Locked Singularity

[0x1]

Singularity of Origin DNS Rebinding Attack Framework.

This is the hidden content, please

• Sign In
• or
• Sign Up

NEW! Check out our DEF CON 27 and BSIDESLV presentation at

This is the hidden content, please

• Sign In
• or
• Sign Up

Singularity of Origin is a tool to perform

This is the hidden content, please

• Sign In
• or
• Sign Up

attacks. It includes the necessary components to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on the target machine.

It also ships with sample payloads to exploit several vulnerable software versions, from the simple capture of a home page to performing remote code execution. It aims at providing a framework to facilitate the exploitation of software vulnerable to DNS rebinding attacks and to raise awareness on how they work and how to protect from them.

Detailed documentation is on the

This is the hidden content, please

• Sign In
• or
• Sign Up

Core Features

• Singularity provides a complete DNS rebinding attack delivery stack:
  • Custom DNS server to rebind DNS name and IP address
  • HTTP server (manager web interface) to serve HTML pages and JavaScript code to targets and to manage the attacks
  • Several sample attack payloads, ranging from grabbing the home page of a target application to performing remote code execution. These payloads can be easily adapted to perform new and custom attacks.
  • Supports DNS CNAME values in target specification in addition to IP addresses to evade DNS filtering solutions or to target internal resources for which the IP address is unknown.
• A simple, fast and efficient HTTP port scanner to identify vulnerable services.
• Attack automation allows to completely automate the scanning and exploitation of vulnerable services on a network.
• Hook and Control permits using victim web browsers as HTTP proxies to access internal network resources, to interactively explore and exploit otherwise inaccessible applications with your own browser.

Spoiler

Hook and Control a Vulnerable Application on Localhost or Other Hosts

This is the hidden content, please

• Sign In
• or
• Sign Up

Automate the Scan and Compromise of All Vulnerables Applications

This is the hidden content, please

• Sign In
• or
• Sign Up

Usage

Setting up Singularity requires a DNS domain name where you can edit your own DNS records for your domain and a Linux server to run it. Please see the

This is the hidden content, please

• Sign In
• or
• Sign Up

wiki page for detailed instructions.

The documentation is on the

This is the hidden content, please

• Sign In
• or
• Sign Up

. Here are a few pointers to start:

This is the hidden content, please

• Sign In
• or
• Sign Up

A test instance is available for demo purposes at

This is the hidden content, please

• Sign In
• or
• Sign Up

.

Payloads Description

Singularity supports the following attack payloads:

• Basic fetch request (simple-fetch-get.js) This sample payload makes a GET request to the root directory ('/') and shows the server response using the fetch API. The goal of this payload is to function as example request to make additional contributions as easy as possible.
• automatic: This payload automatically attempts to detect known services and exploit them using other payloads listed in this section or that were developed and added to Singularity by users.
• Chrome DevTools RCE (exposed-chrome-devtools.js) This payload demonstrates a remote code execution (RCE) vulnerability in Microsoft VS Code fixed in version 1.19.3. This payload can be adapted to exploit any software that exposes Chrome Dev Tools on localhost.
• Etcd k/v dump (etcd.js) This payload retrieves the keys and values from the
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  to get the list of owned eth addresses and retrieve the balance of the first eth address.
• Rails Console RCE (rails-console-rce.js) Performs a remote code execution (RCE) attack on the
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
• AWS Metadata Exfil (aws-metadata-exfil.js) Forces a headless browser to exfiltrate AWS metadata including private keys to a given host. Check the payload contents for additional details on how to setup the attack.
• Duplicati RCE (duplicati-rce.js) This payload exploits the Duplicati backup client and performs a remote code execution (RCE) attack. For this attack to work, parameter targetURL in file payload-duplicati-rce.html must be updated to point to a valid Duplicati backup containing the actual RCE payload, a shell script.
• WebPDB (webpdb.js) A generic RCE payload to exploit PDB, a python debugger exposed via websockets.
• Hook and Control (hook-and-control.js) Hijack target browsers and use them to access inaccessible resources from your own browser or other HTTP clients. You can retrieve the list of hooked browsers on the "soohooked" sub-domain of the Singularity manager host on port 3129 by default e.g.
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  To authenticate, submit the secret value dumped to the console by the Singularity server at startup.
• Jenkins Script Console (jenkins-script-console.js) This payload exploits the
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  and displays the stored credentials.
• Docker API (docker-api.js) This payload exploits the
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  and displays the /etc/shadow file of the Docker host.

Source & Download

This is the hidden content, please

• Sign In
• or
• Sign Up

Edited September 22, 2019 by 0x1