{
    "id": "da1ef33c-7726-4649-89c9-90c615faead4",
    "name": "Attacking LDAP",
    "slug": "attacking-ldap",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "657cf698-108b-45a3-993c-d8e238ebbfaf",
            "630a470a-1ccf-44eb-8111-8947846b5d78"
        ],
        "pta_sdn": "184",
        "collections": [],
        "pta_namespace": "my.ine",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2022-06-09T17:39:42.219124Z",
    "modified": "2024-12-20T16:47:01.293912Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [],
    "tags": [],
    "difficulty": null,
    "is_web_access": false,
    "is_lab_experience": false,
    "is_featured": false,
    "cve": null,
    "severity": null,
    "year": null,
    "classification": null,
    "is_trackable": false,
    "cpe_credits": null,
    "is_skill_check": false,
    "external_url": "",
    "solution_video": null,
    "explanation_video": null,
    "description": "In this lab, you will learn to perform LDAP injections on a vulnerable application and steal SSH credentials for a user to gain shell access on the target machine.",
    "description_html": "<p>In this lab, you will learn to perform LDAP injections on a vulnerable application and steal SSH credentials for a user to gain shell access on the target machine.</p>",
    "tasks": "# Lab Environment\n\nIn this lab environment, the user will get access to a Kali GUI instance. A [vuLnDAP](https://github.com/digininja/vuLnDAP) instance can be accessed using the tools installed on Kali at http://demo.ine.local.  \n\n**Objective:** Exploit the vulnerable application to perform LDAP injection, retrieve the administrator's SSH credentials, and get the flag from the target machine.  \n\n![0](https://assets.ine.com/content/ptp/attacking_ldap/0.png)\n\n# Instructions\n\nThe vulnerable application can be accessed via the browser on port 9090.  \n\n# Tools\n\nThe best tools for this lab are:\n\n- Nmap\n- ssh\n- A web browser\n\n**Please go ahead ONLY if you have COMPLETED the lab or you are stuck! Checking the solutions before actually trying the concepts and techniques you studied in the course will dramatically reduce the benefits of a hands-on lab!**",
    "tasks_html": "<h1>Lab Environment</h1>\n<p>In this lab environment, the user will get access to a Kali GUI instance. A <a href=\"https://github.com/digininja/vuLnDAP\">vuLnDAP</a> instance can be accessed using the tools installed on Kali at http://demo.ine.local.  </p>\n<p><strong>Objective:</strong> Exploit the vulnerable application to perform LDAP injection, retrieve the administrator's SSH credentials, and get the flag from the target machine.  </p>\n<p><img alt=\"0\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/0.png\" /></p>\n<h1>Instructions</h1>\n<p>The vulnerable application can be accessed via the browser on port 9090.  </p>\n<h1>Tools</h1>\n<p>The best tools for this lab are:</p>\n<ul>\n<li>Nmap</li>\n<li>ssh</li>\n<li>A web browser</li>\n</ul>\n<p><strong>Please go ahead ONLY if you have COMPLETED the lab or you are stuck! Checking the solutions before actually trying the concepts and techniques you studied in the course will dramatically reduce the benefits of a hands-on lab!</strong></p>",
    "published_date": "2020-10-20T15:32:24Z",
    "solutions": "# Solution\n\n**Step 1:** Open the lab link to access the Kali GUI instance.  \n\n![1](https://assets.ine.com/content/ptp/attacking_ldap/1.png)\n\n**Step 2:** Check if the provided machine/domain is reachable.  \n\n**Command:**\n```\nping -c3 demo.ine.local\n```\n\n![2](https://assets.ine.com/content/ptp/attacking_ldap/2.png)\n\nThe provided machine is reachable.  \n\n**Step 3:** Check open ports on the provided machine.\n\n**Command:**\n```\nnmap -p- demo.ine.local\n```\n\n![3](https://assets.ine.com/content/ptp/attacking_ldap/3.png)\n\nPorts 22 (SSH) and 9090 are open on the target machine. As mentioned in the challenge description, the vulnerable web application is available on port 9090.  \n\n**Step 4:** Check the web application available on port 9090.  \n\nOpen the following URL in the browser:  \n\n**URL:** http://demo.ine.local:9090  \n\n![4](https://assets.ine.com/content/ptp/attacking_ldap/4.png)\n\nA [vuLnDAP](https://github.com/digininja/vuLnDAP) instance is present on the target machine.  \n\n**Step 5:** Explore the web application.  \n\nClick on the **Stock Control** link:  \n\n![5](https://assets.ine.com/content/ptp/attacking_ldap/5.png)\n\nSelect the **Fruit** category:  \n\n![5_1](https://assets.ine.com/content/ptp/attacking_ldap/5_1.png)\n\nNotice the URL:  \n\n![5_2](https://assets.ine.com/content/ptp/attacking_ldap/5_2.png)\n\nThe value **fruits** is reflected in the **objectClass** parameter.  \n\n# Exploiting LDAP injection vulnerability in the web application.  \n\n**Step 6:** Perform LDAP injection.  \n\nSet the value `*` in the **objectClass** parameter:  \n\n**Note:** `*` is a special character that would end up returning all the `objectClass` items.  \n\n![6](https://assets.ine.com/content/ptp/attacking_ldap/6.png)\n\n![6_1](https://assets.ine.com/content/ptp/attacking_ldap/6_1.png)\n\nNotice the output contains the names of the system users as well.  \n\nClick on **More Info** link for the administrator (user david):  \n\n![6_2](https://assets.ine.com/content/ptp/attacking_ldap/6_2.png)\n\nClick **Back**:  \n\n![6_3](https://assets.ine.com/content/ptp/attacking_ldap/6_3.png)\n\nNotice the URL parameter **objectClass** contains the value **posixAccount**.  \n\nThe page contains the list of system users present in the LDAP database.  \n\n**Step 7:** Extract SSH password for user david from the LDAP database.  \n\nClick on **More Info** link for the administrator (user david):  \n\n![7](https://assets.ine.com/content/ptp/attacking_ldap/7.png)\n\nThe resulting page doesn't contain any interesting information:  \n\n![7_1](https://assets.ine.com/content/ptp/attacking_ldap/7_1.png)\n\nCheck the LDAP schema information from the following URL:  \n\n**URL:** https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html  \n\n![7_2](https://assets.ine.com/content/ptp/attacking_ldap/7_2.png)\n\nNotice the **posixaccount** object class. Some of the attributes it contains are:  \n\n- uidNumber\n- gidNumber\n- homedirectory\n- userpassword\n\nOpen the home page of the vulnerable web application:  \n\n**URL:** http://demo.ine.local:9090  \n\n![7_3](https://assets.ine.com/content/ptp/attacking_ldap/7_3.png)\n\nThe admins store the SSH keys in the database.  \n\nSearch for the ssh keys in the posixaccount object class:  \n\n**Search Query:**  \n```\nldap posixaccount ssh keys\n```\n\n![7_4](https://assets.ine.com/content/ptp/attacking_ldap/7_4.png)\n\nCheck the [StackOverflow](https://serverfault.com/questions/653792/ssh-key-authentication-using-ldap) link from the results:  \n\n![7_5](https://assets.ine.com/content/ptp/attacking_ldap/7_5.png)\n\nWe can use the `sshPublicKey` attribute to get the SSH keys.  \n\nUse the following URL to get the uid, gid, home directory, user password, and SSH public key for the user david:  \n\n**URL:** http://demo.ine.local:9090/item?cn=david&disp=uidNumber,gidNumber,homedirectory,userpassword,sshPublicKey  \n\n![7_6](https://assets.ine.com/content/ptp/attacking_ldap/7_6.png)\n\nNotice the `sshPublicKey` returned a password instead of SSH keys. Probably this is the SSH password of the user.  \n\n**Potential SSH password for user david:** r0ck_s0l1d_p4ssw0rd  \n\n**Step 8:** Retrieve the flag from the target machine using the recovered SSH credentials.  \n\nTry connecting to the target machine over SSH using the following credentials:  \n\n**Username:** david  \n**Password:** r0ck_s0l1d_p4ssw0rd  \n\n**Command:**\n```\nssh david@demo.ine.local\n```\n\n![8](https://assets.ine.com/content/ptp/attacking_ldap/8.png)\n\nLogin was successful!  \n\nRetrieve the flag:  \n\n**Commands:**  \n```\nls\ncat flag\n```\n\n![8_1](https://assets.ine.com/content/ptp/attacking_ldap/8_1.png)\n\n**Flag:** 5520dd2d85e5003db92048c629bb5072  \n\nThat was all for LDAP injections!  \n\n# Exploiting XSS vulnerability in the web application.  \n\n**Step 9:** Identify content injection issues in the web application.  \n\nOpen the vulnerable web application:  \n\n**URL:** http://demo.ine.local:9090  \n\nClick on **Stock Control**:  \n\n![9](https://assets.ine.com/content/ptp/attacking_ldap/9.png)\n\nSelect **Fruit** category:  \n\n![9_1](https://assets.ine.com/content/ptp/attacking_ldap/9_1.png)\n\nNotice the value of URL parameter **objectClass** is reflected on the page:  \n\n![9_2](https://assets.ine.com/content/ptp/attacking_ldap/9_2.png)\n\nChange the **objectClass** URL parameter to **more_fruits**:  \n\n![9_3](https://assets.ine.com/content/ptp/attacking_ldap/9_3.png)\n\nAgain, the parameter value is reflected.  \n\n**Inject HTML content on the page:**  \n\nSend the following HTML injection payload in the **objectClass** URL parameter:  \n\n**Payload:**  \n```\n<u>fruits</u>\n```\n\n![9_4](https://assets.ine.com/content/ptp/attacking_ldap/9_4.png)\n\nNotice the specified HTML content is rendered on the page!  \n\nCheck the page source (press `CTRL+SHIFT+U`):  \n\n![9_5](https://assets.ine.com/content/ptp/attacking_ldap/9_5.png)\n\nNotice the URL parameter is reflected on the page without any encoding.  \n\n**Step 10:** Exploit XSS vulnerability on the vulnerable web page.  \n\nEnter the following XSS payload in the **objectClass** parameter:  \n\n**Payload:**  \n```\n<script>alert(1);</script>\n```\n\nThe above payload won't work. Check the page source (`CTRL+SHIFT+U`) to identify the issue:  \n\n![10](https://assets.ine.com/content/ptp/attacking_ldap/10.png)\n\nNotice the content is not reflected as is. The brackets from the payload and the ending script tag are removed.  \n\nEnter the following XSS payload in the **objectClass** parameter:  \n\n**Payload:**  \n```\n<script>alert`1`</script>\n```\n\n![10_1](https://assets.ine.com/content/ptp/attacking_ldap/10_1.png)\n\nThis time the XSS payload worked!  \n\nCheck the page source:  \n\n![10_2](https://assets.ine.com/content/ptp/attacking_ldap/10_2.png)\n\nThis time the XSS payload is reflected in the DOM as is!  \n\nWith that, we conclude this lab on LDAP injection. We have exploited the vulnerable web application and retrieved the SSH credentials of the administrator user, and gained shell access on the target machine. Besides LDAP injection, we also leveraged a reflected XSS vulnerability in the web application.  \n\n\n\n# References\n\n- [vuLnDAP](https://github.com/digininja/vuLnDAP)\n- [LDAP Implementation HOWTO](https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html)",
    "solutions_html": "<h1>Solution</h1>\n<p><strong>Step 1:</strong> Open the lab link to access the Kali GUI instance.  </p>\n<p><img alt=\"1\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/1.png\" /></p>\n<p><strong>Step 2:</strong> Check if the provided machine/domain is reachable.  </p>\n<p><strong>Command:</strong>\n<pre class=\"codehilite\"><code>ping -c3 demo.ine.local</code></pre></p>\n<p><img alt=\"2\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/2.png\" /></p>\n<p>The provided machine is reachable.  </p>\n<p><strong>Step 3:</strong> Check open ports on the provided machine.</p>\n<p><strong>Command:</strong>\n<pre class=\"codehilite\"><code>nmap -p- demo.ine.local</code></pre></p>\n<p><img alt=\"3\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/3.png\" /></p>\n<p>Ports 22 (SSH) and 9090 are open on the target machine. As mentioned in the challenge description, the vulnerable web application is available on port 9090.  </p>\n<p><strong>Step 4:</strong> Check the web application available on port 9090.  </p>\n<p>Open the following URL in the browser:  </p>\n<p><strong>URL:</strong> http://demo.ine.local:9090  </p>\n<p><img alt=\"4\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/4.png\" /></p>\n<p>A <a href=\"https://github.com/digininja/vuLnDAP\">vuLnDAP</a> instance is present on the target machine.  </p>\n<p><strong>Step 5:</strong> Explore the web application.  </p>\n<p>Click on the <strong>Stock Control</strong> link:  </p>\n<p><img alt=\"5\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/5.png\" /></p>\n<p>Select the <strong>Fruit</strong> category:  </p>\n<p><img alt=\"5_1\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/5_1.png\" /></p>\n<p>Notice the URL:  </p>\n<p><img alt=\"5_2\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/5_2.png\" /></p>\n<p>The value <strong>fruits</strong> is reflected in the <strong>objectClass</strong> parameter.  </p>\n<h1>Exploiting LDAP injection vulnerability in the web application.</h1>\n<p><strong>Step 6:</strong> Perform LDAP injection.  </p>\n<p>Set the value <code>*</code> in the <strong>objectClass</strong> parameter:  </p>\n<p><strong>Note:</strong> <code>*</code> is a special character that would end up returning all the <code>objectClass</code> items.  </p>\n<p><img alt=\"6\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/6.png\" /></p>\n<p><img alt=\"6_1\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/6_1.png\" /></p>\n<p>Notice the output contains the names of the system users as well.  </p>\n<p>Click on <strong>More Info</strong> link for the administrator (user david):  </p>\n<p><img alt=\"6_2\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/6_2.png\" /></p>\n<p>Click <strong>Back</strong>:  </p>\n<p><img alt=\"6_3\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/6_3.png\" /></p>\n<p>Notice the URL parameter <strong>objectClass</strong> contains the value <strong>posixAccount</strong>.  </p>\n<p>The page contains the list of system users present in the LDAP database.  </p>\n<p><strong>Step 7:</strong> Extract SSH password for user david from the LDAP database.  </p>\n<p>Click on <strong>More Info</strong> link for the administrator (user david):  </p>\n<p><img alt=\"7\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/7.png\" /></p>\n<p>The resulting page doesn't contain any interesting information:  </p>\n<p><img alt=\"7_1\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/7_1.png\" /></p>\n<p>Check the LDAP schema information from the following URL:  </p>\n<p><strong>URL:</strong> https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html  </p>\n<p><img alt=\"7_2\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/7_2.png\" /></p>\n<p>Notice the <strong>posixaccount</strong> object class. Some of the attributes it contains are:  </p>\n<ul>\n<li>uidNumber</li>\n<li>gidNumber</li>\n<li>homedirectory</li>\n<li>userpassword</li>\n</ul>\n<p>Open the home page of the vulnerable web application:  </p>\n<p><strong>URL:</strong> http://demo.ine.local:9090  </p>\n<p><img alt=\"7_3\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/7_3.png\" /></p>\n<p>The admins store the SSH keys in the database.  </p>\n<p>Search for the ssh keys in the posixaccount object class:  </p>\n<p><strong>Search Query:</strong><br />\n<pre class=\"codehilite\"><code>ldap posixaccount ssh keys</code></pre></p>\n<p><img alt=\"7_4\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/7_4.png\" /></p>\n<p>Check the <a href=\"https://serverfault.com/questions/653792/ssh-key-authentication-using-ldap\">StackOverflow</a> link from the results:  </p>\n<p><img alt=\"7_5\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/7_5.png\" /></p>\n<p>We can use the <code>sshPublicKey</code> attribute to get the SSH keys.  </p>\n<p>Use the following URL to get the uid, gid, home directory, user password, and SSH public key for the user david:  </p>\n<p><strong>URL:</strong> http://demo.ine.local:9090/item?cn=david&amp;disp=uidNumber,gidNumber,homedirectory,userpassword,sshPublicKey  </p>\n<p><img alt=\"7_6\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/7_6.png\" /></p>\n<p>Notice the <code>sshPublicKey</code> returned a password instead of SSH keys. Probably this is the SSH password of the user.  </p>\n<p><strong>Potential SSH password for user david:</strong> r0ck_s0l1d_p4ssw0rd  </p>\n<p><strong>Step 8:</strong> Retrieve the flag from the target machine using the recovered SSH credentials.  </p>\n<p>Try connecting to the target machine over SSH using the following credentials:  </p>\n<p><strong>Username:</strong> david<br />\n<strong>Password:</strong> r0ck_s0l1d_p4ssw0rd  </p>\n<p><strong>Command:</strong>\n<pre class=\"codehilite\"><code>ssh david@demo.ine.local</code></pre></p>\n<p><img alt=\"8\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/8.png\" /></p>\n<p>Login was successful!  </p>\n<p>Retrieve the flag:  </p>\n<p><strong>Commands:</strong><br />\n<pre class=\"codehilite\"><code>ls\ncat flag</code></pre></p>\n<p><img alt=\"8_1\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/8_1.png\" /></p>\n<p><strong>Flag:</strong> 5520dd2d85e5003db92048c629bb5072  </p>\n<p>That was all for LDAP injections!  </p>\n<h1>Exploiting XSS vulnerability in the web application.</h1>\n<p><strong>Step 9:</strong> Identify content injection issues in the web application.  </p>\n<p>Open the vulnerable web application:  </p>\n<p><strong>URL:</strong> http://demo.ine.local:9090  </p>\n<p>Click on <strong>Stock Control</strong>:  </p>\n<p><img alt=\"9\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/9.png\" /></p>\n<p>Select <strong>Fruit</strong> category:  </p>\n<p><img alt=\"9_1\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/9_1.png\" /></p>\n<p>Notice the value of URL parameter <strong>objectClass</strong> is reflected on the page:  </p>\n<p><img alt=\"9_2\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/9_2.png\" /></p>\n<p>Change the <strong>objectClass</strong> URL parameter to <strong>more_fruits</strong>:  </p>\n<p><img alt=\"9_3\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/9_3.png\" /></p>\n<p>Again, the parameter value is reflected.  </p>\n<p><strong>Inject HTML content on the page:</strong>  </p>\n<p>Send the following HTML injection payload in the <strong>objectClass</strong> URL parameter:  </p>\n<p><strong>Payload:</strong><br />\n<pre class=\"codehilite\"><code>&lt;u&gt;fruits&lt;/u&gt;</code></pre></p>\n<p><img alt=\"9_4\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/9_4.png\" /></p>\n<p>Notice the specified HTML content is rendered on the page!  </p>\n<p>Check the page source (press <code>CTRL+SHIFT+U</code>):  </p>\n<p><img alt=\"9_5\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/9_5.png\" /></p>\n<p>Notice the URL parameter is reflected on the page without any encoding.  </p>\n<p><strong>Step 10:</strong> Exploit XSS vulnerability on the vulnerable web page.  </p>\n<p>Enter the following XSS payload in the <strong>objectClass</strong> parameter:  </p>\n<p><strong>Payload:</strong><br />\n<pre class=\"codehilite\"><code>&lt;script&gt;alert(1);&lt;/script&gt;</code></pre></p>\n<p>The above payload won't work. Check the page source (<code>CTRL+SHIFT+U</code>) to identify the issue:  </p>\n<p><img alt=\"10\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/10.png\" /></p>\n<p>Notice the content is not reflected as is. The brackets from the payload and the ending script tag are removed.  </p>\n<p>Enter the following XSS payload in the <strong>objectClass</strong> parameter:  </p>\n<p><strong>Payload:</strong><br />\n<pre class=\"codehilite\"><code>&lt;script&gt;alert`1`&lt;/script&gt;</code></pre></p>\n<p><img alt=\"10_1\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/10_1.png\" /></p>\n<p>This time the XSS payload worked!  </p>\n<p>Check the page source:  </p>\n<p><img alt=\"10_2\" src=\"https://assets.ine.com/content/ptp/attacking_ldap/10_2.png\" /></p>\n<p>This time the XSS payload is reflected in the DOM as is!  </p>\n<p>With that, we conclude this lab on LDAP injection. We have exploited the vulnerable web application and retrieved the SSH credentials of the administrator user, and gained shell access on the target machine. Besides LDAP injection, we also leveraged a reflected XSS vulnerability in the web application.  </p>\n<h1>References</h1>\n<ul>\n<li><a href=\"https://github.com/digininja/vuLnDAP\">vuLnDAP</a></li>\n<li><a href=\"https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html\">LDAP Implementation HOWTO</a></li>\n</ul>",
    "flags": [],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": null
}