Leaderboard

//editat. O sa incerc sa o zic mai pe sleau, daca o sa o zic iar candva.

Il dau gratuit, e la godaddy mai are un an. Inca mai sunt multi sa-mi dea NS-urile la domeniile pe care le-am luat. Astept asta. Propagarea dureaza maxim 3 zile

File path injection in PHP ? 5.3.6 file upload (CVE 2011-2202) Saturday, June 18, 2011 Since the thing went public before new PHP version has been released, I present full details of the latest PHP vulnerability I reported - together with some sweet demo exploit. The issue was found with fuzzing being part of my recent file upload research. And I still have some more to show in the future My thanks go to Pawe? Gole? who helped analyze the vulnerability. The PHP Part The whole issue is tracked as PHP bug #54939, but the website is now down. The exemplary exploit is at pastebin. The nature of the bug is simple. PHP claims to remove the path component from HTTP file upload forms (transferred as MIME multipart/form-data requests), leaving only the file name given by the user agent. This is both for security, and to fix MSIE incompatibility (IE used to send full path like this: c:\WINDOWS\WHATEVER\My_file.txt). However, in 2008 PHP developers made a off-by-one error, and, as a result, if a name starts with \ or / and has no other (back)slashes, it's left as-is. So, this allows for: /vmlinuz /autorun.inf (/ will map to C:\ in WINDOWS - the drive where your PHP is run from) /boot.ini and other interesting file "names" to pass through. The application part Of course, what this means is simply that $_FILES[$input_field_name]['name'] will contain unsanitized file path - and that's not enough to complete an exploit. PHP script would need to use that filename as a destination for file writing. Unfortunately, at least a few applications do. I've found some pretty interesting examples. Among them is this AjaxFileUpload plugin. There are more applications with the same approach - just go on looking! AjaxFileUpload simply passes the given file "name" to move_uploaded_file(), which would try to create/overwrite a file in a root directory... The set up part And that will most likely fail, because of insufficient permissions. Who on Earth would allow PHP to write to root? Well, default Apache installation on Windows systems is run as a SYSTEM user (a.k.a root). Also, for some shared hostings PHP is run in a chroot-ed environment, and / is the document root of a website (which allows for an easy site defacement). It's tricky, I agree, that's why this bug is v. difficult to exploit in the wild (luckily). But it's possible! Today's Heroes: WAMP server, newest version (PHP 5.3.5), default install PHP <= 5.3.6, (5.3.5 in the demo) Windows XP AjaxFileUpload - A jQuery plugin that simulates asynchronous file uploads. In the exploit I simply show that (thanks to vulnerable set up) I can overwrite c:\boot.ini and make the system unbootable. There are more advanced scenarios that could be done (essentially I can supply a boot record file to use on next boot), but it's not my area of expertise. To upload a file, the HTML5 arbitrary file upload technique was used. So, patch your PHPs and bye! Sursa si video demonstrativ: http://blog.kotowicz.net/2011/06/file-path-injection-in-php-536-file.html

FileShare Download vplay-vip.txt bigup..

Am o curiozitate: de ce ar da cineva gratis un domeniu pe care a dat niste bani - vad ca la godaddy un domeniu similar costa $11.99*/yr iar domeniul tau deabia l-ai creat si il si faci cadou. Created on: 02-Jun-11 Expires on: 02-Jun-12 Fara suparare, dar eu m-am invatat ca totul pe lumea asta are un pret!

[+] Am vazut ca majoritatea userilor noi care apar pe forum cauta asta si am vazut ca mai este un topic in care toti scriu si nu le raspunde nimeni la intrebari si mai mult de atat buti nu sunt buni ceea ce ii face pe ei sa creada ca programul nu e bun. O sa fac eu sa zicem "tutorialul" acesta pentru userii care nu stiu ce au de facut. [+] Pentru inceput avem nevoie de o arhiva cu cateva "floodere" (sunt cele pe care le folosesc si eu ) Arhiva contine 3 foldere : - Flooderi - IR IDMakerV3.2 - Multi Yahoo Boots Checker La Flooderi sunt programele , La IR IDMaker V3.2 este un program cu care puteati realiza buti foarte usor ,si la Multi Yahoo Boots Checker se afla un program cu care puteti scana lista voastra de buti si sa salvati buti care mai merg si sa scapati de cei care numai merg. [+] Intrati la Flooderi si deschideti pe rand doar : -Big Killer Release -Fusion Ym v2 -GMC Booters Restul de 2 le lasati acolo pentru ca nu merg si mi-a fost lene sa le sterg..^^ La toate cele 3 programe o sa vedeti ca va apare Load la fiecare dintre ele. Dati la Load pe rand la fiecare si selectati fisierul .txt din folderul Flooderi numit dEv1L Boots buni. Faceti la fel la toate si dupaia dati la toate log in. Asteptati putin sa se incarce toate . O sa ia ceva timp sa se incarce..Nu mult.Cam 45 de secunde . Dupa ce s-au incarcat buti bagati idiul acolo la Victim si dati in felul urmator. La Big Killer Release dati Flood ,la Fusion Ym dati Fast YM Flood iar la Gmc booters dati Boot 1. Acum victima va fi scoasa de pe mess.Nu dureaza foarte mult ..depinde de viteza netului. [+]Cam asta e tot ca sa flodati pe cineva. [+]Ca sa creati buti faceti in felul urmator : Intrati in arhiva IR IDMakerV3.2 Intrati in IR IDMaker . Cand ati intrat in el bifati : -Random Boot name -Randomize Name and Lastname -Randomize information Si apasati butonul start. Acum v-a aparut codul captcha in dreapta pe care va trebui sa il scrieti in stanga butonului Create..Dupa fiecaredata cand scrieti codul apasati pe Create.Si un boot se va creea. Dupa dati Save si veti putea salva buti creati unde vreti. [+] Daca "tutorialul" meu v-a fost de ajutor apasati pe butonul REP de sub avatarul meu. Sper ca am fost de folos noilor membri care cautau asta.