[#thread šŸ§µ] For this third day of #CyberAdvent (3/24), I'll tell you a story. The story of how I gained root access to a server by leveraging a really fun feature in a web application. This #pentest #writeup will explain the complete process from recon to root. šŸ¦‹
[#thread šŸ§µ(2/9)] In the recon phase of my pentest, as usual I was performing a port scan. In the output from nmap, I saw an uncommon port 86 with an HTTP server running "Micro Focus DSD 1.0.0":
[#thread šŸ§µ(3/9)] When going on the page from a browser, surprise šŸ„³šŸŽ‰ we have an unauthenticated access! This is cool, but I never saw this app before so I didn't know whether we could exploit it simply or not!
[#thread šŸ§µ(4/9)] This application allows to manage #COBOL applications, like what Apache Tomcat does with Java applications. Let's mess around with this!šŸ•µļø
[#thread šŸ§µ(5/9)] When we create a new application, we have a "Script" tab allowing to create a start/stop shell script that will be executed before/after starting the COBOL application.
[#thread šŸ§µ(6/9)] We can execute commands on the server, but we do not have any output. And šŸ˜± there is an unbelievable option on this tab. "User id", we can literally choose the user id the script will run as. I'm going to use uid=0 to run commands as root!
[#thread šŸ§µ(7/9)] As the remote machine was an IBM server with ksh shell, I had to write a reverse shell by living off the land because classic payloads (even compiled static binaries) did not work. So I wrote a wget reverse shell during the night, and I tried it the next morning
[#thread šŸ§µ(8/9)] Basically, it's a while True loop receiving and sending data in base64 through the User-Agent http header with wget:
[#thread šŸ§µ(9/9)] I used my wget reverse shell as root to create a new user on the machine, and set its password. After this, I could simply connect with SSH to the machine, and boom I was in ! I also added my user to the sudoers to gain complete control over the server ! šŸŽ‰šŸ„³šŸ•µļø
Complete technical details about the MicroFocus exploit is available on my website here:

podalirius.net/en/articles/exā€¦
And complete technical details about the wget reverse shell principle is available here:

podalirius.net/en/articles/coā€¦

ā€¢ ā€¢ ā€¢

Missing some Tweet in this thread? You can try to force a refresh
怀

Keep Current with Podalirius

Podalirius Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @podalirius_

2 Dec
[#thread šŸ§µ] For this second day of #CyberAdvent (2/24), we will be talking about a common #PrivilegeEscalation when using the * (wildcard) in shell scripts. Almost everyone has used at least once the * (wildcard) in a shell script but what really happens with the #wildcard ? šŸ¦‹
[#thread šŸ§µ(2/7)] We will take as an example this shell script, performing a backup of a website using tar and a wildcard: Image
[#thread šŸ§µ(3/7)] In this script, the shell replaces the wildcard with matching files from the current directory then executes the command. The * character is never sent to the command (TAR in our case) instead a list of matched files will be sent as arguments to the command. Image
Read 8 tweets
2 Aug
[thread] Did you know that ssh tries to authenticate with stored keys BEFORE the key specified with -i in the command line ? I just noticed this, the hard way šŸ˜.

Let's imagine you have more than 5 keys loaded in your ssh agent. When authenticating to a remote server, you get:
After this message, ssh tries to authenticate with the keys in the order listed above. Why is that a problem ?

Because most servers have a default configuration with MaxAuthTries set to 6. After 6 tries, you will get a "Too many authentication failures" error.
So, ssh tries to authenticate with the keys in the order listed above, but gets disconnected after 6 tries. This means that if your agent has more than 6 stored keys, the key specified with -i is never used. This means you can't login to a remote server and you might not know why
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(