Troubleshooting the “index out of range” Error
As we found during the previous section, the Python interpreter has thrown an error
related to line 24 of our modified exploit.
Inspecting this line, we’ll notice that it uses the split method
in order to slice the string stored in the location parameter
passed to the parse_csrf_token function.
The Python documentation for split
indicates that this method slices the input string,
using an optional separator passed as a first argument.
The string slices returned by split are then stored in a Python list object,
that can be accessed via an index.
In our exploit code, the string separator is defined as the csrf_param variable
followed by the equals sign.
In order to better understand the IndexError,
we can add a print statement in the parse_csrf_token function
before the return instruction.
The exploit now displays the full string before the split method is invoked.
While the exploit code expected the input string to contain “c”,
we received “sk” from the web application.
At this point, we don’t fully understand why this is happening.
Perhaps there is a version mismatch
between the exploit developer’s software and ours,
or a CMS configuration mismatch.
In any case, we know that exploit development is never straightforward.
Next, let’s try to change the csrf_param variable to match the CMS response
to find out if the exploit works.
Next, we’ll execute the modified exploit.
The error is no longer displayed and we are presented with a message
informing us that the exploit has succeeded.
Although we don’t clearly understand why
we needed to change the csrf_param variable,
this scenario showed us how to adapt to unexpected situations,
something great penetration testers do very well.
We can now validate the exploit by attaching to the PHP shell
with a tool like curl and supplying a system command to serve as the payload:
Nice! The exploit was successful, and we now have a web shell.