Werkzeug PIN exploit - TryHackMe's OWASP Top 10 2021

Описание

This a is a video walk-through of the unintended way of achieving Remote Code Execution from a Server Side Request Forgery vulnerability via a Werkzeug PIN exploit in the TryHackMe's OWASP Top 10 2021 room.

Buy Me A Coffee :)
https://www.buymeacoffee.com/hadrian3689

Chapter:
0:00 Intro
1:30 Looking at the Website. Finding the admin endpoint
2:30 The Website is running Werkzeug
3:00 Finding the PIN locked console
3:30 Using Burp Suite to intercept the Download
4:30 Playing around with the Download parameters
5:00 Finding that we can't use letters in the id parameter
6:00 The server parameter is vulnerable to SSRF
6:50 The server utilizes PyCurl
7:40 Finding a hard-coded directory that stops path traversals
9:30 Error handling shows how the URL is created
10:20 Explaining how to use anchor for bypass
11:00 Using anchor to read files on the server
12:00 Accessing the admin endpoint
12:50 Looking into Werkzeug PIN exploit
15:10 Looking at Werkzeug __init__.py file to see what files we need
18:30 Getting first file and confirming we are in a Docker container
19:30 Getting the Server MAC address
22:30 Getting the location of the app.py file
23:00 Finding the user that is running the server
24:00 Looking at the source code for fun
24:30 Finding a potential directory traversal vulnerability
26:00 Back to our exploit. Getting PIN. It works!
26:30 Confirming RCE on server