This new module can be used to audit web servers\/web server plugins\/components\/filters, by fuzzing form fields and optionally fuzz some header fields.<\/p>\n
While this type of fuzzing\/audits most likely won't reveal bugs in the most common webserver platforms themselves (Apache, IIS, etc), I am convinced that there are a lot of other web server components out there that may not properly validate input from form fields or header fields.<\/p>\n
A few hints :<\/p>\n
- \n
- custom modules \/ isapi components \/ custom dll's that process input <\/li>\n
- admin consoles <\/li>\n
- embedded webservers <\/li>\n
- etc <\/li>\n<\/ul>\n
The module<\/h3>\n
This new fuzzer module was added to the Metasploit framework earlier today (svn release r11013 and up), and can be found in \/modules\/auxiliary\/fuzzers\/http. The module file is called http_form_field.rb<\/p>\n
If you are using a svn based copy of the framework, you can get the module very easily (and all future updates) by updating your svn copy. More info about creating a svn copy and about updating the svn can be found in the post about the client ftp fuzzer<\/a> module.<\/p>\n
Anyways, this is what the module will do :<\/p>\n
- \n
- It will connect to a webpage (referred to by the "URL" option), parse the body and identify all forms & form fields contained within those forms. <\/li>\n
- Then, it will create POST (or GET, depending on the form method) requests, sending those fields back to the webpage provided in the "action" field of the form, and fuzz the contents of the fields while doing that. It will only fuzz one field at a time. <\/li>\n
- By default, only text fields, password fields, and inputtextbox fields will be fuzzed, but you can define other field types by setting the "TYPES" parameter. <\/li>\n
- In additition to that, it can optionally fuzz header fields as well. It will use the existing headers (and add some common headers if they are missing) and fuzz each one of those headers using POST\/GET requests. <\/li>\n<\/ul>\n
Using the module<\/h3>\n
Loading the module is as easy as doing this :<\/p>\n
root@bt:\/pentest\/exploits\/trunk# .\/msfconsole -n<\/span>\n\nmsf > use auxiliary\/fuzzers\/http\/http_form_field\nmsf auxiliary(http_form_field) ><\/pre>\n\n
The available module options are : <\/p>\n<\/p>\n
msf auxiliary(http_form_field) > show options\n\nModule options:\n\n Name Current Setting Required Description\n ---- --------------- -------- -----------\n ACTION no Form action full URI. Leave empty to autodetect\n CODE 200,301,302 yes Response code(s) indicating OK\n CYCLIC true<\/span> yes Use Cyclic pattern instead of A's (fuzzing payload).\n DELAY 0 yes Number of seconds to wait between 2 actions\n ENDSIZE 200000 yes Max Fuzzing string size.\n FIELDS no Name of the fields to fuzz. Leave empty to fuzz all fields\n FORM no The name of the form to use. Leave empty to fuzz all forms\n FUZZHEADERS true<\/span> yes Fuzz headers\n Proxies no Use a proxy chain\n RHOST yes The target address\n RPORT 80 yes The target port\n STARTSIZE 1000 yes Fuzzing string startsize.\n STEPSIZE 1000 yes Increment fuzzing string each attempt.\n STOPAFTER 2 no Stop after x number of consecutive errors\n TIMEOUT 15 yes Number of seconds to wait for<\/span> response on GET or<\/span> POST\n TYPES text,password,inputtextbox yes Field types to fuzz\n URL \/ no The URL that contains the form\n VHOST no HTTP server virtual host<\/pre>\n- \n
- Action<\/strong> : By default, this field will be auto-populated. It is used to store the "action" variable of each form. In essence, this is the target URL that is used when submitting form contents to the webserver. So, if you leave this field empty, the fuzzer will attempt to detect the form action and use it as a target for the fuzzing operations. If you need to specify an action URL yourself (because the autodetection routine is not accurate enough), then it will be used for all forms on the page. This means that you should use this in conjunction with the FORM parameter (so you would be fuzzing the correct form fields against the correct action page). <\/li>\n
- Code<\/strong> : This parameter contains a comma separated list of response codes that are considered to be OK <\/li>\n
- Cyclic<\/strong> : When set to true, the fuzzdata will consist of a cyclic pattern. If you set this value to false, the fuzz data will be made up of a long string of A's <\/li>\n
- Delay<\/strong> : This parameter allows you to specify the number of seconds to wait between two fuzz operations. <\/li>\n
- Endsize<\/strong> : This is the maximum size of fuzzdata that will be sent to the target. When the maximum length has been reached, the fuzz operation will end. <\/li>\n
- Fields<\/strong> : If you leave this option empty, then all fields in the form (limited to field types specified in the TYPES option) will be subject to fuzzing. If you want to limit the fuzz to certain fields only, then you populate the option with a comma separated list of field names. <\/li>\n
- Form<\/strong> : When empty, the fuzzer will attemt to identify and enumerate all forms on the page, and fuzz all of the fields in all of those forms. If you only want to fuzz specific form(s), you can put a comma separated list of form names\/ids in this field. <\/li>\n
- Fuzzheaders<\/strong> : If this option is enabled, then the fuzzer will also fuzz http request header fields after fuzzing form fields. <\/li>\n
- Proxies<\/strong> : You can use this field to specify a proxy chain <\/li>\n
- Rhost<\/strong> : This option is used to specify the target host <\/li>\n
- Rport<\/strong> : This option is used to specify the target port <\/li>\n
- Startsize<\/strong> : This parameter allows you to specify the start length of the fuzz data <\/li>\n
- Stepsize<\/strong> : This parameter defines the number of chars to increase the fuzz data with after each fuzz <\/li>\n
- Stopafter<\/strong> : This parameter defines the number of error conditions to occur before giving up <\/li>\n
- Timeout<\/strong> : Use this option to specify the number of seconds for each get\/post request to wait for a response <\/li>\n
- Types<\/strong> : This option can be used to define the type of form fields to fuzz. When left empty, it will fuzz all fields. <\/li>\n
- URL<\/strong> : This option defines the exact url of the page that contains the form to fuzz. <\/li>\n
- Vhost<\/strong> : Use this option if you want to use a host header name. <\/li>\n<\/ul>\n
\n
Important note : if you want to clear a certain option, don't set it to an empty string (set <option> ""), but use the unset command : unset <option><\/p>\n<\/blockquote>\n
The advanced options are :<\/p>\n
msf auxiliary(http_form_field) > show advanced\n\nModule advanced options:\n\n Name : BasicAuthPass\n Current Setting:\n Description : The HTTP password to specify for<\/span> basic authentication\n\n Name : BasicAuthUser\n Current Setting:\n Description : The HTTP username to specify for<\/span> basic authentication\n\n Name : FingerprintCheck\n Current Setting: true<\/span>\n Description : Conduct a pre-exploit fingerprint verification\n\n Name : SSL\n Current Setting: false<\/span>\n Description : Negotiate SSL for<\/span> outgoing connections\n\n Name : SSLVersion\n Current Setting: SSL3\n Description : Specify the version of SSL that should be used (accepted: SSL2,\n SSL3, TLS1)\n\n Name : UserAgent\n Current Setting:\n Description : The User-Agent header to use for<\/span> all requests\n\n Name : WORKSPACE\n Current Setting:\n Description : Specify the workspace for<\/span> this module<\/span><\/pre>\n- \n
- BasicAuthPass and BasicAuthUser can be used if the target website requires authentication prior to accessing it (Basic authentication only) <\/li>\n
- FingerPrintCheck has no use in this fuzzer <\/li>\n
- You can set SSL (and SSLVersion) if the target website requires https. Don't forget to change the rport option accordingly <\/li>\n
- Useragent allows you to define an alternative User Agent field. The default value (hardcoded into the fuzzer) is "Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.15) Gecko\/2009102814 Ubuntu\/8.10 (intrepid) Firefox\/3.0.15" <\/li>\n<\/ul>\n
Example :<\/h3>\n
Let's use the module to test the Integard admin login page (and reproduce the vulnerability that was reported here<\/a>). I installed a vulnerable copy of Integard Home on a test computer (192.168.201.1). From my attacker machine, I can access the login page on port 18881 :<\/p>\n
![\"image\"](\"\/wp-content\/uploads\/2010\/11\/image_thumb.png\" "\\"image\\"")
<\/a><\/p>\nThe source of the page reveals the following form :<\/p>\n
![\"image\"](\"\/wp-content\/uploads\/2010\/11\/image_thumb1.png\" "\\"image\\"")
<\/a><\/p>\n- \n
- The form fields will be posted to \/LoginAdmin <\/li>\n
- There are 3 fields (password, Redirect, NoJs) and a submit button. We'll fuzz the password field in this example. <\/li>\n<\/ul>\n
Next, I attached Immunity Debugger to Integard.exe and let the application run inside the debugger.<\/p>\n
![\"image\"](\"\/wp-content\/uploads\/2010\/11\/image_thumb2.png\" "\\"image\\"")
<\/a><\/p>\nConfiguring the Metasploit form field fuzzer for this case is really easy. We only have one form, so we can try to let the plugin auto-configure itself. The only 3 parameters we'll need to specify are :<\/p>\n
- \n
- rhost \/ vhost <\/li>\n
- rport <\/li>\n
- URL <\/li>\n<\/ul>\n
msf auxiliary(http_form_field) > set rhost 192.168.201.1\nrhost => 192.168.201.1\nsmsf auxiliary(http_form_field) > set vhost 192.168.201.1\nvhost => 192.168.201.1\nsmsf auxiliary(http_form_field) > set rport 18881\nrport => 18881<\/pre>\n
The URL option already contains "\/", so that will work fine in this case. The default field types are "text", "password" and "inputtextbox", so that means that the fuzzer will only look at the password field.<\/p>\n
Now simply issue "run" and the fuzzer will start fuzzing :<\/p>\n
![\"image\"](\"\/wp-content\/uploads\/2010\/11\/image_thumb3.png\" "\\"image\\"")
<\/a><\/p>\nYou will notice that the fuzzer will report a "No response" when fuzzing the password field with 2000 bytes. Look at the debugger :<\/p>\n
![\"image\"](\"\/wp-content\/uploads\/2010\/11\/image13_thumb.png\" "\\"image\\"")
<\/a><\/p>\nNice : we control EIP and can see the payload on the stack. Game over \ud83d\ude42<\/p>\n
Finally :<\/h3>\n
If you have questions \/ comments \/ feedback about the module, feel free to leave your comments below, or drop by in the corelan IRC channel on freenode<\/a>.<\/p>\n
Have fun !<\/p>\n
- Code<\/strong> : This parameter contains a comma separated list of response codes that are considered to be OK <\/li>\n
- Action<\/strong> : By default, this field will be auto-populated. It is used to store the "action" variable of each form. In essence, this is the target URL that is used when submitting form contents to the webserver. So, if you leave this field empty, the fuzzer will attempt to detect the form action and use it as a target for the fuzzing operations. If you need to specify an action URL yourself (because the autodetection routine is not accurate enough), then it will be used for all forms on the page. This means that you should use this in conjunction with the FORM parameter (so you would be fuzzing the correct form fields against the correct action page). <\/li>\n
![\"\"\/](\"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png\")