domingo, 2 de agosto de 2015

Accessing sensitive data FileZilla

FileZilla FTP Passwords now Stored in Plaintext.

It's an old vulnerability FileZilla, but we can still find servers with such a security breach, Vulnerability allows access to sensitive files from the server. Containing passwords and FTP users.  FileZilla version ~ 3.0.9.2+ (and possibly older) store all FTP connection data .xml files in plain text.  The following files are what you need to know about:  filezilla.xml – Stores most recent server info including password in plaintext. recentservers.xml – Stores all recent server info including password in plaintext. sitemanager.xml – Stores all saved sites server info including password in plaintext.  These files can usually be found in the following directories: Windows XP/2K: "C:\Documents and Settings\username\Application Data\FileZilla" Windows Vista: "C:\Users\username\AppData\Roaming\FileZilla\" Linux: "/home/username/.filezilla/"  FileZilla configuration files FileZilla is a cross-platform application. That’s why it stores its settings in platform-neutral XML files.

It's an old vulnerability FileZilla, but we can still find servers with such a security breach, Vulnerability allows access to sensitive files from the server. Containing passwords and FTP users.

FileZilla version ~ 3.0.9.2+ (and possibly older) store all FTP connection data .xml files in plain text.

The following files are what you need to know about:

filezilla.xmlStores most recent server info including password in plaintext.
recentservers.xmlStores all recent server info including password in plaintext.
sitemanager.xmlStores all saved sites server info including password in plaintext.

These files can usually be found in the following directories:
Windows XP/2K: "C:\Documents and Settings\username\Application Data\FileZilla"
Windows Vista: "C:\Users\username\AppData\Roaming\FileZilla\"
Linux: "/home/username/.filezilla/"

FileZilla configuration files
FileZilla is a cross-platform application. That’s why it stores its settings in platform-neutral XML files.
FileZilla configuration files FileZilla is a cross-platform application. That’s why it stores its settings in platform-neutral XML files.

sitemanager.xml 
The XML files are readable for reading with access data, As you can see, everything is stored in plain text, including the password.
sitemanager.xml  The XML files are readable for reading with access data, As you can see, everything is stored in plain text, including the password.
filezilla.xml
The filezilla.xml file follow the same example sitemanager.xml, It starts with naming <LastServer>
filezilla.xml The filezilla.xml file follow the same example sitemanager.xml, It starts with naming <LastServer>
Quick connect 
QuickConnect lets you connect to servers without adding them to your administrative panel. when instaciado a fast connection it is added in recentservers.xml file.

Danger?
Yes the same way that you can read these files. Malicious applications can do the same, and can be read also on web servers.
ex:
www.target.com.br/folder/{file.xml}
www.target.com.br/microsite/geo243/FileZilla.xml www.target.com.br/149224/prg/programok/Total%20Commander/FileZilla/recentservers.xml

Other files:
  1. sitemanager.xml
  2. recentservers.xml
  3. filezilla.xml
  4. bookmarks.xml
  5. filters.xml
  6. layout.xml
  7. queue.xml
Looking for vulnerable servers
Now let's use the inurlbr tool to search sites with such breach and confirm such information.
Download tool: 
https://github.com/googleinurl/SCANNER-INURLBR

Setting command:
using search engines..

SET DORK:
Choose your dork search

  • "\FileZilla\" ext:xml
  • inurl:"\FileZilla\" & inurl:sitemanager.xml -github -sourceforge
  • inurl:"\FileZilla\" & inurl:recentservers.xml -github -sourceforge
  • inurl:"\FileZilla\" & inurl:filezilla.xml -github -sourceforge
  • inurl:"\FileZilla\" & inurl:bookmarks.xml -github -sourceforge
  • inurl:"\FileZilla\" & inurl:filters.xml -github -sourceforge
  • inurl:"\FileZilla\" & inurl:layout.xml -github -sourceforge
  • inurl:"\FileZilla\" & inurl:queue.xml -github -sourceforge
  • inurl:sitemanager.xml & ext:xml & -github -sourceforge
  • inurl:recentservers.xml & ext:xml & -github -sourceforge
  • inurl:filezilla.xml & ext:xml & -github -sourceforge
  • inurl:bookmarks.xml & ext:xml & -github -sourceforge
  • inurl:filters.xml & ext:xml & -github -sourceforge
  • inurl:layout.xml & ext:xml & -github -sourceforge
  • inurl:queue.xml & ext:xml & -github -sourceforge
  • inurl:"\FileZilla\" & inurl:(sitemanager.xml | recentservers.xml | filezilla.xml | filters.xml | bookmarks.xml | layout.xml | queue.xml) ext:xml -github -sourceforge
--dork 'YOU_DORK'
- Setting: --dork '"\FileZilla\" ext:xml'

SET FILE OUTPUT:
- Setting: -s filezilla.txt

SET TIPE VALIDATION: 
- Setting: -t
   2 The second type tries to valid the error defined by: -a 'VALUE_INSIDE_THE _TARGET' It    also establishes connection with the exploit through the get method.

SET STRING VALIDATION:
Specify the string that will be used on the search script:
   Example: -a {string}
   Usage:    -a '<title>hello world</title>'
   If specific value is found in the target he is considered vulnerable.
Setting:     -a '<FileZilla3>'
All filezilla file there is a primary tag called <FileZilla3>. It is trough this that we will validate.
Ex:
All filezilla file there is a primary tag called <FileZilla3>. It is trough this that we will validate. Ex:


Full command - using search engines:
php inurlbr.php --dork '"\FileZilla\" ext:xml' -s filezilla.txt -t 2 -a '<FileZilla3>'

OR SCANNER DORKING-FILE:
php inurlbr.php --dork-file dorks.txt -s filezilla.txt -t 2 -a '<FileZilla3>'

OUTPUT PRINT:
Full command - using search engines: php inurlbr.php --dork '"\FileZilla\" ext:xml' -s filezilla.txt -t 2 -a '<FileZilla3>'  OUTPUT PRINT:




Using FileZilla the safe way

FileZilla is a great FTP client and I use it myself. But since it doesn’t protect your FTP credentials, you should protect them yourselves. Here is what you can do:

1. Don’t use the “Normal” logon type. There are the “Ask for password” and the “Interactive” types that won’t save your passwords on disk. So malware simply won’t be able to get enough information from FileZilla configuration files to hack your sites.

Pros
Malware cannot steal your FTP credential from configuration files.

Cons
You’ll have to enter your password every time you connect to your site.
It won’t save you from more sophisticated spyware such as keyloggers and traffic sniffers. But I hope this sort of trojans can be better detected by you antivirus tools since they need to hook known system functions. To protect yourself from traffic sniffers, always use SFTP instead of FTP (if possible).

2. Hosts trick. If you manage multiple web sites, interactive logon types may be really inconvenient. There is a trick that can let you use the “Normal” logon type in a more secure manner. You should create aliases of your sites’ addresses in the “hosts” file (on Windows, you can find it in C:\WINDOWS\system32\drivers\etc\).

For example you have a site “example.com” with an IP-address "208.xxx.188.166".
To create an alias you need to add the following line into the hosts file:

208.xxx.188.166         my_example

"my_example" will work the same way as “example.com” when you use it on your computer.
However, on other computers it won’t make any sense. Now use this alias in FTP connection settings instead of “example.com”.
If hackers manage to steal your FTP credentials, all they’ll have will be: (host: my_example, user: unmask, password: parasites) – the username/password pair is valid, but the host name doesn’t make any sense to them. It’s like having a key and not knowing where the door is.

Pros
Once you have added new aliases to the hosts file and to FileZilla Site Manager, you can enjoy the ease of one-click connections.
Cons

This trick will only work as long as malware steals FTP credentials from configuration files verbatim (and I have proofs that at least some malware steal the data verbatim).  If they only add a simple check that converts host names to IP-addresses before sending the credentials to their central database, the trick will be useless.  This trick is better than no protection at all, but you should not count on it.
You’ll need to update the hosts file if IP-addresses change.

3. Public Key Authentication. If your hosting plan included SSH (secure shell), you can use FileZilla in SFTP mode. One of convenient SSH features is public key authentication. And FileZilla supports this type of authorization (I didn’t use it myself, but at least have seen the UI in the “Settings” dialog). FileZilla recognizes PuTTY’s Pageant, so the configuration should be easy if you already use PuTTY for SSH.

Pros
Secure one-click connections.

Cons

This authentication method will only work if your hosting plan includes SSH/SFTP. Unfortunately, this option is rearly included into shared hosting plans.
Creating the keys and configuring FileZilla to use them is not a trivial process.
You might still have to enter a pass phrase when adding keys to the Pageant.
Other FTP programs

In this article I reviewed FileZilla only because it’s a popular FTP client that I have on my computer and it was very easy to demonstrate how little it does to protect users’ FTP credentials. However the same concerns apply to all other  programs that have FTP functions: classical FTP clients, web page editors, file managers. Popular applications like DreamWeaver, CuteFTP, Total Commander, etc. account for majority of FTP credentials leaks.

Solution Source: http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/

Referencias:
http://seclists.org/fulldisclosure/2008/Apr/508
http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/
http://bl0wj0bb3r.blogspot.com.br/2015/08/d3lphi-filezilla-password-stealer.html
http://unsharptech.com/2008/05/20/filezilla-ftp-passwords-stored-in-plaintext/

6 comentários:

  1. Este comentário foi removido por um administrador do blog.

    ResponderExcluir
  2. Saudações

    Estou a procura de duas pessoas qualificadas e com experiencia acima de 20 anos que tenha responsabilidade e foco.

    Estou querendo montar um grupo no inicio com apenas 3 membros eu e mais 2 para um grupo de Cracker, totalmente focado em reconhecimentos de habilidades e lucro financeiro 100% bitcoins.

    Membro 1 eu:
    Minhas Habilidades: HTML5, Java, PHP, CSS, Perl, Conhecimento em rede, Linux e Invasão XSS, SQL Inject, 70% dos sites que tentei obtiveram sucesso altualmente tenho um banco com grandes empresas e todos sites com shell hospedado pronto para ataques.
    Ficarei responsavel pelas invasões de servidores web, dados valiosos recebidos serão guardados pelo grupo, atualmente tenho um banco de 50 mil sites vuneraveis e posso implantar javascripts em todos, quero usar isso para inserir propagandas pequenas que não interviram na visualização do usuario para manteremos ativa.


    Habilidade Membro 2 - Ingles Avancado Escrita e Leitura.( o membro 2 ou 3 precisam ter ingles se o membro 2 tiver o 3 precisa ter somente o basico para exercer a função.
    tenha os conhecimentos basico para web html5, php, javascript etc..
    O membro 2 ficara encarregado de criar paginas para substituir sites hackeados, (não se engane achando que a pagina so contera html5 e css, pois isso até um muleque de 12 anos faz será um pagina dinamica que teremos visualização de todos os acessos e locais).
    E gerenciar a rede que existira de botnets ( tenho metodos para conseguir no minimo 50+ botnets por dia ), e todos conhecimentos adicionais serão bem vindos.


    Habilidade Membro 3 - Ingles Avancado Escrita e Leitura.
    tenha os conhecimentos basico para web html5, php, javascript etc..
    Membro 3 ficara responsavel pela segurança do grupo criação de proxys seguros, esse membro terá que ter conhecimento de segurança vasto,
    pois precisamos de segurança em primeiro lugar conhecimento de como usar os botnets como servidores proxy. Isso é exemplos de conhecimentos basicos, espero que hajam outros tipos de conhecimento



    Por favor sem Script Kiddies - preciso de crackers experientes e que já tiveram muitos sucessos em invasão de servidores web. No momento preciso somente de pessoas

    Todos os sites hackeados poderam ser recuperados pelo dono após o pagamento de um valor estipulado em btc.

    Contato email: gamesownedone@torbox3uiot6wchz.onion


    Torchat: eg3w3fv2xpcgagjf

    No email somente envie coisas que dominam não adianta enviar que sabe pouco sobre certo assunto somentes experientes serão aprovados conversarei com cada membro no torchat faleremos sobre certos conhecimentos.
    Pois no brasil está dificil membros com esse conhecimento aprofundado.( no brasil existem uma deficiencia muito grande em conhecimento na area de segurança)

    ResponderExcluir
  3. ei me manda o link do walpaper vlw mesmo

    ResponderExcluir
  4. Partilho um muito bonito. obrigado

    ResponderExcluir

............