Hi, after a
long time... today I am going to show you POC for pwning TLD .ug which I did
some 3-4 years back.
Years back the
interface of the domain was http://old.registry.co.ug/ and "Domain Manager
Panel" sub-domain was not exposed in the TLD main domain and search
engines.
So, after doing
some information gathering e.g. port scanning, whois lookup's etc I found the
Domain panel which was located at https://new.registry.co.ug:8006/
I am not going
in detailed explanation of how I do the pentest rather show you the main
weakness "Direct object reference".
So, after
trying hard for RCE, SQLi, server vulnerabilities enumeration etc. I found a
direct object reference to the admin panel.
To enter in the
domain manager as admin you just have to locate below URL:
https://new.registry.co.ug:8006/admin
There was no
validation of users via sessions or any other mechanism. And I was able to see
all the stuff in admin panel including changing DNS of any domain such as google,
MSN etc.
At that time I
tried to contact them but I didn’t get any response and later in 2013 and 2015
someone hacked and changed the DNS of some domains like google.co.ug, MSN etc.
When I came to know the defacement I recheck for the vulnerability but this
time it was patch by them (after the defacement). But still it is vuln to
direct object reference in many other places.
Will come up
with some more cool Hack Diaries - Happy Hacking ;)
