Full Version: Help Needed!
Craz3
I didn't know where else to put this post, as putting it in the wrong place would have meant it being unanswered. But to those who know I'd appreciate a reply.

Right I'm having trouble understanding something, and i'd like pionting the right direction as to where to find the info i'm seeking. (sounds like a riddle)...


I need to know what kind of OS/shell this is as it has me baffled...

. filename :
[ arg... ] [[ expression ]]
alias [-p] [name[=value] ... ] bg [job_spec]
bind [-lpvsPVS] [-m keymap] [-f fi break [n]
builtin [shell-builtin [arg ...]] case WORD in [PATTERN [| PATTERN].
cd [-L|-P] [dir] command [-pVv] command [arg ...]
compgen [-abcdefgjksuv] [-o option complete [-abcdefgjksuv] [-pr] [-o
continue [n] declare [-afFirtx] [-p] name[=valu
dirs [-clpv] [+N] [-N] disown [-h] [-ar] [jobspec ...]
echo [-neE] [arg ...] enable [-pnds] [-a] [-f filename]
eval [arg ...] exec [-cl] [-a name] file [redirec
exit [n] export [-nf] [name[=value] ...] or
false fc [-e ename] [-nlr] [first] [last
fg [job_spec] for NAME [in WORDS ... ;] do COMMA
for (( exp1; exp2; exp3 )); do COM function NAME { COMMANDS ; } or NA
getopts optstring name [arg] hash [-lr] [-p pathname] [-dt] [na
help [-s] [pattern ...] history [-c] [-d offset] [n] or hi
if COMMANDS; then COMMANDS; [ elif jobs [-lnprs] [jobspec ...] or job
kill [-s sigspec | -n signum | -si let arg [arg ...]
local name[=value] ... logout
popd [+N | -N] [-n] printf format [arguments]
pushd [dir | +N | -N] [-n] pwd [-PL]
read [-ers] [-u fd] [-t timeout] [ readonly [-anf] [name[=value] ...]
return [n] select NAME [in WORDS ... ;] do CO
set [--abefhkmnptuvxBCHP] [-o opti shift [n]
shopt [-pqsu] [-o long-option] opt source filename
suspend [-f] test [expr]
time [-p] PIPELINE times
trap [arg] [signal_spec ...] or tr true
type [-afptP] name [name ...] typeset [-afFirtx] [-p] name[=valu
ulimit [-SHacdflmnpstuv] [limit] umask [-p] [-S] [mode]
unalias [-a] [name ...] unset [-f] [-v] [name ...]
until COMMANDS; do COMMANDS; done variables - Some variable names an
wait [n] while COMMANDS; do COMMANDS; done

ph34r.gif ph34r.gif ph34r.gif ph34r.gif

7|-|4|\||<5
cvh
Just a normal bash/sh shell and no tcsh/csh shell on a *nix system, just look at the ulimit command. But why do you want to know??? Just type into a shell uname -a to know the OS.
Craz3
Yeah sorry should have explained a bit more...Right I've just installed Ubuntu on my system and have got rid of windows. I was cruising around a few sites when I came across a MYSQL injection exploit. Knowing my friend designs and runs/mods a few different websites I thought i'd see if his site had this particular vuln. after doing a INURL: google search of his site for the particular vunlerable string (which I obviously found). I compiled and ran the exploit and got admin rights to the server.

the reason I wanted to know this is so I can present to him as much info as pos so he can take action to stop some little script kid getting in and doing any milicious harm.

To add to that, there are litterally hundreds of sites that seem to be vulnerable to this exploit. Anyway thanks for the reply.....
flush
QUOTE(Craz3 @ Jul 10 2005, 03:12 PM)
Yeah sorry should have explained a bit more...Right I've just installed Ubuntu on my system and have got rid of windows. I was cruising around a few sites when I came across a MYSQL injection exploit. Knowing my friend designs and runs/mods a few different websites I thought i'd see if his site had this particular vuln. after doing a INURL: google search of his site for the particular vunlerable string (which I obviously found). I compiled and ran the exploit and got admin rights to the server.

the reason I wanted to know this is so I can present to him as much info as pos so he can take action to stop some little script kid getting in and doing any milicious harm.

To add to that, there are litterally hundreds of sites that seem to be vulnerable to this exploit. Anyway thanks for the reply.....
*




mmh usually mysql daemon is running as a member of the group daemon and its some kind of user account... so if mysql is running as root, the admin is really stupid...
Craz3
QUOTE(flush @ Jul 10 2005, 05:19 PM)
QUOTE(Craz3 @ Jul 10 2005, 03:12 PM)
Yeah sorry should have explained a bit more...Right I've just installed Ubuntu on my system and have got rid of windows. I was cruising around a few sites when I came across a MYSQL injection exploit. Knowing my friend designs and runs/mods a few different websites I thought i'd see if his site had this particular vuln. after doing a INURL: google search of his site for the particular vunlerable string (which I obviously found). I compiled and ran the exploit and got admin rights to the server.

the reason I wanted to know this is so I can present to him as much info as pos so he can take action to stop some little script kid getting in and doing any milicious harm.

To add to that, there are litterally hundreds of sites that seem to be vulnerable to this exploit. Anyway thanks for the reply.....
*




mmh usually mysql daemon is running as a member of the group daemon and its some kind of user account... so if mysql is running as root, the admin is really stupid...
*





I think your right, but, I don't know if you check exploit sites alot but they seem to have alot of MYSQL exploits that offer root or at least some admin rights to a shell. So either there's alot of stupid people about or they've got a way of using myspl to do this..???
myth
you may have missed cvh's suggestion of

CODE
glitch:/# uname -a
Linux glitch.sexygeeks.local 2.6.8-2-686 #1 Thu May 19 17:53:30 JST 2005 i686 GNU/Linux
glitch:/#


Dont ask about the config, long story :P

Also, in /etc/ you should be able to find a file about the version of the distro your running, like /etc/redhat-version or something....
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.

 
Invision Power Board © 2001-2005 Invision Power Services, Inc.