Chapter 7 practical examples of remote attacks
the unauthorized reproduction in whole or in part of this publication in any form is prohibited
We will now copy the required files to the hard disk using the Diskin close to the set.
If we do not have binary versions of the programs used we will now compile and install them in the system
to start the compilation process.
We give the make command.
Finally we install the unmap program on the hard disk.
We compile and install the netcat application.
We use the scanner to check the services available in the victim computer now we will verify the versions
of the services made available by the server analyzing greeting messages on the specific ports.
As we have an account on the server being investigated we can check the configuration of the Apache
server and the possibility of exploiting security holes
as we can see it's possible to execute system requests through the script.
We will now check the content of the w w w service on the server we are investigating.
It is the PBB form version 2.0 dot 0 8.
Let's search the internet to find out about the potential errors in the software.
We did it by manipulating the value of the highlight paramita.
It is possible to execute our own request.
Now let's try to create our own exploit using the error in PBB for this purpose.
We will now familiar lies ourselves with the basic instructions for the Python language.
Python commands can also be run outside interactive mode by creating a file that contains a request
set
Python also allows us to use external libraries.
For instance FGP LGB
as we can see we can easily perform operations connected to the connection without worrying about technical
details.
The U R L L I B library helps us take advantage of the error using it we can easily generate queries
to the H.T. TPD server
after preparing a query.
We start the connection and read the information returned by the server
the content of interest to us will be located between the start and stop tags only this content will
be shown on screen.
We did it our request has been executed by the server.
Now let's try to use the final version of the exploit created it should work equally well
everything went according to plan.
Now let's use the netcat program to create an independent connection with the server.
The connection has been made correctly the system kernel is Version 2.0 for 20.
Let's find out if it contains any errors.
Voila.
This version of the kernel contains a serious error.
The local use of which can raise the privileges of a normal user led search.
Therefore for a file with the exploit and put it to use
after compiling successfully it is time to start up the exploit.
We did it thanks to the use of the technique of inject the HP code and the exploit.
We obtained full access to the system by granting ourselves administrator rights.