Node.Js Deserialization Attack

Steps of this attack

1. We need to capture the GET request of the Nodejs Vulnerable IP with the help of one of the most popular proxy intercepting tool i.e. Burp Suite.

2. Simply select the cookie value and send it to Decoder tab for further decryption.

3. The vulnerability in our vulnerable web application is that it reads a cookie named profile from the HTTP request, perform base64 decode of the cookie value and pass it to unserialize() function. As cookie is an untrusted input, an attacker can craft malicious cookie value to exploit this vulnerability.

4. Now we need to generate the output of final reverse shell payload.

5. With a simple javascript code we can generate the serialized payload.

6. Save the file as exploit.js and run with node command which generates the final serialized payload.

7. Go back to Burp Suite and navigate to Decoder tab and paste the output code into Text area and before to decode, add the IIFE brackets () after function body as shown below:
Here, we need to perform Base64 encode of the same, and then make a request to the web server with encoded payload in the Cookie header value.

8. Now to make a request, you need to send the same request to Repeater Tab.

9. In Repeater Tab, you need to replace the cookie value with base64 encoded value which we generated from above step and then click on GO button.
And side by side, make sure that your netcat service is listening on same port i.e. 4443 (it’s the same port for reverse shell payload)

10. As soon as you click on Go button, the request will hit to server which shows 200 OK response with some error message “An error occurred…invalid username type” and instantly you’ll get connected with that server in netcat terminal with status “Connected“.