XSS and bypassing an Imperva WAF with JSFuck
When you work in IT, no matter what your job title and responsibilities, someone will always bring their home laptop or their child’s laptop and say it’s broken… help! This happened to Grumpy Admin last week and well I was in a charitable mood, so I cleared a bit of space on my desk and had a look at the “broken” laptop.
It was very clear that the HDD was borked and would be better as paper weight than as a persistent storage device. So without replacement hardware, nothing I can do. The individual asked for some advice, so I naturally told him to put an SSD in there and all will be right with the world. I should of expected, and deep down I knew it was coming. Yesterday he returned with the laptop and nice shiny SSD to be fitted.
No problem, whipped out the screw drivers and got the drive replaced…. and now for the Windows installation. You got media right? Oh no… Well the only Win8.1 ISO I had was for the Enterprise SDK. Why the hell would I need the home SDK for Windows 8.1 at work!!!
So I download that ISO from my MSDN account on the company internet at a speedy 340kb/s…. My web browsing was reduced to using 4g on my phone as well it was soooo much faster! So with the ISO downloaded, rather than burn it, it now common practice to stick it on your USB key right?
Now, I grab a spare 8GB stick (as the ISO is like 4.6gb Win8.1 64x with updates). Then comes the great fun of making a USB boot/drive installation media.
There are a few way, to do this – two main ways are either to use the command line, or third is a GUI tools like this one from Microsoft.
This tool is a real simple method, and is great and easy. But it is only a front end tool. If you really want to see how it works, they even provide the C# source code for the tool. wudtsource.zip. So if you really wanted too, you could modify and recompile the application with your own branding for internal use and bragging rights! The code is released under the GPL as it uses some GPL code for the ISO stuff, so you would have ship your updated tools source as well like MS did. Took me two mins and Visual Studio to “rebrand” their tool just to prove the point 🙂 Grumpy Admin has far too much free time! But he isn’t grumpy about it \o/
I am not sure how much different people know about how the install process works on Windows. WIM files and all that good stuff like DISM, apart from making everyone one laugh in the office when you say your playing with DISM…. it a lot easier now vista onwards 🙂 I am sure we will meet DISM futher in blog posts, so for now all I want to do is make a Windows 8.1 bootable usb installer stick! I find it is a trend in IT that people know they need to run tools, and follow guides to do stuff, but they don’t really understand the base concepts. This makes me Grumpy!
Basically to get this laptop installed, I need a formatted USB stick, with the boot sector on it and then the contents of the ISO. I always say just blank a stick and do it fresh not point worrying about boot sector issues etc. At least you then KNOW what you are going to be booting right… no dirty little GRUB loaders etc…
While having the nice GUI tool works at treat and is very easy, you run, point select and it does it for you 🙂 but what if you can’t download or run such a tool and have to create the USB stick yourself. Dam IT policies – Anyway Grumpy Admin likes to do things by the command line, it wastes more time and makes you look like you know what you are doing… So we are going to use the diskpart tool to achieve our aims 🙂
I launch the Diskpart tool and I need enumerate the drives to confirm – Grumpy Admin hates it when you don’t confirm things that are destructive! Accidents happen but if you don’t take precautions and do thing Willy Nilly then ask me to fix it I get GRUMPY!!!
So to enumerate I issue the following command
Then I have to tell the diskpart tool what disk I want to work on and I do this by using
SELECT DISK 1
Then I get risky and trash it! I CLEAN it up with the CLEAN command
Then I need to start to rebuild it! So I CREATE a Primary Partition on it…. To do that I type the following
CREATE PARTITION PRIMARY
In my screenshots – I did it a keyword at a time so you can see the other options, don’t say Grumpy Admin isn’t nice to you! Now I have a partition on this disk, I need to make it ACTIVE, but before we do that I need to select the dam thing so like before
SELECT PARTITION 1
I type… yes you guessed it… ACTIVE
Now all I have to do is format it! So type….. And be shocked here again…
And then go and make coffee and let it do its thing. Just to prove to you that it is actually formatting, I have a screenshot here of the Disk Management Tool, as you can see it is being formatted! Then you might need to ASSIGN a drive letter – remember this drive letter!
Now EXIT diskpart and mount the ISO image, using whatever method you feel like. Now you need to copy the boot sector, to do this we are going to use the command line tool – Bootsect.exe, so navigate to the \boot folder on the ISO you just mounted and run
bootsect.exe /NT60 G:
Now all you need to do is copy all the files from the ISO to your USB stick and you are golden, you have yourself a bootable USB stick to install Windows from. So I did this and then moved on to installing Windows 8.1 on this guy’s laptop! Easy – As I had recommended he upgrade to an SSD rather than spinning rust, the installation was very speedy!
08:32 – installation started
08:39 – At the Desktop – Windows Activated – Grumpy Admin gives a big thumbs up to OEM UEFI Bios and burnt in Windows Keys, no messing around, choose region and a few other bits and bobs and all is done!
If there wasn’t a better case for spending the cash to upgrade to an SSD, All that was left was to grab the last missing drivers off the Internet and Install the odd driver and then run windows update! Easy, and people think it is some kind of Voodoo magic!
The thing that makes me grump in all of this… it took longer to make the same USB bootable stick, downloading the ISO, Formatting and copying across than it did to install Windows on that laptop! Meh… I getting beer out of this so I don’t really mind…
I am sure, you can do some of these steps in Powershell, and perhaps people would like to comment on the Powershell method. I will no doubt when I get the time, throw it in to the Google Machine and perhaps produce another blog about it in the future!