Facebook Vulnerability Reflected File Download

Before starting with the write up i want to share the response that i got from facebook after reporting the bug.

Hi Rio,

Thank you for sharing this information with us. Although this issue does not qualify as a part of our bounty program we appreciate your report. We will follow up with you on any security bugs or with any further questions we may have.

I will let you guys decide if its a vulnerability or not.
Lets begin.

The vulnerability existed and still exists at

https://graph.facebook.com/

The vulnerability exists because the api reflects data from the url and since we can inject a malicious payload.

Visiting the following url:

https://graph.facebook.com/injected%20in%20json%7C%7Ccalc.exe%7C%7C?callback=random

Since the data is reflected our main goal is to to make this get saved as a file.

Facebook did not have a content-disposition so our way to download is to use html5 download attribute.

Lets create a html file. ("test.html") and put the following content.

<a href='https://graph.facebook.com/rio/;/test.bat;"||calc.exe||?callback=random' download="test.bat">Download</a>

Now lets open the test.html and click download.

Basically we downloaded a bat file with our injected payload from the facebook website.

VIDEO:

Thanks
Rio Sherri

SkyTower CTF Walkthrough

VM Author Description

This CTF was designed by Telspace Systems for the CTF at the ITWeb Security Summit and BSidesCPT (Cape Town). The aim is to test intermediate to advanced security enthusiasts in their ability to attack a system using a multi-faceted approach and obtain the “flag”.
You will require skills across different facets of system and application vulnerabilities, as well as an understanding of various services and how to attack them. Most of all, your logical thinking and methodical approach to penetration testing will come into play to allow you to successfully attack this system. Try different variations and approaches. You will most likely find that automated tools will not assist you.

Author: Telspace Systems

Download: VulnHub

WordSteal - Stealing Windows Credentials through crafted document

On every external pen-test I do after information gathering and enumeration phase I prepare some spear-phishing campaigns. My favorite method is using Word Macros because most of the companies use a windows environment and the Microsoft Office pack is used widely.

During a pen-test on of the problems that I faced was the mail gateway was rejecting every email that contained macro. Even if it was encoded,obfuscated, encrypted even empty the email gateway rejected our emails.
Since I hadn't some l33t 0day for all the version of Microsoft Word ( company used different versions) , I had to find a different way to spear-phish the employees.

Then I remembered a post about a Word Exploit generator which used an unusual way to track how many times the document was opened. Microsoft Word had an undocumented function that can load a remote picture. The malware creators used http to map the users who opened the files.

Then I thought why not trying the 'file://' handler.
If you want to…

InfoGen AL

Search This Blog