0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
SEANux 1.0 Remote Code Execution Vulnerability
[Title: SEANux 1.0 remote code execution Vulnerability
Author: Larry W. Cashdollar, @_larry0
Date: 1/23/2015
Advisory: http://origin.vapid.dhs.org/blog/01-23-2015/
The SEA stated that this distribution is not to be used as a server, in order to secure network connections against port 80, modify the apache configuration to bind to localhost:80. This is a misconfiguration and will be fixed in the next release.
Modify ports.conf in the following way:
# cat ports.conf |grep -n 127
8:NameVirtualHost 127.0.0.1:80
9:Listen 127.0.0.1:80
SEANux 1.0 is a linux distribution Available here developed by the Syrian Electronic Army. The SEA pre-populated the distribution with some of their home grown tools under /var/www.
The tools appear to be developed in PHP & Perl and are web based.
They are served through a local apache instance running on the desktop system
The apache webserver listening on 0.0.0.0:80 allowing remote access to all of the tools in their catalog. These tools allow remote command execution and file uploads, it was the intent of the SEA to have these only accessable to the local user.
root@larry-VirtualBox:/etc/mysql# netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN
tcp 0 0 127.0.1.1:53 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 192.168.0.33:22 192.168.0.22:53474 ESTABLISHED
tcp6 0 0 ::1:6010 :::* LISTEN
tcp6 0 0 :::80 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:631 :::* LISTEN
tcp6 1 0 ::1:57375 ::1:631 CLOSE_WAIT
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 0.0.0.0:52375 0.0.0.0:*
udp 0 0 0.0.0.0:5353 0.0.0.0:*
udp 0 0 0.0.0.0:41938 0.0.0.0:*
udp 0 0 0.0.0.0:31229 0.0.0.0:*
udp 0 0 127.0.1.1:53 0.0.0.0:*
udp6 0 0 :::37598 :::*
udp6 0 0 :::5353 :::*
udp6 0 0 :::12590 :::*
udp6 0 0 :::52638 :::*
udp6 0 0 :::546 :::*
Active UNIX domain sockets (servers and established)
This apache server is a tool server hosting web based tools by the SEA
One of the tools is a web shell to the system
The path http://192.168.0.33/tools/sea.php is a webshell, meant to be accessable only locally but due to a misconfiguration is available remotely.
Here is a screen shot after logging in:
From lines 6-15 contain the credentials sea.php:
6 $user = 'SEA'; ^M
7 $pass = 'SEA'; ^M
8 $uselogin = 1;^M
9 $sh3llColor = "#0040FF";^M
10 ^M
11 # MySQL Info ---------^M
12 $DBhost = "localhost";^M
13 $DBuser = "root";^M
14 $DBpass = "root";^M
15 #---------------------^M
Looks like an uploader script too at http://192.168.0.33/tools/uploader.php
# 0day.today [2024-11-16] #