When spawning new web shell, it is commonly just nothing but the dumb terminal. To explorer target system better, it is mandatory to use fully interactive shell. There are few ways to make it, but I believe those two options were the best.
1)discovery : which ports are opened? – only 80 port is opened
2)enumerate : input/output sanitization? third platform? – check the website, does it use open source platform? any known vulnerabilities? – inject malicious strings, %00, {, |, . are acceptable? – can execute remote script?
3)manipulate webpage : any possible exploits? – exploit db, python code compile -> cmd shell (okay) – but, better way?
4)get a reverse shell : can we get a reverse web shell? – manipulate HTTP request by using burp – pawn a powershell
5)privilege escalation : any mis-configurations or vulnerabilities? – upload/execute powershell script
1)discovery : which ports are opened? – only 80 port is opened
2)enumerate : third party web platform? – use gobuster to check directory structure – check the website, does it use open source platform? any known vulnerabilities? – are those files really images? or have weird sizes compared to other one? – find username and password by enumerating webpage, image files – ask google for a help, research blog
3)manipulate webpage : any possible exploits? – inject php code
4)get a reverse shell : can we get a reverse web shell? – manipulate HTTP request by using burp – php cmd shell
5)privilege escalation : any mis-configurations or vulnerabilities? – pspy to check system process – focus on cronjob which as privileged permission
6)manipulate file – replace file to /etc/shadow in cronjob – copy normal users hashed password to root in /etc/shadow
OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications! (https://www.owasp.org/)
$cd /opt
$git clone https://github.com/CTFd/CTFd.git
Modify the docker-compose.yml file from the repository to specify a SECRET_KEY environment for the CTFd service.
: Environment
- SECRET_KEY=<SPECIFY_RANDOM_VALUE>
$docker-compose up
