GitHub
github.com › wdahlenburg › werkzeug-debug-console-bypass
GitHub - wdahlenburg/werkzeug-debug-console-bypass: Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. · GitHub
The Werkzeug documentation warns users to never enable the debug console in production with or without a pin (https://werkzeug.palletsprojects.com/en/2.0.x/debug/#debugger-pin). This repo provides a sample application to play with the /console endpoint on a dummy Flask application.
Starred by 66 users
Forked by 8 users
Languages Python 85.8% | Dockerfile 14.2%
GitHub
github.com › grav3m1nd-byte › werkzeug-pin
GitHub - grav3m1nd-byte/werkzeug-pin: Yet another Werkzeug Console Pin Exploit Explanation · GitHub
From this function, the following variables need to be exploited to get the console PIN: probably_public_bits = [ username, modname, getattr(app, '__name__', getattr(app.__class__, '__name__')), getattr(mod, '__file__', None), ] private_bits = [ str(uuid.getnode()), get_machine_id(), ] ... getattr(mod, '__file__', None) is the absolute path of app.py in the flask directory (e.g.
Author grav3m1nd-byte
How an attack would use an open flask console page to easily get code execution
72 votes, 11 comments. 85K subscribers in the flask community. Flask is a Python micro-framework for web development. Flask is easy to get started… More on reddit.com
11
72
November 22, 2020Do NOT leak your secret key, here's how an attacker might approach an exposed secret key
This is nuts. Great video! More on reddit.com
21
80
October 22, 2020How Patreon got hacked – Publicly exposed Werkzeug Debugger
I am the author of the entry that the article links to in there. It's pretty easy to enable debug within Werkzeug but it isn't enabled by default. It's also not by default listening on "0.0.0.0" but rather instead by default "127.0.0.1". Here's exactly what they did in the code (this is straight from the dump): web_app.debug = patreon.config.debug web_app.run('0.0.0.0', port=args.port, use_reloader=False) Then in the patreon.config.debug string, it had a true statement: debug = True Whoever enabled this server wouldn't have fed arguments to enable it as it was hard-coded into the application. All someone had to do was just type "python patreonweb.py" and the server would be ready to go with debug-mode enabled. More on reddit.com
82
480
October 2, 2015HackTricks
book.hacktricks.xyz › home › network services pentesting › pentesting web › werkzeug
Werkzeug / Flask Debug - HackTricks
2 days ago - Upon collating all necessary data, the exploit script can be executed to generate the Werkzeug console PIN. The script uses the assembled probably_public_bits and private_bits to create a hash, which then undergoes further processing to produce ...
Medium
b33pl0g1c.medium.com › hacking-the-debugging-pin-of-a-flask-application-7364794c4948
Hacking the Debugging Pin of a Flask Application | by Akash Poudel | Medium
September 8, 2022 - So, the console is a place that allows some arbitrary python code execution in the browser itself. I quote straight from the Flask documentation: “Do not run the development server, or enable the built-in debugger, in a production environment. The debugger allows executing arbitrary Python code from the browser. It’s protected by a pin, but that should not be relied on for security.”
Bengrewell
bengrewell.com › cracking-flask-werkzeug-console-pin
Cracking Werkzeug Debugger Console Pin
March 11, 2023 - This debugger is commonly seen with the Python-based Flask web application framework. However, you may have been discouraged when you tried to access it and were met with a prompt for a pin number. In this post, we'll explore how you can crack the debugger pin and gain access to the console.
Greg Scharf
blog.gregscharf.com › 2023 › 04 › 09 › lfi-to-rce-in-flask-werkzeug-application
LFI to RCE in Flask Werkzeug Application :: Greg Scharf — Development & Security
April 10, 2023 - First, look for SSTI (server-side template injection) since Flask uses the Jinja2 templating engine. Second, check if the secret key used to sign session cookies is visible anywhere in the source code.
Medium
medium.com › swlh › hacking-flask-applications-939eae4bffed
Hacking Flask Applications. Executing arbitrary commands using the… | by Vickie Li | The Startup | Medium
February 18, 2020 - However, it is possible that the PIN has been disabled in the application. Once you’ve exposed the debugger console, standard RCE escalation techniques apply.
Vulnlab
arz101.medium.com › hackthebox-opensource-84e644164a4c
HackTheBox — Opensource - ARZ101 - Medium
October 8, 2022 - We can get foothold by generating the console PIN using the exploit from here · https://github.com/wdahlenburg/werkzeug-debug-console-bypass · Replacing the values in the exploit by reading the MAC from /sys/class/net/eth0/address, boot-id from /proc/sys/kernel/random/boot_id and cgroup from /proc/self/cgroup also replacing the path to flask app , modname and the user running this flask app ·
Daehee
daehee.com › blog › werkzeug-console-pin-exploit
Werkzeug Console PIN Exploit | Daehee Park
January 10, 2020 - Once all variables prepared, run exploit script to generate Werkzeug console PIN: import hashlib from itertools import chain probably_public_bits = [ 'web3_user',# username 'flask.app',# modname 'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__')) '/usr/local/lib/python3.5/dist-packages/flask/app.py' # getattr(mod, '__file__', None), ] private_bits = [ '279275995014060',# str(uuid.getnode()), /sys/class/net/ens33/address 'd4e6cb65d59544f3331ea0425dc555a1'# get_machine_id(), /etc/machine-id ] h = hashlib.md5() for bit in chain(probably_public_bits, private_bits): if not bit: c
CTFtime.org
ctftime.org › writeup › 17955
CTFtime.org / TetCTF 2020 / The Prophet / Writeup
``` From there I was stuck for a while but I noticed after a bit of researching that there was a console under http://45.77.245.232:7004/console. The problem was that it was secured with a pin. So I ran the sourcecode on my local machine and tried it there. I got a pin ``` * Serving Flask app "app" (lazy loading) * Environment: production WARNING: This is a development server.
Khant
khant.dev › exploiting-insecure-flask-debugger-console.html
Exploiting insecure Flask debugger console
March 27, 2023 - In order to crack the Werkzeug console PIN, I need the following 6 parameters. can get from enumeration or, in my case, from logs /home/khant/… ... getattr(mod, '__file__', None) → from debug logs I can see where the package installed, so should be under /home/khant/Documents/work/security/demo/flask-hello-world/env/lib/python3.10/site-packages/flask/app.py
Vicarius
vicarius.io › vsociety › posts › research-exploiting-insecure-debugger-console-oc
Research: Exploiting Insecure Debugger Console (OC) - vsociety
October 6, 2022 - One of the many cool Flask features is the interactive debug console in the browser. This can be useful to quickly test what part of your code is causing issues. But in many cases, developers explicitly enable the debug console and disable the pin protection on those debug consoles.
Reddit
reddit.com › r/flask › how an attack would use an open flask console page to easily get code execution
r/flask on Reddit: How an attack would use an open flask console page to easily get code execution
November 22, 2020 - 72 votes, 11 comments. 85K subscribers in the flask community. Flask is a Python micro-framework for web development. Flask is easy to get started…
Gitbook
angelica.gitbook.io › hacktricks › network-services-pentesting › pentesting-web › werkzeug
Werkzeug / Flask Debug - HackTricks - GitBook
November 10, 2024 - To exploit the console PIN, two sets of variables, probably_public_bits and private_bits, are needed: username: Refers to the user who initiated the Flask session.
YouTube
youtube.com › 0xdf
Reassembling Werkzeug's Pin - Hacking Flask Debug Mode [Part 1] - YouTube
Flask is a really common Python web framework, and one of the features it offers is a debug mode. In this mode, when your application crashes, it gives not o...
Published July 31, 2023 Views 3K
Vulnlab
arz101.medium.com › hackthebox-agile-19a3559ad04a
HackTheBox — Agile - ARZ101 - Medium
August 4, 2023 - Since we can read local files, we can try to generate the PIN by reading specific files which are used for generating Werkzeug console PIN. So we first we must identify, with which user this application is running, we can read /proc/self/environ ...
Shells
book.jorianwoltjer.com › web › frameworks › flask
Flask | Practical CTF - Jorian Woltjer
These lines can expand to a few ... comes from the Console. Every line shows a small terminal icon, that when pressed will prompt for a PIN that can unlock an interactive Python console on the server....
GitHub
github.com › StillNoob › Werkzeug-Console-PIN-Cracker
GitHub - StillNoob/Werkzeug-Console-PIN-Cracker: Generates all possible PIN combinations! · GitHub
Generates all possible PIN combinations using below possible combinations! Module Name Application Name ------------------------------------- flask.app - wsgi_app werkzeug.debug - DebuggedApplication flask.app - Flask
Author StillNoob
Reddit
reddit.com › r/pentesting › recalculate flask debugger pin
r/Pentesting on Reddit: Recalculate Flask Debugger PIN
January 9, 2020 - Penetration testing (or pen testing) ... find and exploit vulnerabilities in a computer system. The purpose of this simulated attack is to identify any weak spots in a system's defenses which attackers could take advantage of. ... Imagine Flask app in debug mode running as root and a limited shell access to the machine. During a pentest I was able to recalculate the Debugger PIN for that flask ...