2008年10月 的日志
reDuh: Re-inventing TCP like its 1973!
reDuh was released as part of SensePost’s BlackHat USA 2008 talk on tunnelling data in and out of networks. Most external firewalls block all incoming sockets except for port 80/443. reDuh allows an attacker to use the compromised web server as a tunneling proxy into the internal network enviroment. reDuh encodes data into valid HTTP requests, which is then delivered to the server agent, decoded, and redirects the data to the various configured tunnels. reDuh is available in JSP/PHP/ASP.
主页：reDuh home page
下载地址：reDuhClient (the local proxy) | reDuhu Server Pages (JSP/PHP/ASP)
在 Way7T 那里看到的，原文题目为：超强的内网渗透跳板webshell。
Tags: reDuh, WebShell入侵骗子站xuehk.com全过程
鬼仔注：本文的亮点在“仔细看过讨论后得知原来用nc反弹回来的shell权限是比webshell权限高的”这句，其实这个以前在提权之道（关于WNDOWS 2003 目录权限的初探）中就提到过—“反弹回来的SHELL的权限与网站的权限是不一样的”。
文章作者：落叶纷飞[J.L.S.T]
信息来源：安全叶子技术小组[J.Leaves Security Team] （http://00day.cn）
本文已发表于黑客手册0807期,转载请保留此信息.
这篇文章在两个多月前的时候我就完成了，但是只是做为我自己的入侵笔记来用，并没有想过要投稿。但现在因为比较急用银子，所以就发给N0h4ck献丑了。（为了有人对号入座，我把图片稍稍处理了一下，请读者们见谅）。
阅读全文 »
PHP二分法注射猜解
来源：wolvez
b.php
<?php
$conn = new com("ADODB.Connection");
$connstr = "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=". realpath("data.mdb");
$conn->Open($connstr);
$rs = new com("ADODB.RecordSet");
$sql="select * from news where id=".$_GET[id];
$rs->Open($sql,$conn,1,1);
if(! $rs->eof) {
echo "{ok}";
} else{
echo "{no}";
}
?>mIRC 6.34 Remote Buffer Overflow Exploit
#!/usr/bin/perl
#
#
# mIRC 6.34 Remote Buffer Overflow Exploit
# Exploit by SkD (skdrat <at> hotmail <.> com)
# —————————————-
# A day’s work of debugging and looking at mIRC.
#
# Tested on Windows XP SP3 English and Windows Vista SP0.
#
# Credits to securfrog for publishing the PoC.
#
# Author has no responsibility over the damage you do with this!
#
# Note: You might change the addresses for Vista ;)
#
# —————————————-
阅读全文 »
mysqlhack
来源：T00LS
MySQL 利用工具.
连接对方的MySQL后,可以上传文件,执行dos命令.以及下载文件并运行.
软件需要 Microsoft .NET Framework 2.0 支持
无法打开软件请安装 Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 下载地址:
http://www.microsoft.com/downloads/details.aspx?FamilyID=0856eacb-4362-4b0d-8edd-aab15c5e04f5&displaylang=zh-cn
阅读全文 »
Serv-U 7.2.0.1 Remote FTP File Replacement Vulnerability (auth)
Serv-U 7.2.0.1 Remote FTP File Replacement Vulnerability (auth)
#Serv-U 7.2.0.1 ftp file replacement
#user must have upload permissions
#
#(x) dmnt 2008-10-01
阅读全文 »
