80

Redirects to windcorp.htb so I had to add it into /etc/hosts.

From source code we know that its using MyBiz - v4.7.0 from bootstrap.

Nothing crazy here.

I tried admin'||'1'=='1 as this is running on nodejs, but it says wrong credentials.

But admin:admin works on this page.

On burp, I went to see the login process. First it makes a POST request to submit the credentials, and then it sends another GET request with a new header profile. Which is basically base64 encoded credentials in JSON format.

This post explains how to abuse JS deserialization to get code execution.

TLDR

Untrusted data passed into unserialize() function in node-serialize module can be exploited to achieve arbitrary code execution by passing a serialized JavaScript Object with an Immediately invoked function expression (IIFE).

The post explains the attack , and also how to get a reverse shell from it.

First lets create the payload:

This is what it'll look like

But we hit Modsecurity which is a WAF. It says Action Blocked.

Turns out modesecurity will filter this part of the payload and not allow it

After modifying this we still get Action Blocked. Turns out other function here are also filtered such as ones found here in core rules.

So I modified some more. A useful manual for converting ASCII to Hex was the man page for ASCII.

I chose a few characters in the payload and replaced them with Hex characters. And the final reverse shell payload was:

And we will get a shell on the listening port.

We can a shell on the Linux VM as the user webster.

PreviousEnumerationNextFoothold

Last updated