00:00 - Intro
01:00 - Start of nmap
03:10 - Enumerating port 5000/5001 to see a Docker Registry and Auth Server
06:10 - Creating our auth token for the Docker Registry
08:45 - Adding the SSL Cert to our certificate store, then doing a docker pull to download and run the container
13:00 - Discovering JSESSIONID Cookie, attempting the weird directory traversal bug of /..;/ (nginx directory didn't have a trailing slash on the location)
16:45 - The Examples directory has a sessions example that lets us modify the session, doing this to get a File Disclosure vulnerability then downloading the WAR file hosting the app
27:45 - Opening the WAR in JD-GUI then examining the source code, discovering we can change our user to admin by editing the session
33:30 - Pointing the RMI.HOST back to us, then use YSOSERIAL to host a malicious server
42:50 - YSOSERIAL-MODIFIED Docker is up, using YSOSERIAL to start a JRMP Listener and host a malicious payload
46:45 - Shell on the container, showing where IPv6 addresses are stored (/proc/if_inet6) and that we could have gotten this with the file disclosure which allows for bypassing the firewall, did not need to do the ysoserial step for this next one.
52:51 - Looking at the source code again, discovering we can use the RMI to perform file operations on the host
56:00 - Start of creating the RMI Client Java App
1:09:18 - Running into an error using our decompiled code. Having our exploit just reference the class files (before decompilation)
1:25:00 - Finishing up our exploit script, then writing an SSH Key
1:36:60 - Looking at running processes, discovering the RMI Server restarts every 3 minutes, then running PSPY discovering a quarentine.jar
1:43:00 - Looking at the initial JAR again, discovering it will give out a config. Using RECAF so I can just replace code in the jar without recompiling
1:48:00 - Looking at the Quarantine Service, which pulls a config from the RMI Server then runs CLAM AV
1:51:40 - Having CLAM AV scan /root, and flag every file as a virus sending it to /dev/shm
Support the originator by clicking the read the rest link below.
