UHC - LogForge

Name: UHC - LogForge
Uploaded: 2021-12-23T14:09:55Z
Channel: IppSec
Description: 00:00 - Intro 01:04 - Start of nmap 02:30 - Discovering an Apache Tomcat Errror message despite the webserver being Apache 03:15 - Looking at Orange Tsa...

IppSec · Beginner ·🔐 Cybersecurity ·4y ago

00:00 - Intro 01:04 - Start of nmap 02:30 - Discovering an Apache Tomcat Errror message despite the webserver being Apache 03:15 - Looking at Orange Tsai's 2018 Blackhat talk on Path Normalization 03:55 - Explaining the attack and how to bypass apache blocking access to /manager by using /..;/ or ;name=Stuff 05:20 - Attempting to deploy a WAR File to see that path is blocked by the max upload size being 1 byte 06:55 - Testing for log4j in Tomcat, discovering a callback 07:55 - Finding a twitter post that combines JNDI-Injection-Exploit-Kit and Ysoserial to do deserialization attacks with Log4…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Intro

1:04 Start of nmap

2:30 Discovering an Apache Tomcat Errror message despite the webserver being Apache

3:15 Looking at Orange Tsai's 2018 Blackhat talk on Path Normalization

3:55 Explaining the attack and how to bypass apache blocking access to /manager by

5:20 Attempting to deploy a WAR File to see that path is blocked by the max upload

6:55 Testing for log4j in Tomcat, discovering a callback

7:55 Finding a twitter post that combines JNDI-Injection-Exploit-Kit and Ysoserial

8:20 Explaining whats different about ysoserial modified and why it lets us do reve

9:20 Running YsoSerial-Modified to generate a CommonsCollections5 payload

11:00 Running JNDI Injeection Exploit Kit to setup the LDAP Server

13:00 Running the exploit and getting a reverse shell, then looking at port 21 since

15:30 FTP is running as root and written in Java. Testing for Log4j!

18:15 Using JD-GUI to examine the FTP Server source to discover credentials are stor

19:30 Explaining why we are going to use Wireshark to view these environment variabl

20:30 Creating a log4j payload that sends us the ftp_user environment variable, then

24:25 Using log4j to extract the java class path which may be helpful in creating se

25:50 Using log4j to extract the java version

27:00 Using log4j to extract OS Information

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →