Last updated: May 13, 2014 at 06:15 GMT Created: Exactly 2 years ago
Greetings, fellow mortal in the universe! Welcome to my personal space on Mr. Tim's World Wide Web. This website is several things, but in short, it's a personal homepage; so expect to find many of the things you would find on other personal homepages. It serves as an outlet for me to express ideas and attempt to communicate with others. Such ideas may be intended to inform, educate, inspire debate, or merely to intrigue. The contents vary from thoughts of an African programmer to just about anything. It is not always straight and engrossing. It is not always about programming or even computers. However, there is constantly enough variation to keep it going.
Jobs.com.gh is a Ghanaian job portal launched in 2013 by Ringier Ghana, a subsidiary of the Swiss multinational media enterprise Ringier AG. The website lists job vacancies on a daily basis and claims to be "Ghana's number 1 jobs portal." In this third case study of the Exploit Chronicles campaign, we are putting Jobs.com.gh on the radar. One distinguishing feature of this case study, however, is the absence of an SQL injection vulnerability. For the first time, we are exploiting a logical flaw in the design, implementation, and functioning of an application.
The Bank of Ghana (BoG) is the central bank of Ghana. It was formally established on 4th March, 1957, two days before the declaration of Ghana's independence. In 2012, one Romanian gray-hat hacker compromised the systems of several African banks, most of them Ghanaian, including that of SG-SSB, UT Bank, and Fidelity Bank. But it seems not every bank learned a lesson from those incidents. So in this case study of Exploit Chronicles, we are exploiting an SQL injection vulnerability in BoG's website to install a backdoor onto the web server.
Trilion IT Services is a small website development and web hosting reseller company based in Ghana, situated at Community 12 in Tema. The company develops and maintains a content management system called Trilion CMS. The software has been installed for at least a dozen of its clients to manage their websites, spanning from simple company websites to complex web directories. In this case study of Exploit Chronicles, we are looking at how to exploit an SQL injection vulnerability in this web software to gain administrative privileges.
I was thinking this afternoon and there came to my mind my childhood days. When I would be called from among my congregated schoolmates to come forward and recite a poem written by my class teacher. But today I have grown up to become a man. My very adorable facial features have long been lost and totally forgotten. No one is extending invitations to me to recite a poem or even sing a song anymore. So what would I do then? I picked up a pen and began writing a poem, about someone I hardly know, which I am presenting in this piece.
Exploit Chronicles is the name of a campaign that I'm about to start to expose bad code (and for that matter bad software) that I managed to put up with in the past year - 2013. Over the last couple of months, I have been bitterly amazed at how some so-called Ghanaian programmers write software, especially with applications that are exposed to the Internet. Nowadays, it seems one only needs to know how to install Wordpress on a web server to call himself a "software engineer." But does good enough code even make good enough software?
Just in case you are the kind who care about such things, the underlying software of this web server is a hacked version of Apache. It is installed with a PHP CGI engine and configured to use MySQL as the back-end DBMS. The overall architectural design is flat—all pages are simply posts. These are written in a special markup language which outputs highly optimized and cacheable HTML, and even binary data like images! I reinvented the wheel because all the already-made solutions were too bulky for my simple needs. In reality, this whole website runs from a single PHP script, has no client-side dependencies, and does not leave any chocolate chip cookies on your device!
# Server information
CPU Family: x86_64
Software: Linux/2.6.32 PHP/5.4.33
Uptime: 26 days, 57 minutes, 9 seconds
Memory Usage: 768 KiB
# TCP connection info
Server IP: 220.127.116.11
Server Port: 80
Client IP: 18.104.22.168
Client Port: 56184
# HTTP request headers
GET / HTTP/1.0
Accept-Encoding: x-gzip, gzip, deflate
User-Agent: CCBot/2.0 (http://commoncrawl.org/faq/)
DISCLAIMER: The opinions expressed on this website (that is, those that originate with me) are my own; they do not represent the plans, thoughts, or strategies of my employer, family, friends, religion, or even that my beautiful future wife. Likewise, the opinions expressed in public comments on some parts of this site are those of their respective authors and do not reflect my point of view on the matter. The world already has enough of its conspiracy theories, don't you think? Meh.