XSS and bypassing an Imperva WAF with JSFuck
Its grumpy admin here! OMG – so tired, lots of things have been happening and going on in my world – My CISSP endorsement came through, so now apparently I’m a cyber-security professional… never mind… it feels good to be part of club! ha ha ha not really, we all know it’s a HRFirewall bypass qualification really, but it good ammo to ask for a pay rise maybe!
Grumpy admin is now also a MBCS, a professional member of the British Computer Society. There is a madness to all these things I assure you, my employer needs these things for a customer… but that a story for another day – but seriously if you hate yourself and want to punish yourself for the way you treat your poor suspecting users on your systems. Go study and sit the CISSP exam! Your pray to do a shift on the hell desk halfway through the exam! I know I did!
It’s been very busy at work also, with projects and study and just daily work, you know when you WSUS server goes crazy cause some muppet (might of been me) added Windows 10 products to WSUS and gobbled up an extra 400GB of space and filled the SAN up! Make sure you check the right boxes people!!! Hyper-V doesn’t really like runnistng out of space and kind of kills your production system!
With my time being used up, I have not really invested much time in to my labs or building a deployment lab or anything but I really wanted to get a POC for my boss done and perhaps move it to production. To do this I need to deploy some Nano server images and as you do I discovered a tool from Microsoft.
Now it’s quite easy to build you Nano Server images with PowerShell! There a script in the root of the windows 2016 media folder under the Nano Server folder with a script, lots of documentation and tutorials and YouTube content on this.
The tool I discovered from Microsoft was released in October, and I don’t know how I missed it, released a useful tool for the tool box.
The tool is called Nano Server Image Builder and you can find it here!
Grumpy Admin Being Grumpy Admin, I thought I would download it and give bash! Might save me some key strokes… and all good learning right?
I download and install, nothing special about that we all installed MSI’s before 🙂 Looks like a normal program – excellent!
I launch the program, Dam it – it actually does require the ADK to be installed! But lucky it provides a link to the download the ADK – make sure you select the right bits to install don’t want to waste your HDD space!
Some more installing and little bit downloading later the ADK is installed and the work internet connection is so fast there hardly any time to get coffee while downloading 4 gigs odd of data off the web L.
However, I can now launch my new shiny Nano Server Image Builder tool and learn to master it! Another string to the bow right?
It has the same feeling as the standard Server Manager Wizards we had for the last 4/5 years – so the same UI guidelines are being applied I like standards and thank god it isn’t a title based store app! I like the look actually and feel of it, fits in with GUI elements of Windows Server nicely…. but to be fair we really should be doing this in PowerShell right or though Chef, puppet or DSC or some other cookbooking method! – At the crunch of it I bet my bottom dollar it calls PowerShell under the hood like other wizards 🙂
So the first screen it’s simple, I want to create a new Nano Server image – USB is for wimps, as they life too short to unplug USB safely!
I click through the basic wizard where I have to select the correct media folder. I mounted the ISO image for Windows Server 2016 and used that as the source, but you can put it on a share or local drive – But the tool is it quite insistent on looking for a folder called NanoServer so the file/folder structure needs to be the same as on the media disk!
Then you come to the license terms – A key point to know is you need Software Assurance to deploy Nano Server in production etc another thing is – very odd that his isn’t before the create new image as the first item in the wizard! Look at Grumpy Admin being all licence compliant!!!
Next you can determine your deployment type – Virtual Machine Image is the one for us. Here we can give the HDD a size… From this you can tell that it will generate a dynamic disc, where you can choose the vhd or vhdx formats, again remember if you going for GEN2 VM you will have to have a VHDX file!
For the key differences in deciding what format you want your Virtual Disc, look at this
Then we move on to the basic configuration of this soon be alive Nano Server VHD
This screen is where we can choose the packages that we want to include in our Nano Server image! We can also select the edition of Nano Server we want to deploy! Standard or Datacentre
The next wizard screen, allows us to install any custom drivers we may need! This feels like the Windows Deployment tools, but seems simpler to use! To me this is an easier way of doing it!
Then I need to provide the build too with some standard information such as the machine name and admin password.
The next screen in the wizard allows me to domain join the machine if I wanted too, either directly using a pre-staged computer account or via a domain blob file…. As I build the nano image on a domain joined machine it prepopulates the domain name… but I’m going to skip over this step I don’t want to domain join the machine!
This next screen I think is the best screen is the ability to set your networking options for the Nano Server in advance – at this stage having not looked at the tool it’s clear that it will create a basic unattend.xml file from this information. Easier using the GUI then doing manually! How sad is it that Grumpy Admin can actually work out how a tool work under the hood by watching it!
Then we can either do some advance configurations or we can just hit the option to just create the basic Nano server image! AKA skip to the end of the wizard and bypass the Advance Configuration settings.
In the advance options you can set things like the debug options, a brilliant thing in the advance options is the ability to add other files into the image… say the content of www folder in IIS?
I hit the create button and wait for my Nano VHD to cook!
You will note that it shows the PowerShell for creating the VHD file – but the other options are not there… clearly showing there has to be an unattend.xml somewhere.
if we check the logs you can clearly see there was a temp unattend.xml created and applied using DISM…
Now I have the VHD we can go ahead and create the VM, I could use the Hyper-V manager and point the new VM’s HDD at our VHD or we could use the New-VM Cmdlet. I will spare the egg sucking! We all created machine before right!
So here is the proof, our VM created with the builder and running and it’s only got 128MB RAM because Grumpy Admin doesn’t generous at this time!