start	end	text
14060	19000	Alright folks, it's almost the end. But here we are again.
19680	25640	Wanted to take a quick second and give a big thanks to our 2020 sponsors.
25640	29720	That's Checkmarks, Google, and Offensive Security.
29720	33560	Thank you all so much for helping to make the AppSec Village happen.
33740	35900	We could have done it without you.
37160	39540	If you haven't gotten your shirt yet,
39540	45140	go to appsecvillage.com and pick up your t-shirt.
46720	51060	Also, if you're interested in making sure that this is a lasting thing,
51060	53820	go out and become a SuperFan for us.
53860	57440	That would go a long way towards helping to make sure that
57440	61280	hopefully if next year's DEF CON is in person,
61280	63380	AppSec Village will be part of it.
63820	68320	Alright, without any further introduction or me talking,
68320	73340	we are going to hear a talk from Mehmet Enes,
74240	78560	Managing Partner at Invictus in Cyber Intelligence.
78560	82260	He's going to be talking about A Haven for Hackers,
82260	85980	Breaking a Web Security Virtual Appliance.
85980	89940	With that, please help me welcome to the stage, Mehmet.
89940	93500	Let's talk about finding zero-day vulnerabilities.
93500	97980	In that presentation, I'm trying to take you all to the journey
97980	103260	with me to finding different vulnerabilities in a security solution
103260	107660	and a combination of them will give us a remote code execution
107660	109500	with a root user.
110040	115580	This is Mehmet. I've been doing vulnerability researching since 2005
115580	121260	and I'm working for a company, Invictus Cyber Security and Intelligence.
121260	123880	This is my Twitter address, mdisec.
123880	128020	And pentest.blog is a webpage where me and my teammates
128710	133320	are sharing our technical research in here.
133500	136840	Okay, so, A Haven for Hackers, third edition.
136840	143840	Actually, there's a story behind that title and it has started back in 2017.
144120	149140	I was doing a pentesting for a company and there was a blue team member
149140	152520	and they were telling me, you are doing this, etc.
152520	159320	And I was thinking about what happens if we somehow manage to break in
159320	165700	to your product that they are using and write a custom rule
165700	168700	in order to become totally invisible.
168700	171980	Because they are telling us what they are seeing in the product
171980	175900	and if we become invisible, that would be so nice.
175900	180080	So, that idea led me to finding remote code execution
180080	184920	on various different seam and log management solutions back in 2017.
185480	190580	And after one year, I was trying to send an email to a friend of mine
190580	194640	and that dude was not receiving any email from me at all.
194640	199580	And it turned out that there was a problem on the email security gateways
199580	203640	and they managed to solve the problem and eventually we started sending
203640	207220	an email to each other and I was thinking that,
207220	209900	all right, there is an email security gateway product
209900	215320	and what happens if I manage to break into your email security gateways
215320	220100	so that I can read all the emails incoming and outgoing.
220100	227840	So, that idea motivated me to finding a zero-day remote code execution vulnerabilities
227840	232100	on Symantec, MacroFocus, and the Tranq macro.
232140	236460	And the previous year, I was working with another client
236460	240780	and the project was hardening the client's network
240780	246060	in order to find data exfiltration scenarios.
246060	250460	And they were telling me we have the web security solutions
250460	253540	and only that device can connect to the internet
253540	256400	so all the clients have to go through that box
256400	261780	and if you find a different way to exfiltrate the data, that would be nice.
261780	267140	And I was like, okay, so what happens if you find another zero-day vulnerability
267140	271360	on especially the web security and the content filtering solutions.
271640	277500	So, when the attacker managed to execute a code on the client network
277500	280880	for the data exfiltration and the CT communication phase
280880	284300	they can exploit the content filtering solutions.
284300	286400	So, this is today's topic.
286400	288860	We are going to talk about the zero-day vulnerabilities
288860	294280	that I found on a very, very interesting product.
294320	297080	And I have a case study for you.
297760	303660	There is a product from the Trend Macro, InterScan Web Security Virtual Appliance
303660	308540	and I have done the vulnerability research on specifically that solution
308540	312920	and we are going to see what kind of vulnerabilities that I managed to find
312920	316600	and using all of those vulnerabilities together
317240	321380	we are going to see some sort of code executions in the end.
321380	325900	But, before diving into the case study, I would like to talk a little bit about
325900	330460	what is the content filtering in order to make it crystal clear to everyone.
330460	333680	As you can see in the picture, there is a computer on the left
333680	336940	which represents a client's network of the company.
337020	343700	And those devices don't have a direct internet access.
343700	346360	So, they have to go to the proxy service first
346360	349200	and that proxy service goes to the internet
349200	353940	so that the organization can do some sort of analysis
353940	356620	and the rules on the client's network.
356620	360500	So, content filtering is happening in here right now.
360500	362800	We can imagine that the content filtering solutions
363440	368240	they are kind of spatially implemented proxy service
368240	372500	and the term is given to do controlling the type of web content
372500	376820	that employees, guests, customers can access
376820	380480	while they are connected to the business wired or wireless network
380480	385740	so that the business may want to apply control over the type of content
385740	393560	that can be accessed to stop employees by restricting access to certain type of web pages.
393560	398800	And on top of that, also the content filtering is quite a good place
398800	403120	to ensure malicious web pages cannot be accessed
403120	409240	such as those used for phishing, malicious, distributing malware, etc.
409490	417140	So, we are targeting that kind of products in this presentation.
417140	421860	So, at the beginning, I had two main motivations
421860	427100	like targeting web filtering solutions, why we are doing this.
427100	431240	First and foremost, obviously, you know, all the clients network
431240	434560	are going to the internet through that solutions.
434560	438360	That means if we manage to break in, we are going to see the whole
438360	441500	clients network internet traffic of the organization.
441940	444860	And second motivation is, as I told you before,
444860	448320	clients computer don't have a network access to the internet,
448320	451060	they must go through the web filter.
451160	455000	So, we need to find a better way to CT communication
455000	457360	in the red teaming scenarios.
457360	462500	And I believe web filter solutions is a quite secure and stealth way
462500	464700	to make a CT communication.
465380	469860	Of course, there is a lot of different approach like DNS beaconing, etc.
470060	474860	But I believe that is a very secure and stealth way.
475760	480000	So, all right, that is the brief introduction to the idea
480800	482480	and the main motivation.
482480	485420	And this is the methodology that I usually follow
485420	488620	for my vulnerability research projects.
488720	492980	And there is a seven steps and we're going to see every single step
492980	496240	in details throughout the case study.
496320	499780	And first and foremost, we have to find a way to get a free trial
499780	503040	of the product that we are going to do vulnerability research on it.
503040	508380	Because you have to, you know, break into your operating system level
508380	511320	and you need to find all the source code and etc.
511320	514380	And you have to test your vulnerabilities
514380	516480	and eventually you're going to implement exploits
516480	519100	for the vulnerabilities you found.
519100	522680	So, you have to find a way to get a free trial
522680	524540	and it's not quite easy, guys, always.
524540	525480	It's not quite easy.
525480	529420	It's sometimes and most of the times it requires to have a lot of meetings
529420	531200	with the sales team.
531540	535880	And if you find a free trial of the product,
535880	538300	I strongly suggest you to start by reading the documentation
538300	542200	because there is administrative documentation of this type of solutions
542200	546800	and there is a huge technical information about the product itself.
546860	554820	So, after that, we are going to find a way to have a root SSH access to the box
554820	557460	because we are going to do the vulnerability research
557460	562240	and most of the case there is operating level hardening
562240	566020	and we need to get rid of all of those hardening stuff.
566020	569380	And after that, you know, you are in a situation
569380	572020	where you managed to install the solution,
572900	576680	you read the documentation and you managed to overcome
576680	580220	the operating level system hardening
580220	584440	and that is the moment that you need to start using product itself
584440	586320	like a regular user
586320	589680	because you have to understand all the features
589680	593660	because those information will become so handy
593660	597020	when you need to define a possible attack vector.
597020	600520	So, after that, we are going to talk about the enumeration
600520	602980	and the configuration step
603500	607420	and the most important phase is the defining possible attack vectors
607420	610120	because you got all the information you need
610420	613560	and it is a time to building attack scenarios
613560	616520	and then find a vulnerability as a final step.
616520	620580	We are going to see every single step throughout our case.
620580	623300	And in that case, I mean the TRANQ macro
624140	626520	Intersecam Web Security Virtual Appliance
626520	631660	6.5 version. You can download it from the vendor web page.
632160	634720	So, getting a free trial was quite easy
635440	637540	specifically in that case.
637540	641060	If you go to the Google and looking for the administrative documentation
641060	643820	is an important keyword in here for the Google search
644760	647940	you can directly find the administrative file
647940	651340	which is usually like 300 pages.
651440	654240	I strongly suggest you to read
655160	656940	administrative documentation because
656940	659080	you are going to see very very
660800	663340	helpful information about the product.
663340	664780	As you can see in here
665780	668900	administrative documentation tells us there is
668900	671580	different modes of the product. It can be
671580	674600	transparent breach mode, it can be transparent
674600	677040	breach mode with higher availability
677600	680560	forward proxy, reverse proxy, iCAP
680560	682260	WCCP, etc.
682780	686900	That product can be installed in very different modes.
687140	689840	On the right side, you are seeing the forward proxy mode
689840	691040	which tells you
691040	695160	that product can participate in a proxy chain
695160	698360	forward all the traffic to the upstream proxy service
698360	701760	and you will be seeing lots of graphics
701760	705200	on the administrative documentation which will help you
705200	708660	to understand about the product itself.
708660	711360	So we are reading the funny manual as well
711360	713520	and we
713520	717260	of course, for the third step after reading the documentation
717260	719840	you need to install the solution into your
719840	722780	virtualization system.
723760	726560	During the installation, there was an admin user
726560	729580	and the password has been set during the installation
729580	731760	and the product gives you
732390	735680	an opportunity to do SSH connection to the box
735680	738500	with the administrator user. But the problem is
738500	741420	there was a restricted shell on the SSH
741420	744560	there is very limited tools
744560	747860	that you can use in the SSH interface of the product
747860	750340	and we need to find a way to
750340	753960	have a directly SSH connection
753960	756780	with the root user because we are going to do
756780	760600	remote debugging, we want to try to find out
760600	763500	all the source codes and we are going to do
763500	765720	further analysis, etc.
765920	769060	So there is a little bit of a step before
769060	771600	starting the vulnerability research.
771880	774840	In that case, it was quite easy
775540	778880	because the product was distributed
778880	781300	by the vendor as an ISO file
781300	783880	so you can directly install it into your VM
785100	787320	and when you finish the installation
787980	790840	the idea is you can detach the VM
790840	794380	from the virtual machine that you just installed
794380	797820	and then you can attach it to the different Linux machines
797820	799880	and then you are going to mount
800140	803440	a new disk and you are going to find a grab file
803440	806540	because there was a password protection on the grab file
806540	809840	and I want to get rid of that protection as well
809840	813080	and you just need to remove the password protection
813080	820400	line on the graph file. And after that, in order to get rid of the restricted shell thing,
820400	826520	you can go to the SHT config file and you can enable remote root login. And if you do that,
826520	831060	you need to go to the ETC task video file and add binbash for the root user, which will give
831060	837480	us a direct SSH connection with the root user without having any restricted shell at all.
837480	842760	And we have to undo every single thing that we have done so far. So that means
842760	848900	you need to unmount this, detach the VM backup file, and attach it back to the original VM and
848900	854200	reboot the machine, actually. And in that case, you are going to have the direct
854200	862080	root SSH connection to the box. This is important. We need to get rid of, you know,
862080	869840	operating level hardening. So we are kind of ready to start using product itself. In that case,
869840	874880	I choose the reverse proxy mode, but I believe all the vulnerabilities that we have found,
874880	882940	it exists no matter what is the installation mode at all. For the fourth step, I strongly
882940	889700	suggest you to use a product for a day to get used to about the features itself, because
889700	896280	there is a lot of functionality, as you can see in the picture. There is a URL access control,
896280	902880	HTTP decryption. Right now, we know that product can't offload the SSL at all. That means we can
902880	908680	deploy SSL through the administratory interface. And there is an advanced threat protection
909360	915040	on the left side of the menu, as you can see. I hope you are seeing my mouse pointer in here.
915040	921680	There is advanced threat protection. That means all the HTTP or HTTPS traffic will be analyzed
921680	928720	by the product in order to find out malicious activities because of that feature. So later
928720	934860	of that presentation, guys, we are going to see how important it is to understand and getting
934860	940620	familiar with the product interface. Yeah, it's quite important. Just use it like a normal user.
940880	947000	So we have a search access with a root user. So the initial step is always enumerating the
947000	952320	services. This is what I'm doing. Of course, there would be a better way to do it, but this
952320	958780	is my way to do. So I'm always looking for the nested command to find out what kind of services
958780	969280	we have in the product itself. As you can see in here, there is a UWSGI, which listens for 6011.
969360	975520	That means we are doing some sort of assumptions in that phase. So that most probably means
975520	982780	there is a Python project running in the internal system. And there is a Java process which listens
982780	989320	exact port of the administrator interface. That means we are going to deal with the Java
989320	996540	when the time comes to do doing a research on the administrator interface. There's another UWSGI
996540	1004100	in here. And that is another important thing because as I said before, that product acts as
1004100	1011440	proxy service. So that must be as some service on the product itself in order to handle incoming
1011440	1020880	HTTP connections from the user. So IWSSD process that you are seeing in here, which listens for
1022020	1029300	8080801. This is responsible for all the incoming connection from the client's network. So this is
1029300	1036520	the majority part of the product itself because that is the one who is communicating with the
1036520	1044460	clients. All right, so those are the services that we have in the product. But we need to find
1044460	1052960	which of those services are allowed to communicate with the different computers in the network.
1052960	1060400	Because in the end, we need to exploit at least one of those services. So what I'm doing
1060400	1067780	to find out that information, I usually run an nmap scan from my main host to the product
1068480	1076340	IP address. Or you can just use the IP tables dash dash list command to find out the IP
1076340	1083140	tables rules. So according to that rule, most of the internal services have been forbidden
1083820	1095660	to network traffic from the outside of the machine. You guys are remembering the IWSGI
1095660	1103260	service. If you keep doing enumeration, we are seeing very interesting information in here.
1103260	1109060	As you can see in here, there is a supervisor which is responsible for starting the solar
1109060	1118080	service. So right now, we know there is Apache Solar and lots of Python services in the box. So
1118080	1126500	what is Apache Solar? It is an open source enterprise search platform written in Java.
1126500	1133740	It's a major feature is included full text search, highlighting the time indexing,
1133740	1142420	dynamic clustering, etc, etc. So that means that Python project that we are seeing in here is
1142420	1149040	responsible reading and writing the log file into the Apache Solar service. So most probably,
1149040	1154740	whenever the request comes to the proxy service from the client's network, that proxy service is
1154740	1159560	sending some sort of signals to the Python project that we have seen in here. It's
1159560	1166320	something like an internal microservice. So that Python project is taking the information and
1166320	1172700	writing it into the Apache Solar service. So whenever the administrator user tries to query
1172700	1177120	something through the administrator interface, that request will be coming to the Python project
1177120	1184240	as well. Because the naming convention in here says the dashboard parse, mains,
1184240	1189980	stats parse, summary parse. There's a lot of log parsing and writing to the Apache Solar service.
1189980	1196800	And whenever it needs to be accessed by the administrator interface, that Python project
1196800	1202420	is taking the responsibility again. So it is quite important to know there is an Apache
1202420	1208960	Solar service within the box. But unfortunately, due to the IP tables rule that we have in here,
1208960	1215180	we're not going to be able to directly communicate with Apache Solar at the beginning. But later on
1215180	1224060	the presentation, we will find a way to do it. So all right, let's talk about the IWSST process.
1224060	1230280	If you grab it from the process tree, you are seeing the full path of the binary. And if you
1230280	1238380	look for the file type, it is a symbolic link to the IWSST process, which is a SUID LFI
1239060	1248540	binary. And there is a 61 module in that binary. So it's a very huge binary. And we can, of course,
1248540	1255820	target that process. But it will be requiring lots of reverse engineering. So
1255820	1261960	of course, we are going to do that at some point. But one of the most important attack
1261960	1269500	surface, as you can imagine, it is the process itself. So, so far, I believe I just spent 20
1269500	1281120	minutes, I guess. And we managed to collect enough level of information about product itself. So it
1281120	1287720	is time to define attack vectors in a light of those information that we got so far.
1287720	1293920	So we know that administrator interface is written with Java. And there is a proxy service,
1293920	1301320	which is written with C++. I haven't told that before, but it is C++, guys. It's my best story.
1301320	1308400	And there is a lot of internal services, but most of them are not accessible from outside of the box.
1308400	1315220	And you guys are remembering, you know, SSL decryption and advanced threat protection
1315220	1321060	features of the administrator interface. So we know that it does offloading the SSL,
1321060	1330140	it parses HTML contents, scan files, et cetera, et cetera. So my idea at that phase, my idea was,
1330140	1337060	okay, let's start with the administrator interface, and we can go after proxy service,
1337060	1342240	if it needs to be, you know, let's start with the administrator interface at the beginning.
1342500	1349580	But there is a lot of possible attack scenarios, as you can imagine, you know.
1350280	1356000	One of the... if you want to, let's say, target the HTML parser of the product,
1356000	1364060	like a browser exploitation, you can just send that phishing email to one of the employees of
1364060	1370200	the company that contains a link. Whenever the user clicks on that link, that request will be
1370200	1375520	sent to the proxy service, and proxy service is going to take that request from the client,
1375520	1380780	and it's going to send exactly the same request to the destination server, which is a webpage that
1380780	1388660	attacker can control. And whenever the proxy service gets the response, it performs analysis.
1388660	1396460	It has to parse HTML content and scan the file. So that means you can directly attack to the HTML
1396460	1402940	parser engine of the product, you know. There is a lot of different possible attack vectors,
1402940	1408300	you know, that was just one example that just popped in my mind right now during the presentation.
1409100	1413000	We are going to talk about the administrator interface, and then we're going to talk about
1413000	1421580	the proxy service. You know, as you know, it is a Java project, and I love, I like to be working
1421580	1426800	on the Java project. And every single time, whenever I'm facing with a Java application,
1426800	1433820	I always start by reading the configuration file, because, you know, the web.xml, struct.xml,
1433820	1440500	you know, all of those XML files contain a very good, high level of understanding information
1440500	1448040	about the software that we are going to do vulnerability research. And I don't want to
1448040	1455060	live in an SSH connection during vulnerability research, so we need to find out all the location
1455060	1461640	of the jar file by using just find command on the step two. And then you can copy all of them
1461640	1469680	to your main host to further analysis. Because we are going to deal with lots of jar files,
1469680	1480680	and I strongly suggest you to use IDEs. I used to use gdgui for the compiling of the jar files,
1480680	1487140	but those kind of project has hundreds of different jar files, and if you put all of
1487140	1493460	those jar files into the gdgui, it wasn't working for me. It was just crashing or freezing,
1493460	1498700	because it has to compile all the class and the functions, and they need to find all the cross
1498700	1509300	calls. So I strongly suggest you to use IntelliJ or Eclipse for that purpose. And if you are up to
1509300	1518680	use the IntelliJ IDE, there is a java.compiler.jar file under the compiler library, which comes by
1519080	1528320	default with IntelliJ, I guess. And you can compile all the jar files under the lib folder.
1528320	1536340	You can change the name, of course. And we are going to put all the compiled files under the lib-decompiled folder.
1536600	1543120	And if you go to the IntelliJ interface and look for the project settings, there is a library
1543120	1552480	section in here. You can import those libraries and sources all together, which will tell the
1552480	1559700	IntelliJ, this is my Java software. IntelliJ will take the rest of the job. It's going to process
1559700	1565680	all the classes, and you're going to be able to just find a function that you are interested in,
1565680	1571560	and you will be just clicking it to go to the definition. And also you can find a very
1571560	1579240	interesting function that might be some problem in the definition. You can just by using the IDEs,
1579240	1584560	you can find all the different locations where this specific function has been called. So I
1584560	1590020	strongly suggest you to be a friend with, you know, IntelliJ or Eclipse, if you are up to
1590020	1601000	one little research on Java application, guys. So I beg your pardon. So we have an access to
1601000	1608740	the source code of the administrator interface. So we are ready to do for the last step,
1608740	1614820	which was finding a vulnerability. There is a different approach to do it, like, you know,
1614820	1621740	top to bottom or bottom to top, you know. Bottom to top means, you know, the potentially vulnerable
1622380	1628760	functions on the Java, let's say, and you can directly search those functions within the code
1628760	1636240	base. And if you believe that you just find a very interesting, very easy way to use those
1636240	1642660	potential vulnerable function, you can start from the bottom to go to the top in order to find out
1642660	1648720	whether you are controlled to parameter that passed through all the function calls. Or you
1648720	1654900	can start from top to bottom, which is like, you know, start by reading the filter or the middle
1654900	1661080	layer definitions and the classes, look for the authentication mechanism, and then search for
1661080	1669920	all the controller or the request handler definition, which will be important because
1669920	1677000	that is the location where you can see the user controller parameters, etc, etc. In that case,
1677000	1684920	I was doing top to bottom approach. I choose that approach because of not very specific reason. I
1684920	1691040	was like, you know, doing fun, funny time on the Sunday and I was just start reading the source
1691040	1699020	code and it was like a top to bottom approach. I wish I could show you all the code bases and
1699020	1705220	everything, but I believe I don't have enough time to do it. So I just grabbed a very specific
1705220	1716940	function definition, which name is a mount device. It has to be a post request to be able to execute
1716940	1724320	the function definition. And there is a very interesting if statement in here. It tells you
1724320	1730340	if the request is coming from the localhost, it is okay. But if the request is not coming from
1730340	1736720	localhost, I'm going to validate your session and your privilege as well. Since we don't have
1736720	1742720	the username, the password, you know, this is going to be a problem for us because it is a
1742720	1749420	password protection if the request is not coming from localhost. And there is a function call in
1749420	1756560	here, get token, which will have a very important role on our exploitation. We will come back later.
1756560	1764580	So that was the important part of the function, and we are moving to the more important stuff.
1764680	1771020	So it tells us that the request must be a post request, and the post body, it is taken
1771020	1776440	from the request, and it is a JSON object. And we're going to get the mount device string from the
1777520	1785500	JSON data, and that part is quite interesting because it performs some sort of escaping. So
1786060	1793500	if the mount device contains a double quote, it will be escaped. If it contains a backtick,
1793500	1801280	dollar sign, it will be escaped by the backslash. But the problem is, if it contains backslash,
1801280	1807300	it will escape backslash one more time. So if we have a double quote, it will be escaped one time,
1807300	1812640	and it will be escaping backslash one more time in here. There is some sort of problem in here.
1812640	1819080	And after that, there is a function call, which is an IsVioletMountDevice,
1819080	1825440	and it takes our parameter that we can control. And if we manage to pass that if statement,
1825440	1832660	we are going to see Exe UI help with CMD, which is tend to execute operating system
1834260	1840580	command with a parameter that we are controlled. So we need to skip that if statement. It has to
1840580	1849380	be returned true. So let's have a look at that one. IsVioletMountDevice, it is just like a very
1849380	1855120	weak blacklisting. It tells you it cannot be contained bash, bin as such, Python, slash,
1855120	1862940	Perl, Python, et cetera, et cetera. It validates, it performs some sort of blacklisting on that
1862940	1869800	bounce. But the problem is, it has the white space at the beginning of the Perl and the Python
1869800	1875780	command in here. So it's a very weak blacklisting. We can bypass that without having any problem.
1875900	1880820	So we have to keep that in our minds if we've managed to find a vulnerability.
1881180	1888600	So all right, we can pass that part and we can reach in here. So it is time to read the Exe UI
1888600	1898980	helper CMD. And Exe UI helper CMD, it is going to execute UI helper binary with a sub-CMD, which is
1899780	1908140	a command that we can control. So what is UI helper? It is located in here and it has a root
1908140	1913880	privilege and there is a suidb. So all the commands will be executed with a root user.
1913880	1920620	So if you find a way to execute our command, that command will be executed with the root privileges,
1920620	1928060	which is something very, very important for us. And finally, that function calls Exe CMD, which is
1929120	1936360	basically calls runtime.getRuntime.exe. So obviously, we have command injection
1936360	1943440	vulnerability in here. So we believe that we have the vulnerability in here and we need to do the
1943440	1948340	proof of concept. Thanks to the reading of funny manual and the product feature steps of the
1948340	1958360	methodology, we know where is which administrator interface, I mean, which many of them it is going
1958360	1963480	to execute that specific endpoint. Of course, you can build it from scratch, but this is more
1963480	1971300	easier for me. And as you can see, that is the post request and there is a month device and we
1971300	1979220	can inject our command in here because the dollar sign, it will be used for the execution and the
1979220	1984320	dollar sign escape one time and the backslash escape one more time, which means there is no
1984320	1990200	at all. That backslash escaping did another one and there is nothing related with the dollar sign,
1990200	1996160	which will be helping us to inject our command. So basically, we are executing sleep command with
1996280	2003880	a 15 seconds with administrator with a root privilege. So let's talk about the exploitation
2003880	2013180	of that vulnerability as well. I'm one of the Metasploit contributors and I usually, you know,
2013180	2020040	using the Python dropper for the exploitation, especially exploiting the Linux machines.
2020040	2026780	But there's a problem about the Python dropper from the MSF Venom of the Metasploit. It has to
2027340	2034940	include the double code that wraps up our dropper command in order to pass it to the Python process.
2034940	2040460	So that means we're not going to be able to directly use it because, as you know, the double
2040460	2048620	code has been escaped on the backend service. So the idea is that we can use Perl because Perl can
2048620	2057420	take a parameter with a single code, which is allowed to use. And basically, the idea is simple.
2057420	2066040	I want to execute Python dropper, but I'm gonna put that Python command into the Perl command. So
2066040	2071600	basically, during the exploitation, we are going to execute Perl, which is going to execute the
2071600	2077060	first step of the Python dropper. When the Python executes, it communicates with the handler,
2077060	2081400	and the handler sends the second stage. So there is, you know, lots of execution,
2081400	2088860	one and after. And there is a Ruby code, as you can see in here, that we can build a Perl command,
2088860	2093540	which includes, which contains our Python command. So it's a quite nice trick.
2094470	2100700	So I reported that vulnerabilities to the ZDI. And of course, ZDI told me that the authentication
2100700	2106960	is required to exploit that vulnerability, but we are going to see that the exploitation can
2106960	2116060	be bypassed, guys. So we have to bypass authentication. Those are the initial ideas.
2116060	2120800	We can find a stored cross-site scripting vulnerability because we can force the
2120800	2128700	user to send HTTP requests to the device endpoint where we have the command injection.
2128700	2138380	And since the user is going to be manipulated by JavaScript, that request will be sent to the
2138380	2144350	endpoint with the authenticated user. So we don't have to be thinking about authentication request,
2144350	2151250	authentication stuff. And another idea is it would be handy to find something,
2151250	2157470	SSH vulnerability, some sort of, some type of SSH vulnerability could be handy in order to
2157470	2164590	communicate with internal services so that we can send a request from the localhost to the endpoint,
2164590	2171530	or it can go directly after the authentication bypass. I don't have too much time. I'm just
2171530	2178470	going to show you how I find a stored cross-site scripting on the administrative interface.
2178470	2185350	So as you can see in here, that is a very basic HTTP request to the proxy service. It tells to
2185350	2191550	the proxy service that I'm going to, you know, that I want to send a GET request to the pentest.blob
2191550	2198750	and proxy service does the job and sends the response back to the user. So that activity
2198750	2204050	has been written into the administrative interface. Guys, remember the Python and
2204050	2210390	Apache Solr stuff that we have talked about 15 minutes ago. You know, that activity
2210390	2217370	has been written to the Apache Solr database, which is represented into the administrative
2217370	2222750	interface. So the idea is that we can control that data in here because we can tell anything
2222750	2229210	we want to the proxy service. So the idea is quite simple. As an attacker, we are going to
2229210	2237930	intentionally download a very, very known malware through the proxy service. So proxy product can
2237930	2243530	detect it and produce a log file and it will be like, you know, ringing all the alarms, you know,
2243530	2252150	I call the malware, etc, etc. But the data will be written into the Apache Solr, which is being
2252150	2258370	used in the administrative interface and very, very specifically in here. So when the system
2258370	2265290	administrator logs in and checks what's happening, we can execute JavaScript code on the
2265290	2271870	system administrator browser. And thanks to that JavaScript code, we can send the IX request to
2271870	2278590	the vulnerable endpoint that we have found in the first place. So, you know, there was a quite
2278590	2283930	interesting XSS vulnerability because whenever the browser is sending requests to the proxy,
2283930	2289290	they are performing the full URL encoding in here. But I'm manually crafting the HTTP request
2289290	2296110	to the proxy service. That means there will be no encoding and that data is not being encoded
2296110	2302710	on the administrator interface. Basically, we have a cross-site scripting, spatially stored
2302710	2308710	cross-site scripting vulnerability in here. So instead of popping up an alert box, we are just,
2308710	2315970	we can just call IX request to the endpoint that we have a command injection. So that was,
2315970	2322850	I reported that vulnerability to the ZDI as well. And as you can see in the vulnerability description,
2322850	2327610	attacker can leverage this in a conjunction with other vulnerabilities to execute code
2327610	2334970	in the context of the root user. But guys, you know, cross-site scripting is cool.
2334970	2342730	I'm not underestimating any kind of vulnerabilities, but it is just not enough for me because there is
2342870	2349410	a huge setback which requires the user interaction for the exploitation. I was like, okay, I just
2349410	2355070	find something very cool, you know, intentional downloading of malware, etc, etc. That idea was
2355070	2363590	simple and cool, but I need to find a better way to continue the exploitation. But, you know,
2363590	2371070	I got another idea while I was spending a time to find the XSS through the proxy service. So
2371070	2377430	the idea is targeting proxy service itself. So as you can remember from the previous slides,
2377430	2382990	that is the HTTP request, a very simple HTTP request to the proxy service itself. It tells
2382990	2388090	the proxy service that I want to communicate with the Pantheon staff blog. Proxy service
2388090	2394830	sends the request, gets the response, and sends back to the user, right? So what happens if I
2394830	2401550	tell the proxy service that I want you to communicate with yourself? In that case,
2401550	2407430	it told me there is a, you know, self-referential request to proxy are forbidden. And I was like,
2407430	2414410	all right, that means there is some sort of control and lots of if statements in the proxy
2414410	2419850	service itself. What happens if I manage to trick the proxy service to communicate with an
2419850	2426750	internal service? That was the main idea. So that is the function, get end user authentication
2427590	2433150	function. I set a breakpoint in here, which produced exactly the same error message that
2433150	2440150	we have seen in here. And I just sent the same request, and it hit the breakpoint, and it tells
2440150	2447150	you that get user notification or the notification has been called by the prepare proxy loop
2447150	2451550	rejection, which has been called by the handle proxy loop, which has been called by the due
2451550	2458890	processing. So we're going to read all of those functions. So within the due processing, there is
2458890	2465550	one function called, which is an easy reverse proxy. And the function is a member of the proxy
2465550	2471230	config cache. So basically, products try to understand, like, am I being placed as a reverse
2471230	2477810	proxy? And in that case, handle proxy loop has been called, this function that we have seen on
2477810	2486990	the previous slide. And that function calls tm socket address is same ADDR. That is the important
2486990	2495110	part, because that function performs full URL comparison with the URL of the proxy service,
2495110	2504550	with a URL of the user try to communicate. So if it is a same address, it calls prepare proxy
2504550	2511650	loop rejection call, and we are seeing that error message. So I just changed the port number
2511650	2518090	to the Apache Solr service. And due to that changes, there will be a no match in the full
2518090	2526390	URL comparison on the proxy service. And there is administrator interface of the Apache Solr service.
2526530	2534890	I'm just can communicate with it because of a very interesting bug in the proxy service. So
2534890	2540650	I, as you can see in here, I'm allowed to communicate with the Apache Solr service
2540650	2549330	administrator interface. So, all right, that was another very, very, very important vulnerability,
2549330	2555790	because we can, we are going to leverage this vulnerability to the bypass authentication
2555790	2560690	on the systems. And in the end, we're going to chain all of them together, guys. So
2562730	2568010	Apache Solr service in the box, I mean, in the product was very old version,
2568010	2572750	because it's not quite easy to upgrade your third party dependencies like Apache Solr or
2572750	2580030	database servers. And in these type of solutions, it's quite hard to upgrade to newer versions. So
2580030	2588170	that was a very, very old vulnerability in Apache Solr service, but it is exactly what I need.
2588170	2595050	It is arbitrary file read vulnerability. So that is the name of the collection,
2595050	2601090	and there is a replication endpoint. And the command has to be a file content. And you can
2601090	2607810	traverse back to the roots folder, and then you can call whatever you want. And that will give
2607810	2616370	you to reading any content of the file. So at the beginning, I wasn't, there was no way to
2616370	2621530	communicate with the Apache Solr service, but we find a very interesting bug. And by exploiting
2621530	2630790	that bug, we are going to read anything we want. So far, so good. I want you to remind the get
2630790	2638690	token function. You know, it was like way behind of our presentation. Guys, all right. Do you
2638690	2645590	remember that get token function? It is going to help us what we are going to achieve in here.
2645590	2657650	Because, let me, yeah. Because that function takes cookies from the HTTP request, and it returns
2657650	2665330	the value. But the problem is, it prints out the value and the name of the cookies. But the
2665330	2674610	Java application is running by the Tomcat process. So those standard outputs data will be written
2674610	2682930	into the log file, which is a Catalina.auth file. So due to that little function, all of those
2682930	2689970	valid session IDs written into the log file, and we have arbitrary file read vulnerability.
2690330	2696250	So what we are going to do that, we're going to exploit two vulnerabilities together in order
2696250	2702750	to get the content of the Catalina.auth file, which contains the valid session IDs. And then
2702750	2709170	we are going to collect all the session IDs together, and we can go to administrator
2709170	2717050	interface in order to exploit command injection vulnerability with the active session IDs. So
2717490	2723590	the idea is actually quite simple, guys. We are going to, in the first step, we are going to exploit
2724370	2730290	a comparison bug in the proxy service, which helps us to communicate with the Apache
2730290	2738230	solar service that is running within the product itself. And this is a very old software which has
2738430	2744670	a vulnerability, and it is arbitrary file reads. And combination of that vulnerability, we are
2744670	2751250	going to read Catalina.auth file. And we're going to, by using regex, we're going to extract all the
2751250	2757430	session IDs that we have. And there is a check session endpoint. I haven't talked about it
2757430	2763250	because it was quite easy. There is a check session endpoint in the product. We are going to
2763250	2769770	test all the session IDs we have in order to find out whether it is still active or not. And if you
2769770	2777910	find an active session, we are going to exploit the command injection vulnerability, and we are
2777910	2785930	going to be executing operating system commands with a root privilege, which will give us a C2
2785930	2794550	reverse shellcr command and control server. That is the idea. And of course, I have implemented a
2794550	2801530	metasplit module that performs all of those steps automatically. And I have a video for it. I would
2801530	2813660	like to, I guess, yeah, time is good. I guess I still have a minute. So let's see. And by the way,
2813660	2820240	that metasplit module has been merged to the master branch of the metasplit project. You are
2820240	2826980	just, you know, can go and fetch the module and install the product on your lab and, you know,
2826980	2834140	have fun. So when we run, as you can see in here, it's trying to, it exploits reverse process
2834140	2840280	service and extract the katalina.out file. And that was, of course, this is a demonstration.
2840280	2845900	There's only one session ID in the log file and it's inactive. And by using that session ID,
2845900	2851460	it goes to the command injection vulnerability and it executes operating system command,
2851460	2856820	which is a Perl command. Perl command contains a Python command, you know, and all of those steps
2856820	2864940	have been automatically done. And as you can see in here, we have a root session on the back filter
2864940	2869700	solution of the company, guys. That's it. Thank you very much.