diff --git a/CHANGELOG.md b/CHANGELOG.md index 040b3d8..8c66572 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ All notable changes to this project will are documented in this changelog file. +## [1.1.0] - 2023-09-09 +### Added +- added RCE Deserialization challenge + ## [1.0.1] - 2023-06-02 ### Added - fixed macOS icon diff --git a/README.md b/README.md index 2c92fbd..e7b8867 100644 --- a/README.md +++ b/README.md @@ -1,21 +1,76 @@ # ![Vulnerable Client-Server Application (VuCSA)](http://vucsa.warxim.com/img/logo.png) # Vulnerable Client-Server Application (VuCSA) -Vulnerable client-server application (VuCSA) is made for learning/presenting how to perform penetration tests of non-http thick clients. +Vulnerable client-server application (VuCSA) is made for learning/presenting +how to perform penetration tests of non-http client-server applications. It is written in Java (with JavaFX graphical user interface). -Currently the vulnerable application contains the following challenges: -1. Buffer Over-read (simulated) -2. Command Execution -3. SQL Injection -4. Enumeration -5. XML -6. Horizontal Access Control -7. Vertical Access Control +Currently, the vulnerable application contains the following challenges: + +1. **Buffer Over-read (simulated)** +2. **Command Execution** +3. **SQL Injection** +4. **Enumeration** +5. **XML** +6. **Horizontal Access Control** +7. **Vertical Access Control** +8. **RCE Deserialization** If you want to know how to solve these challenges, take a look at the [PETEP website](https://petep.warxim.com/methodology/), which describes how to use the open-source tool PETEP to exploit them. -**Tip:** Before you start hacking, do not forget to check the data structure of messages bellow. +**Tip 1:** Before you start hacking, do not forget to check the data structure of messages bellow. +When modifying the network traffic, you will probably have to consider the structure, +especially payload length bytes. + +**Tip 2:** Most of the challenges can be exploited through modification of network traffic. +Therefore, it is recommended to use TCP proxy or process hooks for the testing. + +**Tip 3:** Some challenges have input validation and restrictions in place, which is common in thick clients, +but it does not mean that the server uses the same validation. + +### Buffer Over-read (simulated) Vulnerability +In this challenge, your goal is to manipulate the network traffic between the client and the server in a way +that leads to buffer over-read. + +### Command Execution Vulnerability +Command execution challenge represents a very simple command execution vulnerability. +The goal is to execute malicious command on the server. + +### SQL Injection Vulnerability +SQL Injection challenge contains a search input vulnerable to SQL injection, +but as you will soon notice, the input does not allow you to input the characters you need. + +### Enumeration Vulnerability +Enumeration challenge is based on simulated login form that is not protected from enumeration. +Will you be able to find all 5 users and guess their passwords? + +### XML Vulnerabilities +In this challenge, you can find multiple XML vulnerabilities: +- XML External Entity Attack (XXE Injection) +- XInclude Attack +- XML Bomb Attack + +### Horizontal Access Control Vulnerability +Horizontal Access Control challenge represents document reader that allows the user to see +own documents and read their content. +The goal is to find 5 documents of other users. + +### Vertical Access Control Vulnerability +Vertical Access Control challenge is based on simulated user panel, which shows basic user +information. The goal is to find a hidden admin functionality and check if it is possible +to use it as a Guest user. + +### RCE Deserialization Vulnerability +RCE Deserialization vulnerability uses Java deserialization/serialization for transmitting data through the network. +The application contains two paths that you can use to achieve remote code execution through +the vulnerable Java deserialization. + +You can find both paths by examining the server's JAR file +or by looking into the [source code](vucsa-server/src/main/java/com/warxim/vucsa/server/challenge/rcedeserialization). + +The goal is to create exploits for both paths and execute malicious command on the server. + +**Tip:** You can use the server JAR as library to make the exploit creation easier. ## How to Run In order to run the vulnerable server and client, you can use one of releases on GitHub @@ -24,6 +79,8 @@ These packages contain sh/bat scripts that will run the server and client using You need Java 11 or newer version to run VuCSA. +***Note:** For Mac with ARM64 architecture (M1, M2 chips), use special build for Java 17.* + ## Project Structure Project is divided into three modules: - **vucsa-common** - common functionality for both client and server (including protocol processing utilities) @@ -38,6 +95,18 @@ Messages transmitted between server and client have the following simple format: These four parts have the following meaning: - **type** - type of the message (used for serialization/deserialization) -- **target** - target handler that will receive the message +- **target** - target handler that will receive the message (identifier) - **length** - length of the payload - **payload** - data serialized into bytes + +In order to send custom payloads, you might have to update the payload length. +Otherwise, it will not work properly. In the [tutorial](https://petep.warxim.com/methodology/analysis/), +automatic script is developed to auto-fix the payload length bytes. + +# Tutorial (Solutions) +Vulnerable client-server application (VuCSA) contains multiple vulnerabilities, +which can be exploited in various ways. Official guide for exploiting these vulnerabilities +uses open-source PEnetration TEsting Proxy (see [PETEP Methodology](https://petep.warxim.com/methodology/)). + +In the PETEP methodology, the whole process of exploiting the challenges is explained, +including useful payloads. diff --git a/build.gradle b/build.gradle index de99886..016ede1 100644 --- a/build.gradle +++ b/build.gradle @@ -4,7 +4,7 @@ plugins { } group 'com.warxim' -version '1.0' +version '1.1' repositories { mavenCentral() diff --git a/vucsa-client/build.gradle b/vucsa-client/build.gradle index 8c29067..2d08a6b 100644 --- a/vucsa-client/build.gradle +++ b/vucsa-client/build.gradle @@ -12,7 +12,7 @@ javafx { } group 'com.warxim' -version '1.0' +version '1.1' mainClassName = 'com.warxim.vucsa.client.Main' repositories { diff --git a/vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/rcedeserialization/RceDeserializationController.java b/vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/rcedeserialization/RceDeserializationController.java new file mode 100644 index 0000000..a19e37d --- /dev/null +++ b/vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/rcedeserialization/RceDeserializationController.java @@ -0,0 +1,78 @@ +/* + * Vulnerable Client-Server Application (VuCSA) + * + * Copyright (C) 2023 Michal Válka + * + * This program is free software: you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License along with this program. If + * not, see . + */ +package com.warxim.vucsa.client.challenge.rcedeserialization; + +import com.warxim.vucsa.client.Bundle; +import com.warxim.vucsa.client.challenge.ChallengeController; +import com.warxim.vucsa.common.ChallengeConstant; +import com.warxim.vucsa.common.message.rcedeserialization.MessageContent; +import com.warxim.vucsa.common.message.rcedeserialization.TextMessage; +import javafx.application.Platform; +import javafx.event.ActionEvent; +import javafx.fxml.FXML; +import javafx.fxml.Initializable; +import javafx.scene.control.TextArea; + +import java.net.URL; +import java.util.ResourceBundle; + +/** + * RCE Deserialization controller handles RCE Deserialization challenge, which acts as echo server using object serialization. + */ +public class RceDeserializationController extends ChallengeController implements Initializable { + private final RceDeserializationHandler handler = new RceDeserializationHandler(this); + + @FXML + private TextArea dataInput; + @FXML + private TextArea dataOutput; + + @Override + public void initialize(URL location, ResourceBundle resources) { + initHandler(); + } + + /** + * Sets data to the output component + * @param data Output to be set + */ + public void setOutput(String data) { + Platform.runLater(() -> dataOutput.setText(data)); + } + + /** + * Sends items to the server. + */ + @FXML + private void onSendClick(ActionEvent event) { + var data = dataInput.getText(); + var messageContent = new MessageContent(data); + + var message = TextMessage.builder() + .target(ChallengeConstant.RCE_DESERIALIZATION_TARGET) + .content(messageContent) + .build(); + sendMessage(message); + } + + /** + * Initializes RCE deserialization message handler. + */ + private void initHandler() { + Bundle.getInstance().getClientManager().registerHandler(ChallengeConstant.RCE_DESERIALIZATION_TARGET, handler); + } +} diff --git a/vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/rcedeserialization/RceDeserializationHandler.java b/vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/rcedeserialization/RceDeserializationHandler.java new file mode 100644 index 0000000..c428185 --- /dev/null +++ b/vucsa-client/src/main/java/com/warxim/vucsa/client/challenge/rcedeserialization/RceDeserializationHandler.java @@ -0,0 +1,42 @@ +/* + * Vulnerable Client-Server Application (VuCSA) + * + * Copyright (C) 2023 Michal Válka + * + * This program is free software: you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License along with this program. If + * not, see . + */ +package com.warxim.vucsa.client.challenge.rcedeserialization; + +import com.warxim.vucsa.common.connection.Connection; +import com.warxim.vucsa.common.message.Message; +import com.warxim.vucsa.common.message.MessageHandler; +import com.warxim.vucsa.common.message.rcedeserialization.TextMessage; +import lombok.RequiredArgsConstructor; + +/** + * Handler for handling messages for RCE Deserialization challenge. + */ +@RequiredArgsConstructor +public class RceDeserializationHandler implements MessageHandler { + private final RceDeserializationController controller; + + @Override + public boolean supports(Message message) { + return message instanceof TextMessage; + } + + @Override + public boolean handleMessage(Connection connection, Message message) { + controller.setOutput(((TextMessage) message).getContent().getText()); + return true; + } +} diff --git a/vucsa-client/src/main/java/com/warxim/vucsa/client/gui/controller/ApplicationController.java b/vucsa-client/src/main/java/com/warxim/vucsa/client/gui/controller/ApplicationController.java index 70c90f0..207383c 100644 --- a/vucsa-client/src/main/java/com/warxim/vucsa/client/gui/controller/ApplicationController.java +++ b/vucsa-client/src/main/java/com/warxim/vucsa/client/gui/controller/ApplicationController.java @@ -19,6 +19,7 @@ import com.warxim.vucsa.client.Bundle; import com.warxim.vucsa.client.challenge.commandexecution.CommandExecutionController; import com.warxim.vucsa.client.challenge.enumeration.EnumerationController; +import com.warxim.vucsa.client.challenge.rcedeserialization.RceDeserializationController; import com.warxim.vucsa.client.challenge.verticalaccesscontrol.VerticalAccessControlController; import com.warxim.vucsa.client.challenge.ChallengeController; import com.warxim.vucsa.client.challenge.ChallengeWrapper; @@ -191,5 +192,10 @@ private void initChallengeTabs() { "/fxml/challenge/verticalaccesscontrol/VerticalAccessControlTab.fxml", new VerticalAccessControlController(), ++tabOrder); + initChallengeTab( + "RCE Deserialization", + "/fxml/challenge/rcedeserialization/RceDeserializationTab.fxml", + new RceDeserializationController(), + ++tabOrder); } } diff --git a/vucsa-client/src/main/resources/css/Main.css b/vucsa-client/src/main/resources/css/Main.css index dda8ff1..7211499 100644 --- a/vucsa-client/src/main/resources/css/Main.css +++ b/vucsa-client/src/main/resources/css/Main.css @@ -1,4 +1,14 @@ +@font-face { + src: url('../fonts/NotoSans-Regular.ttf'); +} + +@font-face { + font-weight: bold; + src: url('../fonts/NotoSans-Bold.ttf'); +} + { + -fx-font-family: 'Noto Sans', 'sans-serif'; -fx-font-size: 12px; -fx-color-background-light: #fff; -fx-color-text-primary: #000; diff --git a/vucsa-client/src/main/resources/fonts/NotoSans-Bold.ttf b/vucsa-client/src/main/resources/fonts/NotoSans-Bold.ttf new file mode 100644 index 0000000..ab11d31 Binary files /dev/null and b/vucsa-client/src/main/resources/fonts/NotoSans-Bold.ttf differ diff --git a/vucsa-client/src/main/resources/fonts/NotoSans-Regular.ttf b/vucsa-client/src/main/resources/fonts/NotoSans-Regular.ttf new file mode 100644 index 0000000..a1b8994 Binary files /dev/null and b/vucsa-client/src/main/resources/fonts/NotoSans-Regular.ttf differ diff --git a/vucsa-client/src/main/resources/fxml/challenge/bufferoverread/BufferOverreadTab.fxml b/vucsa-client/src/main/resources/fxml/challenge/bufferoverread/BufferOverreadTab.fxml index 7a6fe7e..341d3bc 100644 --- a/vucsa-client/src/main/resources/fxml/challenge/bufferoverread/BufferOverreadTab.fxml +++ b/vucsa-client/src/main/resources/fxml/challenge/bufferoverread/BufferOverreadTab.fxml @@ -18,6 +18,6 @@ -