Looting the Symfony Profjler with EOS Pass The Salt 2020 Matthieu - - PowerPoint PPT Presentation

▶
looting the symfony profjler with eos
SMART_READER_LITE
LIVE PREVIEW

Looting the Symfony Profjler with EOS Pass The Salt 2020 Matthieu - - PowerPoint PPT Presentation

Jan 21, 2024 926 likes •1.17k views

Looting the Symfony Profjler with EOS Pass The Salt 2020 Matthieu Barjole (@__aevy__) Synacktiv French IT security company Focus on offensive security 3 teams Paris Rennes Pentest Reverse engineering Lyon

slide-1
SLIDE 1

Matthieu Barjole (@__aevy__)

Looting the Symfony Profjler with EOS

Pass The Salt 2020

slide-2
SLIDE 2

2 / 22

Synacktiv

 French IT security company

Focus on offensive security

3 teams

Pentest

Reverse engineering

Development

Remote friendly !

apply@synacktiv.com

Paris Rennes Lyon Toulouse

slide-3
SLIDE 3

3 / 22

Context

popular PHP framework for web applications

Debug features exposed during assessments: web profjler

Wanna loot

Wanna automate

slide-4
SLIDE 4

4 / 22

Context > Disclaimer

Not a Symfony vulnerability

The profjler is a powerful development tool that gives detailed information about the execution of any request. Never enable the profjler in production environments as it will lead to major security vulnerabilities in your project.

" "

slide-5
SLIDE 5

5 / 22

Loot > Profjler

Version dependent Kernel instantiation

web/app.php + web/app_dev.php

public/index.php

slide-6
SLIDE 6

6 / 22

Loot > Profjler Toolbar

slide-7
SLIDE 7

7 / 22

Loot > Phpinfo

slide-8
SLIDE 8

8 / 22

Loot > Requests > Routes

slide-9
SLIDE 9

9 / 22

Loot > Requests > Credentials

slide-10
SLIDE 10

10 / 22

Loot > Requests > Remember Me Cookies

protected function generateCookieHash(string $class, string $username, int $expires, string $password) { return hash_hmac( 'sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER. $expires.self::COOKIE_DELIMITER.$password, $this->getSecret()); }

Not enabled by default

slide-11
SLIDE 11

11 / 22

Loot > Requests > Remember Me Cookies

base64(hmac("App\\Entity\\User:amFuZV9hZG1pbg==:1620664267:c05a2...e9b8b"))

slide-12
SLIDE 12

12 / 22

Loot > Files

slide-13
SLIDE 13

13 / 22

Loot > Files > Confjg

slide-14
SLIDE 14

14 / 22

Loot > Files > Source code

No directory listing

Only previously hit code paths appear on the Profjler

→ Cache fjles

slide-15
SLIDE 15

15 / 22

Loot > Files > Source code

var/cache/%env%/%filename%.xml

 env: deployed environment, probably dev  filename: Kernel cache container fjle name

slide-16
SLIDE 16

16 / 22

Loot > Files > Source code

2.0 – 4.1 : srcDevDebugProjectContainer.xml

4.2 – 4.4 : srcApp_KernelDevDebugContainer.xml

5.0 – 5.x : App_KernelDevDebugContainer.xml

slide-17
SLIDE 17

17 / 22

Loot > Files > Source code

slide-18
SLIDE 18

18 / 22

Automate

slide-19
SLIDE 19

19 / 22

Automate

slide-20
SLIDE 20

20 / 22

Demo target

slide-21
SLIDE 21

21 / 22

Conclusion

Basic tasks but now automated :)

Do not expose debug features in prod :(

slide-22
SLIDE 22

Thanks for your attention !

QUESTIONS ?