A neglected attack method-padding oracle

I used WVS to scan a target site and encountered a high-risk vulnerability such as "asp.net padding oracle". I checked the information on the Internet as I have never heard of it before. This technology is actually found last year, there is also a name is ms10-070, but the current domestic research seems to be not much, found information is almost foreign, in fact, this technology is very harmful. For asp.net, you can read the web. config and other sensitive file content. You can go
Http://www.gdssecurity.com/l/ B /2... cks-with-padbuster/
Check. If you are not familiar with English, you can go
Http://blog.zhaojie.me/2010/10/p... tack-in-detail.html
View the translation.
The GDS Security Organization also developed a padbuster. pl tool for padding oracle attacks.Http://www.gdssecurity.com/l/ B /2... ding-oracle-attack/A Brief Introduction to asp.net attacks using this tool is provided.
Here I am sending an example to test asp.net myself. As I am still a little concerned about this technology, I only hope to serve as an example and hope that more people will pay attention to it.
First visit the target siteWww.xxx.com/default.aspxFind WebResource. axd through the source code. Note that calling the file through WebResource. axd may be in any. net file. If the home page does not exist, you can also look for it on other pages.

Copy & mark the previous section of WebResource. axd? D = 9MBwmxN6TLKjC8S3CdFGyw2, which is added after the url.Www.xxx.com/WebResource.axd? D = 9MBwmxN6TLKjC8S3CdFGyw2Run the padbuster. pl tool and enter the following command:
Padbuster. plHttp://www.xxx.com/WebResource.axd? D = 9MBwmxN6TLKjC8S3CdFGyw29MBwmxN6TLKjC8S3CdFGyw2 16-encoding 3-plaintext "| ~ /Web. config"
Here 16 is the number of bytes for each data block, which is divided into 8 and 16. Currently, I have no good method to determine the number of bytes, so you can try both of them (most of them are 16). The encoding parameters include 0 = Base64, 1 = Lower HEX, 2 = Upper HEX 3 =. NET UrlToken, 4 = WebSafe Base64, because this test is asp.net, so here we choose 3, plaintext as the file to read the content, this test uses web. config as an example.

After a period of running, the program will provide such an interface,

Here, let's select a corresponding mode and ** it indicates program recommendation. Here we select the No. 2 mode recommended by the program. After a long wait, the following result is displayed:

The string generated here is the web of the file to be read. after the config is encrypted, it is composed of some characters, because we do not know the key,. net is open-source, so we can generate an encrypted web. config string. The other part is filled with characters first. After the application receives the encrypted value, it will return three conditions:
• After receiving the correct ciphertext (filled with correct and containing valid values), the application returns normally (200-OK ).
• After an invalid ciphertext is received (incorrect filling is found after decryption), the application throws a decryption exception (500-Internal Server Error ).
• Accept valid ciphertext (correct filling), but obtain an invalid value after decryption. The application displays a custom error message (200-OK ).
This is the key to generating the padding oracle (padding prompt) attack. It is precisely because of the status code value that enables us to perform brute force cracking on the filled data. It is precisely because of the brute force attack, this method also takes a long time (but it can be done within one day ).
Next we will perform the brute-force cracking step and enter the command
PadBuster. plHttp://www.xxx.com/ScriptResourc... aaaaaaaaaaaaaaaaaaaa1Izmwcbuweeu5zdlko7jhgwaaaaaaaaaaaaaaaaaaa1 16-encoding 3-bruteforce-log
After selecting a response mode, you will see the value that is continuously changed to be filled for testing.

At the same time, a log folder will be generated under the program directory, regardless of the 404 and 200 commit results will be used as records, and many files in the status of 200 are actually not really web. config, which will be blank after access, but here we will tell you a quick search method, because the Error 404 page and the blank 200 page will not return a lot of bytes, in this example, we have tested it in less than 4 K. Therefore, we can find all the files smaller than 4 K in the current directory, and then select and delete all the files.

After a long time of brute-force cracking, we found a 13 K log file.

Access by url

Seeing this step, I think everyone should understand what this file is. According to the Internet, padding oracle is as common as injection, I didn't talk too much about the principles here because I didn't have a very deep understanding, but I was afraid to mislead everyone. So I hope you can read the articles I mentioned earlier and read the principles by yourself, according to my most vulgar understanding, asp.net padding oracle is actually a decryption string, cracking down the key at the same time, and then encrypting the file we want, in order to make a submission in the correct format to read the content of the file we want to see.
I also found a foreign demo video on the Internet.
Http://www.youtube.com/watch? V = tlCRivo8Sis
 

This article