Security Research & Engineering Practice

Technical articles migrated from Yuque.

[CVE-2022-36804] Bitbucket Pre-auth RCE Vulnerability

Critical severity command injection vulnerability - CVE-2022-36804 Official advisory: https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html Let’s diff 8.3.0 vs 8.3.1, and get familiar with the workflow of diffing jar packages in IDEA along the way: https://product-downloads.atlassian.com/software/stash/downloads/atlassian-bitbucket-8.3.0-x64.bin https://product-downloads.atlassian.com/software/stash/downloads/atlassian-bitbucket-8.3.1-x64.bin Analyzing the patch, two suspicious spots were found: patch#1 found bitbucket/atlassian-bitbucket-8.3.0-x64/app/WEB-INF/lib/nuprocess-2.0.2-atlassian-3.jar!/com/zaxxer/nuprocess/NuProcessBuilder.class the patch#1 is like: this.ensureNoNullCharacters(commands); A new method ensureNoNullCharacters was added command.indexOf(0): checks whether the command contains the \u0000 character If it does, an exception is thrown directly: Commands may not contain null characters — you can add this hint value in your PoC private void ensureNoNullCharacters(List<String> commands) { Iterator var2 = commands.iterator(); String command; do { if (!var2.hasNext()) { return; } command = (String)var2.next(); } while(command.indexOf(0) < 0); throw new IllegalArgumentException("Commands may not contain null characters"); } The full patch is below: ...

HackTheBox: Tenet Notes

Tenet 10.10.10.223 https://app.hackthebox.com/machines/Tenet/ export ip=10.10.10.223 && export url=http://10.10.10.223:80 && echo ok Information Gathering Nmap: Nmap scan report for 10.10.10.223 Host is up (1.1s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 cc:ca:43:d4:4c:e7:4e:bf:26:f4:27:ea:b8:75:a8:f8 (RSA) | 256 85:f3:ac:ba:1a:6a:03:59:e2:7e:86:47:e7:3e:3c:00 (ECDSA) |_ 256 e7:e9:9a:dd:c3:4a:2f:7a:e1:e0:5d:a2:b0:ca:44:a8 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.29 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Directory scanning: ...

A Look at AutoBinding Vulnerabilities in Spring MVC

0x01 BackGround Spring MVC, the Spring Web model-view-controller (MVC) framework Software frameworks sometimes allow developers to automatically bind HTTP request parameters into objects, making it easier for developers to build with the framework. Updates to the framework or business implementation can introduce new parameters that, in turn, affect variables or object parameters in the program code that were not meant to be set. Ruby on Rails, NodeJS, and Spring MVC all have this feature, and it frequently leads to vulnerabilities (it can be understood as property injection), ...

pwnhub: Internal CTF [Unboxing Together - So_That_Login] Writeup

The Challenge Itself There was no response echo at all, so I first tried FUZZing with ffuf and Burp: ./ffuf -w /opt/dic/SecLists/Fuzzing/SQLi/Generic-BlindSQLi.fuzzdb.txt -u http://121.40.89.206:8088/index.php -d "username=FUZZ&passwd=" Throughout the whole process there were only two kinds of responses (both 200): 1) When a forbidden keyword is detected: Returns alert('No,way! hacker!'); Content-Length: 42 2) When the input is substituted into the SQL query: Returns the homepage content Content-Length: 2175 Here is the SQL fuzzing dictionary as well: https://github.com/H4lo/dictionary/blob/master/sql_fuzz.txt ...

CVE-2021-41714: Tipask PostAuth LFR

1.Intro Tipask: Tipask is an open source PHP Question&Answer system developed based on the Laravel framework that is easy to extend and has strong load capacity and stability. Tipask < 3.5.9, which fails to validate the path parameters entered by the user when downloading attachments, a registered user can download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log and so on, causing information leakage. This vulnerability is CREDITED to the following entity: Qi'An Xin Technology Group, Network Security Department, Product-Security Team (1)Vendor Official Site: https://www.tipask.com/ ...

pwnhub: [Mid-Autumn Festival] BabyExec writeup

My first submission to pwnhub — I hope to join this excellent community of ours! 1. Prologue: A True MD5 Collision The challenge: <?php error_reporting(0); highlight_file(__FILE__); if ((string)$_GET['x'] !== (string)$_GET['y'] && md5($_GET['x']) === md5($_GET['y'])) { if(!isset($_GET['shell'])){ echo "Attack me!"; } else { $shell = $_GET['shell']; if(!preg_match("/[a-zA-Z0-9_$@]+/",$shell)){ eval($shell); } else { die('No,No,No! Keep it up......'); } } } else { die("No, way!"); } ?> The MD5 check: Without relying on weak typing, make md5(x) and md5(y) equal while x and y differ — a classic, well-worn topic. ...

[Responsible Disclosure] Tipask Contains an Authenticated Arbitrary Local File Download Vulnerability

http://tipask/attach/download/attachments-2021-09-4oFjTAjm6142e9d617e23.pdf attachments-2021-09-4oFjTAjm6142e9d617e23.pdf E:\Desktop\CodeAudit\v3.5.5\storage\app\ attachments\2021\09 E:\Desktop\CodeAudit\v3.5.5\storage\logs\laravel.log # E:\Desktop\CodeAudit\v3.5.5\storage\app\..-logs-laravel.log E:\Desktop\CodeAudit\v3.5.5\.env E:\Desktop\CodeAudit\v3.5.5\storage\app\..-..-.env The latest version of Tipask contains an “arbitrary local file download” vulnerability. An attacker can craft special input to download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log, etc., leaking important sensitive information from the server. The impact is significant, and roughly 700+ customers on the public internet may be affected. ...

How to Obtain Source Code During Penetration Testing

Using a recent case, let’s talk about some techniques for obtaining source code in real engagements. (This is also material from a closed-door sharing session a while back: hope you guys enjoy it~ Liquid Files Liquid Files is a foreign file-sharing (cloud disk) system; official site: https://www.liquidfiles.com/ It’s a commercial system, widely used abroad. Today we’ll try to obtain the source code of this system and conduct a preliminary attack-surface assessment (an initial code audit). ...

[CVE-2013-4730] Studying the PCMan's FTP Server Buffer Overflow Vulnerability

[CVE-2013-4730] PCMan’s FTP Server Course links: https://www.secpulse.com/archives/116030.html https://www.aqniukt.com/goods/show/597?targetId=12784&preview=0 Installing Windows XP Windows XP Home Edition Simplified Chinese retail original CD-KEY: BQJG2-2MJT7-H7F6K-XW98B-4HQRQ Basic Steps of the Overflow 1. Trigger the exception import socket import sys s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("pacman",21)) # login BOF # Confirm the crash caused by bof here # It crashed at 2000 for i in range(1990, 2050): if i % 1 == 0: s.send(b"USER: " + "A".encode()*i + "\r\n".encode()) data = s.recv(1024) print(str(i) + ":" + data.decode()) 2. Analyze the exception => determine exploitability We observe that after sending 2000 A’s, the FTP server crashes and the EIP register is overwritten with AAAA (i.e., the 41414141 shown in the screenshot) ...

Post-Auth SQL injection vulnerability in app/topic/action/admin/topic.php#2 (bypass of CVE-2020-35337)

Vulnerability name: ThinkSAAS latest version app/topic/action/admin/topic.php contains a SQL injection vulnerability (administrator privileges required) Author: Author of the vuln: Qianxin, Network Security Department, Product-Safety Team ( Unc1e ) This document provides responsible disclosure, aiming to give the open-source code vendor details of the security vulnerability and to facilitate a fix before the vulnerability is exploited in the wild. 0x01 Background Last December, there was a security issue caused by improper URLDecode. See https://github.com/thinksaas/ThinkSAAS/issues/24 ...