Thursday, May 23, 2013

Funky Juniper URLs

If you've ever tested any clients that have Juniper VPNs you've probable seen the ol: 

http://[target]/dana-na/auth/url_default/welcome.cgi URL.

@infosecmafia and I mentioned in our DerbyCon talk on how you can sometimes find extra or test URLs that are also valid URLs for the Juniper VPN. The example we used was where the url_default required secret questions but url_8 or whatever did not because it was a test URL the admins had set up.

Soooooooo, its worth running a quick check if you come across one. I wrote a  Metasploit auxiliary module to do this. Pretty simple, it just runs thru url_0 through url_100 and prints out the 200 replies. looks like so:

–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_0/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_1/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_2/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_3/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_4/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_5/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_6/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_8/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_9/welcome.cgi
–[+] 192.168.1.1:443 Received a HTTP 200 with  bytes for /dana-na/auth/url_12/welcome.cgi

Seeing these doesn't ALWAYS mean you have a multi-factor bypass but its worth checking out if the main site is multi-factor.

Random example:
url_default

url_3

url_8

url_10


Available on my github repo until I get around to doing a pull request.

-CG
at

7 comments:

  1. HUNDREDTiMay 25, 2013 at 6:08 PM

    This comment has been removed by a blog administrator.

    ReplyDelete
  2. CGMay 25, 2013 at 9:36 PM

    ORIGINAL COMMENT
    "HUNDREDTi has left a new comment on your post "Funky Juniper URLs":

    Hi!!, You know?

    VPN SCANNER
    http://www.netprotect.ch/tools.html

    This tool conducts a simple information gathering (find administrative logins, find multiple logins, read schema files, find access to extra modules etc.) and vulnerability testing (common juniper vulnerabilities according to CVE)on Juniper SSL VPN devices.

    - Don't forget to try the other tools posted on the web

    Best regards "

    ReplyDelete
  3. CGMay 25, 2013 at 9:37 PM

    you going to provide the password?

    ReplyDelete
  4. HUNDREDTiMay 27, 2013 at 5:08 PM

    Hi!, Download SWAT,

    This application contains the "Juniper VPN Scanner" tool, which allows the following attacks:

    Multiple sing-in pages (you can configure it for perform dictionary attacks)
    admin access
    web root
    Setup files
    Auth bypass
    Meeting test
    XSS test

    http://www.netprotect.ch/Swat_Setup.msi
    http://www.netprotect.ch/images/key.txt

    (do not forget to try the tool fully)

    ReplyDelete
  5. AbhiMay 28, 2013 at 12:52 PM

    dont forget

    /dana-na/auth/url_admin/welcome.cgi

    And
    /dana/home/basicauth_userpass.cgi
    /,dana-na/,IP=192.168.8.8,port=80

    ReplyDelete
  6. JAJune 16, 2013 at 12:02 PM

    Also check for http://www.securityfocus.com/archive/1/archive/1/511775/100/0/threaded

    ReplyDelete
  7. AnonymousOctober 22, 2015 at 9:13 AM

    for i in {1..100}; do echo -n "$i:"; curl -s -I https://example.com/dana-na/url_$i/welcome.cgi | head -n 1; done | grep -v 404

    ReplyDelete