Topic: mfw I got all passwords from one of my college servers :|
r04r started this discussion 15 years ago #6,979
I was bored.
Little backstory:
They set up a web server for us to work on a project on, and every student group got their own login/password and there were also a few teacher logins. The setup was MySQL/Apache2/PHP. The operating system was lolwindows.
They pretty much failed with the setup and had Apache run a service, and thus PHP also ran as that service, and PHP was not running in safe mode. As the System user. So, pretty much full access for everyone to touch all the files on the machine, and run executable files.
So, uploaded netcat and launched it through PHP for a shell, and uploaded fgdump to dump the password hashes. 5 minutes later with ophcrack and rainbow tables later and had all the passwords.
mfw the administrator account's password is "hippie".
Anyway, next lesson of that class is about security, so that'll be fun.
Oh, also. The teacher did say beforehand we were allowed to play around on the server as long as we wouldn't delete anything or break it.
Little backstory:
They set up a web server for us to work on a project on, and every student group got their own login/password and there were also a few teacher logins. The setup was MySQL/Apache2/PHP. The operating system was lolwindows.
They pretty much failed with the setup and had Apache run a service, and thus PHP also ran as that service, and PHP was not running in safe mode. As the System user. So, pretty much full access for everyone to touch all the files on the machine, and run executable files.
So, uploaded netcat and launched it through PHP for a shell, and uploaded fgdump to dump the password hashes. 5 minutes later with ophcrack and rainbow tables later and had all the passwords.
mfw the administrator account's password is "hippie".
Anyway, next lesson of that class is about security, so that'll be fun.
Oh, also. The teacher did say beforehand we were allowed to play around on the server as long as we wouldn't delete anything or break it.
(Edited 1 minute later.)
Foxygen !FANATICibM joined in and replied with this 15 years ago, 8 minutes later[^] [v] #122,007
You gonna tell 'em you got all the passes when the security lesson comes?
Anonymous C joined in and replied with this 15 years ago, 5 minutes later, 13 minutes after the original post[^] [v] #122,009
Expect ror
get ror
get ror
r04r (OP) replied with this 15 years ago, 1 minute later, 15 minutes after the original post[^] [v] #122,010
@122,007 (Foxygen !FANATICibM)
No. I don't think they'll be too happy with that.
I will replace the teacher's demo website with http://boydscreations.com/ though.
No. I don't think they'll be too happy with that.
I will replace the teacher's demo website with http://boydscreations.com/ though.
Foxygen !FANATICibM replied with this 15 years ago, 2 minutes later, 18 minutes after the original post[^] [v] #122,012
Yes !4et0YaTXO. joined in and replied with this 15 years ago, 4 minutes later, 22 minutes after the original post[^] [v] #122,013
protip !!pMmAiEwOm joined in and replied with this 15 years ago, 2 hours later, 2 hours after the original post[^] [v] #122,046
Meatspin is the only solution for this.
Anonymous F joined in and replied with this 15 years ago, 1 minute later, 2 hours after the original post[^] [v] #122,048
Nega !34Kas0OdzM joined in and replied with this 15 years ago, 2 minutes later, 2 hours after the original post[^] [v] #122,051
This pleases me! :3r04r (OP) replied with this 15 years ago, 3 hours later, 5 hours after the original post[^] [v] #122,430
@122,046 (protip !!pMmAiEwOm)
Lol.
I want to keep it SFW. :[
I did consider changing the apache config to just point everyone's site to that hacked page, but that'd be too much of an impact on the other students.
Lol.
I want to keep it SFW. :[
I did consider changing the apache config to just point everyone's site to that hacked page, but that'd be too much of an impact on the other students.