Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Interpret it!
Search
Bo0oM
August 15, 2020
Research
0
1.1k
Interpret it!
Let's look at the source code that wasn't interpriposed.
Bo0oM
August 15, 2020
Tweet
Share
More Decks by Bo0oM
See All by Bo0oM
Защита от вредоносной автоматизации сегодня
bo0om
0
480
Defending against automatization using nginx
bo0om
0
750
Antibot pitch deck
bo0om
0
110
31337
bo0om
0
120
Your back is white
bo0om
0
280
FTP2RCE
bo0om
1
7.1k
At Home Among Strangers
bo0om
1
3.6k
2000day in Safari
bo0om
2
2.1k
Partyhack 3.0 - Telegram bugbounty writeup
bo0om
0
3.9k
Other Decks in Research
See All in Research
「人間にAIはどのように辿り着けばよいのか?ー 系統的汎化からの第一歩 ー」@第22回 Language and Robotics研究会
maguro27
0
530
ヘルプデスクの事例で学ぶAIエージェント
masatoto
14
7.8k
Как стать 10x экспертом
ikurochkin
1
120
Active Adaptive Experimental Design for Treatment Effect Estimation with Covariate Choices
masakat0
0
190
第 2 部 11 章「大規模言語モデルの研究開発から実運用に向けて」に向けて / MLOps Book Chapter 11
upura
0
260
[2024.08.30] Gemma-Ko, 오픈 언어모델에 한국어 입히기 @ 머신러닝부트캠프2024
beomi
0
570
marukotenant01/tenant-20240916
marketing2024
0
220
授業評価アンケートのテキストマイニング
langstat
1
340
言語処理学会30周年記念事業留学支援交流会@YANS2024:「学生のための短期留学」
a1da4
1
210
20240710_熊本県議会・熊本市議会_都市交通勉強会
trafficbrain
0
730
SSII2024 [OS1] 現場の課題を解決する ロボットラーニング
ssii
PRO
0
550
Weekly AI Agents News!
masatoto
22
19k
Featured
See All Featured
The Power of CSS Pseudo Elements
geoffreycrofte
71
5.3k
Fantastic passwords and where to find them - at NoRuKo
philnash
50
2.8k
Into the Great Unknown - MozCon
thekraken
30
1.4k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
249
21k
Fashionably flexible responsive web design (full day workshop)
malarkey
403
65k
Put a Button on it: Removing Barriers to Going Fast.
kastner
58
3.5k
Side Projects
sachag
452
42k
Faster Mobile Websites
deanohume
304
30k
The World Runs on Bad Software
bkeepers
PRO
65
11k
Adopting Sorbet at Scale
ufuk
73
9k
RailsConf 2023
tenderlove
28
840
Mobile First: as difficult as doing things right
swwweet
222
8.8k
Transcript
How do I see the source code? • Include files
(header.inc) • Backup files • Temp files (nano, vim, etc) • .git or another version-control system • Arbitrary file reading
Interpret it! Anton “Bo0oM” Lopanitsyn
Server configuration errors Multiple routing and microservices location / {
try_files $uri $uri/ /index.html; ... } location /blog { … }
Server configuration errors Multiple routing and microservices
How to find it? https://example.com/config.php - 200, 0B https://example.com/config.php -
200, 3KB Content-type: application/octet-stream text/plain
Find a vulnerability in the config! location ~ ^(.+\.php)(.*)$ {
fastcgi_split_path_info ^(.+\.php)(.*)$; fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name; fastcgi_param DOCUMENT_ROOT /var/www/html; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_index index.php; }
Nope https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_split_path_info
Windows + Nginx = <3 https://example.com/config.php - 200, 0B https://example.com/config.pHP
location ~ ^(.+\.php)(.*)$ location ~ ^(.+\.php)(.*)$ Linux (case sensitive): https://example.com/config.pHP - 404 Windows: https://example.com/config.pHP - 200
Nginx /etc/nginx/site-enabled/default server { listen 80 default_server; listen
[::]:80 default_server; root /var/www/html; index index.html index.htm index.nginx-debian.html; server_name _; location / { try_files $uri $uri/ =404; } }
None
None
None
Apache /etc/apache2/sites-enabled/000-default.conf <VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined </VirtualHost>
Apache /etc/apache2/sites-enabled/example.conf <VirtualHost *:80> DocumentRoot /var/www/html/example.com <FilesMatch "\.ph(p[3-5]?|tml)$"> SetHandler application/x-httpd-php
</FilesMatch> …
How to find it? example.com, IP: 123.123.123.123 Check http://123.123.123.123/config.php http://123.123.123.123/example/config.php
http://123.123.123.123/example.com/config.php
CDN’s https://forum.example.com https://cdn.example.com/forum/static/123/123.jpg https://cdn.example.com/forum/config.php Unbelievable, but the fact is, some
move the whole project to cdn!
0day
Blog: https://bo0om.ru Twitter: @i_bo0om Telegram channel: @webpwn