I called it “hack the hacker” – my plan was to exploit a toolkit, which has been coded for exploiting.
Thought of it for a while, and then i took the next toolkit i could find and began.

The result was a remote code/command execution, which was very easy to find, but the coder didn’t notice.

There is many more stuff, that can be used in a similar way, but first of all the exploit.

URL of exploit

Some of you know the problem.
How can you deactivate or manipulate the apache logs?
The whole procedure is not that difficult and so i’ll explain it quickly.

In general apache creates two logfiles per default. These are error.log and access.log.
We deal mainly with access.log, because the important stuff is logged here.
We can find it at /apache2/logs/.
I’ll show you an extract, that you can see what is logged there:

93.221.465.157 – - [14/Feb/2009:06:43:56 +0100] “GET /index.php?s=test HTTP/1.1″ 200 806

I’ll explain the content later.

We’ve to search the file httpd.conf, so that we can manipulate the content.
When using windows or linux, the file is located in /apache2/conf/
Now we’ve to open the file and search the line beginning with “LogFormat”:

It could look as follows:

LogFormat “%h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”” combined

Various values are saved, contain the data which will be saved in Access_log.

Name of variables Anzeigen

Now you can choose, what will be logged.
You can define a fix value as well, by substituting the variable with text. In this case i replaced the
variable %h with 127.0.0.1:

LogFormat “127.0.0.1 %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”” combined

Because of this substitution, it’s only shown your choosen IP

Of course you can also delete everything, so that nothing is displayed anymore.

You’ve to apply the changes to every “LogFormat”, so that every logfile is updated with your changes.

When you’ve saved the file, you just have to restart apache.

To complete the demo video season i presented a possible action, that could be done if
magic_quotes_gpc = off, FILE permission given and CHMOD is set to full rights.

URL of video

If a few tutorials are done, there’s a point, when you just want to create
a demo video, without explanations and mistakes that can happen while speaking.

One of that videos i want to present now:

URL of video

In formal language complex processes can be presented in an comprehensible and clearer way.
The process of a SQL Injection differs from user to user and i decided to
present a possible way in an event-driven process chain.
It’s a very simple chain, in which i only use 2 states.
I hope it’s more clearer now:

GDLib offers the possibility to capture screenshots.
If you don’t know GDLib, here you’ve got a little extract of Wikipedia

The GD Library, short GD or GDlib, is one of Thomas Boutell and other developed open source-application library for dynamical creating and manipulating of graphics. The GD library is written in C geschrieben, but there
are Interfaces to other programming languages like Perl or PHP.

I’ll show the sourcecode:

1
2
3
4
5

<?php
$im = imagegrabscreen();
imagepng($im, "Screenshot.png");
imagedestroy($im);
?>

The problem is, that you need a windows server, because linux doesn’t support that function.
But you can solve it this way:
You install xampp with GDLib and can run the script on localhost.
If you forward your port 80 now, it’s possible to get access remotely.
If someone navigates to your site the screenshot will be created.

It’s nothing special, but you can get some more information e.g. which antivirus application the victim is using

By accident i found the whole sourcecode of a Sponsorads layer on their server I want to present it to you for sure.
Some of you could think something like: “Wtf can i do with it?” It’s simple, you can e.g.

• change the layer, that it’s closed after 5 seconds without clicking on it.
• reduce the layers size, so that it’s not as large as before
• increase the layers size, so that you’ve to click it away to see anything.

Sourcecode

While browsing Google for interesting websites, you sometimes set priority at the country the pages
are located in.

You can automate it well with the GET parameter “cr”, because it looks as follows:

cr = country + countrycode(in capital letters)

if you wanna search in the USA with country code “US” you’ve to use:

cr=countryUS

——————

A list of all country codes i wanna present now:

Country codes

Here you can find the default paths of various operating systems.
They can be used for exploiting local file inclusion (LFI) vulnerabilities, or the load_file() function.

If you wanna know what operating system is running, you can use the following firefox Add-On.

https://addons.mozilla.org/de/firefox/addon/4276

ServerRoot              ::      /usr/local/apache2
DocumentRoot            ::      /usr/local/apache2/htdocs
Apache Config File      ::      /usr/local/apache2/conf/httpd.conf
Other Config Files      ::      /usr/local/apache2/conf/extra/
SSL Config File         ::      /usr/local/apache2/conf/extra/httpd-ssl.conf
ErrorLog                ::      /usr/local/apache2/logs/error_log
AccessLog               ::      /usr/local/apache2/logs/access_log
cgi-bin                 ::      /usr/local/apache2/cgi-bin (enabled by default, but the bundled scripts are 644)
binaries (apachectl)    ::      /usr/local/apache2/bin
start/stop              ::      /usr/local/apache2/bin/apachectl (start|restart|graceful|graceful-stop|stop|configtest)

ServerRoot              ::      /usr/local/apache2
DocumentRoot            ::      /usr/local/apache2/htdocs
Apache Config File      ::      /usr/local/apache2/conf/httpd.conf
SSL Config              ::      /usr/local/apache2/conf/ssl.conf
ErrorLog                ::      /usr/local/apache2/logs/error_log
AccessLog               ::      /usr/local/apache2/logs/access_log
cgi-bin                 ::      /usr/local/apache2/cgi-bin (enabled by default, but the bundled scripts are 644)
binaries (apachectl)    ::      /usr/local/apache2/bin
start/stop              ::      /usr/local/apache2/bin/apachectl (start|stop|graceful|configtest)

ServerRoot              ::      /usr/local/apache
DocumentRoot            ::      /usr/local/apache/htdocs
Apache Config File      ::      /usr/local/apache/conf/httpd.conf
ErrorLog                ::      /usr/local/apache/logs/error_log
AccessLog               ::      /usr/local/apache/logs/access_log
cgi-bin                 ::      /usr/local/apache/cgi-bin (enabled by default, but the bundled scripts are 644)
binaries (apachectl)    ::      /usr/local/apache/bin
start/stop              ::      /usr/local/apache/bin/apachectl (start|stop|graceful|configtest)

ServerRoot              ::      /etc/apache2
DocumentRoot            ::      /var/www
Apache Config Files     ::      /etc/apache2/apache2.conf
                        ::      /etc/apache2/ports.conf
Default VHost Config    ::      /etc/apache2/sites-available/default, /etc/apache2/sites-enabled/000-default
Module Locations        ::      /etc/apache2/mods-available, /etc/apache2/mods-enabled
ErrorLog                ::      /var/log/apache2/error.log
AccessLog               ::      /var/log/apache2/access.log
cgi-bin                 ::      /usr/lib/cgi-bin
binaries (apachectl)    ::      /usr/sbin
start/stop              ::      /etc/init.d/apache2 (start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean)

Notes:

1. The Debian/Ubuntu layout is fully documented in /usr/share/doc/apache2/README.Debian
2. Debian/Ubuntu use symlinks to enable vhosts and modules. Configuration files are created in their respective sites-available and mods-available directories. To activate vhosts and modules, symlinks are created in the respective sites-enabled and mods-enabled directories to the config files in either sites-available and mods-available. Debian provides scripts to handle this process called ‘a2ensite’ and ‘a2enmod’ which enables vhosts and modules.
3. The default DocumentRoot is specified in the default vhost config file, /etc/apache2/sites-available/default

ServerRoot              ::      /etc/apache
DocumentRoot            ::      /var/www
ErrorLog                ::      /var/log/apache/error.log
AccessLog               ::      /var/log/apache/access.log
cgi-bin                 ::      /usr/lib/cgi-bin
binaries (apachectl)    ::      /usr/sbin
start/stop              ::      /etc/init.d/apache (start|stop|graceful|configtest)

ServerRoot              ::      /etc/httpd
Primary Config Fle      ::      /etc/httpd/conf/httpd.conf
Other Config Files      ::      /etc/httpd/conf.d
Module Locations        ::      /usr/lib/httpd/modules
DocumentRoot            ::      /var/www/html
ErrorLog                ::      /var/log/httpd/error_log
AccessLog               ::      /var/log/httpd/access_log
cgi-bin                 ::      /var/www/cgi-bin (empty and disabled by default)
binary                  ::      /usr/sbin/httpd
runtime directory       ::      /etc/httpd/run
start/stop              ::      /sbin/service httpd {start|stop|restart|condrestart|reload|status|fullstatus|graceful|help|configtest}

Notes:

1. There is an extra config file in /etc/sysconfig/httpd which can be used to change to the worker mpm /usr/sbin/httpd.worker.
2. Extra config files named *.conf are loaded from /etc/httpd/conf.d. This directory is used by packages like mod_python for drop-in configs
3. If you’re having issues with authorization and your permissions are correct make sure that you try testing with SELinux turned off. Run ’setenforce 0′ and use ‘chcon’ to fix permissions. Run ‘ls -alZ’ to view the current permissions.’ SELinux first manifested itself in Fedora Core 3, RHEL 4, and CentOS 4.

ServerRoot              ::      /etc/httpd
Primary Config Fle      ::      /etc/httpd/conf/httpd.conf
DocumentRoot            ::      /var/www/html
ErrorLog                ::      /var/log/httpd/error_log
AccessLog               ::      /var/log/httpd/access_log
cgi-bin                 ::      /var/www/cgi-bin (empty and disabled by default)
binary                  ::      /usr/sbin/httpd
start/stop              ::      /sbin/service httpd {start|stop|restart|condrestart|reload|status|fullstatus|graceful|help|configtest}

Mandriva (Apache 2.2):

ServerRoot              ::      /etc/httpd
Primary Config Fle      ::      /etc/httpd/conf/httpd.conf
DocumentRoot            ::      /var/www/html
ErrorLog                ::      /var/log/httpd/error_log
AccessLog               ::      /var/log/httpd/access_log
cgi-bin                 ::      /var/www/cgi-bin
binary                  ::      /usr/sbin/httpd
start/stop              ::      /sbin/service httpd
{start|stop|restart|reload|graceful|condreload|closelogs|update|condrestart|status|extendedstatus|configtest|configtest_vhosts|semcleanrestart|debug|show_defines}

ServerRoot              ::      /usr
Primary Config Fle      ::      /etc/apache2/httpd.conf
DocumentRoot            ::      /Library/WebServer/Documents
ErrorLog                ::      /var/log/apache2/error_log
AccessLog               ::      /var/log/apache2/access_log
cgi-bin                 ::      /Library/WebServer/CGI-Executables (empty by default)
binary                  ::      /usr/sbin/httpd
start/stop              ::      /usr/sbin/apachectl (start|stop|restart|fullstatus|status|graceful|graceful-stop|configtest|help)

Notes:

1. apachectl graceful is equivalent to apachectl restart and doesn’t keep running connections alive. Similarly, graceful-stop is not graceful.
2. The /usr/sbin/envvars script is ineffective for setting environment variables. See http://lists.apple.com/archives/web-dev/2008/Apr/msg00059.html

ServerRoot              ::      /usr
Primary Config Fle      ::      /etc/httpd/httpd.conf
DocumentRoot            ::      /Library/WebServer/Documents
ErrorLog                ::      /var/log/httpd/error_log
AccessLog               ::      /var/log/httpd/access_log
cgi-bin                 ::      /Library/WebServer/CGI-Executables (empty by default)
binary                  ::      /usr/sbin/httpd
start/stop              ::      apachectl (start|stop|restart|fullstatus|status|graceful|configtest|help)

ServerRoot              ::      /usr/pkg
Config File             ::      /usr/pkg/etc/httpd/httpd.conf
DocumentRoot            ::      /usr/pkg/share/httpd/htdocs
ErrorLog                ::      /var/log/httpd/error_log
AccessLog               ::      /var/log/httpd/access_log
cgi-bin                 ::      /usr/pkg/libexec/cgi-bin
binaries (apachectl)    ::      /usr/pkg/sbin
start/stop              ::      /etc/rc.d/apache [fast|force|one](start stop restart rcvar reload status poll)
/etc/rc.conf variables  ::      apache=YES, apache_start="start" (or "startssl")

Notes:

1. The “apache” script must be copied from the installation default /usr/pkg/share/examples/rc.d to /etc/rc.d (for automatic rc.conf usage) or /usr/pkg/etc/rc.d (for advanced usage).

ServerRoot              ::      /usr/local
Config File             ::      /usr/local/etc/apache22/httpd.conf
DocumentRoot            ::      /usr/local/www/apache22/data
ErrorLog                ::      /var/log/httpd-error.log
AccessLog               ::      /var/log/httpd-access.log
cgi-bin                 ::      /usr/local/www/apache22/cgi-bin
binaries (apachectl)    ::      /usr/local/sbin
start/stop              ::      /usr/local/etc/rc.d/apache22.sh (start|restart|stop|reload|graceful|gracefulstop|configtest)
/etc/rc.conf variables  ::      apache22_enable="YES"

Notes:

1. Other variables to insert in rc.conf are listed in the comments at the top of the start/stop script
2. To start 2.2 on freebsd 6.1 the accf_http kernel module must be loaded. To do this once, run kldload accf_http . To do so at boot time, add accf_http_load=”YES” to /boot/loader.conf
3. Apache 2.2.6 in the FreeBSD 6.2 release will start regardless of the accf_http kernel module being loaded, and by default doesn’t use it. To reverse this, add apache22_http_accept_enable=”YES” to /etc/rc.conf (which will cause the kernel module to be loaded and Apache to use it).

ServerRoot              ::      /usr/local
Config File             ::      /usr/local/etc/apache2/httpd.conf
DocumentRoot            ::      /usr/local/www/data
ErrorLog                ::      /var/log/httpd-error.log
AccessLog               ::      /var/log/httpd-access.log
cgi-bin                 ::      /usr/local/www/cgi-bin
binaries (apachectl)    ::      /usr/local/sbin
start/stop              ::      /usr/local/etc/rc.d/apache2.sh [fast|force|one](start|restart|stop|reload|configtest|rcvar)
/etc/rc.conf variables  ::      apache2_enable="YES"

Notes:

1. Other variables to insert in rc.conf are listed in the comments at the top of the start/stop script

ServerRoot              ::      /usr/local
Config File             ::      /usr/local/etc/apache/httpd.conf
DocumentRoot            ::      /usr/local/www/data
ErrorLog                ::      /var/log/httpd-error.log
AccessLog               ::      /var/log/httpd-access.log
cgi-bin                 ::      /usr/local/www/cgi-bin
binaries (apachectl)    ::      /usr/local/sbin
start/stop              ::      /usr/local/etc/rc.d/apache.sh
rc.conf variables       ::      apache_enable="YES"
    (other variables to insert in rc.conf are listed in the comments at the top of the start/stop script)

Notes:

1. See: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-apache.html

ServerRoot              ::      "C:/Program Files/Apache Software Foundation/Apache2.2"
Config File             ::      "C:/Program Files/Apache Software Foundation/Apache2.2/conf/httpd.conf"
DocumentRoot            ::      "C:/Program Files/Apache Software Foundation/Apache2.2/htdocs"
ErrorLog                ::      "C:/Program Files/Apache Software Foundation/Apache2.2/logs/error.log"
AccessLog               ::      "C:/Program Files/Apache Software Foundation/Apache2.2/logs/access.log"
cgi-bin                 ::      "C:/Program Files/Apache Software Foundation/Apache2.2/cgi-bin/"
binaries (apachectl)    ::      "C:/Program Files/Apache Software Foundation/Apache2.2/bin"

Notes;

1. There are extra config files in “C:/Program Files/Apache Software Foundation/Apache2.2/conf/extra” that can be included for options such as vhosts

ServerRoot              ::      /usr/apache2
Config File             ::      /etc/apache2/httpd.conf
DocumentRoot            ::      /var/apache2/htdocs
ErrorLog                ::      /var/apache2/logs/error_log
AccessLog               ::      /var/apache2/logs/access_log
cgi-bin                 ::      /var/apache2/cgi-bin
binaries                ::      /usr/apache2/bin

Notes:

1. Config needs to be copied from example file to httpd.conf. Apache-1.3 is the default installation in /etc/init.d and /etc/rc3.d files.

ServerRoot              ::      /usr/apache
Config File             ::      /etc/apache/httpd.conf
DocumentRoot            ::      /var/apache/htdocs
ErrorLog                ::      /var/apache/logs/error_log
AccessLog               ::      /var/apache/logs/access_log
cgi-bin                 ::      /var/apache/cgi-bin
binaries                ::      /usr/apache/bin
start/stop              ::      /etc/init.d/apache (start|startssl|sslstart|start-SSL|restart|stop)

Notes:

1. Config needs to be copied from example file to httpd.conf.
2. Apache-1.3 is the default installation in /etc/init.d and /etc/rc3.d files. Also Apache Tomcat is included in 1.3 installation.

ServerRoot              ::     /usr
DocumentRoot            ::     /var/www/htdocs
AccessLog               ::     /var/log/apache/access_log
ErrorLog                ::     /var/log/apache/error_log
binaries (apachectl)    ::     /usr/sbin
modules                 ::     /usr/libexec/apache
system startup script   ::     /etc/rc.d/rc.httpd (start|stop|restart|graceful)
Apache config file      ::     /etc/apache/httpd.conf
mod_ssl config file     ::     /etc/apache/mod_ssl.conf
php config file         ::     /etc/apache/mod_php.conf
cgi-bin                 ::     /var/www/cgi-bin
on-line docs ("manual") ::     /var/www/htdocs/manual
proxy cache             ::     /var/cache/proxy

ServerRoot              ::     /usr
DocumentRoot            ::     /svr/httpd/htdocs
AccessLog               ::     /var/log/httpd/access_log
ErrorLog                ::     /var/log/httpd/error_log
binaries (apachectl)    ::     /usr/sbin
modules                 ::     /usr/lib/httpd
system startup script   ::     /etc/rc.d/rc.httpd (start|restart|graceful|graceful-stop|stop)
Apache config file      ::     /etc/httpd/httpd.conf
mod_ssl config file     ::     /etc/httpd/extra/httpd-ssl.conf
php config file         ::     /etc/httpd/mod_php.conf
cgi-bin                 ::     /svr/httpd/cgi-bin
on-line docs ("manual") ::     /svr/httpd/htdocs/manual

ServerRoot              ::      /srv/www
DocumentRoot            ::      /srv/www/htdocs
Apache Config File      ::      /etc/apache2/httpd.conf
Other Config Files      ::      /etc/sysconfig/apache2
SSL Config File         ::      /etc/apache2/ssl-global.conf
ErrorLog                ::      /var/log/apache2/error_log
AccessLog               ::      /var/log/apache2/access_log
cgi-bin                 ::      /srv/www/cgi-bin
binaries (apachectl)    ::      /usr/sbin
start/stop              ::      /etc/init.d/apache2 (start|restart|restart-graceful|reload|graceful|graceful-stop|stop|configtest)

Notes:

1. Modules are enabled in /etc/sysconfig/apache2 which is read by the startup script. The a2enmod/a2dismod tool can be used to activate/deactivate modules.
2. See /usr/share/doc/packages/apache2/README.SUSE for more information.

ServerRoot              ::      /usr/lib/apache2
DocumentRoot            ::      /var/www/localhost/htdocs
Apache Config File      ::      /etc/apache2/httpd.conf
Other Config Files      ::      /etc/conf.d/apache2
Default VHost Config    ::      /etc/apache2/vhosts.d/00_default_vhost.conf
Module Configuration    ::      /etc/apache2/modules.d
Module Locations        ::      /usr/lib/apache2/modules
ErrorLog                ::      /var/log/apache2/error_log
AccessLog               ::      /var/log/apache2/access_log
cgi-bin                 ::      /var/www/localhost/cgi-bin
binaries (apache2ctl)   ::      /usr/sbin
start/stop              ::      /etc/init.d/apache2 (start|restart|graceful|stop|configtest)

Notes:

1. To enable a module, “-D MODULENAME” must be added to APACHE_OPTS in /etc/conf.d/apache2