Alright folks, it's almost the end. But here we are again.
Wanted to take a quick second and give a big thanks to our 2020 sponsors.
That's Checkmarks, Google, and Offensive Security.
Thank you all so much for helping to make the AppSec Village happen.
We could have done it without you.
If you haven't gotten your shirt yet,
go to appsecvillage.com and pick up your t-shirt.
Also, if you're interested in making sure that this is a lasting thing,
go out and become a SuperFan for us.
That would go a long way towards helping to make sure that
hopefully if next year's DEF CON is in person,
AppSec Village will be part of it.
Alright, without any further introduction or me talking,
we are going to hear a talk from Mehmet Enes,
Managing Partner at Invictus in Cyber Intelligence.
He's going to be talking about A Haven for Hackers,
Breaking a Web Security Virtual Appliance.
With that, please help me welcome to the stage, Mehmet.
Let's talk about finding zero-day vulnerabilities.
In that presentation, I'm trying to take you all to the journey
with me to finding different vulnerabilities in a security solution
and a combination of them will give us a remote code execution
with a root user.
This is Mehmet. I've been doing vulnerability researching since 2005
and I'm working for a company, Invictus Cyber Security and Intelligence.
This is my Twitter address, mdisec.
And pentest.blog is a webpage where me and my teammates
are sharing our technical research in here.
Okay, so, A Haven for Hackers, third edition.
Actually, there's a story behind that title and it has started back in 2017.
I was doing a pentesting for a company and there was a blue team member
and they were telling me, you are doing this, etc.
And I was thinking about what happens if we somehow manage to break in
to your product that they are using and write a custom rule
in order to become totally invisible.
Because they are telling us what they are seeing in the product
and if we become invisible, that would be so nice.
So, that idea led me to finding remote code execution
on various different seam and log management solutions back in 2017.
And after one year, I was trying to send an email to a friend of mine
and that dude was not receiving any email from me at all.
And it turned out that there was a problem on the email security gateways
and they managed to solve the problem and eventually we started sending
an email to each other and I was thinking that,
all right, there is an email security gateway product
and what happens if I manage to break into your email security gateways
so that I can read all the emails incoming and outgoing.
So, that idea motivated me to finding a zero-day remote code execution vulnerabilities
on Symantec, MacroFocus, and the Tranq macro.
And the previous year, I was working with another client
and the project was hardening the client's network
in order to find data exfiltration scenarios.
And they were telling me we have the web security solutions
and only that device can connect to the internet
so all the clients have to go through that box
and if you find a different way to exfiltrate the data, that would be nice.
And I was like, okay, so what happens if you find another zero-day vulnerability
on especially the web security and the content filtering solutions.
So, when the attacker managed to execute a code on the client network
for the data exfiltration and the CT communication phase
they can exploit the content filtering solutions.
So, this is today's topic.
We are going to talk about the zero-day vulnerabilities
that I found on a very, very interesting product.
And I have a case study for you.
There is a product from the Trend Macro, InterScan Web Security Virtual Appliance
and I have done the vulnerability research on specifically that solution
and we are going to see what kind of vulnerabilities that I managed to find
and using all of those vulnerabilities together
we are going to see some sort of code executions in the end.
But, before diving into the case study, I would like to talk a little bit about
what is the content filtering in order to make it crystal clear to everyone.
As you can see in the picture, there is a computer on the left
which represents a client's network of the company.
And those devices don't have a direct internet access.
So, they have to go to the proxy service first
and that proxy service goes to the internet
so that the organization can do some sort of analysis
and the rules on the client's network.
So, content filtering is happening in here right now.
We can imagine that the content filtering solutions
they are kind of spatially implemented proxy service
and the term is given to do controlling the type of web content
that employees, guests, customers can access
while they are connected to the business wired or wireless network
so that the business may want to apply control over the type of content
that can be accessed to stop employees by restricting access to certain type of web pages.
And on top of that, also the content filtering is quite a good place
to ensure malicious web pages cannot be accessed
such as those used for phishing, malicious, distributing malware, etc.
So, we are targeting that kind of products in this presentation.
So, at the beginning, I had two main motivations
like targeting web filtering solutions, why we are doing this.
First and foremost, obviously, you know, all the clients network
are going to the internet through that solutions.
That means if we manage to break in, we are going to see the whole
clients network internet traffic of the organization.
And second motivation is, as I told you before,
clients computer don't have a network access to the internet,
they must go through the web filter.
So, we need to find a better way to CT communication
in the red teaming scenarios.
And I believe web filter solutions is a quite secure and stealth way
to make a CT communication.
Of course, there is a lot of different approach like DNS beaconing, etc.
But I believe that is a very secure and stealth way.
So, all right, that is the brief introduction to the idea
and the main motivation.
And this is the methodology that I usually follow
for my vulnerability research projects.
And there is a seven steps and we're going to see every single step
in details throughout the case study.
And first and foremost, we have to find a way to get a free trial
of the product that we are going to do vulnerability research on it.
Because you have to, you know, break into your operating system level
and you need to find all the source code and etc.
And you have to test your vulnerabilities
and eventually you're going to implement exploits
for the vulnerabilities you found.
So, you have to find a way to get a free trial
and it's not quite easy, guys, always.
It's not quite easy.
It's sometimes and most of the times it requires to have a lot of meetings
with the sales team.
And if you find a free trial of the product,
I strongly suggest you to start by reading the documentation
because there is administrative documentation of this type of solutions
and there is a huge technical information about the product itself.
So, after that, we are going to find a way to have a root SSH access to the box
because we are going to do the vulnerability research
and most of the case there is operating level hardening
and we need to get rid of all of those hardening stuff.
And after that, you know, you are in a situation
where you managed to install the solution,
you read the documentation and you managed to overcome
the operating level system hardening
and that is the moment that you need to start using product itself
like a regular user
because you have to understand all the features
because those information will become so handy
when you need to define a possible attack vector.
So, after that, we are going to talk about the enumeration
and the configuration step
and the most important phase is the defining possible attack vectors
because you got all the information you need
and it is a time to building attack scenarios
and then find a vulnerability as a final step.
We are going to see every single step throughout our case.
And in that case, I mean the TRANQ macro
Intersecam Web Security Virtual Appliance
6.5 version. You can download it from the vendor web page.
So, getting a free trial was quite easy
specifically in that case.
If you go to the Google and looking for the administrative documentation
is an important keyword in here for the Google search
you can directly find the administrative file
which is usually like 300 pages.
I strongly suggest you to read
administrative documentation because
you are going to see very very
helpful information about the product.
As you can see in here
administrative documentation tells us there is
different modes of the product. It can be
transparent breach mode, it can be transparent
breach mode with higher availability
forward proxy, reverse proxy, iCAP
WCCP, etc.
That product can be installed in very different modes.
On the right side, you are seeing the forward proxy mode
which tells you
that product can participate in a proxy chain
forward all the traffic to the upstream proxy service
and you will be seeing lots of graphics
on the administrative documentation which will help you
to understand about the product itself.
So we are reading the funny manual as well
and we
of course, for the third step after reading the documentation
you need to install the solution into your
virtualization system.
During the installation, there was an admin user
and the password has been set during the installation
and the product gives you
an opportunity to do SSH connection to the box
with the administrator user. But the problem is
there was a restricted shell on the SSH
there is very limited tools
that you can use in the SSH interface of the product
and we need to find a way to
have a directly SSH connection
with the root user because we are going to do
remote debugging, we want to try to find out
all the source codes and we are going to do
further analysis, etc.
So there is a little bit of a step before
starting the vulnerability research.
In that case, it was quite easy
because the product was distributed
by the vendor as an ISO file
so you can directly install it into your VM
and when you finish the installation
the idea is you can detach the VM
from the virtual machine that you just installed
and then you can attach it to the different Linux machines
and then you are going to mount
a new disk and you are going to find a grab file
because there was a password protection on the grab file
and I want to get rid of that protection as well
and you just need to remove the password protection
line on the graph file. And after that, in order to get rid of the restricted shell thing,
you can go to the SHT config file and you can enable remote root login. And if you do that,
you need to go to the ETC task video file and add binbash for the root user, which will give
us a direct SSH connection with the root user without having any restricted shell at all.
And we have to undo every single thing that we have done so far. So that means
you need to unmount this, detach the VM backup file, and attach it back to the original VM and
reboot the machine, actually. And in that case, you are going to have the direct
root SSH connection to the box. This is important. We need to get rid of, you know,
operating level hardening. So we are kind of ready to start using product itself. In that case,
I choose the reverse proxy mode, but I believe all the vulnerabilities that we have found,
it exists no matter what is the installation mode at all. For the fourth step, I strongly
suggest you to use a product for a day to get used to about the features itself, because
there is a lot of functionality, as you can see in the picture. There is a URL access control,
HTTP decryption. Right now, we know that product can't offload the SSL at all. That means we can
deploy SSL through the administratory interface. And there is an advanced threat protection
on the left side of the menu, as you can see. I hope you are seeing my mouse pointer in here.
There is advanced threat protection. That means all the HTTP or HTTPS traffic will be analyzed
by the product in order to find out malicious activities because of that feature. So later
of that presentation, guys, we are going to see how important it is to understand and getting
familiar with the product interface. Yeah, it's quite important. Just use it like a normal user.
So we have a search access with a root user. So the initial step is always enumerating the
services. This is what I'm doing. Of course, there would be a better way to do it, but this
is my way to do. So I'm always looking for the nested command to find out what kind of services
we have in the product itself. As you can see in here, there is a UWSGI, which listens for 6011.
That means we are doing some sort of assumptions in that phase. So that most probably means
there is a Python project running in the internal system. And there is a Java process which listens
exact port of the administrator interface. That means we are going to deal with the Java
when the time comes to do doing a research on the administrator interface. There's another UWSGI
in here. And that is another important thing because as I said before, that product acts as
proxy service. So that must be as some service on the product itself in order to handle incoming
HTTP connections from the user. So IWSSD process that you are seeing in here, which listens for
8080801. This is responsible for all the incoming connection from the client's network. So this is
the majority part of the product itself because that is the one who is communicating with the
clients. All right, so those are the services that we have in the product. But we need to find
which of those services are allowed to communicate with the different computers in the network.
Because in the end, we need to exploit at least one of those services. So what I'm doing
to find out that information, I usually run an nmap scan from my main host to the product
IP address. Or you can just use the IP tables dash dash list command to find out the IP
tables rules. So according to that rule, most of the internal services have been forbidden
to network traffic from the outside of the machine. You guys are remembering the IWSGI
service. If you keep doing enumeration, we are seeing very interesting information in here.
As you can see in here, there is a supervisor which is responsible for starting the solar
service. So right now, we know there is Apache Solar and lots of Python services in the box. So
what is Apache Solar? It is an open source enterprise search platform written in Java.
It's a major feature is included full text search, highlighting the time indexing,
dynamic clustering, etc, etc. So that means that Python project that we are seeing in here is
responsible reading and writing the log file into the Apache Solar service. So most probably,
whenever the request comes to the proxy service from the client's network, that proxy service is
sending some sort of signals to the Python project that we have seen in here. It's
something like an internal microservice. So that Python project is taking the information and
writing it into the Apache Solar service. So whenever the administrator user tries to query
something through the administrator interface, that request will be coming to the Python project
as well. Because the naming convention in here says the dashboard parse, mains,
stats parse, summary parse. There's a lot of log parsing and writing to the Apache Solar service.
And whenever it needs to be accessed by the administrator interface, that Python project
is taking the responsibility again. So it is quite important to know there is an Apache
Solar service within the box. But unfortunately, due to the IP tables rule that we have in here,
we're not going to be able to directly communicate with Apache Solar at the beginning. But later on
the presentation, we will find a way to do it. So all right, let's talk about the IWSST process.
If you grab it from the process tree, you are seeing the full path of the binary. And if you
look for the file type, it is a symbolic link to the IWSST process, which is a SUID LFI
binary. And there is a 61 module in that binary. So it's a very huge binary. And we can, of course,
target that process. But it will be requiring lots of reverse engineering. So
of course, we are going to do that at some point. But one of the most important attack
surface, as you can imagine, it is the process itself. So, so far, I believe I just spent 20
minutes, I guess. And we managed to collect enough level of information about product itself. So it
is time to define attack vectors in a light of those information that we got so far.
So we know that administrator interface is written with Java. And there is a proxy service,
which is written with C++. I haven't told that before, but it is C++, guys. It's my best story.
And there is a lot of internal services, but most of them are not accessible from outside of the box.
And you guys are remembering, you know, SSL decryption and advanced threat protection
features of the administrator interface. So we know that it does offloading the SSL,
it parses HTML contents, scan files, et cetera, et cetera. So my idea at that phase, my idea was,
okay, let's start with the administrator interface, and we can go after proxy service,
if it needs to be, you know, let's start with the administrator interface at the beginning.
But there is a lot of possible attack scenarios, as you can imagine, you know.
One of the... if you want to, let's say, target the HTML parser of the product,
like a browser exploitation, you can just send that phishing email to one of the employees of
the company that contains a link. Whenever the user clicks on that link, that request will be
sent to the proxy service, and proxy service is going to take that request from the client,
and it's going to send exactly the same request to the destination server, which is a webpage that
attacker can control. And whenever the proxy service gets the response, it performs analysis.
It has to parse HTML content and scan the file. So that means you can directly attack to the HTML
parser engine of the product, you know. There is a lot of different possible attack vectors,
you know, that was just one example that just popped in my mind right now during the presentation.
We are going to talk about the administrator interface, and then we're going to talk about
the proxy service. You know, as you know, it is a Java project, and I love, I like to be working
on the Java project. And every single time, whenever I'm facing with a Java application,
I always start by reading the configuration file, because, you know, the web.xml, struct.xml,
you know, all of those XML files contain a very good, high level of understanding information
about the software that we are going to do vulnerability research. And I don't want to
live in an SSH connection during vulnerability research, so we need to find out all the location
of the jar file by using just find command on the step two. And then you can copy all of them
to your main host to further analysis. Because we are going to deal with lots of jar files,
and I strongly suggest you to use IDEs. I used to use gdgui for the compiling of the jar files,
but those kind of project has hundreds of different jar files, and if you put all of
those jar files into the gdgui, it wasn't working for me. It was just crashing or freezing,
because it has to compile all the class and the functions, and they need to find all the cross
calls. So I strongly suggest you to use IntelliJ or Eclipse for that purpose. And if you are up to
use the IntelliJ IDE, there is a java.compiler.jar file under the compiler library, which comes by
default with IntelliJ, I guess. And you can compile all the jar files under the lib folder.
You can change the name, of course. And we are going to put all the compiled files under the lib-decompiled folder.
And if you go to the IntelliJ interface and look for the project settings, there is a library
section in here. You can import those libraries and sources all together, which will tell the
IntelliJ, this is my Java software. IntelliJ will take the rest of the job. It's going to process
all the classes, and you're going to be able to just find a function that you are interested in,
and you will be just clicking it to go to the definition. And also you can find a very
interesting function that might be some problem in the definition. You can just by using the IDEs,
you can find all the different locations where this specific function has been called. So I
strongly suggest you to be a friend with, you know, IntelliJ or Eclipse, if you are up to
one little research on Java application, guys. So I beg your pardon. So we have an access to
the source code of the administrator interface. So we are ready to do for the last step,
which was finding a vulnerability. There is a different approach to do it, like, you know,
top to bottom or bottom to top, you know. Bottom to top means, you know, the potentially vulnerable
functions on the Java, let's say, and you can directly search those functions within the code
base. And if you believe that you just find a very interesting, very easy way to use those
potential vulnerable function, you can start from the bottom to go to the top in order to find out
whether you are controlled to parameter that passed through all the function calls. Or you
can start from top to bottom, which is like, you know, start by reading the filter or the middle
layer definitions and the classes, look for the authentication mechanism, and then search for
all the controller or the request handler definition, which will be important because
that is the location where you can see the user controller parameters, etc, etc. In that case,
I was doing top to bottom approach. I choose that approach because of not very specific reason. I
was like, you know, doing fun, funny time on the Sunday and I was just start reading the source
code and it was like a top to bottom approach. I wish I could show you all the code bases and
everything, but I believe I don't have enough time to do it. So I just grabbed a very specific
function definition, which name is a mount device. It has to be a post request to be able to execute
the function definition. And there is a very interesting if statement in here. It tells you
if the request is coming from the localhost, it is okay. But if the request is not coming from
localhost, I'm going to validate your session and your privilege as well. Since we don't have
the username, the password, you know, this is going to be a problem for us because it is a
password protection if the request is not coming from localhost. And there is a function call in
here, get token, which will have a very important role on our exploitation. We will come back later.
So that was the important part of the function, and we are moving to the more important stuff.
So it tells us that the request must be a post request, and the post body, it is taken
from the request, and it is a JSON object. And we're going to get the mount device string from the
JSON data, and that part is quite interesting because it performs some sort of escaping. So
if the mount device contains a double quote, it will be escaped. If it contains a backtick,
dollar sign, it will be escaped by the backslash. But the problem is, if it contains backslash,
it will escape backslash one more time. So if we have a double quote, it will be escaped one time,
and it will be escaping backslash one more time in here. There is some sort of problem in here.
And after that, there is a function call, which is an IsVioletMountDevice,
and it takes our parameter that we can control. And if we manage to pass that if statement,
we are going to see Exe UI help with CMD, which is tend to execute operating system
command with a parameter that we are controlled. So we need to skip that if statement. It has to
be returned true. So let's have a look at that one. IsVioletMountDevice, it is just like a very
weak blacklisting. It tells you it cannot be contained bash, bin as such, Python, slash,
Perl, Python, et cetera, et cetera. It validates, it performs some sort of blacklisting on that
bounce. But the problem is, it has the white space at the beginning of the Perl and the Python
command in here. So it's a very weak blacklisting. We can bypass that without having any problem.
So we have to keep that in our minds if we've managed to find a vulnerability.
So all right, we can pass that part and we can reach in here. So it is time to read the Exe UI
helper CMD. And Exe UI helper CMD, it is going to execute UI helper binary with a sub-CMD, which is
a command that we can control. So what is UI helper? It is located in here and it has a root
privilege and there is a suidb. So all the commands will be executed with a root user.
So if you find a way to execute our command, that command will be executed with the root privileges,
which is something very, very important for us. And finally, that function calls Exe CMD, which is
basically calls runtime.getRuntime.exe. So obviously, we have command injection
vulnerability in here. So we believe that we have the vulnerability in here and we need to do the
proof of concept. Thanks to the reading of funny manual and the product feature steps of the
methodology, we know where is which administrator interface, I mean, which many of them it is going
to execute that specific endpoint. Of course, you can build it from scratch, but this is more
easier for me. And as you can see, that is the post request and there is a month device and we
can inject our command in here because the dollar sign, it will be used for the execution and the
dollar sign escape one time and the backslash escape one more time, which means there is no
at all. That backslash escaping did another one and there is nothing related with the dollar sign,
which will be helping us to inject our command. So basically, we are executing sleep command with
a 15 seconds with administrator with a root privilege. So let's talk about the exploitation
of that vulnerability as well. I'm one of the Metasploit contributors and I usually, you know,
using the Python dropper for the exploitation, especially exploiting the Linux machines.
But there's a problem about the Python dropper from the MSF Venom of the Metasploit. It has to
include the double code that wraps up our dropper command in order to pass it to the Python process.
So that means we're not going to be able to directly use it because, as you know, the double
code has been escaped on the backend service. So the idea is that we can use Perl because Perl can
take a parameter with a single code, which is allowed to use. And basically, the idea is simple.
I want to execute Python dropper, but I'm gonna put that Python command into the Perl command. So
basically, during the exploitation, we are going to execute Perl, which is going to execute the
first step of the Python dropper. When the Python executes, it communicates with the handler,
and the handler sends the second stage. So there is, you know, lots of execution,
one and after. And there is a Ruby code, as you can see in here, that we can build a Perl command,
which includes, which contains our Python command. So it's a quite nice trick.
So I reported that vulnerabilities to the ZDI. And of course, ZDI told me that the authentication
is required to exploit that vulnerability, but we are going to see that the exploitation can
be bypassed, guys. So we have to bypass authentication. Those are the initial ideas.
We can find a stored cross-site scripting vulnerability because we can force the
user to send HTTP requests to the device endpoint where we have the command injection.
And since the user is going to be manipulated by JavaScript, that request will be sent to the
endpoint with the authenticated user. So we don't have to be thinking about authentication request,
authentication stuff. And another idea is it would be handy to find something,
SSH vulnerability, some sort of, some type of SSH vulnerability could be handy in order to
communicate with internal services so that we can send a request from the localhost to the endpoint,
or it can go directly after the authentication bypass. I don't have too much time. I'm just
going to show you how I find a stored cross-site scripting on the administrative interface.
So as you can see in here, that is a very basic HTTP request to the proxy service. It tells to
the proxy service that I'm going to, you know, that I want to send a GET request to the pentest.blob
and proxy service does the job and sends the response back to the user. So that activity
has been written into the administrative interface. Guys, remember the Python and
Apache Solr stuff that we have talked about 15 minutes ago. You know, that activity
has been written to the Apache Solr database, which is represented into the administrative
interface. So the idea is that we can control that data in here because we can tell anything
we want to the proxy service. So the idea is quite simple. As an attacker, we are going to
intentionally download a very, very known malware through the proxy service. So proxy product can
detect it and produce a log file and it will be like, you know, ringing all the alarms, you know,
I call the malware, etc, etc. But the data will be written into the Apache Solr, which is being
used in the administrative interface and very, very specifically in here. So when the system
administrator logs in and checks what's happening, we can execute JavaScript code on the
system administrator browser. And thanks to that JavaScript code, we can send the IX request to
the vulnerable endpoint that we have found in the first place. So, you know, there was a quite
interesting XSS vulnerability because whenever the browser is sending requests to the proxy,
they are performing the full URL encoding in here. But I'm manually crafting the HTTP request
to the proxy service. That means there will be no encoding and that data is not being encoded
on the administrator interface. Basically, we have a cross-site scripting, spatially stored
cross-site scripting vulnerability in here. So instead of popping up an alert box, we are just,
we can just call IX request to the endpoint that we have a command injection. So that was,
I reported that vulnerability to the ZDI as well. And as you can see in the vulnerability description,
attacker can leverage this in a conjunction with other vulnerabilities to execute code
in the context of the root user. But guys, you know, cross-site scripting is cool.
I'm not underestimating any kind of vulnerabilities, but it is just not enough for me because there is
a huge setback which requires the user interaction for the exploitation. I was like, okay, I just
find something very cool, you know, intentional downloading of malware, etc, etc. That idea was
simple and cool, but I need to find a better way to continue the exploitation. But, you know,
I got another idea while I was spending a time to find the XSS through the proxy service. So
the idea is targeting proxy service itself. So as you can remember from the previous slides,
that is the HTTP request, a very simple HTTP request to the proxy service itself. It tells
the proxy service that I want to communicate with the Pantheon staff blog. Proxy service
sends the request, gets the response, and sends back to the user, right? So what happens if I
tell the proxy service that I want you to communicate with yourself? In that case,
it told me there is a, you know, self-referential request to proxy are forbidden. And I was like,
all right, that means there is some sort of control and lots of if statements in the proxy
service itself. What happens if I manage to trick the proxy service to communicate with an
internal service? That was the main idea. So that is the function, get end user authentication
function. I set a breakpoint in here, which produced exactly the same error message that
we have seen in here. And I just sent the same request, and it hit the breakpoint, and it tells
you that get user notification or the notification has been called by the prepare proxy loop
rejection, which has been called by the handle proxy loop, which has been called by the due
processing. So we're going to read all of those functions. So within the due processing, there is
one function called, which is an easy reverse proxy. And the function is a member of the proxy
config cache. So basically, products try to understand, like, am I being placed as a reverse
proxy? And in that case, handle proxy loop has been called, this function that we have seen on
the previous slide. And that function calls tm socket address is same ADDR. That is the important
part, because that function performs full URL comparison with the URL of the proxy service,
with a URL of the user try to communicate. So if it is a same address, it calls prepare proxy
loop rejection call, and we are seeing that error message. So I just changed the port number
to the Apache Solr service. And due to that changes, there will be a no match in the full
URL comparison on the proxy service. And there is administrator interface of the Apache Solr service.
I'm just can communicate with it because of a very interesting bug in the proxy service. So
I, as you can see in here, I'm allowed to communicate with the Apache Solr service
administrator interface. So, all right, that was another very, very, very important vulnerability,
because we can, we are going to leverage this vulnerability to the bypass authentication
on the systems. And in the end, we're going to chain all of them together, guys. So
Apache Solr service in the box, I mean, in the product was very old version,
because it's not quite easy to upgrade your third party dependencies like Apache Solr or
database servers. And in these type of solutions, it's quite hard to upgrade to newer versions. So
that was a very, very old vulnerability in Apache Solr service, but it is exactly what I need.
It is arbitrary file read vulnerability. So that is the name of the collection,
and there is a replication endpoint. And the command has to be a file content. And you can
traverse back to the roots folder, and then you can call whatever you want. And that will give
you to reading any content of the file. So at the beginning, I wasn't, there was no way to
communicate with the Apache Solr service, but we find a very interesting bug. And by exploiting
that bug, we are going to read anything we want. So far, so good. I want you to remind the get
token function. You know, it was like way behind of our presentation. Guys, all right. Do you
remember that get token function? It is going to help us what we are going to achieve in here.
Because, let me, yeah. Because that function takes cookies from the HTTP request, and it returns
the value. But the problem is, it prints out the value and the name of the cookies. But the
Java application is running by the Tomcat process. So those standard outputs data will be written
into the log file, which is a Catalina.auth file. So due to that little function, all of those
valid session IDs written into the log file, and we have arbitrary file read vulnerability.
So what we are going to do that, we're going to exploit two vulnerabilities together in order
to get the content of the Catalina.auth file, which contains the valid session IDs. And then
we are going to collect all the session IDs together, and we can go to administrator
interface in order to exploit command injection vulnerability with the active session IDs. So
the idea is actually quite simple, guys. We are going to, in the first step, we are going to exploit
a comparison bug in the proxy service, which helps us to communicate with the Apache
solar service that is running within the product itself. And this is a very old software which has
a vulnerability, and it is arbitrary file reads. And combination of that vulnerability, we are
going to read Catalina.auth file. And we're going to, by using regex, we're going to extract all the
session IDs that we have. And there is a check session endpoint. I haven't talked about it
because it was quite easy. There is a check session endpoint in the product. We are going to
test all the session IDs we have in order to find out whether it is still active or not. And if you
find an active session, we are going to exploit the command injection vulnerability, and we are
going to be executing operating system commands with a root privilege, which will give us a C2
reverse shellcr command and control server. That is the idea. And of course, I have implemented a
metasplit module that performs all of those steps automatically. And I have a video for it. I would
like to, I guess, yeah, time is good. I guess I still have a minute. So let's see. And by the way,
that metasplit module has been merged to the master branch of the metasplit project. You are
just, you know, can go and fetch the module and install the product on your lab and, you know,
have fun. So when we run, as you can see in here, it's trying to, it exploits reverse process
service and extract the katalina.out file. And that was, of course, this is a demonstration.
There's only one session ID in the log file and it's inactive. And by using that session ID,
it goes to the command injection vulnerability and it executes operating system command,
which is a Perl command. Perl command contains a Python command, you know, and all of those steps
have been automatically done. And as you can see in here, we have a root session on the back filter
solution of the company, guys. That's it. Thank you very much.