inosec2 / vulnerablesamlapp Goto Github PK

Vulnerable SAML infrastructure.

A high level getting started guide is below, if you would like a more detailed guide, that covers the app, features, settings, and walkthroughs please check out:

• Application Overview and Walkthrough
• SAML Refresher

The purpose of these applications is to showcase how certain vulnerable configurations can be exploited to allow a user to change there permissions, name, etc. within an application. OneLogins python SAML library was utilized for this. In order for some of these vulnerable configurations to work the library was heavily modified.

This configuration contains two docker images. The vulnerableidp is an identity provider. It contains a 'database' with a few different users.

To spin up these docker images is fairly easy. Just run:

docker-compose up

The images will build and then the web application will be hosted at http://127.0.0.1:8000

To login as an unpriviledged user:

Username: yogi
Password: bear

Admin user:

Username: admin
Password: this-is-the-administrator-pasword-oh-no-is-that-a-typo-in-password

User accout for CVE2017-11427

Username: brubble
Password: password

Instructor user that can adjust security levels:

Username: instructor
Password: G0od-LuckGu3ssingThisButHeyItCouldHappenRight?

To upgrade privileges after logging in as the 'yogi' user change the group membership in the SAML message from 'users' to 'admin'

If you'd like to change the user accounts, or the groups around edit the vulnerableidp/authsources.php file. All user accounts are statically assigned and created within that file.

Want to set this up on seperate servers or point to an address that isn't localhost? A couple of changes need to be made before you build the images first. The easiest thing to do is to run the configure_platform.py as a privileged user and follow the prompts for each of the hosts. If you allow it to run privileged the script will edit the configuration files for you, build the docker images, and launched them for you.

File: VulnerableSAMLApp/vulnerableidp/saml20-sp-remote.php

Change:

Replace every instance of '127.0.0.1:8000' with the ip of the host hosting the web application.

Lets build the Docker image:

sudo docker build -t idp:1.0 .

Run the container:

sudo docker run -it --rm --name idp -d -p 80:80 idp:1.0

Confirm container is running:

sudo docker ps

Output should have something similar to this:

189adee1b091  localhost/idp:1.0  apache2ctl -D FOR...  2 seconds ago  Up 2 seconds ago  0.0.0.0:80->80/tcp  idp

Confirm idp is listening:

curl http://127.0.0.1

File: VulnerableSAMLApp/vulnerablesp/yogiSP/saml/settings.json

Change:

In the settings.json file within the SP section replace the '127.0.0.1:8000' with your web applications ip.
Within the IDP section you'll also need to replace the '127.0.0.1' address with the address of the IDP server.

Lets build the Docker image:

sudo docker build -t sp:1.0 .

Run the container:

sudo docker run -it --rm --name sp -d -p 8000:8000 sp:1.0

Confirm container is running:

sudo docker ps

Output should be similar to this:

94476aee1abf    sp:1.1    "uwsgi --ini vulnsp.…"   4 minutes ago    Up 4 minutes    0.0.0.0:8000->8000/tcp    sp

Confirm web application is listening:

curl http://127.0.0.1

You should now be able to access the web application on port 8000 and authenticate through the IDP on port 80. Make sure that you have access to both hosts.

Before building the container edit the /vulnerablesp/yogiSP/saml/advanced_settings.json file.

Set values to True that you want to have loaded when the application runs. Once these settings are in, build the image and run it.

• Open User registration
• Config script to make app more portable
• Implement vulnerabilities to allow XSW attacks
• Implement patch for cve-2017-11427 so that the vulnerability can be turned on/off

Shout out to E.D. for initial dockerization of the idp.