Hoşgeldin Misafir

Canarytokens Detection Bypass

Burak Bey

23 Mar 2019
2,323 Mesaj

Aktiflik

Seviye

Deneyim

TIM / GÖREV:
Kod:
<?php
 
system('unzip ' . $argv[1] . '.docx');
 
system('cp ' . $argv[1] . '.docx ./docProps/' . $argv[1] . '.docx && cd docProps');
 
$strFile = file_get_contents("docProps/core.xml");
 
if(strpos($strFile, 'AAAAAAAAAAAAAAAA')!=false && strpos($strFile, '2015-07-21')!=false && filesize( $argv[1] .".docx") < 170000 )
{
     echo "This file probably contains a CanaryToken! Open it with Libreoffice/Microsoft Word Protected View to bypass detection";
}
else
{
     echo "Should be safe to open normally";
}
?>

-~ Exploit > https://www.exploit-db.com/exploits/46589
--