Mostrando entradas con la etiqueta bypass. Mostrar todas las entradas

domingo, 7 de mayo de 2023

Capture TryHackMe Writeup

mayo 07, 2023 | bruteforce, bypass, captcha, python, tryhackme, writeup |

Scanning

We scan the open ports with the nmap tool with scripts and software versions.

 > nmap -sVC -p- --min-rate 5000 10.10.183.73 -Pn -n -oN nmap-10.10.183.73.txt  
 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 22:10 CEST  
 Nmap scan report for 10.10.183.73  
 Host is up (0.058s latency).  
 Not shown: 65534 closed tcp ports (conn-refused)  
 PORT  STATE SERVICE VERSION  
 80/tcp open http  Werkzeug/2.2.2 Python/3.8.10  
 | http-title: Site doesn't have a title (text/html; charset=utf-8).  
 |_Requested resource was /login  
 | fingerprint-strings:   
 |  FourOhFourRequest:   
 |   HTTP/1.1 404 NOT FOUND  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:27 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Content-Length: 207  
 |   Connection: close  
 |   <!doctype html>  
 |   <html lang=en>  
 |   <title>404 Not Found</title>  
 |   <h1>Not Found</h1>  
 |   <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>  
 |  GetRequest:   
 |   HTTP/1.1 302 FOUND  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:22 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Content-Length: 199  
 |   Location: /login  
 |   Connection: close  
 |   <!doctype html>  
 |   <html lang=en>  
 |   <title>Redirecting...</title>  
 |   <h1>Redirecting...</h1>  
 |   <p>You should be redirected automatically to the target URL: <a href="/login">/login</a>. If not, click the link.  
 |  HTTPOptions:   
 |   HTTP/1.1 200 OK  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:22 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Allow: HEAD, GET, OPTIONS  
 |   Content-Length: 0  
 |   Connection: close  
 |  RTSPRequest:   
 |   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"  
 |   "http://www.w3.org/TR/html4/strict.dtd">  
 |   <html>  
 |   <head>  
 |   <meta http-equiv="Content-Type" content="text/html;charset=utf-8">  
 |   <title>Error response</title>  
 |   </head>  
 |   <body>  
 |   <h1>Error response</h1>  
 |   <p>Error code: 400</p>  
 |   <p>Message: Bad request version ('RTSP/1.0').</p>  
 |   <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.</p>  
 |   </body>  
 |_  </html>  
 |_http-server-header: Werkzeug/2.2.2 Python/3.8.10

domingo, 30 de octubre de 2022

Google Search captcha evasion + GooFuzz tool

octubre 30, 2022 | article, bypass, captcha, evasion, goofuzz, google |

Today I bring you a way to bypass the Google Search captcha.

Surely the image below sounds familiar to you, it is when Google Search detects suspicious activity and kindly asks us to solve a captcha to continue searching.

Meeting Google friends

Facebook has a utility for developers called "Echo debugging", in which it allows searches on a website, for example my blog:

As you can see in the image, from this Facebook resource we could get to see the source code of a website, but we will need to be authenticated and for that we will need to have a Facebook account.

Thinking outsite the box

Being clear that we can see the source code of a website (so far nothing relevant), it occurred to me to cross a search to Google Search filtering by the domain "nasa.gov", in the following image it is shown how it is possible to obtain results from Google Search from this utility.

So I tried several executions with different special dorks and noticed that at no time did it ask to solve the security captcha due to suspicious activity (It seems that they completely trust Facebook :P)

The following image shows a search for PDF files in the "nasa.gov" domain:

I know friend, it also occurred to me that this advantage could be used to automate it in a tool ;)

What is GooFuzz?

GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the target's server and by means of advanced Google searches (Google Dorking).

Github: https://github.com/m3n0sd0n4ld/GooFuzz

Although GooFuzz does not require the use of Facebook cookies, I did find it interesting to add a functionality to evade the captcha and be able to make more requests on the browser.

By taking advantage of the "ByPass" functionality, we can use a dictionary of 100 words maximum without being blocked.

....SNIP.....

Proof of concept video with avoidance option:

What does Google think about this?

This was discovered a few years ago, where they mentioned that it was not a vulnerability, but I have to say that they have been silently solving it (another case of "Bad bounty").

Conclusions

Without going into detail about whether or not it is a vulnerability or deficiency, what it reveals is that an attacker would be able to abuse this technique to make massive requests and evade the search engine's detection system (captcha).

Thank you for your time in reading this article and I hope it has been of interest.

Until next time!

sábado, 7 de mayo de 2022

Unicode HackTheBox Writeup

mayo 07, 2022 | bypass, curl, hackthebox, jwt, linux, rsa, writeup |

logo

Scanning

We run nmap on all ports with scripts and software versions.

Enumeration

We access the web service.

We find a section to authenticate and others to register, we use this one and create an account.

Click on the "Upload a threat report" section and you will find a form to upload files.

Form to upload files:

It seems to let us upload the file.... But where is it?

We decode our JWT of the registered account and see that the "jku" field is calling a "jwks.json" file.

Content jwks.json file:

Exploitation

For this part, I was helped by the following article

I follow the tutorial and create one public and one private key:

Now would be the time to build our own "jwks.json" file and generate the value of "n" and the value of "e" and trick the application to load the file from a fraudulent endpoint.

We create an Python script:

!#/usr/bin/python3
from Crypto.PublicKey import RSA

fp = open("publickey.crt", "r")
key = RSA.importKey(fp.read())
fp.close()

print("n:", hex(key.n))
print("e:", hex(key.e))

We run the script and we will have the value of both letters:

We modify the file "jwks.json" with our values and raise a server with python.

Trying to enter the url again and leaving the attacker's url behind, we see that it accepts the jwt, although it redirects us to the login and we do not get the server to execute our file.

Create JWT:

Use in Burp:

If we review the fuzzing performed with the wfuzz tool, we see that we have listed some actions that we did not have authorization, I was curious about the "redirect", as it could be exploited for the server to make the communication with my attacker machine and make it load my malicious "jwks.json" file.

We create our JWT by adding the redirect to our machine.

The server has loaded our malicious file.

We change our nickname to "admin" and repeat the above process.

We change the cookie, refresh the page and log in as the "admin" user:

We see the "display" section, it seems that it loads local files.

We try to load the file "/etc/passwd", but it seems that there is some filter to bypass.

We intercept in Burp and encode in "unicode" format (the host name is the clue ;)) and we get to load the file "/etc/passwd".

We read the flag from "user.txt".

. Viewing the headers, we load the file of available sites in nginx, we list commented information from a file "db.yaml" stored in the user's folder

We obtain some creds from the DB:

We reuse the creds via SSH and they work, we see that we can run the "treport" binary as root and with SUDO.

Privilege Escalation

It seems to allow us to create, read and download a report, this could be running some binary underneath that we have access to, or it could be abused to modify some other system file.

If we try to download, we enter our IP address and it downloads from our machine.

Result on attacker machine:

I did other tests, I saw that in one of them it makes a curl.

If we see the curl options, there is a very interesting one, since it allows us to pass by parameters a configuration file to read it

I did several tests, in one I did get it to run and read the "root.txt" file successfully.

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton