Thomas Gregory - Spentera Blog (Page 2)

Dump Windows System Info

When you were asked to collect all Windows system information such as list of users, services, software installed and its version, Windows update history etc, you probably want to see these tools: System Information Collector WinUpdatesList v1.31 WinAudit Freeware v2.28.2 SAM/Password Extractor pwdump7* ( v7.1 ) (detected

Tutorials

Remove Comments from Configuration

If you want to configure something, sometimes it contains the comments from the developer which help us to figure out options of arguments that will be used. But if you are already familiar with the configuration, comments can be annoying, and here we provide a way to remove them (using

Security Advisory

QuickShare File Server 1.2.1 FTP Directory Traversal Vulnerability

QuickShare File Server is prone to a FTP directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to modify files outside the destination directory and possibly gain access to the system. Software Description QuickShare File Server is a easy to use file

Exploit Development

FTPGetter v3.58.0.21 Buffer Overflow (PASV) Exploit

A vulnerability has been discovered in FTPGetter, which can be exploited by malicious people to compromise a user’s system. The issue is likely due to insufficient bounds checking and presents itself when the affected FTP client makes a connection to a malicious server that is running PASV mode.

Tutorials

ShodanHQ Queries For Penetration Tester

Have you ever heard SHODAN Search Engine? SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners. SHODAN also lets you use boolean operators

General

ShodanHQ Exploits Search Engine

For those who want to search a vulnerable version of applications during vulnerability assessment or penetration testing, take a look at ShodanHQ new feature, a ShodanHQ Exploits Search Engine. It support CVE, OSVDB, Security Focus BID, Microsoft Security Bulletin(MSB), and Exploit-DB. Just input the application, device, brand, or version

Security Advisory

SolarFTP 2.0 Multiple Commands Denial of Service Vulnerability

SolarFTP Server 2.0 is prone to a denial of service condition. It fails to properly sanitize user-supplied input resulting in a denial of service. With a specially crafted ‘USER’, ‘APPE’, ‘GET’, ‘PUT’, and ‘NLST’ command, a remote attacker can

Exploit Development

53 bytes - Windows XP SP3 (en) notepad.exe win32 Shellcode

Finally, my first win32 shellcode.. This will execute notepad.exe when loaded. Run on Windows XP SP3 English. /* (o_Ov) say hello to all digital-echidna org crew: otoy, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix special thx to offsec, exploit-db, and corelan team */ /*shellcodetest.c*/ char code[] = "\x31\xc0\x50\

Tutorials

0day Linux Escalation Privilege Exploit Collection

I have created a script that contains of local privilege escalation exploits that was published on Exploit-DB.com between October – November 2010. Take a look at here 201011-0day-linux-exploit.tar.bz2 (md5sum: b890f6aeccf1721267166e221cd547df) *Update: I rename the file and make the script more comfort. Please note that I am not

Tutorials

Very Simple FTP Fuzzer

Written in Python, i try to make a simple fuzzer for FTP server. This script will try to fuzz the commands like APPE, USER, LIST, CWD, etc..you can find all commands here ? This script is simply a modified version from muts simple ftp fuzzer during offsec training ? Hope you

Exploit Development

Find DLL Hijacking Flaws with DLLHijackAuditKit v2

Metasploit has released DLLHijackAuditKit v2 to determine DLL vulnerabilities that still existing in the wild. This tool will scan possible DLL vulnerability and log the result to CSV file. DLLHijackAuditKit v2 can also make a PoC (will try to hijack the DLL and running calc.exe, of course this is

Web Security

How to: SQLMap (dump and destroy)

SQLMap is the tool to automate SQL Injection vulnerability exploitation. This tool is very popular to exploit the SQL Injection vulnerability. While most of web hacker enthusiast knew about this tool to gather information and retrieves the tables information, i try to share this information about the powerful of SQLMap

Web Security

OWASP ModSecurity Core Rule Set

ModSecurity is a good starting point to secure your web site. OWASP provides the core rule set (CRS) for ModSecurity rules against the most critical web application attack. From OWASP: ModSecurity is an Apache web server module that provides a web application firewall engine. The ModSecurity Rules Language engine is

Exploit Development

Batch Audio Converter <=1.0.0 Stack Overflow SEH

Kebetulan sedang mencari aplikasi yang bisa diotak-atik untuk bermain SEH exploitation, saya menemukan aplikasi Batch Audio Converter (kemungkinan sudah mati websitenya) dan berhasil di eksploitasi dengan sukses melalui tehnik SEH Overflow (tulisan mengenai SEH secara jelas bisa dilihat di situs Peter Van Eeckhoutte dan situs underground Indonesia tertua, Kecoak Elektronik)

Exploit Development

PHP include exploitation with Metasploit

Metasploit support for PHP Include exploitation, or simply known as RFI (Remote File Inclusion). I will show you how this work on CS-Cart 1.3.3 which vulnerable to remote file inclusion. The vulnerable path is at classes/phpmailer/class.cs_phpmailer.php?classes_dir=[include arbitrary php code] so

General

Penetration testing Real world mode by Offsec

A video about Penetration testing in the real world, enjoy the video from Offensive Security. It cannot be embedded, so better view on their website. The video is here: http://www.offensive-security.com/videos/penetration-testing-in-the-real-world/ Enjoy!

Tutorials

Secure Browsing dengan SSH Tunnel

Tehnik ini saya gunakan ketika memakai akses internet di area publik seperti Wireless Hotspot. Yup, secure browsing kali ini menggunakan SSH Tunnel. Tehnik yang menarik karena SSH bisa “ditebengin” dengan paket lain, sehingga paket yang “nebeng” protokol SSH juga ikut terenkripsi (SSH merupakan protokol yang aman

Tutorials

How-to: Backtrack 4 USB Persistent Changes

Here is my dirty way to make BT4 running on USB disk instead of run from DVD. Boot Live DVD Backtrack 4 Split your pendrive into 2 partitions, the 1st is for your BT4 files, and the 2nd is for your changes. I have 4 GB pendrive, so i made

Tutorials

Failed injection packet to AP

Pernah ketemu kasus seperti ini ketika lagi asik-asiknya menginjeksi paket di jaringan wireless? Saving ARP requests in replay_arp-0123-104950.cap You should also start airodump-ng to capture replies. Notice: got a deauth/disassoc packet. Is the source MAC associated ? Notice: got a deauth/disassoc packet. Is the source MAC associated