Node.js Deserialization
0 likes1,606 views
This document discusses node.js deserialization and exploitation examples. It provides an overview of node.js as server-side JavaScript. Deserialization is converting an object from a byte stream back into memory. The document demonstrates two exploitation examples, the first using an unprotected API and the second targeting node.js deserialization. It recommends input sanitization and blocking/replacing methods as remediation techniques.
Node.js Deserialization
- 2. About me Security Analyst at Net-Square Khushal Suthar Twitter: @Khus369 Linkedin: /khus369
- 3. Objectives What is node.js. What is deserialization. Exploitation example 1. Exploit - 1 unprotected api 2. Exploit - 2 nodejs Remediation
- 4. In Simple words Node js is “Server-side JavaScript”
- 5. What is deserialization Serialization is a mechanism of converting the state of an object into a byte stream. Deserialization is the reverse process where the byte stream is used to recreate the actual object in memory
- 6. Exploit - 1 Unprotected API Show data Send GET request for retrieved save serialized data Create data Send POST request with json data for serialization.
- 7. Payload Create ● arbitrary code execution should occur when untrusted input is passed into unserialize() function. The best way to create a payload is to use the serialize() function of the same module.
- 8. Payload Create I created the following JavaScript object and passed it to serialize() function. Which gives the following output.
- 9. Send normal API request, intercept the request.
- 11. Add the command
- 12. And get the response
- 13. Example - 2 Node.js deserialization
- 14. Payload Create
- 15. Load the website
- 17. Decode cookie
- 18. Encode payload in base64
- 19. Cookie replaced by payload
- 20. Get the nc connection
- 21. Remediation ● Properly sanitize the input data ○ Use block and replace method Vulnerable Code
- 22. References ● https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-r emote-code-execution/ ● https://hd7exploit.wordpress.com/2017/05/29/exploiting-node-js-deserialization-bug-for-remote-code-ex ecution-cve-2017-5941/ ● https://github.com/hoainam1989/training-application-security/blob/master/shell/node_shell.py
- 23. Questions
- 24. Thank You!