Payloads

The payloads contain the actual exploit code to attack a specific vulnerable service.

Singularity supports the following attack payloads:

• Basic fetch request (payload-simple-fetch-get.html): This sample payload makes a GET request to the root directory ('/') and shows the server response using the fetch API. The goal of this payload is to function as example request to make additional contributions as easy as possible.
• Chrome DevTools (payload-exposed-chrome-devtools.html): This payload demonstrates a remote code execution (RCE) vulnerability in Microsoft VS Code fixed in version 1.19.3. This payload can be adapted to exploit any software that exposes Chrome Dev Tools on localhost.
• etcd (payload-etcd.html): This payload retrieves the keys and values from the etcd key-value store.
• pyethapp (payload-pyethapp.html): Exploits the Python implementation of the Ethereum client Pyethapp to get the list of owned eth addresses and retrieve the balance of the first eth address.
• Rails Web Console (payload-rails-webconsole.html): Performs a remote code execution (RCE) attack on the Rails Web Console.
• AWS Metadata (payload-aws-metadata.html): Forces a headless browser to exfiltrate AWS metadata including private keys to a given host. Check the payload contents for additional details on how to setup the attack.
• Duplicati RCE (payload-duplicati-rce.html): This payload exploits the Duplicati backup client and performs a remote code execution (RCE) attack. For this attack to work, parameter targetURL in file payload-duplicati-rce.html must be updated to point to a valid Duplicati backup containing the actual RCE payload, a shell script.
• WebPDB (payload-exposed-pdb.html): A generic RCE payload to exploit PDB, a python debugger exposed via websockets.
• Hook and Control (payload-hook-and-control.html): Hijack target browsers and use them to access inaccessible resources from your own browser or other HTTP clients. You can retrieve the list of hooked browsers on the "soohooked" sub-domain of the Singularity manager host on port 3129 by default e.g. http://soohooked.rebinder.your.domain:3129/. To authenticate, submit the secret value dumped to the console by the Singularity server at startup.
• Jenkins Script Console (payload-jenkins.html): This payload exploits the Jenkins Script Console and displays the stored credentials.
• Docker API (payload-docker.html): This payload exploits the Docker API and displays the /etc/shadow file of the Docker host.

Creating your own payloads is as simple as copying the sample payload HTML file (payload-simple-fetch-get.html) and modify it according to your needs. The sample payload makes a single GET request and displays the response. Start with copying the content of this file to a new .html file and add its name to the attackPayloads list in the manager-config.json file. Then modify the new HTML file to change the request URL for example.