OK, so in the last lecture, we took a look at sensitive data disclosures and now we will investigate
X, X, X, X, right.
And this actually stands for X amount of external entity entity injection.
All right.
So so what is this?
Well, ximo external entity injection is a webapp vulnerability.
Right.
And it allows an attacker to sort of interfere with the way a webapp processes ximo data.
And really the impact can range from local phyll exposure, you know, ofis so we can write that here
and it can go all the way to something like SRF.
So by local fire exclusion, I mean that the attacker can, you know, potentially exfiltrate files
directly from the local filesystem.
And by SRF, I'm talking about server side request forgery where an attacker is able to pivot to adjacent
systems.
Right.
These are some other systems here.
And launch attacks from the position of the compromised Web app, so this can be a devastating attack
and one of the best ways to test this vector is to look for input form fields.
And we're going to do that.
We're going to log to the Web.
We're going to look around.
And one of the reasons we're going to authenticate is because, in my experience, credentialled inspection
usually yields better fruit than unauthenticated tests, and it's good news and bad news.
The bad news is we can't actually run this test in the environment we have set up right now because
Duchamp is sitting inside of a docker environment ximo external entity and injection won't work in a
container but have no fear.
I'm going to show you how you can set up a wasp juice shop from source and we're going to install no,
just the latest version and then we're going to run this attack and I'm going to show you just how devastating
it could be and how awesome it is, to be honest, and why you should understand how this works.
All right.
So let's jump right into this.
Let's go to the juice shop at GitHub.
Here we are.
And the first thing we need to do is get the latest version of Node.
OK, so we go to.
Let's see here, packaged distribution's.
You can see here we need to install a 64 bit just now.
This is why it's kind of complicated.
Because if you click on this takes you down here and you say, OK, so any 15 tracks, right?
Well, how do I do that?
Well, you can go to, you know, just that.
All right.
And it's like, all right.
15 tracks, where is it?
I don't see it right.
OK, so this is what you need to do, guys.
You go to no JAG and what you can do is click on other downloads.
You go down, you want to look for the installing no jobs via the package manager.
Right.
So click that.
Then you want to scroll down to Debian and Umbanda, because that's what we have running at your shop.
See, I got shop.
Your name, but your name tag.
That's the issue.
All right, and do so we're running a Mbuti 20 10, so that's obviously what we want.
So we click on the Debian and Boonchu based Linux distribution, and that takes us here a bit of a radical.
I know.
So we need to know.
Jazmyne, every distribution available for node source, like they're going to take it to the GitHub
and you should go down.
Until you find.
15 X and Y, 15 x y control click this.
You see, if we go back here, you see 15 X with the latest supported and tested version of Dogz for
teashop.
So all we need to do now is run this and then nets to get it installed.
Now, if you just run this last part app, install no jass, you'll get the older version of no charge.
You won't get the 15 attacks and therefore you shop might not work.
So let's go ahead and get this going.
Go back to teashop with director, we are here.
Let's make sure our docker container is not running so it's not.
Like the set up just to make sure I'm I'm seeing everything that I'm expecting.
Right.
So it's not running and we are in the home directory.
All right.
So let's just call it down
there.
That node source, dot com set up 15 dot x pipe.
That to zero and bash.
Right, so we'll let this run and then once it finishes, well, then run setto apt, install no jazz
and the Taqua is basically going to tell it to update everything.
Don't prompt.
Right.
So if I say pseudo app install node just Taqwa says yes, I won't.
Yes.
For the defaults and that'll get things going.
All right, so we'll come back once this finishes.
All right, see you guys in a little bit.
Right to that finish in just a few seconds.
Now we're going to want to do is clone the repo.
So if we go back to the GitHub, we can see what we need to do.
Get clone.
Here's the repo.
That's step number two.
Because we've already got no installed, right?
And the way we can check, by the way, we can type no jazz version.
No deaths.
Which no jazz, that is really, really weird.
Oh, I think it's because it's just no verdure.
Yeah, there we go.
All right.
I was starting to freak out for a little bit.
All right.
So we've got version 15 dot 14 dot zero, which is good.
So now we can do is calling this repo
and we'll just call it in here.
Right.
CEDO get Klown to put this guy in here to you.
Shop Dot get four slash.
All right.
I type that right.
Apparently I did.
All right.
So once that finishes, we'll just go to the next step.
We will see into that folder and then run npm install ampm start.
And we'll need to run this as root because, you know, we can't really do this without having privileges,
so we'll just pseudo npm install.
OK, so you see there's some stuff in here we can do.
CEDO npm install.
Let's get this guy going.
This part takes the longest.
So we'll let this run and then we'll, you know, we'll return once this finishes.
All right.
I'll see you guys in a little bit.
All right.
That took a solid like 13, 14 minutes.
But now that we're done, we can type zero in RPM start and it should start in the second part three
thousand.
If it doesn't, that's probably because three 3000 is already listening for you.
And then you can run like pseudo a space S.S. space minus A.l and then space pipe space and then grab
four point three thousand, find the process and kill it with zero space, kill space minus nine and
then space the process Heidi.
All right.
So now that we're listening to import three thousand, let's see if we can access the webapp so we can
go back to Kalay.
Let's go to our Web application and let's go to our site.
You that carbon buy.com.
All right.
So that's always a good sign, right?
So let's go ahead and log into our account.
The cookie to clear hockey, OK, we can do that.
Let's clear out all this.
All right.
So let's log into our account.
This is how we like it.
This is our back door.
All right, so now we're logged in as an admin, if you have questions about why this locked me, hasn't
logged me in as an admin.
Check out the sequel injection talk lecture earlier in the series right now that were logged in.
Let's just click around and you can see we've got, like, you know, customer feedback.
So there is some user input here.
I don't see any forums now.
So that's not really that useful.
Let's see complaints.
Customer, I've got a message and I can upload something.
So this is a prime candidate for Xixi testing, right.
So I'm going to get berp going.
And let's see what we can do,
starpower.
We're going to make sure that we intercept the response so that we can see what the application returns
to us.
The attacker, it's really important, especially when you have everything going through a repeater.
So if we go to proxy, take off intercept for a second, go to options, make sure civil response is
checked.
And let's see here, let's go ahead and look up some payloads.
Take it out of here for a second.
All right, so Google the payloads, all the things, is actually a really good one to use.
So we probably should check that out first.
I don't even see it in this list for some reason.
It's just type payload, all the things Xixi.
See what we've got here?
Ximo external entity injection, where are you?
All right, the injection.
Yes.
All right, so here you can see a summary, right?
And Ximo external entity attack is a type of attack against an application that passes Ximo input and
allows ximo entities.
Now, in order to make this work, we actually need we actually need two things.
First, we need the DOCTYPE element, which you'll probably see here somewhere in these payloads.
Does it show it.
Yeah.
So we need the DOCTYPE element and this is basically the reason we need this because this defines an
external entity.
For example, here the external entity is named example and you can see we're using it there.
So we need this DOCTYPE definition to define this external entity and then we're going to point this
external entity to the path of a file that we want to expel.
And then the second thing we need is a way to edit this data value that is returned in the application
response so we can make use of that that entity in this case example.
Right.
So there may be some kind of complicated and it's not so bad once you actually make this work.
So let's try this out.
Let's grab this guy right here.
We'll break this down.
Let's open up mouse pad.
Let's just expand this out little bit, it's a little easier to see.
So you can see here we've got this.
Entity called Test, we're defining an entity.
This is an entity test, OK, and we're saying, OK, we want to have system abilities, meaning we
want to be able to access an external path.
And here are the external path is the local filesystem.
And then we're just referencing that entity here with this ampersand inside of these root tags, which
we defined up here.
OK, so that's all we're going to do.
We're just going to try to run this and see if we can get access to ETSI password.
Now, typically, we should not have access to this, but if the Web application is running this route,
then we may have access and that's what we want to see.
So let's just name this something easy.
So we'll go to let's see, put it in documents and we'll name it when name it complaints that XML.
OK.
All right, look at that.
If you put all the colors inside, that's because Mousepad recognizes this is an XML document.
Right.
So now we're going to do.
Let's get back here.
And we want to filter this thing through brb.
I'm going to put in the complaint, we'll just call it just to test, right, and we're going to browse.
Let's go ahead and grab that document that we don't see it, we need to change the all support types
to all files.
And, you know, this is a complaint box, they have little reason to accept XML documents, right?
I mean, there should be an invoice, so it should be a PDF or an Excel s, not an XML.
So that's a finding right there for people to upload this.
So let's go ahead and put int. on.
We're going to say submit.
All right.
So here you can see the file we're going to submit.
This is the payload that we typed out.
I'm going to press control our control ship are and then control space to send and how we're going to
observe the response that you can see that there was an error sent.
What we're looking for, of course, is the ETSI password contents is well over to the right.
Look at that.
Oh, man, this is this is delicious.
All right, so can you guys see that what we're looking at here is the contents of ETSI password's hard
to see.
It is hard to highlight.
If I scroll over to the right, you can see.
It's all on one line, right?
The whole files just collapsed on one line, there's no line breaks, but we just exfiltrate at this
file.
Now, this is good for us as an attacker because now we can do all kinds of crazy stuff.
So check this out, but say now we want to see what operating system is running on this Web server.
Well, what we need to do is look at the NSA issue until space well over to the right.
Hey, that's even better than EMAP and Moonta 20 dottiness running.
Isn't that nice?
Now that I know I'm only twenty 2010 is running, I can look to see if I can find out the local IP address.
How do I know that?
Because if you Google Mbutu 20, you can see that it's stored in ETSI in plan zero zero installer config
that yaml by default.
And look at that.
I've got it.
I've got the local IP addresses, I've got the name servers that are configured on the server.
This is absolutely delicious.
I've got the internal IP address of the Web server, right?
So from the attacker perspective now it's our renumerated.
Maybe I can do a port scan internally on this 10, 100 zero zero size 24 subnet, because remember,
this is the IP address, the public quote unquote, IP address that we're hitting, but we now know
the internal IP address and that is awesome.
So one of the best defenses against this is really, really straightforward.
Just make sure you disable external entities, you know, via the configuration file or the documentation
for your given password.
You know, there's very little business reason for leaving this enabled.
So, you know, you should turn that off or things like this can happen.
And so the app is running his route, have access to all kinds of things, including Etsy Shadow, which
contains the hash password, right?
Yeah.
So it just gets worse and worse.
Guys, this is really bad, right?
So this would definitely be in the report that we would type up and send to the client because this
would be a critical finding.
All right.
So I hope that makes sense.
In the next lecture, we're going to get into broken access control.
So let's continue with our own journey and dig into broken access control.
See in all of it by.