Viviry Tech | INFOSEC encyclopedia: OWASP Omaha Feb 2018 - 002 - Deserialization with the JS for the lulz

The OWASP Juice Shop project is great to learn about web app vulnerabilities and how to exploit them. I gave an introduction to web app hacking with the OWASP Juice Shop last year at BSides Iowa which you can see here. The YouTube link discussed web app hacking 101 and demonstrated how to exploit the easier challenges. The intent of these posts and upcoming talk are to skip ahead to the end and tackle more difficult challenges like deserialization. Without further ado, let's go!

Log into the JuiceShop VM

Go to Applications and launch Firefox

In Firefox, browse to http://127.0.0.1:3000

As you can see, this application runs on demand and is not up

Go to Applications and launch Terminal

In Terminal, browse to the location of the Juice Shop (e.g. Downloads/js624)

Now we need to start up the Juice Shop, in Terminal type in, "npm start"

Go back to Firefox and refresh the page

Now that the Juice Shop is up, let's create an account. Click "Login".

On the login page, click "Not yet a customer?"

Fill in the details for a user account and click "Register". You can have Firefox remember your login details.

Log into Juice Shop with your newly created account

Now that we're logged in, we have more options at the top. Let's get the score board and see our list of challenges. Normally you would find this by looking at the source code of the main page, or any number of methods to find this page.

In Firefox, browse to http://127.0.0.1:3000/#/score-board

We can see we have solved a challenge!

You can see the list of challenges and there are 9 one-star challenges, only 8 to go! If you scroll down, you'll see there aren't any more challenges!

At the top, click the blue buttons to make the rest of them darker. That'll reveal the rest of the challenges in this build.

If we scroll to the bottom with the 5-start challenges, we can see what we came for, the RCE Tier 1 challenge. This is a deserialization attack, but without clicking "unsolved" to get hints, let's walk through the app and see how this all works.

Scroll to the top and click on the OWASP Juice Shop logo

Click on the cart sign for "Apple Juice" to add this to our cart

Click "Your basket" at the top

Click the "x" for the solved notification message and then click "Checkout"

All done! No, not really

Click the back button in Firefox to return to the Juice Shop

Well, now we're going to have to get to work and bust out some tools to help us. We can use the Firefox (ideally Chrome) Developer Tools to help us solve some challenges, but we're going to need a bigger boat.

Open a new tab in Firefox

Browse to https://www.getpostman.com

Click "Linux" and choose "x64"

Click "Save file" and click "Ok"

Open a new tab in Firefox

Browse to https://github.com/zaproxy/zaproxy

Scroll down and click "Download ZAP"

In the wiki Downloads page, scroll down a little and click "Download now" for the "Linux Installer" option

Click "Save file" and click "Ok"

Go to your Downloads folder to see the ZAP and Postman downloads

Right click on "Postman..." and click "Open with Archive Manager"

Click "Extract"

Click "Extract"

Click "Close" when the extraction finishes

Close Archive Manager

Move the tar.gz of Postman into the Postman folder

Open a new Terminal application (since our first one is running Juice Shop)

In Terminal, type in, "cd Downloads" and press Enter

Let's see our contents; In Terminal, type in "ls -l" and press Enter

We don't have execute permissions to run the ZAP installer. Let's give ourselves permissions.

In Terminal, type in "chmod 577 ZAP_2_7_0_unix.sh"

In Terminal, type in "ls -l"

Let's run the ZAP installer; In Terminal, type in "./ZAP_2_7_0_unix.sh"

We get an error when we run it as our user account saying that we need to be root. In Terminal, type in "sudo ./ZAP_2_7_0_unix.sh" and enter root's password

Click "Next" in the installer

Review, accept the license, and click "Next"

Let's go "Custom" to see what options we have and click "Next"

Leave the path as default and click "Next"

Leave the symlinks path as default and click "Next"

Desktop icons are fun, click "Next"

I checked the option for "Automatically download new ZAP releases" and left everything else checked. Click "Next"

Install!

Click "Finish"

Go back to the second Terminal window that is in our Downloads directory

"cd" into the "Postman" directory

If we do "ls -l" in the Postman directory, we can see the Postman binary. Let's launch it.

In Terminal, type in, "./Postman"

PC Load Letter?

Let's find out what can provide this missing shared object. In Terminal, type in "yum whatprovides libXss.so.1".

We can see that libXScrnSaver will provide this shared object. In Terminal, type in "yum install libXScrnSaver". NOPE. In Terminal, type in, "sudo yum install libXScrnSaver".

Go through the prompts of the install

Let's try this again, in Terminal, type in, "./Postman" and press Enter

Yay! Postman works!

To go further, you can sign in with a Postman account if you have one, sign up for one, or just skip this step for now. I'm going to skip this for now.

You can choose to keep this helpful window on each launch; Go ahead and click the "x" in the upper right hand corner.

Postman works, you can close this for now

Go to Applications > Other and you should see "OWASP ZAP" in here

Click on "OWASP ZAP" to launch it

ZAP will load up and give you options of how you want to persist your sessions. Since this was just a test run to make sure the app runs, choose "No" and click "Start"