{"id":317,"date":"2019-01-17T06:12:58","date_gmt":"2019-01-17T06:12:58","guid":{"rendered":"https:\/\/mrjsec.co.uk\/blog\/?p=317"},"modified":"2019-01-17T06:13:04","modified_gmt":"2019-01-17T06:13:04","slug":"objective-7-hr-incident-response","status":"publish","type":"post","link":"https:\/\/mrjsec.co.uk\/blog\/objective-7-hr-incident-response\/","title":{"rendered":"
Objective 7: HR Incident Response<\/center>"},"content":{"rendered":"\n

“Santa uses an Elf Resources website to look for talented information security professionals. Gain access to the website and fetch the document C:\\candidate_evaluation.docx. Which terrorist organisation is secretly supported by the job applicant whose name begins with “K.” For hints on achieving this objective, please visit Sparkle Redberry and help her with the Dev Ops Fail Cranberry Pi terminal challenge.”<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

In this one we need to grab a file called candidate_evaluation.docx, sounds pretty simple. However, is it?<\/p>\n\n\n\n

If we have completed the Dev Ops Fail Cranberry Pi terminal challenge by Sparkle Redberry, and speak to them again, we get a hint which is.
\n“Oh my golly gracious – Tangle was right? Was it still in there? How embarrassing!
\nWell, if I can try to redeem myself a bit, let me tell you about another challenge you can help us.
\nI wonder if Tangle Coalbox has taken a good look at his employee’s import system.
\nIt takes CSV files as imports. That certainly can expedite a process, but there’s a danger to be had.
\nI’ll bet, with the right malicious input, some naughty actor could exploit a vulnerability there.
\nI’m sure the danger can be mitigated. OWASP has guidance on what not to allow with such uploads.”<\/p>\n\n\n\n

Also, a hint link.<\/a><\/p>\n\n\n\n

Going to https:\/\/careers.kringlecastle.com\/ were asked to enter some information and upload a CSV of our past work history,
\nI left all the information blank and uploaded a CSV with only the words “test” in it.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Also, we get a thank you message, and once again it hints where the file is “what a little tease”.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

I wonder what happens if we try and find the file using the URL https:\/\/careers.kringlecastle.com\/Book1.csv and we get a 404 not found page\u2026 Again it teases us about where the data is!<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

We’ll let’s boot up Burp and see what we can play with here, I upload the file again, and this is what I see in Burp.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Interesting, I can see the text “test” which is the only text I have within my CSV, so let’s look into CSV Injection. (You can find links, as well as a Video from Kringlecon)<\/p>\n\n\n\n

At first, I was thinking of doing it with a shell and downloading the file\u2026 However, then I would need to open ports and do other such stuff, So its more comfortable to copy<\/a> the file.
<\/p>\n\n\n\n

We know where the public folder is, as the 404 shows it!
\nSo let’s create the corrupt CSV file! (In this case, I use the same file, CSV with the word “test” in it, edit this in the burp.
\nLike so<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n
=cmd|' \/C copy C:\\candidate_evaluation.docx C:\\careerportal\\resources\\public\\swaglife.docx'!A1<\/code><\/pre>\n\n\n\n
Also, there was much chat going on about PowerShell not working; I can confirm PowerShell is working and enabled, so you could also use this command.<\/p>\n\n\n\n
=cmd|' \/C powershell copy C:\\candidate_evaluation.docx C:\\careerportal\\resources\\public\\swaglife.docx'!A1<\/code><\/pre>\n\n\n\n
(Both work!)<\/p>\n\n\n\n
Run the command and let’s go the URL, https:\/\/careers.kringlecastle.com\/public\/swaglife.docx
so here is our file<\/a>.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Now we need to find which terrorist organisation secretly supported by the job applicant whose name begins with “K.”\u2026 So it looks like that is Krampus, so the answer is Fancy Beaver!<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Moreover, that’s it, another challenge down.<\/p>\n\n\n\n
References:
\nhttps:\/\/www.exploit-db.com\/exploits\/45234
\nhttp:\/\/www.tothenew.com\/blog\/csv-injection\/
\nhttps:\/\/www.owasp.org\/index.php\/CSV_Injection
\nhttps:\/\/payatu.com\/csv-injection-basic-to-exploit\/
\nhttps:\/\/blog.zsec.uk\/csv-dangers-mitigations\/
\nhttps:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\/tree\/master\/CSV%20injection
\nhttps:\/\/www.youtube.com\/watch?v=Z3qpcKVv2Bg<\/p>\n","protected":false},"excerpt":{"rendered":"
“Santa uses an Elf Resources website to look for talented information security professionals. Gain access to the website and fetch the document C:\\candidate_evaluation.docx. Which terrorist organisation is secretly supported by the job applicant whose name…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[10],"tags":[13,14,12],"class_list":["post-317","post","type-post","status-publish","format-standard","hentry","category-kringlecon-2018","tag-13","tag-ctf","tag-kringlecon"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paD3U6-57","_links":{"self":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=317"}],"version-history":[{"count":4,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/317\/revisions"}],"predecessor-version":[{"id":331,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/317\/revisions\/331"}],"wp:attachment":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}