Proving Grounds — Detection

Enumeration:

Navigating to http://192.168.167.97:5000/ we are not able to view the page. We need to add this to our /etc/hosts file.

Navigating to http://changedetection.io:5000/ we see a webpage. The top right corner shows a version of v0.45.1. Looking up change detection with this version we discover an RCE.

[embed]OffSec's Exploit Database Archive changedetection < 0.45.20 - Remote Code Execution (RCE).. webapps exploit for Multiple platformwww.exploit-db.com

RCE Exploit

Running this immediately gives us a root shell and we can navigate to /root to cat the proof.txt.

CVE-2024–32651

But what is the exploit and how does it work?

Full Blog on the CVE:

[embed]CVE-2024-32651 - Server Side Template Injection (Changedetection.io) A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote…blog.hacktivesecurity.com

This vulnerability utilizes SSTI sub process of .popen to create the shell within the Notification Body.

In this exploit DB version it utilizes the payload below.

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

Beyond the PG Box

This is a common SSTI payload to use with Jinja2. If you run into this sort of testing in other environments, the link below has a lot more payloads to try.

[embed]PayloadsAllTheThings/Server Side Template Injection/README.md at master ·… A list of useful payloads and bypass for Web Application Security and Pentest/CTF - PayloadsAllTheThings/Server Side…github.com

Another one to help when looking for SSTI is checking which sub processes are available is mro. This first command will give all the processes then you can use a number in brackets to narrow down the results until you find the number that sends back the .popen sub process or number:number to spit out a range of sub processes.

#all sub processes 
{{"".__class__.__mro__[1].__subclasses__()}}

#if you know the sub process number
{{"".__class__.__mro__[1].__subclasses__()[100]}} 

#return range of subprocesses between 1 and a 100
{{"".__class__.__mro__[1].__subclasses__()[1:100]}}

I hope this write up helps you along the way if you are getting stuck. Happy Hunting.

This walkthrough is intended for educational purposes only.