SPRING BOOT PENTESTING PART 3- LAB SETUP+EXPLOITS WALKTHROUGH

Spring Boot Pentesting Lab Setup Is Must for You!!

let’s build a vulnerable Environment /Lab which can be used to test the previous learning and perform some of the possible attacks.

Lab Links are Provided Below:-

• Lab1
• Lab2

Prerequisites:-

• Any Machine-kali,Mint,Ubuntu
• Jdk-8 preferably or try with newer version.

We are going to setup a Linux mint machine. It’s bot compulsory to setup Linux mint, we prefer it because it’s Lightweight and easy to setup.

Points to be noted:- If u get stuck anywhere and have some doubt regarding any process then before proceeding further create a snapshot so that if anything wrong happens then we can revert.

apt install git

mkdir springboot
cd springboot
git clone https://github.com/veracode-research/actuator-testbed.git

ls
cd actuator-testbed/
mvn install

if mvn install command are not working , you can try this command :-

apt-get install maven

This command is particularly useful during development as it compiles the code and starts the application in one step.

mvn spring-boot:run

Here, we got an error as we were using JDK 11 , so we preferred to downgrade it to 8 version.

The apt-cache search openjdk command searches for available OpenJDK packages in the APT package repository

apt-cache search openjdk

sudo apt install openjdk-8-jdk

The sudo update-java-alternatives --list command lists all the available Java alternatives installed on your system.

sudo update-java-alternatives --list

sudo update - alternatives --config java

Then select number 2

after setup openjdk-8 run this command again

mvn spring-boot:run

Hence we are able to setup the lab and now we can perform testing on this lab.

Before testing the lab , Change the ip address from 127.0.0.1 to your machine ip address in my case i enter 192.168.153.150

cd springboot/actuator-testbed/src/main/resources/
nano application.properties

After changing the ip address press ctrl+x then press y

After we change the directory and perform the same comma i.e mvn install then mv spring:boot-run and finally we get now error and now we browse in browser and we get a greeting message

Above was a quick setup of Sprint boot environment setup . Now In this blog we are going to Perform the Exploits of this Lab.

spring.datasource.tomcat.url

It allows us to specify any SQL query, and it will be automatically executed against the current database. It could be any statement, including insert, update, or delete.

Intercept the request then send to it repeater

spring.datasource.tomcat.url

It enables the modification of the existing JDBC connection string. However, updating the JDBC string may not take effect if the database connection has already been established by the running application. Fortunately, there is another property that could potentially assist in such situations.

spring.datasource.tomcat.max-active=888

One technique that can be utilized here is to raise the number of concurrent connections to the database. By modifying the JDBC connection string and increasing the number of connections, the application can be bombarded with numerous requests to mimic a significant workload. When under such stress, the application will generate a fresh database connection using the updated malevolent JDBC string. I have tested this approach on MySQL locally and it performed exceptionally well.

Config modification via ‘/env’

When the Spring Cloud Libraries are present in the class path, you can use the ‘/env’ endpoint to adjust the Spring environmental properties. This includes the ability to modify and rebind all beans that are annotated with ‘@ConfigurationProperties’. Although not all properties are listed, the ‘/configprops’ actuator endpoint provides access to many of the properties that can be controlled. However, the sheer volume of available properties can make it difficult to determine which ones need to be modified in order to achieve a desired result.

RCE caused by improper configuration of the /env endpoint,

Precondition: Eureka-Client <1.8.7 (more common in Spring Cloud Netflix).

For example, if you test the front-end JSON to report an error and leak the package name, you can use netflix.

Following two packages are required

spring-boot-starter-actuator (required for /refresh configuration)

spring-cloud-starter-netflix-eureka-client (functional dependency)

Using python3 to start the script, you need to pay attention to two places, one is the IP and port of the receiving shell, and the other is the port started by our script.

Payload.py

Nc listens to a port to receive a reverse shell,

Write the configuration, access the /env endpoint, capture the packet and change the get request to a post request, and the post content is (the IP is the IP of the machine started by the script):

Then visit /refresh, capture the packet and change the get request to a post request, the post data is random,Then in our nc window, we can see that a shell has successfully bounced back.

Given exploits were performed in the specified Pentest lab setup and for jolokia exploits we will setup another lab to get detailed understanding.Let’s meet in the next blog.

Read our Previous Blogs.

If you enjoyed this blog post , share it with your friends and colleagues!