so hello NDC London uh thank you all for
coming to my little talk about hacking
and cracking and all that good stuff
this is how hacking works the web
Edition I also have another edition of
this talk where we go into more diverse
topics of hacking with binary
exploitations protocol overflows and
stuff like that but this is only web and
the web is really cool when it comes to
hacking as well but before we get into
all of those details we have to you have
to get to know me a little bit so I have
this who am I slide so my name is ESP
sand arson uh I've had many different
roles in the tech industry up through my
career I Bas basically done it all I'm
currently working in DMB bank I'm also a
professional musician I release music I
have three kids and I enjoy all types of
geeky creative tinkering stuff on my
spare time and in my
professional time I also really enjoy be
and doing Mischief stuff as I said I
work for DMB bank in something called
new Tech Lab I'm currently working on
jailbreaking AIS to see if I can get
them to do naughty things which is
really fun I actually get paid for doing
that which is cool and since I work in a
bank we have to have this obligatory
disclaimer where it says everything I'm
about to say is me saying not DMB saying
and you might ask yourself there was
something missing from this slide that
usually goes up on there and that is
where is my academic accolades where my
phds or Master degrees and stuff like
that and the reason it's not there is
because I don't have any because I um
quit school when I was 16 or I was voted
out of school when I was 16 by the
teachers and then I figured out I could
make money by writing software and I
thought that's that's brilliant that's
that must be a scam so I started doing
that and I've been doing that ever since
and you may ask yourself why could a
16-year-old kid take up programming as a
career at that age and that started with
this thing any of you know this
marvelous machine have you used one
awesome that is the excellent commor 64
it's a based on the 6502 processor it's
8bit with a 16bit address bus and we got
that when I was 6 years sold because my
big brother traded some drugs for that
computer and brought that home uh and he
was like ecstatic look at what I got
this thing and we plugged it into the TV
we got a blue screen that said ready and
we didn't understand a thing and I would
spend the next years of my life trying
to figure out how that thing work worked
because when you buy a black market
computer you don't get the best support
agreement so we were basically on our
own and um and that machine taught me
basically all I know about programming
and systems on how computers actually
work and that is beneficial when you do
security
stuff so before we dive into hacking
stuff let's define what it actually is
because it used to mean something
different but why take my word for it
let's check out how Hollywood views
hacking so this is a example from a TV
show called NCIS there's a hacking
progress let's see how it plays
out can we get some Modio
okay that will be much better with
audio do you have
audio it's
flat okay there is audio
here okay let's change it to headph it's
it's
there no way thank you I'm getting
hacked
that's how you know you're get there a
million popups and you have to defend in
real time what's better than one
defender on the keyboard dump them on
the other side of the road you should
I'm trying it's moving too fast two
Defenders on the same keyboard because
that's how keyboards work this is not
good we're using our connection to the
datab of course the technical people
can't solve this problem so the non
technical people come in it's not
possible there's do level encryption
would this guy confident he doesn't know
anything what's going on no Tony we're
getting hacked computer the other guy is
casually eating a s I can't
stop I've never seen Cod like this and
of course the one who saves the day is
the non-technical person who does this
where'd it go Abby I didn't do anything
I thought you did
no I did hey unplug the computer because
that's all you had to do to stop that
app because all essential information
and stuff that those hackers wanted was
on that single terminal in the lab of
that government
agency so that's that's one way so how
about another TV show this is from CSI
New York the these people work with
forensic so they probably know what they
are talking about listen to this
gem for weeks I've been investigating
the cabby killer murders with a certain
morbid Fascination this is in real time
I'll create a guey interface using
Visual Basic see if I can track an IP
address I'll create a gooy interface
using Visual Basic to see if I can find
an IP address I don't know how to
comment on that that's just
silly why would you use Visual Basic
uh so how about a movie that's called
hackers so they surely had to do some
research right let's see look at that
keyboard that's something you have
[Music]
right there's a new virus in the
database if you every want to know what
a virus looks like memory what do I do
type cookie you idiot I'll head him off
at the past
we have a zero bug attacking all login
and overl files run antivirus give me
your systems
display yeah that's your system
display come on shoot the hackers with
lasers and die dick
weeds oh
yeah a rabbit is in the administration
system send a flu shot rabbit flu shot
someone talked to me a rabbit replicates
till it overloads a file that it spreads
like cancer
cancer and of course we have these
circular Defender keyboards right uh
yeah that's silly how about the TV show
that's made for about a real hacker that
actually lived they had to do something
about right this is my favorite
nonsensical hacking examples in media so
it's called uh scorpion there's malare
on a plane and they have to fix that the
only way to fix it is of course jum in
Ferrari and drive off to the
plane you get some four guy from the F
cre to climb down on the landing
gear with an Ethernet table to plug into
the
laptop because that's the only way you
can patch that plane is direct
connecting it to the laptop while in
Flight I don't know why they have to
plug it in because the attackers
evidently have remote access to the
plane through that virus
so of course when you run out to Runway
you just have to
stretch
on
no I tried to get my boss to to
authorize purchasing a Ferrari in case I
ever needed to patch a plane didn't go
through so no let's talk about what
hacking really is so it used to mean
something different back in days because
uh what we used to refer to as hacking
and hackers back in the 80s and early '
90s was usually people who did other
stuff they were usually people who
tinkered with software and Hardware they
built computers by themselves uh what
they tried to do was thinking outside
the box trying to make things do uh
things in which they wasn't intended to
one of my favorite examples of this is
the Apple computer that Steve WN
designed where you figured out how to
make a color display without col chip in
the computer by misaligning the cathode
ray tube uh to misalign them with the
phosphorous cells to create colors
because it didn't hit correctly and that
created a consistent set of pallet of
colors you can have on that machine but
what we refer to as hacking today was
originally known as freaking or phone
freaking the pH stands for phone and
that is because we didn't have the
internet as we know it today back then
if you wanted to comp uh connect to a
computer and communicate with it you
have to actually call it up on the
phone and and these people they were
like proficient with a phone systems the
phone lines they could manipulate the
terminals the switchboards and all that
stuff and they could break into
computers remotely using the phone phone
system uh but what we are talking about
in the context of this talk is just
exploiting systems through their
vulnerabilities so this talk can take a
couple of different turns so I'm going
to do like an informal audience poll
just to gauge what kind of people I'm
working with so how many of you are
programmers coders who write code for a
living wow there's yeah developer
conference I get it how many of you are
tech leads Architects solution
principles you don't work with code you
work with Powerpoints and
whiteboards yeah great couple of you how
about security Engineers pent testers or
white
hackers okay that will change
uh how about something else you're a
scrum master or project
manager ah
okay okay now now I know something about
you let's let's define some different
kinds of hackers because different kinds
of hackers are motivated by different
kinds of things and they express their
Motivation by wearing certain colored
hats so we can just look into a room and
look at all the different hats and you
can figure out what kind of hacker you
are dealing with so we have the black
cats those are the bad people the
malicious people who do bad stuff then
we have the the opposite that's the
white hatat hackers they do ethical
stuff they pent test they figure out
things in your systems that you hire
them to
do then we have the kind of iner that's
the gray hat they don't necessarily do
things maliciously but they also don't
necessarily have permission to do what
they do but they game on getting
rewarded by doing
disclosures then we have the green hats
they are the new hackers who have just
started on their hacker Journey which is
what I hope to convert many of you uh
today into and then we have the red hat
hackers and those are not Linux fan
people they are hackers who hunt other
hackers and take down malicious hacker
organizations and then finally we have
the blue hat hackers those are a certain
kind of group that gets called in prior
to releases of big software to find
vulnerabilities and security floors
before it goes out into the wild for
instance Microsoft has a long history of
Hosting blue hat events where before
they release new versions of Windows and
office and stuff like that so now that
we know the different kinds of hackers
why do hacks actually happen in the
first place could we just stop having
them happen and the reason is simple is
because we are developers we are humans
so we make mistakes we do stupid stuff
sometimes not necessarily on purpose but
sometimes we Overlook some details or we
use something we didn't know we couldn't
use for a certain purpose and sare
systems are pretty complex things is
actually one of the most complex things
we humans do and that's where the devil
is in those little overlooked
details and there's another thing that's
new today that wasn't there before and
that is today we like other people's
code like it's the best thing ever we
love libraries and packages and we pull
them in without ever thinking anything
about it just think of how many packages
your node project has for instance that
should scare
everyone um we developers we tend to
like our tools and if we have a tool
we're proficient with that tool we kind
of tend to use it for everything rather
than changing a tool if it's more suited
for the purpose it's kind of like if you
have a hammer you love your hammer and
you need to mix cement you still use the
hammer to mix this
event and the reason I know this is
because it happened to me I boy did I
get hacked and this this uh cinnamon bum
Swedish ad will make sense in a
bit because I uh back in the day I
changed uh um my job and I got offered a
position as a CTO in a new
startup and we were going to take over
the world of online advertising we would
design this system that would be on all
e newspapers in Europe and North America
and we would have this interconnected
set up uh ad advertisement spaces where
we can put interactive advertisements
where you can play games win prizes have
scoreboards uh in the campaigns
themselves the problem is that when
you're a CTO in a startup and you have a
big thing you envision that isn't uh
doesn't exist it means you're also the
tech lead the principal architect and
the lead programmer and you had to build
this thing and there was another problem
there weren't any clouds yet available
this wasn't a thing so I had to build up
a distributed realtime system by setting
up data centers all over Europe and in
the US figuring out how to connect these
things together and sync everything up
and we built a distributed Cloud
platform
basically and then it came to the client
side and back then there was only one
suitable thing for that task that is
something called flash how many of you
remember Flash
oh
yes so flash is this peculiar thing that
was made by a company called macromedia
was later acquired by Adobe for those of
you who don't know here is a crash
course in Flash this is your
IDE it has a code window and it has some
documentation of things you can do with
a code and what everything does and it
has kind of a setup of what you're using
in your project but there are a couple
of things things here that isn't usually
present in an IDE like you have let's
see does this work we have drawing tools
and we have a timeline that is because
Flash wasn't designed to build secure
client applications it was designed to
create interactive presentations
cartoons or funny little games you could
use to promote your business or do
presentations more
fun so it's kind of like Advanced
PowerPoint
basically so we built this CL
uh in this thing and it compiles into a
binary format that was run on a plug-in
in the browser so which should work I
thought it was
fine what I didn't know but I since have
learned is that flash was really easy to
reverse engineer and we had this big
campaign in Sweden where we had this fly
swatting game that if you killed enough
FES you won a free cinnamon bun it was
uh why would associate food and killing
flies I don't know but at least that was
the game and a Swedish student figured
out how to reverse engineer that game
and by doing so he found a back end call
that generated the price
token so what he did then was share this
on the student forums across Sweden and
suddenly all students in Sweden started
getting a bunch of free cinnamon
buns uh I got a call early one morning
with a furious CEO on the other end of
the line telling me that one student had
picked up 73 cinnamon buns in one single
day one student 73 buns my immediate
response is that person really enjoys
cinnamon buns which uh my CEO didn't
take clly too but I thought it was kind
of funny so I had to stand in front of
the board and say oh I'm so sorry it's
my fault it will never happen again and
then I got tired of being yelled at for
like after a couple of hours so I
decided to fix it so I said to my CEO
you are going to Sweden you're going to
bring a case of cinnamon buns you're
going to this individual you're going to
bring the newspaper you're going to do a
big story of how we thank this person
for helping us find the flow in our
system so I kind of invented a bug
Bounty program for cinemon
buns uh and we figured it out we patched
that hole and we found a new way of
doing that so I learned a lot by that
failure and I actually did this talk in
Sweden and a guy came up to me after and
he said you're the cinnamon bun guy and
I said yes I'm the cinnamon bun guy I
wrote my master thesis on your
failure oh
great yeah I was he was like Star Struck
because he had written his master thesis
on this incident it that was and that is
now part of the Innovation study uh
curriculum in Sweden so my colossal
failure is now literally the textbook
example what not to
do so that's how you
learn so how can we prevent these things
from happening
uh and I think that having knowledge
about how these things happen how they
are executed is beneficial to
development
teams and I that's why I want all of you
to start learning about hacking and a
great way to get into this is something
called ctfs any of you know the CTF
concept okay some of you okay for those
of you who don't know let me let Elliot
from the excellent TV show Mr Robot
which actually gets hacking right Define
it for
you the CTF tournament Capture the Flag
it's like the hacker
Olympics teams around the world compete
to solve challenges reverse engineering
protocol exploitation
forensics the entire city suffering an
energy crisis while they're here
exercising their inner Anarchy she like
the hacker Olympics and you get to
exercise your inner Anarchy and what's
more cool than that
so cdfs are structured in the following
way it it's a basically a gamified way
to learn about these techniques by
giving you challenges that you have to
solve uh these challenges you are
searching for little things that are
called flags that are that you can
exchange for points and you you can
basically compete against others and you
can have prices and tournaments and
stuff like that
going uh we have done this in DMB a
couple of times internally and it really
is an incredible Catalyst for Learning
and it because you kind of start
thinking differently when you start to
poke at systems and try to figure out if
you can make them do something they
shouldn't and uh solving these
challenges you get the flags and then
you you get the points and that Sparks
conversations in your organization
actually we did this uh one time in DMB
for the entire group not just the the IT
team and the water cooler discussions on
a machine discussions were all about
cyber security and SQL ejection attacks
and cross-side scripting and were from
accountants and lawyers and stuff like
that and my favorite email that I ever
got in DNB bank of Norway is a lawyer
from legal who wrote me a letter of
apology because he accidentally deleted
my entire SQL Server when performing a
SQL injection attack and when you're
lawyers in legal are doing SQL injection
attacks you're doing something right and
that was pretty cool
uh and it's just really fun to be the
bad guy for once it's really really fun
uh these challenges come in different
categories we have crypto that's not
Bitcoin but that's encryption and you're
trying to break codes there stego that's
where you find Secrets inside of other
things like images inside documents or
binaries inside images and stuff like
that we have forensics where you get to
do some data mining you have to find
things in some kind of a big bunch of
data it could be Network traffic logs it
could be file systems it could be git
logs and stuff like that so we get to be
like a
detective then we have reverse
engineering that's when you actually
have to disassemble or decompile
something or poke at something figuring
out how it works in order to find
vulnerabilities then we coming into
something called vulnerabilities that's
usually when it's not your code but
other people's code so you're using a
dependency which has a known
vulnerability and you have to exploit
that
then we have web that's where uh that's
everything that has to do with web uh
exploitation it can be anything from uh
protocol level exploitations to
exploiting servers run times uh
Frameworks and stuff like that and then
we have the creme Del Creme of the them
all and that's pawning that means owning
a system taking it over and getting full
control of that system which is the the
ultimate goal of any exercise to do
these things we have a bunch of tools
I'm not going to go through them but the
this is not a non-exhaustive list this
is just one a couple of my favorites
there's stuff there for disassembling
there's stuff there for cracking
passwords there's stuff there for doing
reverse
engineering uh if you can take a picture
of it I guess I'm not going to list them
up and this talk we're going to do some
web exploits and web is kind of cool
because it is one of those things that
had an intention and has grown into
something completely different and it's
a quite the different Beast today than
what this guy invisioned that's Tim
berners Lee and he had the idea of
linking documents together for sharing
research papers and that was that was
what it was intended to do so it was
actually just meant to be linked
together static static content but that
evolved into Dynamic content can we
change things based on other things
and then we moved into interactive
content where we actually interact with
each other directly through the
internet and then we let all the
non-technical people on the internet
which is probably the worst idea we ever
did because now we have all these
content creators creating everything
from uh cat blogs to knitting things but
I yes it's cool it's it's cool that it's
diverse and we have uh what we have
today uh but what they didn't Envision
was it go into the global primary
application development platform because
that's what it is there's everything is
web apps today it's even your native
apps on your computer are most many of
them are still just web
apps and this produces new
vulnerabilities and new challenges that
we have to
solve uh there are many kinds of web
exploits we have cross-side scripting we
have SQL injection template poisoning
prototype pollution misconfigurations
broken authentication fishing spare
fishing third party vulnerabilities and
there are so many more to
list uh there are actually so many
vulnerabilities and web applications
that we decided to create an
organization to kind of keep track on
the pulse of uh web security that is the
oasp organization it's it stands for the
open web application security project it
was founded back in
2001 and it's all about spreading
awareness about information security and
application security and tracking what
the most different kinds of threats are
and figuring a way to disclose and share
that
information and they release uh on
occasion a list they call the obas top
10 which is the top 10 most uh critical
things in application Security on the
web at the
moment so there's also something called
the cve database are you familiar with
that some of you are CV stand for common
vulnerability and exploits and it's this
public repository of known
vulnerabilities pocs so how they are
performed whenever something is
disclosed to the cve database it gets an
identifier with cve the year it was
found and uh running serial number and
it's used risk assessment internally in
organizations to figure out what all the
risks with when it comes to service
security so they can make plans and
figure out what level of security they
need to put in all their uh all the
places in the organization but for our
CTF it's an awesome treasure throw of
goodies because that's where all the
nice things are that you use to solve
the
challenges uh there are many ctfs if you
want to get started there are some
online ones that are always going on
like hack the box or try hack me these
are the services you can subscribe to
and you will get new challenges on
occasion uh and there's the oasp Juice
Shop which is this kind of Docker image
you can download run it's a web
application that's a store selling juice
and it's the least secure application
ever made because it implements all of
the vulnerabilities on the OAS list and
you use that to and it's gamified so you
use that to get points and you can have
some fun with it I really recommend you
taking it back to your teams getting
some pizza getting some beer getting
some wine and just have an evening of
try to do the Juice Shop together it's
really fun in DMB we have had hack the
bank which we have opened to the public
on occasion last time with did A
Christmas calendar with one hack each
day people have to perform was really
fun uh and of course all the big
security conferences like Defcon and
Black Cat and so on they have
ctfs which is really
good but now enough of me talking let's
do some demos shall
we uh let's let's see if I can
transition more smoothly than I did when
I did my intro let's
see
uhhuh now
it's can you don't do
that can you see my screen there okay so
I have created this thing it's uh it's
called hacker portal it's a mini see
that's not
there why didn't that
happen I said
duplicate and I did keep
changes now it works now it works great
maybe I forgot to tap hard enough on
keep to changes okay so this is a
CTF uh it's a mini one it's up on GitHub
so if you want to have a go at this
yourself on your own time you can
download it and just run Docker compose
up and it will spawn all the
containers and this portal so it's
different kinds of things and they all
have this they have like a title a
description a score that you will be
awarded if you get this right and
there's usually a hint sometimes the
hint is very good sometimes it's just
nonsense just to tease
you so let's start with this one it's
Santa's
Bingo it says so Santa decided to give
you an early Christmas present all you
have to do is guess a value that's easy
right so let's open this page so here we
have uh this marvelous web page uh we
can see it's Santa Claus and the Grinch
having a lightsaber battle uh and it
says make a guess this is not normal
Bingo all you need to have to do is to
get one right so I guess I can just
guess something and it says too
bad but then there is a a test thing
here it says ignore and should we ignore
it of course not we should hit it and
that gives us the source code for the
index page probably some kind of feature
left over by some eager
developers and
uh yeah you can see that this is written
in PHP how many of you are PHP
people a couple yeah it's this thing
that doesn't want to die but we still
keep it around
[Applause]
it's no I love PHP it's really fun
because of these things so uh let's
let's dig into this code we have a
regular expression match here so it's uh
you can see it's uh are you good with
regular expression it basically says
match config literally match dot
literally match PHP literally and match
slash literally then be greedy and have
as many slashes as you want or as few as
you want and then it asserts that it's
the end of the string that it ends with
that so if it means that it probably
tries to protect us from seeing the
config that's why that is there because
it says hahaa you didn't say the magic
word so we can test to see if that works
so if I do this and I do I want to see
config.php and I want to do test and
then it says haaha didn't say the magic
word and this is not the unic
system okay so that's the first Hur we
have to go through it is we have to
figure out how to how to do this the
problem with this expression and and
want see that see
it you make it a little bigger I can try
to make it bigger yeah is it easier to
see now yeah so anybody see any problems
with that uh regular
expression okay let's make it more
visual if I take this regular expression
we can go to
uh reg X 101 my go to side because regx
is the thing I say to this year I'm
going to learn it properly and I never
do and I end up going here because it
usually
usually tells it better anyway so if I
do this I get you can see what I guess
it matches the characters in config it
matches the Slash and it asserts that
position at the end of the string with
that dollar and that means that if I do
config.php it matches if I do slash it
matches if I do a bunch of slashes it
matches
but the minute I put something else
there it stopped
matching so that means I can do if I do
index.php
config.php
SL
something and I do the test thing that
should pass the first thing so let's
test that
out and now we get an error it says High
light something because that file
doesn't exist so if we go back we can
see that if test is set it says
highlight file and then it runs base
name on the current address of uh your
uh uh
URL and base name that is a kind of that
is let me see if I can find my other
screen is there I have a link base
name it Returns the trailing name of a
path so for instance if you have SL
etc. D it will do sudor the last thing
of the path but it has this caution base
name is local aware so for it to see the
correct base name with multip by
characters the matching local must be
set using the set local function if a
path contains characters which are
invalid for the current local B base
name is
undefined that is funny undefined
behavior that is something we can
exploit right so let me just uh take
this and I will show you why this is bad
so let me see is this my
terminal can you see this or should I
make it
bigger
yeah this properly tille thing doesn't
work so I guess I will do it like this
uh let's do uh PHP base name so I have
here a little test PHP let's do bat cat
on test
PHP so I basically have implemented that
R match and I just do this um path and I
append the numbers 1 to 130 as a Char on
it and just check what base name gets
out basically that's all
uhuh that's not what we wanted and I
have also created a Docker file to be
able to just run this in the same
environment on the same version of PHP
that this server uses just to make sure
I'm replicating the environment because
it's undefined Behavior meaning that we
can't rely on it happening on my system
but it should happen on that system so
if I do
uh
uh uh is it like this yeah there we go
so this is how you run a Docker
container and just kill it after you
quit it by doing this and now I'm inside
that container I can see have the test
PHP file if I use PHP to run
that you can see
that from everything that's in the asky
table it would just re return that
Char but the minute we are over into
characters which are outside of that
character set it starts to return config
PHP that's pretty pretty neat meaning
all I have to do is add a nonsense
character after the slash before test so
let's check that
out so I do this SLC config PHP and
instead of something let me just do per
80 and then do
test and then I'm inside of config
PHP and I can find my flag uh man Santa
sherlo PHP
so I can just copy this secret from the
config
file I can go back to
my portal and I can set that in and get
my points so that's that's one way of
doing this let's see I'm just check we
still have time for more demos let's do
another one let's do one more PHP just
for the heck of it so we have this thing
it's called the receip
uploader let's just right who doesn't
load PHP can we think of a way to take
over over this site hint how does the
server know you have an image okay so it
evidently it has to do with images so
this is The Marvelous receipt uploader
evidently I can upload a picture of a
receipt and it should do
something and I have prepared a receipt
it's this
cat uh it's a picture of a cat and I
upload that
picture it displays the picture and I
can click it and it gives me the picture
back so that's uneventful how can I
exploit that
well uh it would be cool if I could just
upload a PHP file that would be
cool uh I have this called sploit PHP
it's just uh it does something it tries
to do bad stuff with
PHP so let me try and upload that to see
if that
works exploit pH
this is just to see if I can but then it
says invalid image file upload failed so
that didn't work I couldn't upload a PHP
file so I have to upload an
image uh but what can we do images are
binary
right well that's true but there's also
this thing called exif data which is
meta data so if I
uh if I do this I can see all the exif
data in that
image and that uh exif data is uh is uh
plain text inside that image so I can
add one so if I
do if I do let me just copy paste no I
I'll write it X XF tool and I can just
create a new tag called
comment can set it to be equal
to let's just do
Oh wrong
keyboard let's do pH let's do like this
PHP come on coding front in front of
people like
this and I do that to cat
jpeg if I now check the XF
data on that cat you can see I now have
one line of PHP code inside that image
if I upload that thing how how does that
work so I upload the cat again if I
click this now should something happen
no it doesn't and that is because it's
still an image and the way PHP works is
that it's usually configured to look at
the file extension of U of uh the file
you're trying to access and if it's
extension is PHP well then PHP tries
it's best to do something with it if
it's not called PHP it will ignore it
but we can remedy that can't we so let's
let's let's take this cat uh JPEG and
make it a hack cat.
PHP see if that works so it's the same
thing but now it's called hack cat and
it's a PHP file or it has a PHP
extension it still recognized as an
image but if I click this thing now well
PHP is going to do what PHP does best
that is screw everything up for you
because now it went inside the image and
said I don't know this I don't know this
hey PHP I really know this and then it
outputs that thing so I'm able to
execute code remotely on the server
through a a an image which is kind of
cool and of course we can build this
sploit further let me do sploit again so
here I have something if I take this
thing basically says uh execute a shell
command list all the files so if I do
exif tool and do
comment say say it's equal
to this I do hack cat
PHP and I go
back and I upload that
again you can now see I can see the
directory on the
server and I can do that and figure out
where the flag is uh and the flag is one
level up so and that's the last version
there so I just let's go back remove
this to insert a
little not under the
haat so now I'm just cutting out the
flag with the cat that or the hack
cat and here we can see the flag images
are the
worst and again I can take that back to
my
portal and uh check the answer and I can
get my points so I was able to take over
a server by using an image
uh let's see if we have time for one we
have time for one
more because there's 9 minutes left
right uh how about we
do how about we do a the serial killer
that's that's a fun one this is a this
is an peculiar one that uh I have
something to say about so we have uh
identify all the villains through
Santa's blog here are the 10 most Wanted
characters on the North Pole hint there
was
5,941 applicants to this list okay let's
see so these are the most wanted people
on the North
Pole uh we can see here we have uh the
gringe Rapunzel and it says that we are
logged in as
Santa okay uh let's use a tool just to
figure out what we are working with here
so if I do there's a tool called uh
let's
do um
let do this there's a tool called
whatweb which just checks all the
response headers from a web page to give
as much information about the service as
it can figure out from those it's a very
nice tool and I can see I'm working on
something that's powered by Express so I
suspect we are in node
territory and I can I can I can fill
around with this page and try to see
what's going on but the first thing I'm
looking for is
I'm going to look at some
cookies because I do have a couple of
cookies here so I have asp.net core
something anti forger that's this A Cerf
token but this is called package and
let's see what that is it's a base 64
encoded value so let's
do B 64 uh that's the decode let's just
pipe that value to it and see what it is
it's uh looks like Json doesn't it
username Santa country north pole
elville I wonder if I take
this uh like
that uh and I just do
Echo EO that come on type nicely
into into P pc. Json and I do uh I can
do I can do do VI live
right uh and I can just if I change this
Santa to
spurn and we're at NDC
country and we are
at code will like that come on VQ if I
now do uh base 64 I don't want it to
word wrap and I do PC I get this base 64
in COD value what do you think happens
if I copy this and send that Jon back as
a cookie what
happens uh that
deleted like
this let's see what happens now I'm
logged in as
Espen and if I go to sources I can see
that this thing doesn't have any
JavaScript it doesn't uh do anything
client side that means that that
inclusion of that property happen server
side meaning that they are using some
server side rendering Technologies and
in no there are just there are a couple
you can use and I happen to know of a
vulnerability and one called handlebars
and that is that it can uh it's it's
susceptible to something called
um uh now this isn't sorry I'm raving uh
there's this is probably unserialized on
the server and it's probably on the
server side but what are the chances
that they're using an insecure
deserialization method and there is one
that I know about that is called node
serialize and it's this this object here
let's see if npm is up again yeah it's
called node serialize and it says
serialize object including its function
into Json which somebody thought was a
great idea it's a horrible idea to
serialize behavior and desize that
behavior especially in JavaScript why
because JavaScript has this thing called
an immediately invoked function
expression so if it desize that server
site that would just get invoked when
it's turned into an object and this
still has
2,393 weekly
downloads if you go to the GitHub
repository of that thing it basically
says security warning please don't use
this because it's an insecure yet 3,000
people pull this into their project and
use it every
week which is which is kind of
strange so let's see if we can figure
out how to do that if you go into that
GitHub you figure out the syntax of how
it serializes that function and then we
can uh create our exploit so here I have
the same Json and if you see the pawn
property it has this uh dollar dollar ND
function that's
no node desized function and that's
basically the text representation of uh
a spawn sync of Bin bash piping that uh
bash to my uh my reverse shell on my
other machine that I'm going to show you
so this IP address this runs here in the
cloud this is my reverse reverse shell
lab so I'm just going to set up a
listening shell it listens on the same P
so if I now do that thing again where I
do base
64 and I will do no word wrap and I
would do sploit I get a slightly
longer B 64 in COD the value but this
should work so if I take this let's do a
refresh to make sure I have a new
cookie I change this watch just let's
see if I paste that try and make this
more visible but just Watch What Happens
on this
end when I
refresh now I'm logged in as wch and if
if you didn't see it let's see if I can
make this
bigger uh session
settings
appearance let's make it six
16 that should work as you can see I'm
now longer on Asher user ARA I'm on at
node some somewhere in/ apppp this is
inside that server because that server
went hey I want to connect to this guy's
shell so now I can just uh I can poke
around on that server and find
stuff and I can see that on the root
flag txt resides I can just cat out
that
uh and there there you go wow serial
killers can be deadly that's the flag
can take that
out go back and do that and that's
correct and I get my points so I was
able to take over that server by just
using a bad design of a mpm package that
a bunch thousands of people still use
every
week uh because it's a feature it's not
a bug I
guess so back to the presentation let's
see I have to do this thing just to wrap
up
extend keep
changes and here we
go I'm not from current slid yes that
went pretty well so here are some
takeaways that is that ctfs they are
really fun and learning this in your
team and having you don't have to be a
master hacker but having this mindset
thinking about poking at things fussing
your inputs seeing what happens when you
try to do things you shouldn't that that
tends to make us better developers and
it makes us more aware of security and I
want you to go back home be curious fuss
your inputs test your apps yourself try
and be so little pen testers and I want
you to put on your hoodies and hack hack
hack uh because it's really fun and once
you start to hack you never go
back and this evidently will lead to
more secure and better Solutions and
it's really fun and if you want to poke
around at my little CTF there's a bunch
more tasks that are also really cool uh
you can find it at that GitHub address
it's open open
source uh you can do whatever you
want and if you want to follow me this
is what I look like from behind and
these are also my two social media
things I do I have my LinkedIn and my
GitHub so if you want to hit me up thank
you any questions
any questions then you use the
microphone there some people he will
help you if you have some feel free yeah
there's one
there you mentioned involving people who
are not technical in a CCF event how
would you go about that well we just
said want hey want to win an Xbox this
is open register go at it and we also
had I had like a boot camp in DMB for a
workshop over a day half a day we just
went through the basics and I also did a
live twitch stream uh where I sold some
we had the we had one section of the CTF
which we called 101 which is everything
basic and I had a twitch stream where I
went through all of those things which
is basically just teaching you how to
solve the different challenges or how
you supposed to approach them yeah
anyone else
yes I think that's all then last one we
have time for um yeah do you have a link
to the boot camp so the training stuff
is that part of your sort of Socials is
it in there uh well I did uh I did uh
imagine myself to be a twitch hacker
streamer but that died with a one time
so I couldn't keep it up sadly now it's
not
available but you can if you download
this CDF there's also other ones that
are open source that you can download
and I do recommend the Juice Shop it's
really neat and really fun and it's made
by a German guy who's a quite a qu
quirky character he's pretty cool thank
yes thank you so much enjoy the rest of
[Applause]
NDC for