https://insinuator.net/tags/dora/ Recent content in Dora on Insinuator.net - Bold Statements Hugo en-us Wed, 04 Mar 2020 00:00:00 +0000 https://insinuator.net/2020/03/dns-exfiltration-case-study/ Wed, 04 Mar 2020 00:00:00 +0000 https://insinuator.net/2020/03/dns-exfiltration-case-study/ <p>Lately, we came across a remote code execution in a Tomcat web service by utilizing <a href="https://docs.oracle.com/javaee/6/tutorial/doc/gjddd.html">Expression Language</a>. The vulnerable POST body field expected a number. When sending <code>${1+2}</code> instead, the web site included a Java error message about a failed conversion to <code>java.lang.Long</code> from <code>java.lang.String</code> with value <code>&quot;3&quot;</code>.</p> <p>From that error message we learned a couple of things:</p> <ul> <li>The application uses Java</li> <li>We are able to execute EL expressions</li> <li>Output from the EL engine is always returned as <code>String</code></li> </ul> <p>Whenever you are able to execute code within a Java Context, the most interesting part is to check whether we can get a <code>Runtime</code> object and execute arbitrary OS commands.</p>