Werkzeug / Flask Debug
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Instantly available setup for vulnerability assessment & penetration testing. Run a full pentest from anywhere with 20+ tools & features that go from recon to reporting. We don't replace pentesters - we develop custom tools, detection & exploitation modules to give them back some time to dig deeper, pop shells, and have fun.
Console RCE
If debug is active you could try to access to /console
and gain RCE.
There is also several exploits on the internet like this or one in metasploit.
Pin Protected - Path Traversal
In some occasions the /console
endpoint is going to be protected by a pin. If you have a file traversal vulnerability, you can leak all the necessary info to generate that pin.
Werkzeug Console PIN Exploit
Force a debug error page in the app to see this:
A message regarding the "console locked" scenario is encountered when attempting to access Werkzeug's debug interface, indicating a requirement for a PIN to unlock the console. The suggestion is made to exploit the console PIN by analyzing the PIN generation algorithm in Werkzeug’s debug initialization file (__init__.py
). The PIN generation mechanism can be studied from the Werkzeug source code repository, though it is advised to procure the actual server code via a file traversal vulnerability due to potential version discrepancies.
To exploit the console PIN, two sets of variables, probably_public_bits
and private_bits
, are needed:
probably_public_bits
probably_public_bits
username
: Refers to the user who initiated the Flask session.modname
: Typically designated asflask.app
.getattr(app, '__name__', getattr(app.__class__, '__name__'))
: Generally resolves to Flask.getattr(mod, '__file__', None)
: Represents the full path toapp.py
within the Flask directory (e.g.,/usr/local/lib/python3.5/dist-packages/flask/app.py
). Ifapp.py
is not applicable, tryapp.pyc
.
private_bits
private_bits
uuid.getnode()
: Fetches the MAC address of the current machine, withstr(uuid.getnode())
translating it into a decimal format.To determine the server's MAC address, one must identify the active network interface used by the app (e.g.,
ens3
). In cases of uncertainty, leak/proc/net/arp
to find the device ID, then extract the MAC address from/sys/class/net/<device id>/address
.Conversion of a hexadecimal MAC address to decimal can be performed as shown below:
get_machine_id()
: Concatenates data from/etc/machine-id
or/proc/sys/kernel/random/boot_id
with the first line of/proc/self/cgroup
post the last slash (/
).
Upon collating all necessary data, the exploit script can be executed to generate the Werkzeug console PIN:
Upon collating all necessary data, the exploit script can be executed to generate the Werkzeug console PIN. The script uses the assembled probably_public_bits
and private_bits
to create a hash, which then undergoes further processing to produce the final PIN. Below is the Python code for executing this process:
This script produces the PIN by hashing the concatenated bits, adding specific salts (cookiesalt
and pinsalt
), and formatting the output. It's important to note that the actual values for probably_public_bits
and private_bits
need to be accurately obtained from the target system to ensure the generated PIN matches the one expected by the Werkzeug console.
If you are on an old version of Werkzeug, try changing the hashing algorithm to md5 instead of sha1.
Werkzeug Unicode chars
As observed in this issue, Werkzeug doesn't close a request with Unicode characters in headers. And as explained in this writeup, this might cause a CL.0 Request Smuggling vulnerability.
This is because, In Werkzeug it's possible to send some Unicode characters and it will make the server break. However, if the HTTP connection was created with the header Connection: keep-alive
, the body of the request won’t be read and the connection will still be open, so the body of the request will be treated as the next HTTP request.
Automated Exploitation
References
Instantly available setup for vulnerability assessment & penetration testing. Run a full pentest from anywhere with 20+ tools & features that go from recon to reporting. We don't replace pentesters - we develop custom tools, detection & exploitation modules to give them back some time to dig deeper, pop shells, and have fun.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated