Crosshairs 3 (Challenging):
While I could have written a tcpdump
filter to show me all of the POST's to the server... the dataset is relatively
small. I found it easier to just bust out Chaosreader
and let it do the work for me.
.... a bunch of sessions ....
Open up the index...
Look for some smoke signals... open
up the GET/POST report.
Greeted by a 6 or so popup windows from
.js with the message body "Vulnerable"... friendly reminder that we
are playing with some potentially harmful data and using something like
Chaosreader would not be ideal in real world analysis. Good way to pop your own
box with an EK.
As seen above, the alerts are just resultant of Nikto and the way in which it performs its webserver vuln scans... (alot of alerts like this will be found in TCP stream 19 and up) interesting to note but not what we are looking for.
While going through some of the
POST's I saw the following which looked very interesting...
Jump into wireshark or go
back to the index of chaosreader and work back from there...
See the php script being uploaded with
TinyMCE.
Chaosreader:
...I went off on a short tangent and
decoded the base64 in the php to see what's up, the script makes a connection back to a
predefined host after being accessed (the pcap makes this obvious, but hey...
tangent).
GET request initializing the
script...
After this we can see a remote
connection is made and then the fun stuff begins for our attacker as seen
below.
Joomla exploit used can be seen
here: http://www.exploit-db.com/exploits/9926/
So where there is smoke, there is
fire!
Anyhow... the answer to this should be
"ogfcmxaiaexofkdozkvz.php"
No comments:
Post a Comment