HN Explorer

An exposed .git folder let us dox a phishing campaign

64 points by spirovskib ↗ HN
This past Friday afternoon, a member in our Discord server reported a phishing email pointing to a fake login page.

We took up to research it and because of clumsy decisions by the attacker we got their GitHub and their operational Telegram bot.

Screenshots: https://imgur.com/a/FTy4mrH

Sometimes the attacker incompetence can be a defender's best weapon ¯\_(ツ)_/¯

The phishing page was a standard clone of an "email", unbranded anf generic service. A bit of gobuster reconnaissance and we got the site's .git directory publicly accessible and listing its contents.

Inspecting of the requests also got us the first Telegram bot token. This is the digital equivalent of leaving the blueprints to your entire operation, including past versions and deleted files, lying on the front lawn.

We pulled the repository, found automated deployments and multiple fake pages with different hardcoded Telegram bot tokens and Chat IDs.

With the source code, repo and the active Telegram bot token, we filed detailed abuse reports:

- GitHub: We reported the repository containing the phishing kit's source code. It was taken down for violating TOS.

- Telegram: We reported the bot using the provided token and chat ID, leading to its removal.

- Hosting Provider: The malicious site was reported and taken offline.

Lesson learned? Never deploy a .git folder to production. Even if you are a criminal.

Acknowledgement: This was a collaborative effort by members of the BeyondMachines Discord community. The crowdsourced speed and collaboration helped us take this down very fast.

8 comments

[ 5.9 ms ] story [ 36.4 ms ] thread
poly2it
Could've traced the attacker for a bit before burning all bridges.
ArcHound
It is great that they got taken down. From my experience, these sites are usually parasites on misconfigured Wordpresseses.

We're you able to get the phishing data so that you can help the victims? Is it a good idea to try and do so?

Also, can you please share some bits of the phishing kit for easier detection?

Thank you for your efforts!

CGamesPlay
What leads to the secret being stored in git's config file like that? None of my repositories have that, the remote URLs all just say "git@github.com:foo/bar.git".
KomoD
In reality, it wasn't the attacker's incompetence, it was the hosting provider's fault (which is a "Serverless app platform" they use to deploy their phishing pages)

When you deploy a simple page with them it exposes .git/CONFIG and the x-access-token that grants access to the repository.

wink
Lacking details, but people don't generally rsync a checkout of a git repo (including a .git folder) to their webspace, so you're right if the hoster did that, I find it more likely the people did that.

On the other hand just blacklisting .git/* is not great, maybe I want to publish something on that path, just like any other filename. It's prone to lead to false positives.

JakeStone
I agree with never deploying a .git folder to prod.

Part of our deployment script for sites has something like:

  git clone -d 1 -b $BRANCH https://blahblah.tld/project
  rm -rf .git*
So no .git directory, .gitignore, and so on.