Skip to main content

Hacking Thick Clients – Authorization Bypass

Hello Readers,

 This post will be focused on setting up a vulnerable thick client application and finding vulnerabilities. The blog post is an unofficial part of the on going series of post by NetSPI. NetSPI has released a vulnerable thick client app called BetaFast which has two versions - BetaBank and BetaFast based on 2-tier and 3-tier architecture respectively. The app is coded by Austin Altmann and he is writing the walk-through series.

 Note: At the time of writing this blog, the walk-through/write-up for authorization bypass vulnerability was yet to be published by NetSPI and therefore I decided to create this blog post.

 All the credit for developing and maintaining this app goes to Austin and NetSPI team. You can find some of the cool write-ups here. Let's start.

 Setting up Betafast -
1. Download the files from github - https://github.com/NetSPI/BetaFast .
2. Extract and open the .sln file with Visual Studio
3. Look for App.config
4. Edit the App.config file's baseUri key value as betafast.net as shown in the screenshot below-
5. Click on Build -
6. Install docker desktop for Windows from here.
7. You need to enable Hyper-V for running docker-desktop. Following command can be run as administrator and a restart is required to run docker-desktop.
 To enable:
      bcdedit /set hypervisorlaunchtype auto
To disable:
      bcdedit /set hypervisorlaunchtype off
8. Navigate to the docker folder of Betafast and open powershell.
9. To launch the servers, use the following commands in the same directory as docker-compose.yml: 
docker-compose build 
docker-compose up 


10. Now let's make the following entry in windows host file - 

11. In order to intercept the request from application we would be setting up a system proxy as shown below -

12. Configure Burpsuite proxy listener to the same and let's start with finding the vulnerability.


Finding the Vulnerability -

Step 1: Click on 'Create Account' to register a new low privileged user -

Step 2: Register using some credentials -

Step 3: Login and check HTTP History and we will see an interesting request is made to confirm if the following user is admin or not -

Step 4: Before tampering the response, let's explore the user panel and you can see the below screenshot has limited no. of tabs and functionality -

Step 5: Now logout and login again while keeping the intercept on in order to change the response in the fly -
Change response from 'false' to 'true' -

Step 5: We would be able to access to Admin functions that are available in the application -

Step 6: Let's add an admin user to confirm if we really can perform admin actions from low privileged user -

Conclusion : We were able to bypass the access control mechanism and access admin dashboard to perform unauthorized actions from a low privileged account.
Thanks for reading. You can read more about access control bypass from here.
Labels:

Comments

  1. alamFebruary 22, 2022 at 5:58 AM

    This is highly informatics, crisp and clear. I think that everything has been described in systematic manner so that reader could get maximum information and learn many things. Vulnerabilty

    ReplyDelete

Post a Comment

Popular posts from this blog

Review of Pentester Academy - Attacking and Defending Active Directory Lab

Few months ago I didn't know what Active Directory is, and why should I care about it and never heard about ACL abuse and all. Although I had attended a BPAD (Breaking and Pwning Active Directory) training which was provided by Nullcon but I was not confident enough to go for this course exam, since my day-today activity involves VAPT stuffs related to Web/Network/Mobile and sometimes basic malware analysis (very basic one :p).  I started doing offshore lab and took help from some friends in understanding few Active Directory concepts. I did many silly mistakes during the lab and learned a lot. Meanwhile I registered for Active Directory Lab Course and got it in a discounted offer for first 50 students of about 11k INR  ( 1 mont lab access) :). Before wasting time any further let's dive into the review. The course -  https://www.pentesteracademy.com/activedirectorylab Certification - Certified Red Team Professional The Course Content  - After paying the course fee,
4 comments
Read more

Brute Force Basic Authentication - PSP Assignment 0x1

Before we start I would like to bring your attention to this PSP course from Pentester Academy   - https://www.pentesteracademy.com/course?id=21 . The course is focused on Powershell scripting which can be used in pentesting activities. AGENDA  : 1. Introduction to Powershell 2. Basic Authentication lab setup 3. Brute-force Basic Authentication using Powershell Script -   - cmdlet   - IP,Port and word-list should be easily configurable 1.  Introduction to Powershell  -  Microsoft says- PowerShell is a task-based command-line shell and scripting language built on .NET. PowerShell helps system administrators and power-users rapidly automate tasks that manage operating systems (Linux, macOS, and Windows) and processes. PowerShell commands let you manage computers from the command line. PowerShell providers let you access data stores, such as the registry and certificate store, as easily as you access the file system. PowerShell includes a rich expression parser and a fu
1 comment
Read more

Shellcode Analysis x86 - SLAE Assignment 0x5

Before we start , I would like to bring your attention to this SLAE course from securitytube which will help you learn Shellcoding -  http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ We all use metasploit in our daily pentest engagements so let's break-up some of the shellcode comes with metasploit. Analysis :  1. linux/x86/chmod  2. linux/x86/exec  3. linux/x86/read_file 1. linux/x86/chmod -   msfvenom -p linux/x86/chmod -f raw | ndisasm -u - msfvenom -p linux/x86/chmod -f c msfvenom -p linux/x86/chmod -f raw | sctest -vvv -Ss 100000 -G chmod.dot dot chmod.dot -Tpng -o chmod.png  2. linux/x86/exec -   msfvenom -p linux/x86/exec CMD=ls FILE=tmp.bin -f raw | ndisasm -u - msfvenom -p linux/x86/exec CMD=ls -f c msfvenom -p linux/x86/exec CMD=ls FILE=tmp.bin -f raw | /opt/libemu/bin/sctest -vvv -Ss 100000 -G exec.dot dot exec.dot -Tpng -o exec.png 3. linux/x86/read_file - msfvenom -p linux/x86/shell/revers
1 comment
Read more