往期博文：

DVWA靶场-Content Security Policy (CSP) Bypass

靶场环境搭建

https://github.com/ethicalhack3r/DVWA

[网络安全学习篇附]：DVWA 靶场搭建

JavaScript Attacks

Impossible JavaScript

JavaScript Attacks

Low JavaScript

核心代码

<?php

$page[ 'body' ] .= <<<EOF

<script>

/*

MD5 code from here

https://github.com/blueimp/JavaScript-MD5

*/

!function(n){"use strict";function t(n,t){var r=(65535&n)+(65535&t);return(n>>16)+(t>>16)+(r>>16)<<16|65535&r}function r(n,t){return n<<t|n>>>32-t}function e(n,e,o,u,c,f){return t(r(t(t(e,n),t(u,f)),c),o)}function o(n,t,r,o,u,c,f){return e(t&r|~t&o,n,t,u,c,f)}function u(n,t,r,o,u,c,f){return e(t&o|r&~o,n,t,u,c,f)}function c(n,t,r,o,u,c,f){return e(t^r^o,n,t,u,c,f)}function f(n,t,r,o,u,c,f){return e(r^(t|~o),n,t,u,c,f)}function i(n,r){n[r>>5]|=128<<r%32,n[14+(r+64>>>9<<4)]=r;var e,i,a,d,h,l=1732584193,g=-271733879,v=-1732584194,m=271733878;for(e=0;e<n.length;e+=16)i=l,a=g,d=v,h=m,g=f(g=f(g=f(g=f(g=c(g=c(g=c(g=c(g=u(g=u(g=u(g=u(g=o(g=o(g=o(g=o(g,v=o(v,m=o(m,l=o(l,g,v,m,n[e],7,-680876936),g,v,n[e+1],12,-389564586),l,g,n[e+2],17,606105819),m,l,n[e+3],22,-1044525330),v=o(v,m=o(m,l=o(l,g,v,m,n[e+4],7,-176418897),g,v,n[e+5],12,1200080426),l,g,n[e+6],17,-1473231341),m,l,n[e+7],22,-45705983),v=o(v,m=o(m,l=o(l,g,v,m,n[e+8],7,1770035416),g,v,n[e+9],12,-1958414417),l,g,n[e+10],17,-42063),m,l,n[e+11],22,-1990404162),v=o(v,m=o(m,l=o(l,g,v,m,n[e+12],7,1804603682),g,v,n[e+13],12,-40341101),l,g,n[e+14],17,-1502002290),m,l,n[e+15],22,1236535329),v=u(v,m=u(m,l=u(l,g,v,m,n[e+1],5,-165796510),g,v,n[e+6],9,-1069501632),l,g,n[e+11],14,643717713),m,l,n[e],20,-373897302),v=u(v,m=u(m,l=u(l,g,v,m,n[e+5],5,-701558691),g,v,n[e+10],9,38016083),l,g,n[e+15],14,-660478335),m,l,n[e+4],20,-405537848),v=u(v,m=u(m,l=u(l,g,v,m,n[e+9],5,568446438),g,v,n[e+14],9,-1019803690),l,g,n[e+3],14,-187363961),m,l,n[e+8],20,1163531501),v=u(v,m=u(m,l=u(l,g,v,m,n[e+13],5,-1444681467),g,v,n[e+2],9,-51403784),l,g,n[e+7],14,1735328473),m,l,n[e+12],20,-1926607734),v=c(v,m=c(m,l=c(l,g,v,m,n[e+5],4,-378558),g,v,n[e+8],11,-2022574463),l,g,n[e+11],16,1839030562),m,l,n[e+14],23,-35309556),v=c(v,m=c(m,l=c(l,g,v,m,n[e+1],4,-1530992060),g,v,n[e+4],11,1272893353),l,g,n[e+7],16,-155497632),m,l,n[e+10],23,-1094730640),v=c(v,m=c(m,l=c(l,g,v,m,n[e+13],4,681279174),g,v,n[e],11,-358537222),l,g,n[e+3],16,-722521979),m,l,n[e+6],23,76029189),v=c(v,m=c(m,l=c(l,g,v,m,n[e+9],4,-640364487),g,v,n[e+12],11,-421815835),l,g,n[e+15],16,530742520),m,l,n[e+2],23,-995338651),v=f(v,m=f(m,l=f(l,g,v,m,n[e],6,-198630844),g,v,n[e+7],10,1126891415),l,g,n[e+14],15,-1416354905),m,l,n[e+5],21,-57434055),v=f(v,m=f(m,l=f(l,g,v,m,n[e+12],6,1700485571),g,v,n[e+3],10,-1894986606),l,g,n[e+10],15,-1051523),m,l,n[e+1],21,-2054922799),v=f(v,m=f(m,l=f(l,g,v,m,n[e+8],6,1873313359),g,v,n[e+15],10,-30611744),l,g,n[e+6],15,-1560198380),m,l,n[e+13],21,1309151649),v=f(v,m=f(m,l=f(l,g,v,m,n[e+4],6,-145523070),g,v,n[e+11],10,-1120210379),l,g,n[e+2],15,718787259),m,l,n[e+9],21,-343485551),l=t(l,i),g=t(g,a),v=t(v,d),m=t(m,h);return[l,g,v,m]}function a(n){var t,r="",e=32*n.length;for(t=0;t<e;t+=8)r+=String.fromCharCode(n[t>>5]>>>t%32&255);return r}function d(n){var t,r=[];for(r[(n.length>>2)-1]=void 0,t=0;t<r.length;t+=1)r[t]=0;var e=8*n.length;for(t=0;t<e;t+=8)r[t>>5]|=(255&n.charCodeAt(t/8))<<t%32;return r}function h(n){return a(i(d(n),8*n.length))}function l(n,t){var r,e,o=d(n),u=[],c=[];for(u[15]=c[15]=void 0,o.length>16&&(o=i(o,8*n.length)),r=0;r<16;r+=1)u[r]=909522486^o[r],c[r]=1549556828^o[r];return e=i(u.concat(d(t)),512+8*t.length),a(i(c.concat(e),640))}function g(n){var t,r,e="";for(r=0;r<n.length;r+=1)t=n.charCodeAt(r),e+="0123456789abcdef".charAt(t>>>4&15)+"0123456789abcdef".charAt(15&t);return e}function v(n){return unescape(encodeURIComponent(n))}function m(n){return h(v(n))}function p(n){return g(m(n))}function s(n,t){return l(v(n),v(t))}function C(n,t){return g(s(n,t))}function A(n,t,r){return t?r?s(t,n):C(t,n):r?m(n):p(n)}"function"==typeof define&&define.amd?define(function(){return A}):"object"==typeof module&&module.exports?module.exports=A:n.md5=A}(this);

    function rot13(inp) {

        return inp.replace(/[a-zA-Z]/g,function(c){return String.fromCharCode((c<="Z"?90:122)>=(c=c.charCodeAt(0)+13)?c:c-26);});

    }

    function generate_token() {

        var phrase = document.getElementById("phrase").value;

        document.getElementById("token").value = md5(rot13(phrase));

    }

    generate_token();

</script>

EOF;

?>

再来看一下index.html

$message = "";

// Check whwat was sent in to see if it was what was expected

if ($_SERVER['REQUEST_METHOD'] == "POST") {

    if (array_key_exists ("phrase", $_POST) && array_key_exists ("token", $_POST)) {



        $phrase = $_POST['phrase'];

        $token = $_POST['token'];



        if ($phrase == "success") {

            switch( $_COOKIE[ 'security' ] ) {

                case 'low':

                    if ($token == md5(str_rot13("success"))) {

                        $message = "<p style='color:red'>Well done!</p>";

                    } else {

                        $message = "<p>Invalid token.</p>";

                    }
            }
        }
    }
}

这里通过Post 方式获取变量phrase 和token 的值，if(phrase == "success") 且token值正确的话，就输出well done!

直接输入success 发现无效

检查页面源代码，发现token的值由md5(rot13(phrase))决定的

通过console 控制台直接拿到token值

token：38581812b435834ebf84ebcc2c6424d6

接下来直接post请求提交，即可成功

token=38581812b435834ebf84ebcc2c6424d6&phrase=success&send=Submit

Medium JavaScript

核心代码

<?php

$page[ 'body' ] .= '<script 

src="' . DVWA_WEB_PAGE_TO_ROOT . 'vulnerabilities/javascript/source/medium.js">

</script>';

?>

我们继续跟进查看medium.js

function do_something(e) {

    for (var t = "", n = e.length - 1; n >= 0; n--) t += e[n];

    return t

}

setTimeout(function () {

    do_elsesomething("XX")

}, 300);

function do_elsesomething(e) {

    document.getElementById("token").value = do_something(e + document.getElementById("phrase").value + "XX")

}

这里我们分析代码发现这段代码就是将phrase变量的值逆序，也就是sseccus;生成的token值=XXsseccusXX

这里我们直接提交

High JavaScript

核心代码

<?php

$page[ 'body' ] .= '

<script src="' . DVWA_WEB_PAGE_TO_ROOT . 'vulnerabilities/javascript/source/high.js">

</script>';

?>

跟进查看high.js，这里的代码明显被加密混淆了，我们可以使用在线解码工具http://deobfuscatejavascript.com/#

核心代码

function do_something(e) {

    for (var t = "", n = e.length - 1; n >= 0; n--) t += e[n];

    return t

}

function token_part_3(t, y = "ZZ") {

    document.getElementById("token").value = sha256(document.getElementById("token").value + y)

}

function token_part_2(e = "YY") {

    document.getElementById("token").value = sha256(e + document.getElementById("token").value)

}

function token_part_1(a, b) {

    document.getElementById("token").value = do_something(document.getElementById("phrase").value)

}

document.getElementById("phrase").value = "";

setTimeout(function() {

    token_part_2("XX")

}, 300);

document.getElementById("send").addEventListener("click", token_part_3);

token_part_1("ABCD", 44);

代码的执行顺序是这样的

首先将phrase 的值清空

document.getElementById("phrase").value = "";

token_part_1("ABCD", 44);

调用函数

function token_part_1(a, b) {

document.getElementById("token").value = do_something(document.getElementById("phrase").value)

}

接着自动延时300 执行

setTimeout(function() {

token_part_2("XX")

}, 300);

调用函数

function token_part_2(e = "YY") {

document.getElementById("token").value = sha256(e + document.getElementById("token").value)

}

即生成的"XX"的sha256值

接着当我们点击提交的时候，就会触发 click 事件:

document.getElementById("send").addEventListener("click", token_part_3);

然后调用token_part_3（）函数

function token_part_3(t, y = "ZZ") {

document.getElementById("token").value = sha256(document.getElementById("token").value + y)

}

问题就出在这里

document.getElementById("phrase").value = "";

我们输入的success并没有被函数读取到

转到调试器

选择high.js 文件，设置在mouse下的click 事件断点

点击submit 提交，出现以下界面

浏览器会帮我们自动解码，设置断点

现在已经停止在我们设置的断点处，同时取消mouse 中我们刚才设置的click

这个时候我们在控制台中输入

document.getElementById("phrase").value = "success";

放行，即可登录成功

如果第一次没有成功的话，缓存了之前操作，一般第二次就会成功了

Impossible JavaScript

You can never trust anything that comes from the user or prevent them from messing with it and so there is no impossible level.

这个级别有点幽默，防护的方法就是直接删掉了用户可以输入的地方，简直了。

https://www.sqlsec.com/2020/05/dvwa.html#toc-heading-31

DVWA靶场-JavaScript Attacks JS 攻击

JavaScript Attacks

Low JavaScript

核心代码

Medium JavaScript

核心代码

High JavaScript

核心代码

Impossible JavaScript

猜你喜欢