Apache AXIS server pentest


              In one of my pentest engagement the scope was to test  a website abc.com/xyz/pqr.html and its mobile application.
The website seems to be stronger and I was not able to find any vulnerability. So I switched to mobile application.
When I was testing the mobile application, I was doing code analysis and found a URL in the code which was invoking a web service. The URL is as follows.

https://abc.com/InstaWebServices/services/VersionCheck




After going through some vulnerability reading of AXIS server I triggered the following URL which gave me the version of Apache Axis server and other details.

https://abc.com/InstaWebServices/services/VersionCheck?wsdl



There is an information disclosure exploit present for this version of Apache Axis which can be found on https://www.exploit-db.com/exploits/29930/

The exploit says:

Apache AXIS is prone to a path-information-disclosure vulnerability. Remote unauthorized attackers may be able to determine webserver directory paths.
 
Information obtained may aid attackers in launching further attacks against an affected server.
 
Apache AXIS 1.0 is vulnerable to this issue.
 
http://www.example.com/axis/tt_pm4l.jws?wsdl
(Quoted from exploit-db.com)

So accessing similar URL for my server gave me the following:

https://abc.com/InstaWebServices/services/VersionCheck/t_pm4l.jws?wsdl


It seems that debugging is disabled from the webserver side and I did not get sensitive information from the error.

There was also an instance of Content-injection with CRLF vulnerability on Apache Axis 1.4 reported by nososecure.com

https://www.notsosecure.com/apache-axis-crlf-and-content-injection/


This was all about Apache Axis pentest.

Comments

  1. m0nkeyshell12 August 2016 at 02:57

    Sir Can you please recommend some good books for network pentesting. Possible even good tutorial. I need to prepare for OSCP and my network concept and pentesting all topic are weak.. PLease provide as many good book and Tutorial.

    ReplyDelete
  2. test14 August 2016 at 02:34

    Check out the following tutorials: 1) https://www.cybrary.it/course/metasploit/ 2) https://www.cybrary.it/course/advanced-penetration-testing/ 3) https://www.cybrary.it/course/post-exploitation-hacking/

    ReplyDelete

Post a Comment

Popular posts from this blog

MY OSCP REVIEW

Image
MY OSCP REVIEW About me I am just a guy who has done B.E (Computer Engineering), C.E.H and I am doing vulnerability assessment for different clients in Mumbai. Inspiration to do OSCP Wanted to read technical stuff only then skip this para. Like other guyz I thought that OSCP is one of the most difficult task in the world of IT Security. And yes, it is one the difficult mission you could ever face. Back in Dec 2014 I was really bored with the conventional vulnerability assessment thing, I wanted to do some more exploitation and some black hat stuff. But in our job we were not allowed to do so, as the environment used to be critical most of the time and time for completing the task was less. So I asked few question on some group in facebook regarding How can I learn more exploitation stuff. There was a guy with the name Mr.WhiteW0rm who have given me a brilliant answer and recommended me to do OSCP. That time I thought though I won't be able to do OSCP but at least I...
Read more

Minishare 1.4.1 Bufferoverflow

Image
You can download the server from: https://www.dropbox.com/s/zhivgb79wtbce37/minishare-1.4.1.exe?dl=0 Exploit code in ruby: https://www.exploit-db.com/exploits/616/ The vulnerability is a long URL in the GET request. Eg:- GET AAAAAAAAAAAAAAAA..... HTTP/1.1 Lab Setup: 1) Windows xp ( I am using windows xp sp1) 2) Immunity debugger installed on the windows xp machine. 3) Minishare 1.4.1 installed on windows xp running on port 80. 2) Kali linux for scripting and exploiting. Configure the victim: I have installed Minishare server 1.4.1 and it is listening for connections on port 80, as depicted below. Generate Sample script to crash: We will try to smash the stack by sending a buffer of 2000 A's with the help of the following script. #!/usr/share/python import socket,sys s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect((sys.argv[1],80)) buff="GET " buff+="A"*2000 buff+=" HTTP/1.1\r\n\r\n" s.send(buff) s.close...
Read more