{"id":30542,"date":"2016-01-13T14:48:35","date_gmt":"2016-01-13T09:18:35","guid":{"rendered":"http:\/\/www.tothenew.com\/blog\/?p=30542"},"modified":"2016-02-26T15:45:27","modified_gmt":"2016-02-26T10:15:27","slug":"how-i-discovered-rce-through-a-misconfigured-plugin","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/how-i-discovered-rce-through-a-misconfigured-plugin\/","title":{"rendered":"How I discovered RCE through a Misconfigured plugin"},"content":{"rendered":"

We have seen a lot of applications where some sub-domains or sub-directories are publicly exposed (intently or by mistake). So, with experience from our past pentests<\/a>\u00a0<\/em>we have made a habit of testing \u00a0for vulnerable or accessible sub-domains. <\/span><\/p>\n

During one of such testing, I was manually testing the URLs of different sub-domains of the application and found a sub-directory which appeared interesting to me, so I went ahead to test it. It was a surprise to see grails console opening up. So, entering a Linux command in it was the next thing that one will do and waited for the response of the same. <\/span><\/p>\n

But the result was not as per my expectation as the command did not yield any result. Then I went forward and reloaded the page, to my surprise the command did got executed this time. And a complete list of usernames along with their respective password (which were present on this local system\/server) was fetched as an output on the screen. The following is the screenshot of the same:<\/span>
\n \"\"<\/span><\/p>\n

What took me by surprise is that this sub-domain could have been easily\u00a0found through Google dorking. There was no restriction on the particular page of the application i.e. based on IP Address. This made me think about the necessity of having a proper check over consoles which can execute Remote Code Execution. So, this blog post will be covering the devastating impact of a publicly exposed console and how to protect this from happening.<\/span><\/p>\n

There are different ways to search for the possible sub-directories such as:<\/span>
\n– Google dorking\u00a0<\/span>or using a tool such as Knockpy or Wfuzz.<\/span><\/p>\n

Following are the detailed demonstration of performing directory fuzzing in applications:<\/span><\/p>\n

Use of fuzz to enumerate sub-directories<\/strong><\/span><\/h3>\n

\"wfuzz1\"<\/span><\/p>\n

The above-mentioned command has the following components:<\/span>
\n -c argument is for color output.<\/span>
\n -z is for a file as a payload and the path of the file is given after a coma.<\/span>
\n \u2013hc 404 is used for hiding the pages that fetched a 404 error response.<\/span>
\n \/FUZZ is used in the place where the payload has to be inserted.<\/span><\/p>\n

The trick that one should follow is observing the response codes and the length of response received. If you observe the screenshot, the value C=403 is the response code which can be the following:<\/span>
\n200 OK<\/span>
\n302 Found<\/span>
\n404 Not found
\nFor the complete list of HTTP Status Code, refer to the following link<\/a>.<\/span><\/p>\n

So, while fuzzing an application for sub-directories one should look for successful response codes such as 200 (302 at times). Also, there might be a case where two pages will be giving the same response code but different length of response. In such scenario, one should always manually traverse the sub-directory.<\/span><\/p>\n

Possible Impacts of Publicly Accessible Console<\/span><\/h3>\n

The console can be used to perform RCE(Remote Code Execution). A RCE is code execution\u00a0technique used to execute any commands of the attacker’s choice on a target machine. A program that made possible successful execution of \u00a0a command is called\u00a0code execution\u00a0<\/b>exploit. In this case, Grails console was the exploit entry point. This vulnerability allows the execution of code or command\u00a0and therefore mostly used to inject and execute a shell script to give an attacker an easy way to manually execute commands.on victims server\/system. Since an attacker is able to execute code from one machine on another (especially via a wide-area network such as the Internet), this attack is referred as remote code execution.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

We have seen a lot of applications where some sub-domains or sub-directories are publicly exposed (intently or by mistake). So, with experience from our past pentests\u00a0we have made a habit of testing \u00a0for vulnerable or accessible sub-domains. During one of such testing, I was manually testing the URLs of different sub-domains of the application and […]<\/p>\n","protected":false},"author":166,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":1},"categories":[2026,1],"tags":[2040,2270,1221,2847,248,4840,947,622,2850,2851],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/30542"}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/166"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=30542"}],"version-history":[{"count":0,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/30542\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=30542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=30542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=30542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}