* Update Wasdat to week05 level if needed. Example flow in `was-students` directory:
*`docker-compose down -v` # removes volumes (test data you created will be removed)
*`git pull`
*`docker-compose up --force-recreate`
* Force refresh the browser (CTRL+Shift+R or CTRL+F5) if needed
* Note: WasDat gives a lot of HTTP 422 Unprocessable entity when we tested developing the exploit on WasDat (not sure yet why some requests fail). Keep calm, 422's don't prevent exploitation, work your way around :-)
## First part A7:2017 Cross-site scripting (10 pts)
In this week you are dealing with insecure deserialization in practice. The programming language used is Python 3 and the target application is WasDat. WasDat's backend endpoint `/api/import` performs insecure object deserialization allowing attacker to run arbitrary commands on the server remotely. For object deserialization server uses Python's Pickle module documentation of which you may want to read (https://docs.python.org/3/library/pickle.html :). Your job is to exploit the vulnerability in a way that you eventually get reverse shell to the server.
Tasks:
* Pickle (1 pts)
* Find out how Pickle module is used to serialize and deserialize Python objects
* Give some simple example to support your issue report
* Why is it insecure?
* Create Base64 encoded byte stream from Python object initialized from class that implements [__reduce__](https://docs.python.org/3/library/pickle.html#object.__reduce__) method
* Exploit insecure deserialization in WasDat's backend (`/api/import`)
* Find out what methods `/api/import` endpoint offers using `OPTIONS`
* Perform HTTP request with supported method and data created in Pickle section
* Base64 encoded payload (1 pts)
* Get flag WasFlag9_1
* Base64 encoded payload Pickle can deserialize (1 pts)
* Get flag WasFlag9_2
* Take a note of `HINT` response readers if stuck. Also, remember to follow containers log messages for possible errors
* Verify that you are able to run arbitrary command on the target server (2 pts)
* If using command that creates like a new file use `docker exec -it wasdat-backend /bin/bash` to get access to the container to prove its existence
* Remote Code Execution (RCE) for remote shell (2 pts)
* Read notes `About reverse shell creation` first
* Verify that you have active remote connection to `wasdat-backend` container
*`ps aux`
In your report:
* As usual, refer to "Issue report" from Assignment instructions (don't forget mitigation section!)
### About reverse shell creation
You might be able to utilize tools like `netcat` etc. to create reverse shell easily. However, this is not always the case. Sometimes additional tooling is not available on target system and you have to use tools coming preinstalled with the operating system. In containers this is taken even further. Docker's philosophy is that a service running on a container is built from an image size of which is as minimal as possible. This means, that the operating system running on a container should lack of all the functionality and tooling but needed to run the service. Take this as an advice to just not to look `nc` or other familiar tools to create reverse shell when you have created a working RCE exploit. Think above. How I can create a reverse shell just using `Bash` and its functionality?
Working with containers: By default containers usually and in this case opens `sh` instead of `bash`.
For reverse shell listener you can always use the tools you want, since you have the control of the system.
`nc` example: `nc -nvlp 6666`
* listens to incoming TCP in port 6666 and will pick up the target server initiated shell
