Hello, everyone, and welcome to this video.
So in this video, we are going to see common indication through broken link highjacking.
So it is a very, very interesting report that we have come across.
And you're the report was submitted to Facebook and Facebook rewarded with 500 dollars for this specific
auditability.
Now, you may be thinking that we have seen what is a broken link hijacking and now are we able to do
common addiction through broken link hijacking?
And it is yes, you're able to do it if you find the right test case scenario.
All right.
So let's see this.
So this guy used the dock.
As you can see, this is the Google dock, which is organization Facebook and S3 dot, Amazon, EWR,
dot com.
Now, we know that S3 is a service by Amazon NWS one, which we can create our bucket and we can host
our content into it.
We have already seen how to create bucket into our subdomain decoder videos in which we have successfully
made a bucket and Tigo taken over many of the subdomains.
All right.
So now when this guy used this dog, he came across multiple bottles in one of the project was this.
As you can see, this repository is owned by Facebook.
And you you can see there is a Basche script with the name of setup underscore processed, Alesco,
DataDot, S.H..
Now, this is a script.
All right.
So let's have a look over here.
And you can see this bushcraft.
Exactly.
Does what you can see it sends a W8 command to a U-Haul.
And what is the you that you are pointing to?
A three bucket.
The bucket name is Fair Data.
And you can see there is a gun.
The file, which is basically a zip file, which is data DataDot GZ.
Now, any attacker can simply take over the bucket and place a malicious file in the same pot as shown
in the above image.
So if you have a closer look, you can see the part is after fair data, which is the bucket name,
the party's m, e, m and N gave me M and then and the file, which is data not to desert, which is
a zip file.
All right.
So let's quickly have a look at the steps to reproduce this vulnerability.
Remember, this is a very, very simple vulnerability that was identified and can easily be reproduced.
So the first step is to create a three bucket named affaires data.
And we have already seen this, how to create buckets in the subdomain like our videos.
Next, create a folder which is m m double N inside it again, create a folder with gave me M Plan and
pleasure malicious file, which is Diprotodon GZ over there.
And it should look something like this, as you can see over here.
Now what is the impact.
So when the attacker is able to control the file, which is this file.
Now if the users download the bad script, which is the bad script setup process did not S.H. This script
will get downloaded, which is controlled by the attacker and attacker can execute malicious and harmful
commands onto the system of end users.
So the victim trust the shell file, which is mentioned in the Facebook repository.
So the victim will think as the Shell file is into the repository, which has been hosted by Facebook.
So it should be something legitimate right now, but it is the attacker control repository and contains
some harmful commands that may cause some disruption into the Linux system.
As you can see, the reward that was given by Facebook was five hundred dollars on 16th January 2020
and again into a message of what year.
After reviewing the issue, we have decided to award you a bounty of $ 500.
Below is an explanation of the bounty amount as Tribecca take over.
Usually these submissions are low-impact are not eligible for a white hat program, but in this case,
the bucket contains an executable shell script that could be written by other people.
So this actually contains the severity and has been understood that it may portray a risk to all its
customers.
So I hope you guys understood this.
How interesting scenario can be changed, which is command in action with broken link highjacking.
So I hope you guys and.
Thank you.