About a month after releasing an ftp client fuzzer module for Metasploit, I decided to release yet another fuzzer module I have been working on over the last few weeks.
This new module can be used to audit web servers/web server plugins/components/filters, by fuzzing form fields and optionally fuzz some header fields.
While this type of fuzzing/audits most likely won’t reveal bugs in the most common webserver platforms themselves (Apache, IIS, etc), I am convinced that there are a lot of other web server components out there that may not properly validate input from form fields or header fields.
A few hints :
This new fuzzer module was added to the Metasploit framework earlier today (svn release r11013 and up), and can be found in /modules/auxiliary/fuzzers/http. The module file is called http_form_field.rb
If you are using a svn based copy of the framework, you can get the module very easily (and all future updates) by updating your svn copy. More info about creating a svn copy and about updating the svn can be found in the post about the client ftp fuzzer module.
Anyways, this is what the module will do :
Loading the module is as easy as doing this :
root@bt:/pentest/exploits/trunk# ./msfconsole -n msf > use auxiliary/fuzzers/http/http_form_field msf auxiliary(http_form_field) >
The available module options are :
msf auxiliary(http_form_field) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- ACTION no Form action full URI. Leave empty to autodetect CODE 200,301,302 yes Response code(s) indicating OK CYCLIC true yes Use Cyclic pattern instead of A's (fuzzing payload). DELAY 0 yes Number of seconds to wait between 2 actions ENDSIZE 200000 yes Max Fuzzing string size. FIELDS no Name of the fields to fuzz. Leave empty to fuzz all fields FORM no The name of the form to use. Leave empty to fuzz all forms FUZZHEADERS true yes Fuzz headers Proxies no Use a proxy chain RHOST yes The target address RPORT 80 yes The target port STARTSIZE 1000 yes Fuzzing string startsize. STEPSIZE 1000 yes Increment fuzzing string each attempt. STOPAFTER 2 no Stop after x number of consecutive errors TIMEOUT 15 yes Number of seconds to wait for response on GET or POST TYPES text,password,inputtextbox yes Field types to fuzz URL / no The URL that contains the form VHOST no HTTP server virtual host
Important note : if you want to clear a certain option, don’t set it to an empty string (set <option> ""), but use the unset command : unset <option>
The advanced options are :
msf auxiliary(http_form_field) > show advanced Module advanced options: Name : BasicAuthPass Current Setting: Description : The HTTP password to specify for basic authentication Name : BasicAuthUser Current Setting: Description : The HTTP username to specify for basic authentication Name : FingerprintCheck Current Setting: true Description : Conduct a pre-exploit fingerprint verification Name : SSL Current Setting: false Description : Negotiate SSL for outgoing connections Name : SSLVersion Current Setting: SSL3 Description : Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) Name : UserAgent Current Setting: Description : The User-Agent header to use for all requests Name : WORKSPACE Current Setting: Description : Specify the workspace for this module
Let’s use the module to test the Integard admin login page (and reproduce the vulnerability that was reported here). I installed a vulnerable copy of Integard Home on a test computer (192.168.201.1). From my attacker machine, I can access the login page on port 18881 :
The source of the page reveals the following form :
Next, I attached Immunity Debugger to Integard.exe and let the application run inside the debugger.
Configuring the Metasploit form field fuzzer for this case is really easy. We only have one form, so we can try to let the plugin auto-configure itself. The only 3 parameters we’ll need to specify are :
msf auxiliary(http_form_field) > set rhost 192.168.201.1 rhost => 192.168.201.1 smsf auxiliary(http_form_field) > set vhost 192.168.201.1 vhost => 192.168.201.1 smsf auxiliary(http_form_field) > set rport 18881 rport => 18881
The URL option already contains "/", so that will work fine in this case. The default field types are "text", "password" and "inputtextbox", so that means that the fuzzer will only look at the password field.
Now simply issue "run" and the fuzzer will start fuzzing :
You will notice that the fuzzer will report a "No response" when fuzzing the password field with 2000 bytes. Look at the debugger :
Nice : we control EIP and can see the payload on the stack. Game over 🙂
If you have questions / comments / feedback about the module, feel free to leave your comments below, or drop by in the corelan IRC channel on freenode.
Have fun !
Copyright secured by Digiprove © 2010 Peter Van Eeckhoutte
Tags:
© Corelan Consulting BV. All rights reserved. The contents of this page may not be reproduced, redistributed, or republished, in whole or in part, for commercial or non-commercial purposes without prior written permission. See the Terms of Use and Privacy Policy for details.
