#command injection

So over the last few weeks I've been working on Catch. With work and the festive period I haven't had a lot of time; I finally got the opportunity to finish it last night. :)

It has a medium rating but I wouldn't say it's due to the initial foothold and privilege escalation being difficult- it's more due to there being a couple of rabbit holes (all of which I fell into for a period!)

Enumeration

As always, a port scan kicks off the process. Unfortunately I can't show the output of the port scan as during the time I switched laptops and I'm too lazy to power my old one on. xD However, the results were roughly as follows:

Port 80: HTTP (Catch Global Systems main page)

Port 3000: Gitea(?)

Port 5000: Lets Chat(?)

Port 8000: Cachet status page system

Port 80 was the first location I checked. You're greeted with what appears to be Catch's main application:

The signup/login functionality isn't present; I did notice the ability to download a file. The file that downloads is an apk.

For those that are unfamiliar with mobile applications, apk is one of the file formats for an Android mobile application which uses XML and Java. Having a little experience with mobile applications, my first thought was to decompile the apk and check for any hidden hardcoded secrets, usually stored in strings.xml.

To decompile the apk, I used apktool.

$ apktool d catchv1.0.apk

This decompiles the apk to near it's original form and places the resulting files in ./catchv1.0/. From here, I viewed ./res/values/strings.xml and found 3 potentially usable tokens for other applications:

$ grep token catchv1.0/res/values/strings.xml <string name="gitea_token">b87bfb6345ae72ed5ecdcee05bcb34c83806fbd0</string> <string name="lets_chat_token">NjFiODZhZWFkOTg0ZTI0NTEwMzZlYjE2OmQ1ODg0NjhmZjhiYWU0NDYzNzlhNTdmYTJiNGU2M2EyMzY4MjI0MzM2YjU5NDljNQ==</string> <string name="slack_token">xoxp-23984754863-2348975623103</string>

Foothold

With these in hand, I started with Lets Chat at random. Lets Chat is an open-source chat application utilizing a REST api. With it being open-source, it didn't take long at all to find how to use the discovered token:

As you can see, a password for John is viewable in one of the chat rooms. This grants you access to another one of their applications called Cachet- open-source yet again.

Cachet is the last stop before system access; admittedly this is where I fell rabbit hole 1 as I did spend some time trying to use the gitea_token, more out of curiosity than anything. After spending some time on this, however, I gave up and focused on Cachet.

As it turns out, the version of Cachet in use had two pubicly known vulnerabilities related to interaction with the application's dotenv file. One allowed you to leak values set in dotenv while the other allowed you to add new values to dotenv which could be used to achieve remote command execution. This is done by hosting a redis server, altering the dotenv file to make the application use your hosted redis server as a session driver and finally changing the value of the session key after the initial connection to a payload generated by phpggc. Better detail off this is given here.

I did spend some time playing around with the RCE vulnerability here, more out of interest as I haven't had any experience with Redis prior to this and it took me a while to get RCE working as the video doesn't explicitly show the process step-by-step.

Originally, I was getting the token from the source code in the application, adding this as a key with the phpggc payload as the value and then altering the dotenv file to connect to my Redis Server. As the RCE occurs when the client connects the second time and reads the value from the original session token, this didn't work.

I did eventually get this working, uploaded a PHP web shell and upgraded this to a reverse shell; this ultimately proved to be a waste of time as you end up in a Docker instance with no ability to break out of it!

With a heavy heart, I turned to the second vulnerability and leaked the database password from the dotenv file. This grants us access to the server through SSH as WIll.

Privilege Escalation

Privilege escalation was actually quite easy! Some simple enumeration reveals the presence of world-writeable directory /opt/mdm/apk_bin. In /opt/mdm, there is a Bash file verify.sh.

verify.sh is used to verify the legitimacy of apks uploaded to apk_bin and is executed as part of a cronjob which is executed as root. While references to verify.sh cannot be directly found, there is reference to 'check.sh' in the root directory in running processes (netstat -ano.)

The interesting lines of the script are here:

app_check() { APP_NAME=$(grep -oPm1 "(?<=string name=\"app_name\">)[^<]+" "$1/res/values/strings.xml") echo $APP_NAME ...

The function app_check is taking the app_name from strings.xml and echoing it back with no form of mitigation against command injection. For example, wrapping the variable name with ${} would have prevented this vulnerability being exploitable as this would have specified that only variable expansion was expected- the app name would have been echoed back as a string and not interpreted as a literal Bash command.

I tested this first by simply making the app name 'Catch; touch /opt/mdm/heuheu' and uploading it using python -m SimpleHTTPServer on my end and curl on Catch's end which achieved the expected outcome.

I did this with APK Editor Studio after encountering some errors trying do manually decompile and then recompile with apktool. Note that you also need to create a key for signing the APK as verify.sh uses jarsigner to verify this.

will@catch:/opt/mdm/apk_bin$ ls -al .. total 16 drwxr-x--x+ 3 root root 4096 Jan 6 21:55 . drwxr-xr-x 4 root root 4096 Dec 16 2021 .. drwxrwx--x+ 2 root root 4096 Jan 6 22:03 apk_bin -rw-r--r-- 1 root root 0 Jan 6 21:55 heuheu -rwxr-x--x+ 1 root root 1894 Mar 3 2022 verify.sh

From here, I went old school and just made /etc/passwd fully accessible by everyone before changing root's password to 'mwaha'

Generating the password:

$ openssl passwd mwaha KW56XEY7wxZuU

Where the password is added in /etc/passwd:

root:KW56XEY7wxZuU:...

Command injection without space, $, {, } 

Python3 or PHP on server? 

 uname`cat<<<'<?="\x20"?>'|php`-a 

uname`cat<<<'print("\x20")'|python3`-a

Smartphones have become an indispensable tool in everyday life. One can shop, browse, watch videos, listen to music, stay in touch on social media...this list goes on and on. Basically anything one can do on a computer, they can do on a phone. The difference being, mobile phones don’t usually have the same type of security software that a computer does, making them an easy vector for malicious activity. Smishing (SMS phishing), scam calls, QR code compromise, and now code injection via HTTP requests in Ivanti that can lead to remote code execution in iOS and Android, as well as others.

Ivanti is an IT software company offering a variety of management and security options. It has a history of mergers with other IT products over the years, and came onto the market with its current name in 2017. This is not the first time the company has been added to CISA’s Known Exploited Vulnerabilities catalog. The current ones are CVE-2026-1281 and CVE-2026-1340, both of which allow unauthenticated RCE. They are quite narrow and specific, but WatchTowr Labs has broken them down, at least for those of us familiar with Bash. And since it’s my job to break that down even further for those who don’t, let’s get started.

Bash is the script Linux code is written in, and is used in many mobile platforms because it doesn’t need much memory space and is generally pretty secure. As in, not many varieties of malware affect Linux, although obviously generally secure does not mean completely invulnerable. As coding languages go, it’s fairly straightforward and easy to learn. In fact, before I even started my cybersecurity training, I learned Bash scripting in a matter of days, much of which was self study. Commands in the language have some hallmarks that are to this day glaring red flags when doing analysis. Exploitation of this pair of vulnerabilities abuse GET and REWRITE.

GET is just what it says on the tin: data seeking. It’s the command for ‘find this thing’. In and of itself, it’s a normal part of any command line. It’s what one does with that data’s endpoint that’s important here. REWRITE is also what it says on the tin: rewriting the command of an if/then request.

Commands are a sequence of switches, essentially. If this, then that. Yes or no. On or off. I recently described digital code as being like DNA. Gene expression is merely a matter of having something switched on or off. This is why inherited traits like facial structure, eye color, even the texture of hair can skip generations. The parent could have a trait, but the child does not, then the child’s child has the trait active again. The gene is always present, it’s just turned on or off. We have tens of thousands of genes, which is what leads to such diversity among us as a species. Digital code is not nearly as complex, but it behaves in much the same way. RCE is, by definition, a switch in command expression by an outside actor.

CVE-2026-1281 and CVE-2026-1340 are vulnerable to manipulations of GET/REWRITE in which an injected command deletes the existing Bash command with a new one in Java. As vulnerabilities go, these take some skill to exploit, as the exploitation showed up in a rather roundabout way, according to WatchTowr’s research. The circumstances require HTTP requests, knowledge of the Java paths and are then subtly inserted in a GET command for a timestamp. But like I said, Bash is easy to learn. And threat actors are constantly finding innovative ways to exploit vulnerabilities for their own ends.

Ivanti has not released details of how these are being exploited in the wild, other than the versions affected. These include 12.5.0.0 and prior, 12.6.0.0 and prior, 12.7.0.0 and prior for CVE-2026-1281. 12.5.1.0 and prior, 12.6.1.0 and prior for CVE-2026-1340. There are patches, but they are a temporary solution involving reinstallment of RPM, the Linux based package manager upon which Ivanti runs. The permanent ‘fix’ will be available when the software upgrades to a new version later in this first quarter of the year. However, there is another way to reduce the chance of falling victim to these RCE’s. Turn off HTTP requests in your phone’s settings, so that it will only process HTTPS. This may affect how some apps function, but that S stands for Secure. It’s there for a reason. And as always, your friendly neighborhood WISP is here to help.

Delta Electronics Patches Serious Flaws in Industrial Networking Devices

Home › ICS/OT Delta Electronics Patches Serious Flaws in Industrial Networking Devices By Eduard Kovacs on November 30, 2022 Tweet Taiwan-based Delta Electronics has patched potentially serious vulnerabilities in two of its industrial networking products. The flaws were identified by researchers at CyberDanube, a new industrial cybersecurity company based in Austria, in Delta’s DX-2100-L1-CN 3G…