DirectAdmin 1.33.6 – Symlink Security Bypass
Subject: DirectAdmin <= 1.33.6 Symlink Permission Bypass Date: 5/1/21010 Author: alnjm33 Tested on: 1.33.6 -- 1.33.1 and i think it's work in all versions Home:sec-war.com :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::exploit:::::::::::::::::::::::::::::::::::::::::::::::::::::::::: first must execute this command on the server >>>> ln /etc/shadow to make symbolic link to shadow file in any dir after that go to Create/Restore Backups in direct and make ((Domains Directory: Backs up)) the backup file will be in /home/test/backups go there then Extract tar.gz file after extract go to /home/test/backups/domains/test.com/public_html or the dir which you execute the command and now you can read the shadow file which have 400 Permission Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso -JaMbA-RoOt_EgY-jago-dz-XR57 all sec-war.com members<http://sec-war.com/cc//index.php?showuser=36> |