[arrogant]

okay I'm lost once I log into the platform

edit: nvm, rooted

[hinkledinkle2]

Got the USER and the HASH  ... not sure if I understand enough to read the github of that application to reverse engineer the HASH creation for craking ... any help on those steps?

Hi, please how did you get the user and hash, i've tried dumpiing the seg0 folder but no luck

For the USER: https://github.com/jakabakos/Apache-OFBi...ion-Bypass

Once you have a shell and are in the box:
For the HASH: check the dat files under the DERBY database folder ... it's an encrypted SHA

i've tried dumpiing the seg0 folder but no luck

It's in there

I have the hash, and im reading the source code but im not sure what I'm missing. I get we need to decode it first, but im not getting anything useful out of it...

[hinkledinkle2]

can you give me a hint on what next after cracking the hash?

How did you manage to crack the hash?

I still can't figure out how to crack that part of it...

I've been going through the site that was linked earlier, but I'm still completely lost trying to figure out what part of it was salt or not.

same here

[intersteller2038]

I do got a SHA password from these derby dat files, but its weird to crack..

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

Where did you find this? What exact file?

[Eliot0x0]

got user


anyone get something for root ?

I'm not sure but...

ofbiz@bizness:~/l$ getcap -r / 2>/dev/null
/usr/bin/ping cap_net_raw=ep
/home/ofbiz/l/python3 cap_setuid=eip

not vulnerable

btw did you manage to get a good shell ? mine breaks after 2 minutes it's soooo annoying

yes, https://github.com/abdoghazy2015/ofbiz-C...exploit.py shell option
shell option

thanks !

---

idk why but got error

Error while generating or serializing payload
java.lang.IllegalAccessError: class ysoserial.payloads.util.Gadgets (in unnamed module @0x5a9ae579) cannot access class com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl (in module java.xml) because module java.xml does not export com.sun.org.apache.xalan.internal.xsltc.trax to unnamed module @0x5a9ae579
        at ysoserial.payloads.util.Gadgets.createTemplatesImpl(Gadgets.java:102)
        at ysoserial.payloads.CommonsBeanutils1.getObject(CommonsBeanutils1.java:20)
        at ysoserial.GeneratePayload.main(GeneratePayload.java:34)
Please make sure from data

Use this https://github.com/jakabakos/Apache-OFBi...ion-Bypass

[pepsimax]

I do got a SHA password from these derby dat files, but its weird to crack..

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

Where did you find this? What exact file?

/opt/ofbiz/runtime/data/derby/ofbiz/seg0

The directory contains a lot of dat files for the database. Using something like

grep -arin -o -E '(\w+\W+){0,5}password(\W+\w+){0,5}' .

from that directory will identify files with the keyword "password" in them which will help you find it.

[M3nd4x]

can you give me a hint on what next after cracking the hash?

How did you manage to crack the hash?

I still can't figure out how to crack that part of it...

I've been going through the site that was linked earlier, but I'm still completely lost trying to figure out what part of it was salt or not.

Try rewriting a similar code but the password is taken from rockyou.txt. Brute force until the correct password is found

[hinkledinkle2]

for those of you who have solved this, is key-encrypting-key important to know?

[M3nd4x]

Here is the code to find the password, replace the path of your password list file (I recommend rockyou.txt)

import org.apache.commons.codec.binary.Base64;

import java.io.BufferedReader;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.io.IOException;
import java.io.FileReader;

public class Main {
    public static void main(String[] args) {
        String filePath = "<Path to list password>";

        try (BufferedReader reader = new BufferedReader(new FileReader(filePath))) {
            String line;

            while ((line = reader.readLine()) != null) {
                byte[] bytes = line.getBytes(StandardCharsets.UTF_8);
                String hash = cryptBytes("SHA", "d", bytes);
                System.out.println(hash);
                if (hash.equals("$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I")){
                    System.out.println("[+] Password: " + line);
                    break;
                }
            }
        } catch (IOException ignored) {}
    }

    public static String cryptBytes(String hashType, String salt, byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        sb.append("$").append(hashType).append("$").append(salt).append("$");
        sb.append(getCryptedBytes(hashType, salt, bytes));
        return sb.toString();
    }

    private static String getCryptedBytes(String hashType, String salt, byte[] bytes) {
        try {
            MessageDigest messagedigest = MessageDigest.getInstance("SHA");
            messagedigest.update("d".getBytes(StandardCharsets.UTF_8));
            messagedigest.update(bytes);
            return Base64.encodeBase64URLSafeString(messagedigest.digest()).replace('+', '.');
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("Error while comparing password", e);
        }
    }
}

[peRd1]

The above script also works. Good job coding that 

But hashcat also finds it easily once the hash is converted.

From the official docs of Apache OfBiz (check for HashCrypt.java from source code), you can figure out that the hash is stored in base64 url-safe encoded fashion so this needs to be re-converted to traditional hex representation of SHA1. Then just hashcat use -a 0 and -m 120 and remember what was the salt and set it up as hash : salt  and it's done.

Quite stupid privesc tbh, problem was we spent way tooo much time on other privesc methods mostly due to python binary capsetuid which was a leftover from the game overlay vuln testing ... that ruined bit the box experience... foothold was fantastic for an easy box - identifying the CVE then making it work