Tianji's Blog.

parse_url + curl

web安全
Word count: 382 / Reading time: 2 min
2018/04/24 Share

parse_url + curl

Let’s open the URL and prod around. We find a search box, which can retrieve the source code of any page on https://www.google.com.

  1. Different hostnames are all blocked. Examples are:
    • evil.com
    • hostnames that include www.google.com such as www.google.com.evil.com
    • URLs that include google.com such as www.evil.com/http://www.google.com
  2. php:// filter urls do not work.
  3. Appending a null byte to the query, i.e., site=http%3A%2F%2Fwww.google.com%00 gives a warning: curl_setopt(): Curl option contains invalid characters (\0)
    • So null bytes are detected and blocked
    • We now know that the backend used is cURL
  4. Googling for this error then leads to https://bugs.php.net/bug.php?id=68089
    • This has a nice example: file:///etc/passwd%00http://google.com
    • Apparently cURL also understands file:// urls!
    • If you read carefully, you’ll notice that this specific vulnerability is not addressed in PHP as it’s considered a cURL issue
  5. First focusing on the file:// protocol: we notice that this protocol is supported, as file://www.google.com returns a different error than before.
  6. Testing locally, we find that file://www.google.com/../etc/passwd in fact reads /etc/passwd. However, search-box appends a /
    to the end of the url, which means the code would try to read /etc/passwd/, which of course doesn’t exist.
  7. Combining the two, we can send the null byte URLencoded to cURL. So the final attack URL becomes something like
    file://www.google.com/../etc/flag.txt%00. The final request thus becomes
    http://search-box.web1.sunshinectf.org/?submit=Submit&site=file%3A%2F%2Fwww.google.com%2F..%2Fetc%2Fflag.txt%2500
    and this finally gets us the flag.
  8. file://user@127.0.0.1:80@www.google.com/etc/flag.txt
  9. file://user@127.0.0.1:80@www.google.com/etc/flag.txt#‘
1
2
3
4
5
6
7
8
9
10
11
12
13
php > var_dump(parse_url("http://127.0.0.1:123.@c7f.zhuque.com/..//"));
array(5) {
  ["scheme"]=>
  string(4) "http"
  ["host"]=>
  string(14) "c7f.zhuque.com"
  ["user"]=>
  string(9) "127.0.0.1"
  ["pass"]=>
  string(3) "123."
  ["path"]=>
  string(5) "/..//"
}

原文作者: Tianji

原文链接: https://www.tiandiwuji.top/posts/15636/

发表日期: April 24th 2018, 9:55:40 am

版权声明: 本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
  1. 1. parse_url + curl
Total : 77
2099
2019
2018
pwn ctf web安全 ctf_php_debug 置顶 工具手册 dubbo jvm linux 运维 mysql php python python安全 前端 zookeeper 渗透测试 安全体系建设
安全