HTB Business CTF 2024 - Solving the Watersnake challenge by Ippsec

This video demonstrates how to exploit the "Water Snake" CTF challenge, which utilizes a SnakeYAML deserialization vulnerability in a Spring Boot application to achieve Remote Code Execution (RCE) and retrieve the flag 0:00.

Key Takeaways:
• Initial analysis identifies a YAML submission point on the "firmware update" page, suggesting a potential deserialization attack vector 1:22
• Source code review reveals a gadget chain where the getWaterLevel function triggers a ProcessBuilder to execute arbitrary shell commands 4:50
• The exploit is verified by sending a YAML payload to execute a sleep command, followed by using curl to exfiltrate the flag file to an external server 11:30
• If outbound connections are blocked, an alternative approach involves copying the flag to the web directory to retrieve it locally via HTTP 14:24
• The presenter concludes by loading a custom JAR file via URLClassLoader to establish a reverse shell, demonstrating a more advanced exploitation technique 18:29

The walkthrough highlights the importance of analyzing source code for gadget chains and adapting exploitation methods to bypass network restrictions.

Sources:

• 0:00 Introduction to the Water Snake challenge
• 1:22 Identifying the YAML firmware update input
• 4:50 Analyzing the getWaterLevel gadget chain
• 11:30 Exploiting deserialization to exfiltrate the flag
• 14:24 Copying flag to web direc