FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

CLZero - A Project For Fuzzing HTTP/1.1 CL.0 Request Smuggling Attack Vectors

By: Zion3R


A project for fuzzing HTTP/1.1 CL.0 Request Smuggling Attack Vectors.

About

Thank you to @albinowax, @defparam and @d3d else this tool would not exist. Inspired by the tool Smuggler all attack gadgets adapted from Smuggler and https://portswigger.net/research/how-to-turn-security-research-into-profit

For more info see: https://moopinger.github.io/blog/fuzzing/clzero/tools/request/smuggling/2023/11/15/Fuzzing-With-CLZero.html


Usage

usage: clzero.py [-h] [-url URL] [-file FILE] [-index INDEX] [-verbose] [-no-color] [-resume] [-skipread] [-quiet] [-lb] [-config CONFIG] [-method METHOD]

CLZero by Moopinger

optional arguments:
  -h, --help      show this help message and exit
  -url URL        (-u), Single target URL.
  -file FILE      (-f), Files containing multiple targets.
  -index INDEX    (-i), Index start point when using a file list. Default is first line.
  -verbose        (-v), Enable verbose output.
  -no-color       Disable colors in HTTP Status
  -resume         Resume scan from last index place.
  -skipread       Skip the read response on smuggle requests, recommended. This will save a lot of time between requests. Ideal for targets with standard HTTP traffic.
  -quiet          (-q), Disable output. Only successful payloads will be written to ./payloads/
  -lb             Last byte sync method for least request latency. Due to th   e nature of the request, it cannot guarantee that the smuggle request will be processed first. Ideal for targets with a high
                  amount of traffic, and you do not mind sending multiple requests.
  -config CONFIG  (-c) Config file to load, see ./configs/ to create custom payloads
  -method METHOD  (-m) Method to use when sending the smuggle request. Default: POST

single target attack:

  • python3 clzero.py -u https://www.target.com/ -c configs/default.py -skipread

  • python3 clzero.py -u https://www.target.com/ -c configs/default.py -lb

Multi target attack:

  • python3 clzero.py -l urls.txt -c configs/default.py -skipread

  • python3 clzero.py -l urls.txt -c configs/default.py -lb

Install

git clone https://github.com/Moopinger/CLZero.git
cd CLZero
pip3 install -r requirements.txt


Bropper - An Automatic Blind ROP Exploitation Tool

By: Zion3R


An automatic Blind ROP exploitation python tool

Abstract

BROP (Blind ROP) was a technique found by Andrew Bittau from Stanford in 2014.

Most servers like nginx, Apache, MySQL, forks then communicates with the client. This means canary and addresses stay the same even if there is ASLR and PIE. So we can use some educated brute force to leak information and subsequently craft a working exploit.


Flow of exploitation

  1. Find buffer overflow offset
  2. Find canary
  3. Find saved registers (RBP / RIP)
  4. Find stop gadgets
  5. Find brop gadgets
  6. Find a Write function (write / dprintf / puts / ...)
  7. Leak the binary

Examples of Results

There is 3 customs vulnerable examples provided in this repository. You can run it directly or build the Dockerfile

BROPPER will then dump the binary :

It's then possible to extract all ROP gadgets from the dumped binary using ROPgadget for example :

$ ROPgadget --binary dump
Gadgets information
============================================================
0x0000000000001177 : adc al, 0 ; add byte ptr [rax], al ; jmp 0x1020
0x0000000000001157 : adc al, byte ptr [rax] ; add byte ptr [rax], al ; jmp 0x1020
0x0000000000001137 : adc byte ptr [rax], al ; add byte ptr [rax], al ; jmp 0x1020
...
...
...
0x0000000000001192 : xor ch, byte ptr [rdi] ; add byte ptr [rax], al ; push 0x16 ; jmp 0x1020
0x000000000000182e : xor eax, 0x891 ; mov rdi, rax ; call rcx
0x0000000000001861 : xor eax, 0xffffff22 ; mov rdi, rax ; call rcx

Unique gadgets found: 235

Script usage

To use this script:

python3 -m pip install -r requirements.txt
python3 bropper.py -t 127.0.0.1 -p 1337 --wait "Password :" --expected Bad --expected-stop Welcome -o dump
$ python3 bropper.py -h
usage: bropper.py [-h] -t TARGET -p PORT --expected-stop EXPECTED_STOP --expected EXPECTED --wait WAIT -o OUTPUT [--offset OFFSET] [--canary CANARY] [--no-canary] [--rbp RBP] [--rip RIP] [--stop STOP]
                  [--brop BROP] [--plt PLT] [--strcmp STRCMP] [--elf ELF]

Description message

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        target url
  -p PORT, --port PORT  target port
  --expected-stop EXPECTED_STOP
                        Expected response for the stop gadget
  --expected EXPECTED   Expected normal response
  --wait WAIT           String to wait before sending payload
  -o OUTPUT, --output OUTPUT
                        File to write dumped remote binary
  --offset OFFSET       set a offset value
  --canary CANARY       set a canary valu   e
  --no-canary           Use this argument if there is no stack canary protection
  --rbp RBP             set rbp address
  --rip RIP             set rip address
  --stop STOP           set stop gadget address
  --brop BROP           set brop gadget address
  --plt PLT             set plt address
  --strcmp STRCMP       set strcmp entry value
  --elf ELF             set elf address

Contributing

Pull requests are welcome. Feel free to open an issue if you want to add other features.



AtomLdr - A DLL Loader With Advanced Evasive Features

By: Zion3R


A DLL Loader With Advanced Evasive Features

Features:

  • CRT library independent.
  • The final DLL file, can run the payload by loading the DLL (executing its entry point), or by executing the exported "Atom" function via the command line.
  • DLL unhooking from \KnwonDlls\ directory, with no RWX sections.
  • The encrypted payload is saved in the resource section and retrieved via custom code.
  • AES256-CBC Payload encryption using custom no table/data-dependent branches using ctaes; this is one of the best custom AES implementations I've encountered.
  • Aes Key & Iv Encryption.
  • Indirect syscalls, utilizing HellHall with ROP gadgets (for the unhooking part).
  • Payload injection using APC calls - alertable thread.
  • Payload execution using APC - alertable thread.
  • Api hashing using two different implementations of the CRC32 string hashing algorithm.
  • The total Size is 17kb + payload size (multiple of 16).

How Does The Unhooking Part Work

AtomLdr's unhooking method looks like the following

the program Unhooking from the \KnwonDlls\ directory is not a new method to bypass user-land hooks. However, this loader tries to avoid allocating RWX memory when doing so. This was obligatory to do in KnownDllUnhook for example, where RWX permissions were needed to replace the text section of the hooked modules, and at the same time allow execution of functions within these text sections.

This was changed in this loader, where it suspends the running threads, in an attempt to block any function from being called from within the targetted text sections, thus eliminating the need of having them marked as RWX sections before unhooking, making RW permissions a possible choice.

This approach, however, created another problem; when unhooking, NtProtectVirtualMemory syscall and others were using the syscall instruction inside of ntdll.dll module, as an indirect-syscall approach. Still, as mentioned above, the unhooked modules will be marked as RW sections, making it impossible to perform indirect syscalls, because the syscall instruction that we were jumping to, can't be executed now, so we had to jump to another executable place, this is where win32u.dll was used.

win32u.dll contains some syscalls that are GUI-related functions, making it suitable to jump to instead of ntdll.dll. win32u.dll is loaded (statically), but not included in the unhooking routine, which is done to insure that win32u.dll can still execute the syscall instruction we are jumping to.

The suspended threads after that are resumed.

It is worth mentioning that this approach may not be that efficient, and can be unstable, that is due to the thread suspension trick used. However, it has been tested with multiple processes with positive results, in the meantime, if you encountered any problems, feel free to open an issue.


Usage

  • PayloadBuilder is compiled and executed with the specified payload, it will output a PayloadConfig.pc file, that contains the encrypted payload, and its encrypted key and iv.
  • The generated PayloadConfig.pc file will then replace this in the AtomLdr project.
  • Compile the AtomLdr project as x64 Release.
  • To enable debug mode, uncomment this here.

Demo (1)

  • Executing AtomLdr.dll using rundll32.exe, running Havoc payload, and capturing a screenshot

  • AtomLdr.dll's Import Address Table


Demo - Debug Mode(2)

  • Running PayloadBuilder.exe, to encrypt demon[111].bin - a Havoc payload file


  • Running AtomLdr.dll using rundll32.exe


  • Havoc capturing a screenshot, after payload execution


Based on



❌