piątek, 5 września 2014

GetClouder domain takeover

GetClouder is cloud hosting service having bug bounty program. In Administration Panel we have some domain management tool for hosting our own domain names. After adding ANY domain - zone is configured on two DNS servers: nimbus.getclouder.com and cumulus.getclouder.com - even if we are not owner of the domain. 



If you get NS records for getclouder.com domain, you'll see that it's hosted on same servers:

zoczus@hell:~$ host -t ns getclouder.com
getclouder.com name server nimbus.getclouder.com.
getclouder.com name server cumulus.getclouder.com.

So my first try was trying to add getclouder.com domain - of course it failed. ;)


Then - I tried to search if GetClouder have any other interesting domains. Here's what I found:


In short - yes, they have other domains. One of interesting - clouder.us or getclouder.info are hosted on ns1.clev1.net and ns2.clev1.net. Now - just check the IP addresses of this servers:

zoczus@hell:~$ host ns1.clev1.net
ns1.clev1.net has address 181.224.128.6
zoczus@hell:~$ host ns2.clev1.net
ns2.clev1.net has address 198.20.77.76
zoczus@hell:~$ host nimbus.getclouder.com
nimbus.getclouder.com has address 181.224.128.6
zoczus@hell:~$ host cumulus.getclouder.com
cumulus.getclouder.com has address 198.20.77.76


So we have few other possibilities to check. I tried to add clev1.net, it failed - but adding ns1.clev1.net - not. :) Win?



Yup - it was deffinetly win. 

zoczus@hell:~$ host wow.ns1.clev1.net
wow.ns1.clev1.net has address 1.2.3.4
zoczus@hell:~$ dig +trace ns1.clev1.net

; <<>> DiG 9.8.3-P1 <<>> +trace ns1.clev1.net
;; global options: +cmd
. 85638 IN NS l.root-servers.net.
. 85638 IN NS b.root-servers.net.
. 85638 IN NS k.root-servers.net.
. 85638 IN NS j.root-servers.net.
. 85638 IN NS i.root-servers.net.
. 85638 IN NS a.root-servers.net.
. 85638 IN NS m.root-servers.net.
. 85638 IN NS h.root-servers.net.
. 85638 IN NS e.root-servers.net.
. 85638 IN NS f.root-servers.net.
. 85638 IN NS d.root-servers.net.
. 85638 IN NS c.root-servers.net.
. 85638 IN NS g.root-servers.net.
;; Received 241 bytes from 62.21.99.94#53(62.21.99.94) in 122 ms

net. 172800 IN NS d.gtld-servers.net.
net. 172800 IN NS b.gtld-servers.net.
net. 172800 IN NS g.gtld-servers.net.
net. 172800 IN NS e.gtld-servers.net.
net. 172800 IN NS k.gtld-servers.net.
net. 172800 IN NS l.gtld-servers.net.
net. 172800 IN NS i.gtld-servers.net.
net. 172800 IN NS f.gtld-servers.net.
net. 172800 IN NS j.gtld-servers.net.
net. 172800 IN NS m.gtld-servers.net.
net. 172800 IN NS h.gtld-servers.net.
net. 172800 IN NS c.gtld-servers.net.
net. 172800 IN NS a.gtld-servers.net.
;; Received 488 bytes from 202.12.27.33#53(202.12.27.33) in 132 ms

clev1.net. 172800 IN NS ns1.clev1.net.
clev1.net. 172800 IN NS ns2.clev1.net.
;; Received 95 bytes from 192.55.83.30#53(192.55.83.30) in 167 ms

ns1.clev1.net. 86400 IN A 8.8.4.4
ns1.clev1.net. 86400 IN A 8.8.8.8
ns1.clev1.net. 86400 IN NS cumulus.getclouder.com.
ns1.clev1.net. 86400 IN NS nimbus.getclouder.com.
;; Received 152 bytes from 181.224.128.6#53(181.224.128.6) in 174 ms

We have full control of ns1.clev1.net - so everyone asking for - let's say - clouder.us will got response about it's hosted on ns1.clev1.net (and ns2.clev1.net) which points to IP addresses controled by us.

The second vulnerability was ability to add root-servers.net zone. 


After adding just 3 root servers (a,b,c), pointing it to IP with DNSChef on board, and waiting few minutes this is what I got:


As GetClouder told me - it was result of one tool for checking if customer's domains are still pointed to its nameservers.

I want to thank GetClouder security team for realy fast responses and the way how they did treat me as researcher. That was one of my best bounty experiences :) 

31 komentarzy:

  1. Odpowiedzi
    1. The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. دانلود آهنگ های ایرانی
      The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

      Usuń
  2. nice information shared by you for domain takeover.best hosting company for host your website

    OdpowiedzUsuń
  3. Thanks for sharing your information with us.


    UAE Hosting

    OdpowiedzUsuń
  4. Ten komentarz został usunięty przez autora.

    OdpowiedzUsuń
    Odpowiedzi
    1. SEO company in Pune
      https://www.edigibrands.com/seo-companies-in-pune/
      https://www.edigibrands.com/best-seo-company-in-india/
      https://www.edigibrands.com/10-tips-by-top-seo-company-in-pune-to-rank-the-business-successfully/
      https://www.edigibrands.com/the-future-of-seo-prediction-by-best-seo-agency-in-pune-for-2019-and-beyond/
      https://www.edigibrands.com/seo-for-wordpress-websites/
      https://www.edigibrands.com/improve-your-website-performance-seo-experts-in-pune/

      Usuń
  5. PMP and Scrum Master certification in Pune
    http://www.sarvashikshan.com/scrum-master-certification-in-pune/
    http://www.sarvashikshan.com/pmp-certification-in-pune/
    http://www.sarvashikshan.com/pmp-course-in-pune/
    http://www.sarvashikshan.com/pmp-certification-exam/
    http://www.sarvashikshan.com/pmp-certification-training-in-pune/

    OdpowiedzUsuń
  6. Thanks for sharing, nice post! Post really provice useful information!

    Hương Lâm chuyên cung cấp máy photocopy, chúng tôi cung cấp máy photocopy ricoh, toshiba, canon, sharp, đặc biệt chúng tôi có cung cấp máy photocopy màu uy tín, giá rẻ nhất.

    OdpowiedzUsuń
  7. Nice Post...Thanks for sharing the information...
    Elegant IT Services

    OdpowiedzUsuń
  8. Ten komentarz został usunięty przez autora.

    OdpowiedzUsuń
  9. Many blogs like this cover subjects that just aren’t covered by magazines.
    offshoreservers.net

    OdpowiedzUsuń
  10. If you are looking for a place to buy weed online, then visit legit online dispensary shipping worldwide. Delivery is private and secure.Quick Reliable Shipping.
    They ship directly to your door! Quality medical-grade marijuana! With great prices and discounts for customers.

    OdpowiedzUsuń
  11. We have the best top quality medical marijuana for sale online. Visit our website at Https://leafcuremed.com to buy weed online. Top shelf medical marijuana. We deliver all over USA and Canada and the rest of the world.
    buy real weed online cheap
    They ship directly to your door! Quality medical-grade marijuana! With great prices and discounts for customers.

    OdpowiedzUsuń
  12. looking to Buy 2-FDCK Online from a leading supplier? onlineresearchchemlab.com is the best research chemicals store where you can buy
    For More Info

    Email: info@onlineresearchchemlab.com / onlineresearchchemlab@gmail.com
    Wickr: locallegit
    whatsapp: +1662-403-4557
    Skype: williamjune1

    OdpowiedzUsuń
  13. looking to BUY 4-CMC CRYSTAL ONLINE from a leading supplier? onlineresearchchemlab.com is the best research chemicals store where you can buy
    For More Info

    Email: info@onlineresearchchemlab.com / onlineresearchchemlab@gmail.com
    Wickr: locallegit
    whatsapp: +1662-403-4557
    Skype: williamjune1

    OdpowiedzUsuń
  14. tremendous name, and top internet site. thanks for the opinion! WPS Office Crack

    OdpowiedzUsuń
  15. Fillers are designed to fill and adjust the face shape in many points, such as adjusting the size of the cheekbones to give dimension to the face Reduce the fold of the nasal cavity and reduce the gaps under the eyes Reduce wrinkles around the cheeks-lips ฟิลเลอร์ and back of the hands, temples, large chin, V-shape injection to make the face look smaller. Get better proportions and outline the face more clearly. Adjust the plane for light and shadow dimensions, easy to apply makeup.

    OdpowiedzUsuń
  16. The HA filler injection has been approved by the FDA. If using a genuine product that meets the standards Professional injections will give you a natural filler youthful effect. In addition, fillers Hyaluronic acid is also a substance that is not toxic to the body. The incidence of allergic reactions is not high. and the body can decompose completely without leaving any residue

    OdpowiedzUsuń
  17. Agriculture is the leading investment for many Indian families; the government aims to support increase productivity in farming activities. This helps sustain the country’s economy and give employment to different people. Kisan Registration Bihar application Bihar government and the central government have implemented a new scheme to finance farmers and support the agricultural activity in Bihar.

    OdpowiedzUsuń
  18. First of all, I would like to appreciate your efforts towards this piece of blog. This helps me a lot. Keep it up and keep sharing such posts.
    A good communication skill is really important everyone should know. When it comes to good communication skills, a person should be good at speaking english. But many people face issues in speaking English fluently, for which they take online spoken english classes to improve their English speaking skills.
    https://onlinetuitionclassesadda.blogspot.com/2023/01/benefits-of-spoken-english-classes.html
    Benefits of Spoken English classes

    OdpowiedzUsuń
  19. Slotxo5 เกมสล็อตของเว็บน้องใหม่ปี 2021 เปิดแล้วให้ผู้เล่นได้ลองกัน ทั้งสนุกและหลากหลาย PGไม่ซ้ำกับเว็บไหนและโปรโมชั่นโดนใจมากมาย

    OdpowiedzUsuń
  20. ฟรีเครดิต กดรับเองหน้าเว็บไซต์ปัจจุบัน pg slot รับไปเลยเครดิตให้เล่นฟรี 100 บาท ให้ท่านสามารถทดสอบรับเครดิตฟรีกดรับเอง ก็ได้ของ PG SLOT เว็บไซต์ตรงของเรา pg-slot.game

    OdpowiedzUsuń
  21. https://unogeeks.com/oracle-fusion-financials-online-training

    OdpowiedzUsuń