CSRFT - Cross Site Request Forgeries (Exploitation) Toolkit

This project has been developed to exploit CSRF Web vulnerabilities and provide you a quick and easy exploitation toolkit. In few words, this is a simple HTTP Server in NodeJS that will communicate with the clients (victims) and send them payload that will be executed using JavaScript.
This has been developed entirely in NodeJS, and configuration files are in JSON format.

*However, there's a tool in Python in utils folder that you can use to automate CSRF exploitation. *

This project allows you to perform PoC (Proof Of Concepts) really easily. Let's see how to get/use it.

How to get/use the tool

First, clone it :

$ git clone git@github.com:PaulSec/CSRFT.git

To make this project work, get the latest Node.js version here. Go in the directory and install all the dependencies: 
npm install
Then, launch the server.js :

$ node server.js

Usage will be displayed :

Usage : node server.js  

 

A) I want to write my specific JSON configuration file and launch it by hand

Based on the templates which are available, you can easily create your own. If you have any trouble creating it, feel free to contact me and I'll try to help you as much as I can but it shoudn't be this complicated.

Steps to succeed :

1) Create your configuration file, see samples in conf/ folder
2) Add your .html files in the exploits/ folder with the different payloads if the CSRF is POST vulnerable
3) If you want to do Dictionnary attack, add your dictionnary file to the dicos/ folder,
4) Replace the value of the field you want to perform this attack with the token <%value%>
=> either in your urls if GET exploitation, or in the HTML files if POST exploitation.
5) Launch the application : node server.js conf/test.json

B) I want to automate attacks really easily

To do so, I developed a Python script csrft_utils.py in utils folder that will do this for you.

Here are some basic use cases :

*GET parameter with Dictionnary attack : *
$ python csrft_utils.py --url="http://www.vulnerable.com/changePassword.php?newPassword=csvulnerableParameter" --param=newPassword --dico_file="../dicos/passwords.txt" 
 
*POST parameter with Special value attack : *

$ python csrft_utils.py --form=http://website.com/user.php --id=changePassword --param=password password=newPassword --special_value 

Download and Read more

Read more

by Malik korrich ~ jeudi 22 octobre 2015 0 commentaires

OpenVPN Desktop client affected by a critical CSRF flaw

Researchers at SEC Consult have discovered a CSRF vulnerability in the OpenVPN Desktop Client that can allow remote code execution.

Security researchers at SEC Consult have discovered a CSRF flaw in the OpenVPN Desktop client and promptly reported it to the company in May. OpenVPN Desktop Client for its Access Server is an SSL VPN for a variety of platforms. The vulnerability only affects Windows versions of the application.


 

In response to the discovery, OpenVPN issued a security advisory to warn its customers of the presence of a Cross-Site Request Forgery (CSRF) vulnerability in its Desktop Client which could allow an attacker to execute arbitrary code remotely. 

“All Access Server customers using the ‘Desktop Client’ app for Windows should upgrade immediately to the OpenVPN Connect client.  The ‘Desktop Client’ is obsolete and is no longer maintained or available for download. This client contains a CSRF (Cross Site Request Forgery) vulnerability that can allow remote code execution by a malicious web site,” 
“It is also bundled with an older version of OpenSSL that has not received recent OpenSSL security updates.  This advisory only applies to the OpenVPN Access Server ‘Desktop Client’ app for Windows, and does not affect OpenVPN Connect, Private Tunnel, or community builds of OpenVPN for Windows.” OpenVPN reported in the advisory.

Experts at SEC Consult have verified that vulnerabilities affect OpenVPN Access Server “Desktop Client” version 1.5.6, which was the most recent version at the time of discovery. Also, any other versions of the product are affected by the flaw.

OpenVPN is requesting its customers to update the Desktop Client to avoid attacks which exploit the CSRF flaw.

“Remote attackers can execute arbitrary code and execute other attacks on computers with the OpenVPN Access Server “Desktop Client” installed. Affected users should upgrade immediately to the OpenVPN Connect client.” the SEC Consult advisory states.

The attacker has to trick the user, running a vulnerable version of OpenVPN,  in to visit a malicious site.

“The OpenVPN Access Server ‘Desktop Client’ consists of two parts, a Windows service that offers an XML-RPC API via a webserver on localhost and a GUI component that connects to this API,” 

“The XML-RPC API is vulnerable to Cross-Site Request Forgery (CSRF). Using the API commands an attacker can: unmask a victim (e.g. by disconnecting an established VPN connection), perform MITM attacks (by connecting the victim to an ‘evil’ VPN server), execute arbitrary code with SYSTEM privileges (by adding a VPN profile that executes code).”

SEC Consult has provided a video proof of concept for the OpenVPN Access Server ‘Desktop Client’ vulnerability.

Source

Read more

by Malik korrich ~ vendredi 18 juillet 2014 0 commentaires