Week 1. Bizness
TL;DR
This is an Ubuntu machine running a vulnerable version of ApacheOFBiz (CVE-2023-51467 and CVE-2023-49070). A PoC is used to attack the web server running on port 80 an get initial foothold. The root password hash is found in the file system in base64url format.
KEYWORDS
Apache OFBiz, CVE-2023-51467, CVE-2023-49070, java, base64url.
REFERENCES
https://www.cvedetails.com/cve/CVE-2023-51467
https://www.cvedetails.com/cve/CVE-2023-49070
https://github.com/jakabakos/Apache-OFBiz-Authentication-Bypass
https://github.com/apache/ofbiz
ENUMERATION
Port scan.
Enumerate the open ports.
Enumerate the web site with Firefox, it seems it is built using Apache OFBiz (https://ofbiz.apache.org/).
For initial foothold, we'll focus on Apache OFBiz vulnerabilities.
USER
Looking for ApacheOFBiz vulnerabilities, we came across these ones: https://www.cvedetails.com/cve/CVE-2023-51467 and https://www.cvedetails.com/cve/CVE-2023-49070
And this PoC: https://github.com/jakabakos/Apache-OFBiz-Authentication-Bypass
The exploit is supposed to provide direct RCE when executed against the host. We will test if it works issuing a ping command.
And verify we receive ICMP requests in Kali.
Once we have verified the PoC provides direct RCE, next step is gain a reverse on the host. For this, create an msfvenom payload and serve it with a Python web server. Also, start a listener on port 9000.
Now use the PoC to download the shell payload into the host and execute it.
A reverse shell is received on the listener, it can be used to get the user flag.
ROOT
From the low-priv shell on the host, let's look for clear text passwords contained in XML files the filesystem, particularly in the /opt directory, where Apache OFBiz is installed.
Some SHA hashes are found, none of them useful though. Next step is to look for password or hashes in the binary files of the Apache OFBIz Derby database.
This command returns a hash contained in the file /opt/ofbiz/runtime/data/derby/ofbiz/seg0/c54d0.dat
This cannot be cracked as-is, a little investigation is needed to find out where this hash comes from. We need to refer to the Apache OFBiz source code (available at https://github.com/apache/ofbiz) to understand how this hash has been formed. In particular, source for the java app that generates the hash is located at https://github.com/apache/ofbiz/blob/trunk/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java
Reading the java code, we can see the hash is structured as: $SHA$ + SALT +$ + HASH BYTES. Also, it seems the hash bytes are base64url encoded.
Base64url encoding is just a standard base64 encoding where URL-problematic characters, such as / or . are removed, so the resulting string can be used in URL's.
To obtain a crackable hash, we have to revert the process. First we need to restore the URL-removed characters, and then decode the result using standard base64.
Transform base64url back to base64 by replacing _ with /, and - with +. The resulting hash is this.
Once we have the base64 string, we just decode it and transform the result to HEX, the final hash obtained is:
Final step is to crack the hash taking into account the salt :d
The resulting password is used to su root and retrieve the root flag as superuser.
Last updated