they refuse to help.  I don't want to affect Mediafire safety reputation and most likely will have to move out this time.

The main challenge is not to find hosting, it is not difficult and I can pay for it, but the effort move all files and fix the existing links on the Blogpost, and there are many. I planned to move out long time ago but did not have time for it. If anyone can suggest how to change all Blogspot links in bulk, I will be happy.


P.P.S. Feb. 24 - The files will be moved to a Dropbox Business account and shared from there (Dropbox team confirmed they can host it )  


The transition will take some time, so email me links to what you need. 

Thank you all
M

More information