This is my very frist blog post which was pending for a long time (almost a year). I would like to share a particular Remote Code Execution (RCE) in Java Springboot framework. I was highly inspired to look into this vulnerability after I read this article byDavid Vieira-Kurz, which can be found at hisblog. His article talks about an RCE in the Spring Security OAuth framework and how the Whitelabel error page can be used to trigger code execution.
So this meant that any Whitelabel Error Page which reflected user input was vulnerable to it. This was because user input was being treated in as Springs Expression Language (SpEL). So during my pentest I had come across a particualr URL which triggered this Whitelabel Error page.
My input ofabc${12*12}abcwas reflected asabc144abc. Then I wanted to perform a simpleidand get the result on screen. I proceeded with the following payload:
Hmm…..I see nothing. The reflection gave back the input as it is. I double checked David’s blog to see if I was doing anything wrong. I was unsure as to what went wrong. Was the payload incorrect or did I make a mistake with the braces?? Nope. Everything was correct but I was still not getting my desired output. After fiddling around for a few hours I decided to fireup a demo Springs app and try to recreate the same scenario. I tried with a basic{5*5}and got25printed beautifully onscreen. Then I tried doing anidand bam!!!, it did not execute. I knew that I had to dig deeper because this was eating me up.
It got me thinking that quotes might have been encoded and might have broken theexec()command. Next thing was to look at the stack trace at the server and see what was wrong.
So after debugging I could see that single & double quotes were URL encoded. Theexec()method clearly takes an argument as a string. Now I either need to find characters within the error code and take bits & pieces and pass it to exec usingsubstring(), which is still pretty difficult or I need to find a way to pass my string without using double quotes or single qutoes. I wanted to go with the second approach. Java supports nested functions and if I’m able to find a method which can outputidorcat etc/passwd, this would then be passed toexec()and then my payload would run successfully.
After going through some Java classes I stumbled upon the following:
java.lang.Character.toString(105)
-> prints the characer 'i'
Now I need to concat the letter ‘d’ and I’m golden. Again concat() is a method and i’m going to nest thecharacter.toStringinside it as well.
java.lang.Character.toString(105).concat(T(java.lang.Character).toString(100))
-> prints the characters 'id'
Now crafting the final payload, I get the following:
ThegetRuntime()method returns the runtime object which we got on screen. Now we have some sort of a Blind RCE with which we can run any commands. I wanted to go a step further and get the output on screen (just for fun). At this point I wanted to do acat etc/passwdand print the result onto the Whitelabel Error page. This meant for every character I would need to write its ASCII equivalent in the formatconcat(T(java.lang.Character).toString(<ascii value>)). Wrote a quick sloppy python script to acheive this:
Python Script:
#!/usr/bin/env python
from __future__ import print_function
import sys
message = raw_input('Enter message to encode:')
print('Decoded string (in ASCII):\n')
for ch in message:
print('.concat(T(java.lang.Character).toString(%s))' % ord(ch), end=""),
print('\n')
Now to get the output ofcat etc/passwdin the response, we will use theIOUtilsclass and call thetoString()method. We can pass an input stream to this method and get the contents of the stream as a response.
The payload became quite huge. To sum up, I used the Apache IOUtils library. I convertedcat etc/passwdinto ASCII characters using the character class, passed this value to theexec()method and got the input stream and passed it to thetoString()method of IOUtils class. Awesome isnt it. I tried this on the remote box and got the following.
All this hassle just to get around the single and double quotes. However I feel there might have been easier ways to go about it. Tackling out the hurdles and troubleshooting and debugging and finally getting what you want is such a serene feeling. This bug was a learning curve for me and I learned a lot of things alongside exploiting this. If you are using an older version of Spring Boot, I would highly advise you to upgrade it. The vulnerability has been patched sinceSpring Boot 1.2.8.
In this write up, I will be covering multiple bugs in the Edge (EdgeHTML) browser. The combination of these bugs will result in two distinct attacks, one being a local file disclosure and the other is an elevation of privilege which is used to change any settings within 'about:flags'.
We all know thatCapture the Flag(CTF) tasks are synthetic. They are designed as games or puzzles for security professionals to solve in order to hone, demonstrate, and add skills. It’s like merging chess, a maze, and a physically challenging 10K obstacle course, but for security aficionados.
“Computer security represents a challenge to education due to its interdisciplinary nature… Attack-oriented CTF competitions try to distill the essence of many aspects of professional computer security work into a single short exercise that is objectively measurable. The focus areas that CTF competitions tend to measure are vulnerability discovery, exploit creation, toolkit creation, and operational tradecraft.”
The following are network traces with file types contained in them:
PDF. For this use a filter ofhttp contains "%PDF"orhttp contains "\x25\x50\x44\x46":Here
GIF. For this use a filter ofhttp contains "GIF89a"orhttp contains "\x47\x49\x46\x38":Here
PNG. For this use a filter ofhttp contains "\x89\x50\x4E\x47":Here
MIME. For this use a filter ofsmtp contains "/9j/4AAQSkZJRgA":Here
SMTP Trace with email number. For this use a filter ofsmtp matches "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9._%+-]":Here
SMTP Trace with credit card number. To detect Visa credit card number, use a filter ofsmtp matches "5\\d{3}(\\s|-)?\\d{4}(\\s|-)?\\d{4}(\\s|-)?\\d{4}":Here
