RedPanda

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.227.207
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-10 09:28 EDT
Nmap scan report for 10.129.227.207
Host is up (0.0087s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy

Red Panda Search SSTI

The page was some kind of search engine:

When we search for something, it shows our result back on the screen:

There are a few possibilities in my mind:

  • XSS -> But there's no users present to 'view' our requests

  • SQL Injection -> Might have a database present, but not typical for non-logins.

  • SSTI

When we use ${7*7}, we get a unique error:

It seems that some characters are being blocked. We can fuzz this using wfuzz.

it seems that some of the characters here straight up cause crashes. When we filter for the word banned, then we see some more characters:

These characters are banned, but the rest are not. This is what happens when I used #{7*7}:

This confirms that SSTI works, and the payload was taken from a Freemarker cheat sheet, meaning the page runs in Java (but not necessarily FreeMarker!). We can use this payload after replacing the $ with * because # doesn't seem to work.

From this, I will get a hit back on my Python server:

Now, we can easily get a reverse shell. We can do so by first downloading the shell on the machine, then executing it using bash:

Our listener port would catch a shell:

Privilege Escalation

Identifying XXE Injection

The first thing I noticed was we are part of the logs group. We can use the find command to see all files owned by the user:

The /credits directory contains XML files with the number of views that each Artist got for their respective images. However, the /opt directory has some interesting stuff.

credit-score was a new thing. Within it there were a lot of directories leading to an App.java file that contains source code for it. We can break it down here.

It firsts takes a string and splits it into 3 portions, and only the last one is important.

After parsing the string (uri), it checks to see which Artist has an image matching the query. The uri variable is passed into the fullpath variable without sanitisation, making it vulnerable to directory traversal if we can control it. The Artist variable is embedded in the metadata of the image, which is also controllable.

Afterwards, it basically updates the XML files within the logs:

The goal here is to somehow pass an XML file that we control to the addViewTo function that has a malicious XML payload. The function above does not seem to check or verify the XML that is passed to it, so I'll be trying to read the /root/.ssh/id_rsa file.

Here's the XML file that I constructed:

Afterwards, we can transfer this to the machine via wget. Then we need to somehow put our user controlled string into the machine to execute.

Panda Search Logs

When reading the source code for panda_search, within MainController.java, it seems to check for the author of the files created:

This is where /credits come in. The logs are then written to /opt/panda_search/redpanda.log.

So this is where we have to enter our malicious string to start our exploit.

Exploit

First, let's grab the image from the website and change the metadata using exiftool.

The reason we are using this is because the XML files would be read from /credits../tmp/read.xml after a single ../. Then we need to transfer our XML file over as read_creds.xml.

Afterwards, we can create our malicious string based on the template and drop it into /opt/panda_search/redpanda.log:

Then we wait for a little bit, then read the read_creds.xml file to find the root SSH key.

Then we can ssh in as root.

PreviousPreviseNextRemote

Last updated