Hack the box OWASP Top 10: Looking Glass

Looking glass:

Synopsis: Unsanitized system function call leads to command injection.

Skills Required:

1. Knowledge of web application security

2. Understanding of command injection vulnerabilities

3. Basic knowledge of Docker and containerization

Skills Learned:

1. How to identify and exploit command injection vulnerabilities in a web application

2. Techniques to bypass input validation and execute arbitrary commands

3. Understanding of Docker and its components

The exercise:

This Looking Glass provides you with information relative to backbone routing and network efficiency, providing you with the same transparency that customers on our network receive directly.

Traceroute allows a user to follow a packet through the network to a specific destination. It shows the domain, IP address and the roundtrip packet times as it traces the route to the destination.

Ping can be used to show whether or not a device with a valid Internet address or domain name can return packets sent to it by a specified server.

Analysis:

There is a clue in the tab name rce. Remote Code Execution is a cyberattack where a threat actor remotely executes commands on a victim's device.

First, let's determine the field.

Ping and Server01 are dropdown menus, and there's nothing else required here. The IP address is the field we're interested in exploring. It's known that in Linux, to execute one command followed by another on the same line, you use the ; symbol. For example:

Let's enter the same in the IP address field

pwd prints the working directory. /www and ls lists the content of the directory index.php

Now we can use the command cat to preview the file content.

Now, we can try ls options

-l -> long list. Displays detailed information about files and directories.

-a -> all files. List all files including the hidden files and directories.

So we try ; ls -l -a

This time we can try changing to the parent directory

; cd .. ; ls -l -a

Lets type so ;cd ..; cat flag_yv3Uz

How to prevent command injection - unsanitized system calls:

• Use secure coding libraries

Utilize libraries designed to handle system calls securely, which sanitize user input and abstract dangerous operations.

Avoid directly using system functions like exec() or system() without rigorous input validation.

• Run the application with minimal system privileges

Limit the application’s system access by following the principle of least privilege.

• Prevent Remote Code Execution (RCE) Attacks

Implement comprehensive security measures, including input validation, secure coding practices, regular updates, and robust monitoring systems to prevent RCE attacks.