Blind Exploitation

There may be cases where even the previous option would not work, and we would not have any way to inject the command output into the HTTP response. In such cases, we would have two last options: sleep timers and boolean output.

The technique of blindly obtaining text through sleep timers is based on a simple idea: if the first character is X, then sleep for 1 second; otherwise, don't sleep. So, we can send multiple requests iterating over the entire ASCII charset, and whenever there is a delay in the response, we will know that we have hit the correct character.

The same idea is used for boolean output, but instead of sleeping, we would slightly change something in the request, like controlling whether an error message would show or controlling the HTTP response code (e.g. 200 or 403). Since we are going with the premise that we cannot inject command outputs into the HTTP response, we will also assume this is impossible.

Sleep Timers

You may think that since we can execute any JavaScript code, it may be best to use JavaScript to cause a delay, such as using the setTimeout function. However, this may not always work, as NodeJS servers often process requests asynchronously, so we would get a response immediately, even if part of the injected code is still processing. This may not always be the case, so it is worth testing and validating this claim.

Luckily, we already have system command execution, so we don't need to rely on JavaScript code and can simply use system commands to cause a delay. The advantage here is that the execSync function waits for the command to finish processing, so a system sleep should cause a delay in the response.

Our backend runs on linux, so we can use a sleep 2 command for 2 seconds delay. Let's try sending a request with this command and see if we get a delay in the HTTP response. To measure the time our request takes, we will add the time command before our curl command, as follows:

[!bash!]$ time curl -s -X POST -H "Content-Type: application/json" -H "Authorization: bearer eyJhbGciOiJIUz...SNIP...1YLEvDs4SR7RHfQ" -d "{ \"text\": \"'}) + require('child_process').execSync('sleep 2')//\" }" http://localhost:5000/api/service/generate

{"message":"Could not generate QR code."}curl -s -X POST -H "Content-Type: application/json" -H  -d    0.00s user 0.01s system 0% cpu 2.035 total

As we can see, the command took exactly 2.035 seconds, which matches the sleep timer duration we specified. We can try changing this to 3 or 5, and we would get similar delays. This means that we have a way to delay the response, which we should be able to use to blindly obtain the command output.

Reading Output through Sleep

We need to read the first character in the command output and compare it against each ASCII charset. Then, we must repeat this for all other characters in the command output until no match is found, indicating the output's end.

If we were relying on JavaScript code, we could do so with the following code:

require("child_process").execSync("ls").toString()[0] == "a"
  ? new Promise((resolve) => setTimeout(resolve, 2000))
  : null;

This may work and need some tinkering to avoid breaking the eval function and any other code. Luckily, we already have command execution, so we can rely on the bash command for sleep as we did before and do not need to write a lot of JavaScript code to get it working. If we did not have command execution and were trying to read the content of a local file, we would need to rely on JavaScript, as shown above.

So, we need a one-line bash command that executes our specified command, reads the first character, compares it to a. If it matches, then sleep for 2 seconds, if not, do nothing. Let's copy this entire sentence and ask AI to write this bash code for us:

As we can see, GitHub Copilot gave us this command:

command | head -c 1 | { read c; if [ "$c" = "a" ]; then sleep 2; fi; }

Excellent! This saves us a lot of online searching. Let's test this in our payload while ensuring that we escape any characters that may break the JSON body or the JavaScript code. We will replace command with ls:

{
  "text": "'}) + require('child_process').execSync('ls | head -c 1 | { read c; if [ \"$c\" = \"a\" ]; then sleep 2; fi; }')//"
}

If we send the above payload, we get an immediate response. However, if we replace a with the actual first character in the command output, which is n from node_modules as we saw in the previous section, we do indeed get a delay of 2 seconds.

Then, we can move to the next character and try to find its value. But, if we change head -c 1 to head -c 2, then it would return the first 2 characters. So, we would either need to append the first identified character, or use tail to only capture the last character, so we would always be reading 1 character, as follows:

{
  "text": "'}) + require('child_process').execSync('ls | head -c 2 | tail -c 1 |  { read c; if [ \"$c\" = \"a\" ]; then sleep 2; fi; }')//"
}

This way, we can keep modifying the number after head, and it would act as the index of the character we are currently testing. Obviously, this is not feasible to be done manually character by character, as it would take forever to finish. Furthermore, using curl at this point becomes too difficult for the amount of character escapes we need to add. So, try to write a script to automate all of this and be able to execute any command and read its output.