Copyright Disclaimer Under Section 107 of the Copyright Act 1976?Fair use is a use permitted by copyright statute that might otherwise be infringing. Non-profit, educational or personal use tips the balance in favor of fair use. Unless you are in this field of investigative journalism, especially covering extremely sensitive subjects and potentially dangerous subjects as well, you simply cannot understand the complexities and difficulties involved with this work that I face every day.
Monday, June 17, 2013
4 Steps Hacking Jcow Social Networking Web Server via Arbitrary Code Execution Bookmark Posted by v4L in Hacking Tutorial | 18 comments
Type : Tutorial
Level : Medium
Victim Server : Windows XP SP3
Victim vulnerable application : JCow 4.2
Attacker O.S : Backtrack 5 R1
After very long times I didn't write about hacking webserver, today
"again" when surfing around I've found that Jcow Social netwoking engine
can be exploited and the exploit ranking marked as "excellent".
So actually what happen when you have this Jcow vulnerable version??The
simple thing is the attacker can go through your web server directory
and doing everything there. For example if you hosting your Jcow
vulnerable version(on unsecure hosting also :-) ) you can own your web
In this example, let's say I have a Jcow
vulnerable web server in IP address 192.168.8.94. Actually it's better
to try installing your own web server, but if you want to find out Jcow
in the wild you can search through Google dork "intext:Powered by Jcow
4.2.0" and register as normal user there. In this tutorial I have
already register as username : victim and password also victim :-)
Okay I hope you understand what I say above :-P to make it more realistic, let's try the tutorial… Requirement :
1. Metasploit framework
2. Jcow.rb exploit
mediafire.com Step by Step :
1. Copy the downloaded jcow.rb exploit from the download link above and copy it into /pentest/exploits/framework/modules/exploits/remote/ folder(see the command below).
the text "framework" with blue color it's because I'm using Backtrack 5
R1 and using metasploit v4.0.1, so the name was depends on your
Metasploit version, maybe on your computer it can be "framework3" or
"framework2" so on..
If you didn't know how to copy that
jcow.rb file into your Backtrack, please refer to this tutorial about
Linux folder sharing(click here).
2. Open your Metasploit console and then use the exploit you just added before.
msf > use exploit/remote/jcow
3. The next step we need to view the available switch for this exploit
by running show options command, and then configured it(see the box with
Hacking Jcow Social Networking via Arbitrary Code Execution (PoC)
msf exploit(jcow) > set rhost 192.168.8.94 --> set the target IP rhost => 192.168.8.94 msf exploit(jcow) > set username victim --> set the username username => victim msf exploit(jcow) > set password victim --> set the password password => victim msf exploit(jcow) > set uri jcow --> only if jcow not in / directory fill it here uri => jcow