一个暴露的 .git 文件夹让我们得以揭露一个钓鱼攻击活动
2 分•作者: spirovskib•7 个月前
上周五下午，我们 Discord 服务器中的一位成员报告了一封指向虚假登录页面的钓鱼邮件。<p>我们着手调查，由于攻击者做出了一些草率的决定，我们获取了他们的 GitHub 账户和正在运行的 Telegram 机器人。<p>截图：https://imgur.com/a/FTy4mrH<p>有时候，攻击者的无能是防御者最好的武器 ¯\_(ツ)_/¯<p>这个钓鱼页面是一个标准化的“邮件”克隆，没有品牌标识，是一个通用服务。经过一些 gobuster 侦察，我们发现该网站的 .git 目录可以公开访问，并列出了其内容。<p>检查请求也让我们获得了第一个 Telegram 机器人令牌。这相当于把整个行动的蓝图，包括过去的版本和已删除的文件，都扔在了前院。<p>我们拉取了存储库，发现了自动化部署和多个带有不同硬编码 Telegram 机器人令牌和聊天 ID 的虚假页面。<p>有了源代码、存储库和活动的 Telegram 机器人令牌，我们提交了详细的滥用报告：<p>- GitHub：我们报告了包含钓鱼工具包源代码的存储库。它因违反服务条款而被删除。<p>- Telegram：我们使用提供的令牌和聊天 ID 报告了该机器人，导致其被移除。<p>- 托管服务提供商：恶意网站被报告并下线。<p>经验教训？永远不要将 .git 文件夹部署到生产环境中。即使你是个罪犯。<p>致谢：这是 BeyondMachines Discord 社区成员的共同努力。众包的速度和协作帮助我们非常迅速地将其拿下。
查看原文
This past Friday afternoon, a member in our Discord server reported a phishing email pointing to a fake login page.<p>We took up to research it and because of clumsy decisions by the attacker we got their GitHub and their operational Telegram bot.<p>Screenshots: https://imgur.com/a/FTy4mrH<p>Sometimes the attacker incompetence can be a defender's best weapon ¯\_(ツ)_/¯<p>The phishing page was a standard clone of an "email", unbranded anf generic service. A bit of gobuster reconnaissance and we got the site's .git directory publicly accessible and listing its contents.<p>Inspecting of the requests also got us the first Telegram bot token.
This is the digital equivalent of leaving the blueprints to your entire operation, including past versions and deleted files, lying on the front lawn.<p>We pulled the repository, found automated deployments and multiple fake pages with different hardcoded Telegram bot tokens and Chat IDs.<p>With the source code, repo and the active Telegram bot token, we filed detailed abuse reports:<p>- GitHub: We reported the repository containing the phishing kit's source code. It was taken down for violating TOS.<p>- Telegram: We reported the bot using the provided token and chat ID, leading to its removal.<p>- Hosting Provider: The malicious site was reported and taken offline.<p>Lesson learned? Never deploy a .git folder to production. Even if you are a criminal.<p>Acknowledgement: This was a collaborative effort by members of the BeyondMachines Discord community. The crowdsourced speed and collaboration helped us take this down very fast.