一个暴露的 .git 文件夹让我们揭露了一场网络钓鱼活动。
上周五下午，我们的Discord服务器上一位成员报告了一封指向假登录页面的钓鱼邮件。<p>我们对此进行了调查，由于攻击者的笨拙决策，我们找到了他们的GitHub账户和运营中的Telegram机器人。<p>截图链接： https://imgur.com/a/FTy4mrH<p>有时候，攻击者的无能反而可能成为防御者最好的武器 ¯\_(ツ)_/¯<p>这个钓鱼页面是一个标准的“电子邮件”克隆，属于无品牌和通用服务。经过一些gobuster侦查，我们发现该网站的.git目录是公开可访问的，并列出了其内容。<p>检查请求时，我们还获得了第一个Telegram机器人令牌。这就相当于把整个操作的蓝图，包括过去的版本和已删除的文件，放在前院上。<p>我们拉取了该代码库，发现了自动部署和多个带有不同硬编码Telegram机器人令牌和聊天ID的假页面。<p>凭借源代码、代码库和活跃的Telegram机器人令牌，我们提交了详细的滥用报告：<p>- GitHub：我们报告了包含钓鱼工具包源代码的代码库，因违反服务条款而被下架。<p>- Telegram：我们报告了使用提供的令牌和聊天ID的机器人，导致其被移除。<p>- 主机提供商：我们报告了恶意网站，并使其下线。<p>教训是什么？绝不要将.git文件夹部署到生产环境中。即使你是个罪犯。<p>致谢：这是BeyondMachines Discord社区成员的协作努力。众包的速度和合作帮助我们迅速处理了此事。
查看原文
This past Friday afternoon, a member in our Discord server reported a phishing email pointing to a fake login page.<p>We took up to research it and because of clumsy decisions by the attacker we got their GitHub and their operational Telegram bot.<p>Screenshots: https://imgur.com/a/FTy4mrH<p>Sometimes the attacker incompetence can be a defender's best weapon ¯\_(ツ)_/¯<p>The phishing page was a standard clone of an "email", unbranded anf generic service. A bit of gobuster reconnaissance and we got the site's .git directory publicly accessible and listing its contents.<p>Inspecting of the requests also got us the first Telegram bot token.
This is the digital equivalent of leaving the blueprints to your entire operation, including past versions and deleted files, lying on the front lawn.<p>We pulled the repository, found automated deployments and multiple fake pages with different hardcoded Telegram bot tokens and Chat IDs.<p>With the source code, repo and the active Telegram bot token, we filed detailed abuse reports:<p>- GitHub: We reported the repository containing the phishing kit's source code. It was taken down for violating TOS.<p>- Telegram: We reported the bot using the provided token and chat ID, leading to its removal.<p>- Hosting Provider: The malicious site was reported and taken offline.<p>Lesson learned? Never deploy a .git folder to production. Even if you are a criminal.<p>Acknowledgement: This was a collaborative effort by members of the BeyondMachines Discord community. The crowdsourced speed and collaboration helped us take this down very fast.