Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Interpret it!
Search
Bo0oM
August 15, 2020
Research
0
1k
Interpret it!
Let's look at the source code that wasn't interpriposed.
Bo0oM
August 15, 2020
Tweet
Share
More Decks by Bo0oM
See All by Bo0oM
Защита от вредоносной автоматизации сегодня
bo0om
0
410
Defending against automatization using nginx
bo0om
0
690
Antibot pitch deck
bo0om
0
98
31337
bo0om
0
91
Your back is white
bo0om
0
230
FTP2RCE
bo0om
0
6.8k
At Home Among Strangers
bo0om
1
3.4k
2000day in Safari
bo0om
2
2k
Partyhack 3.0 - Telegram bugbounty writeup
bo0om
0
3.9k
Other Decks in Research
See All in Research
脳卒中患者・家族からみた循環器病対策推進基本計画の進捗に関する調査
japanstrokeassociation
0
500
Ground Metric Learning with applications in genomics
gpeyre
0
300
Schrödinger Bridge問題に基づく拡散生成モデル学習
takeshi_koshizuka
1
500
第12回全日本コンピュータビジョン勉強会:画像の自己教師あり学習における大規模データセット
naok615
0
460
3D Human Mesh Estimationについていくつかまとめてみた / Survey about 3D Human Mesh Estimation
nttcom
0
130
Elix, CBI 2023, ランチョンセミナー, 大規模言語モデルの基本から最前線へ
elix
0
170
論文紹介: Generating News-Centric Crossword Puzzles As A Constraint Satisfaction and Optimization Problem
upura
0
130
IRではデータ収集がどのように実施・認識されてきたのか
gmoriki
0
330
Julia Tokyo #11 トーク: 「Juliaで歩く自動微分」
abap34
1
1.1k
クリック率を最大化しない推薦システム
joisino
40
13k
Alternative Photographic Processes Reimagined: The Role of Digital Technology in Revitalizing Classic Printing Techniques【SIGGRAPH Asia 2023】
toremolo72
0
400
熊本都市交通リノベーション_熊本青年会議所ローカルマニフェスト検証会
trafficbrain
1
500
Featured
See All Featured
Reflections from 52 weeks, 52 projects
jeffersonlam
343
19k
Robots, Beer and Maslow
schacon
PRO
154
7.9k
[RailsConf 2023] Rails as a piece of cake
palkan
21
3.8k
Imperfection Machines: The Place of Print at Facebook
scottboms
257
12k
Designing for Performance
lara
601
67k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
6
930
The Language of Interfaces
destraynor
150
22k
StorybookのUI Testing Handbookを読んだ
zakiyama
10
4.4k
Build The Right Thing And Hit Your Dates
maggiecrowley
23
1.9k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
153
14k
5 minutes of I Can Smell Your CMS
philhawksworth
199
19k
Web Components: a chance to create the future
zenorocha
304
41k
Transcript
How do I see the source code? • Include files
(header.inc) • Backup files • Temp files (nano, vim, etc) • .git or another version-control system • Arbitrary file reading
Interpret it! Anton “Bo0oM” Lopanitsyn
Server configuration errors Multiple routing and microservices location / {
try_files $uri $uri/ /index.html; ... } location /blog { … }
Server configuration errors Multiple routing and microservices
How to find it? https://example.com/config.php - 200, 0B https://example.com/config.php -
200, 3KB Content-type: application/octet-stream text/plain
Find a vulnerability in the config! location ~ ^(.+\.php)(.*)$ {
fastcgi_split_path_info ^(.+\.php)(.*)$; fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name; fastcgi_param DOCUMENT_ROOT /var/www/html; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_index index.php; }
Nope https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_split_path_info
Windows + Nginx = <3 https://example.com/config.php - 200, 0B https://example.com/config.pHP
location ~ ^(.+\.php)(.*)$ location ~ ^(.+\.php)(.*)$ Linux (case sensitive): https://example.com/config.pHP - 404 Windows: https://example.com/config.pHP - 200
Nginx /etc/nginx/site-enabled/default server { listen 80 default_server; listen
[::]:80 default_server; root /var/www/html; index index.html index.htm index.nginx-debian.html; server_name _; location / { try_files $uri $uri/ =404; } }
None
None
None
Apache /etc/apache2/sites-enabled/000-default.conf <VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined </VirtualHost>
Apache /etc/apache2/sites-enabled/example.conf <VirtualHost *:80> DocumentRoot /var/www/html/example.com <FilesMatch "\.ph(p[3-5]?|tml)$"> SetHandler application/x-httpd-php
</FilesMatch> …
How to find it? example.com, IP: 123.123.123.123 Check http://123.123.123.123/config.php http://123.123.123.123/example/config.php
http://123.123.123.123/example.com/config.php
CDN’s https://forum.example.com https://cdn.example.com/forum/static/123/123.jpg https://cdn.example.com/forum/config.php Unbelievable, but the fact is, some
move the whole project to cdn!
0day
Blog: https://bo0om.ru Twitter: @i_bo0om Telegram channel: @webpwn