Merge branch 'dev' into dependabot/pip/django-4.2.22

Author: liquidsec

.github/workflows/tests.yaml

@@ -52,7 +52,7 @@ jobs:
         uses: nick-fields/retry@v2
         with:
           max_attempts: 3
-          timeout_minutes: 20
+          timeout_minutes: 40
           retry_wait_seconds: 0
           command: |
             poetry run pytest --exitfirst --disable-warnings --log-cli-level=DEBUG --cov-report xml:cov.xml --cov=badsecrets --cov=examples

badsecrets/base.py

@@ -93,9 +93,15 @@ def carve(self, body=None, cookies=None, headers=None, requests_response=None, *
                 raise badsecrets.errors.CarveException("Body/cookies/headers and requests_response cannot both be set")
 
             if type(requests_response) == requests.models.Response:
-                body = requests_response.text
-                cookies = dict(requests_response.cookies)
-                headers = requests_response.headers
+                if not cookies:
+                    try:
+                        cookies = {cookie.name: cookie.value for cookie in requests_response.cookies}
+                    except (AttributeError, KeyError):
+                        cookies = {}
+                if not headers:
+                    headers = requests_response.headers
+                if not body and hasattr(requests_response, "text"):
+                    body = requests_response.text
             else:
                 raise badsecrets.errors.CarveException("requests_response must be a requests.models.Response object")
 
@@ -142,7 +148,9 @@ def carve(self, body=None, cookies=None, headers=None, requests_response=None, *
             if self.carve_regex():
                 s = re.search(self.carve_regex(), body)
                 if s:
-                    r = self.carve_to_check_secret(s, url=kwargs.get("url", None))
+                    r = self.carve_to_check_secret(
+                        s, url=kwargs.get("url", None), body=body, cookies=cookies, headers=headers
+                    )
                     if r:
                         r["type"] = "SecretFound"
                     else:

badsecrets/modules/aspnet_viewstate.py

@@ -25,10 +25,22 @@ def carve_regex(self):
             r"<input.+__VIEWSTATE\"\svalue=\"(.+)\"[\S\s]+<input.+__VIEWSTATEGENERATOR\"\svalue=\"(\w+)\""
         )
 
-    def carve_to_check_secret(self, s, url=None):
+    def carve_to_check_secret(self, s, url=None, **kwargs):
         if len(s.groups()) == 2:
-            r = self.check_secret(s.groups()[0], s.groups()[1], url)
-            return r
+            viewstate = s.groups()[0]
+            generator = s.groups()[1]
+
+            possible_userkey_cookies = ["ASP.NET_SessionId", "__AntiXsrfToken", "ASPSESSIONID"]
+
+            if kwargs.get("cookies") and hasattr(kwargs.get("cookies"), "get"):
+                for cookie_name in possible_userkey_cookies:
+                    if cookie_name in kwargs.get("cookies"):
+                        cookie_value = kwargs.get("cookies").get(cookie_name)
+                        r = self.check_secret(viewstate, generator, url, cookie_value)
+                        if r:
+                            return r
+
+            return self.check_secret(viewstate, generator, url)
 
     @staticmethod
     def valid_preamble(sourcebytes):
@@ -92,7 +104,8 @@ def viewstate_decrypt(self, ekey_bytes, hash_alg, viewstate_B64, url, mode):
                     else:
                         continue
 
-    def viewstate_validate(self, vkey_bytes, encrypted, viewstate_B64, generator, url, mode):
+    def viewstate_validate(self, vkey_bytes, encrypted, viewstate_B64, generator, url, mode, viewstate_userkey=None):
+
         original_vkey_bytes = vkey_bytes
         viewstate_bytes = base64.b64decode(viewstate_B64)
 
@@ -104,19 +117,32 @@ def viewstate_validate(self, vkey_bytes, encrypted, viewstate_B64, generator, ur
             signature_len = len(vs.signature)
             candidate_hash_algs = self.search_dict(self.hash_sizes, signature_len)
 
+        modifier_bytes = b"\x00" * 4
+        if viewstate_userkey and viewstate_userkey.strip():
+            modifier_bytes += viewstate_userkey.encode("utf-16le")
         for hash_alg in candidate_hash_algs:
             vkey_bytes = original_vkey_bytes
             viewstate_data = viewstate_bytes[: -self.hash_sizes[hash_alg]]
             signature = viewstate_bytes[-self.hash_sizes[hash_alg] :]
             if hash_alg == "MD5":
-                md5_bytes = viewstate_data + vkey_bytes
                 if not encrypted:
-                    md5_bytes += b"\x00" * 4
+                    if viewstate_userkey and viewstate_userkey.strip():
+                        md5_bytes = b"will not work, sorry"
+                        # MD5 + ViewStateUserKey is a horrible edge case that may NEVER work. We will not match on it, currently.
+                        # Last attempt:
+                        # md5_bytes = viewstate_data + vkey_bytes + page_hash_bytes + viewstate_userkey.encode('utf-16le')
+                        # But page_hash_bytes is apparently NOT the generator and my have to be brute-forced.
+                        # Probably not worth it for the 3 servers in the entire world probably using these settings in the wild.
+                    else:
+                        md5_bytes = viewstate_data + vkey_bytes + modifier_bytes
+                else:
+                    md5_bytes = viewstate_data + vkey_bytes
                 h = hashlib.md5(md5_bytes)
             else:
                 vs_data_bytes = viewstate_data
                 if not encrypted:
                     vs_data_bytes += generator
+                    vs_data_bytes += modifier_bytes[4:]
                 if mode == "DOTNET45" and url:
                     s = Simulate_dotnet45_kdf_context_parameters(url)
                     label, context = sp800_108_get_key_derivation_parameters(
@@ -129,7 +155,9 @@ def viewstate_validate(self, vkey_bytes, encrypted, viewstate_B64, generator, ur
                     self.hash_algs[hash_alg],
                 )
 
-            if h.digest() == signature:
+            computed_hash = h.digest()
+
+            if computed_hash == signature:
                 return hash_alg
 
         return None
@@ -139,6 +167,7 @@ def resolve_args(self, args):
         generator_pattern = re.compile(r"^[A-F0-9]{8}$")
 
         url = None
+        viewstate_userkey = None
         generator = "0000"
 
         for arg in args:
@@ -147,14 +176,15 @@ def resolve_args(self, args):
                     generator = arg
                 elif url_pattern.match(arg):
                     url = arg
-
+                else:
+                    viewstate_userkey = arg
         # Remove query string from the URL, if any
         if url:
             url = urlsplit(url)._replace(query="").geturl()
-        return generator, url
+        return generator, url, viewstate_userkey
 
     def check_secret(self, viewstate_B64, *args):
-        generator, url = self.resolve_args(args)
+        generator, url, viewstate_userkey = self.resolve_args(args)
 
         if not self.identify(viewstate_B64):
             return None
@@ -182,7 +212,7 @@ def check_secret(self, viewstate_B64, *args):
 
                 for mode in ["DOTNET40", "DOTNET45"]:
                     validationAlgo = self.viewstate_validate(
-                        binascii.unhexlify(vkey), encrypted, viewstate_B64, generator, url, mode
+                        binascii.unhexlify(vkey), encrypted, viewstate_B64, generator, url, mode, viewstate_userkey
                     )
                     if validationAlgo:
                         if encrypted:
@@ -201,6 +231,8 @@ def check_secret(self, viewstate_B64, *args):
                         product_string = f"Viewstate: {viewstate_B64}"
                         if generator != "0000":
                             product_string += f" Generator: {generator[::-1].hex().upper()}"
+                        if viewstate_userkey:
+                            product_string += f" ViewStateUserKey: {viewstate_userkey}"
                         return {"secret": result, "product": product_string, "details": f"Mode [{mode}]"}
         return None