Hey there! So it’s been a while since I posted anything worthwhile: you’re not supposed to share information on the challenges in RastaLabs and I also had to complete four modules with the Open University.
Well, long story short: I hate university. I was missing out on time I could spend on developing my hacking skills (this is a lot of time too :/) and quite frankly, you could leave university with a first class degree in Cyber Security and still struggle to land an entry-level pentester role due to a lack of industry experience.
Due to this, I made the decision two weeks ago to actively seek out an entry-level Penetration Tester role. While this would usually be an extremely difficult process and would probably take months to even secure an interview, I’ve been very lucky and managed to land a remote job as a full-time Penetration Tester/Python Programmer. As of now I have reduced university to part-time.
This week is my first week- while I’m still in training on in-house software, I have also been introduced to my new team and today we’re all working on a project together involving the use of APIs.
A little rusty, I did some searching for API-based hacking challenges and came across DVWS (https://github.com/snoopysecurity/dvws-node.) Giving the impression of being short but sweet, I decided to give it a try for a couple of hours.
1. Vertical Privilege Escalation
As you can see, addition of the admin key with a value of true results in successful user creation. I got this idea from the data captured in the first image (note to self: note this endpoint in future!)
2. Remote Command Execution
The page of the requested directory was being directly passed to the system CLI in this endpoint; an ‘-a’ flag was being appended to every command resulting in some failing to execute.
This was easily bypassed by appending with the || (or) operator; other possibilities such as a semi-colon would result in the production of an error as the ‘-a’ flag would be interpreted as a command.
The first image shows the request sent when accessing dvwsuserservice- you can see that XML is sent with this POST request.
When you see that XML is sent with a request, it’s always worth attempting an XML external entity attack as such a threat results in the exposure of data stored on the system.
That’s all for now but I will be continuing with this at some later date. :) As for RastaLabs: I’m working on the last flag I deem important and I will then post a review of my experience with it; unfortunately my experience was tainted by university work.
