ืืืื ืืึธืจ ืฆืืจืืง, ืืขืจืฅ 21, 2019, ืืื ืึท ืืืืขืจ ืืื ืืืื ืขืจ ืืขืงืืืขื ืฆื HackerOne ืคืื . ืืืขื ืื ืืจืึธืืืืกืื ื ืึท ื ืื ืืืื (ASCII 0) ืืื ืื POST ืคึผืึทืจืึทืืขืืขืจ ืคืื ืืืื ืขืจ ืคืื ืื ืืืขืืืึทืื ืึทืคึผื ืจืืงืืืขืก ืืืึธืก ืืืืืขืงืขืจื ืึท ืืืืคึผ ืจืืืขืจืขืงื, ืืจืขืงืืขื ืคืื ืึทื ืื ืืฉืืึทืืืืื ืืึผืจืื ืืขื ืขื ืงืขื ืืืง ืืื ืื ืจืืืขืจืขืงื ืืึทืื, ืืื ืืืึธืก ืคืจืึทืืืึทื ืฅ ืคืื GET ืคึผืึทืจืึทืืขืืขืจืก ืืื ืืขืืขืจื ืคืื ืื ืืขืจืข ืจืืงืืืขืก ืฆื ืื ืืขืืืืงืขืจ ืกืขืจืืืขืจ.
ืืึธืก ืืื ืึท ืงืจืืืืฉ ืืืึทืื ืขืจืึทืืืืืื ืืืืึทื ... ืจืืงืืืขืก ืืืื ืึทื ืืืึทืืื ืกืขืกืืข ืงืืืืขื. ืขืืืขืืข ืฉืขื ืฉืคึผืขืืขืจ, ืึท ืฆืืึทืืืืืึทืืืง ืคืึทืจืจืืืื ืืื ืืขืืืื ืืืึธืก ืคืืืืขืจื ืื ื ืื ืืืื (ืืื ืขืก ืคืืจืงืขืจื ืืืืก ืฉืคึผืขืืขืจ, ืืึธืก ืืื ื ืืฉื ืืขื ืื, ืืืืึทื ืขืก ืืื ื ืึธื ืื ืืขืืืขืืงืืื ืคืื ืื ืืืฉืขืงืืื ื CRLF / ASCII 13, 10, ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืืึทื ืืคึผืืืืจื ืื ืืขืืขืจื ืืื ืืึทืื ืคืื ืื ืืืืคึผ ืขื ืืคืขืจ, ืืึธืก ืืื ืืืืื ืืงืขืจ ืงืจืืืืฉ, ืึธืืขืจ ื ืึธื ืคึผืจืืงืจืข). ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ืื ืคึผืจืึธืืืขื ืืื ืืจืึทื ืกืคืขืจื ืฆื ืืืืขืจืืืื ืึทื ืึทืืืก ืืื ืืขืืืขืืึธืคึผืขืจืก ืฆื ืืขืคึฟืื ืขื ืืื ืขืืืืื ืืจื ืื ืกืืืืช ืคืื ืืขื ืืฉืืง.
Mail.ru ืคึผืึธืกื ืืื ืึท ืืืืขืจ ืงืึธืืคึผืืขืงืก ืึทืคึผืืึทืงืืืฉืึทื; ืึท ืืจืืืก ื ืืืขืจ ืคืื ืคืึทืจืฉืืืขื ืข ืคืจืึธื ื-ืขื ื / ืฆืืจืืง-ืขื ื ืงืึทืืคึผืึธืื ืึทื ืฅ, ืืืืืข ืึธืคึฟื ืืงืืจ (ืคืืืข ืืึทื ืง ืฆื ืึทืืข ืคืจืื ืืืืืืืืืจื ืืขืืืขืืึธืคึผืขืจืก) ืืื ืืื-ืืืื ืืขืืืขืืึธืคึผืขื, ืงืขื ืขื ืืืื ืื ืืืึทืืืื ืืื ืืืฉืขื ืขืจืืืืื ื ืื ืขื ืืคืขืจ. ืืืจ ืืขืจืืื ืฆื ืืืกืฉืืืกื ืึทืืข ืงืึทืืคึผืึธืื ืึทื ืฅ ืึทืืืฅ nginx ืืื openresty ืืื ืืึธืงืึทืืืืืจื ืืขื ืคึผืจืึธืืืขื ืืืืืขืจ ืจืืคื ืืื ืึทื OpenResty ืฉืจืืคื ืืืึธืก ืืื ื ืืฉื ืืืืืืืื ืืื ืืขืจืืืึทืจื (ืื ืกืขืจืืื ื ืึท ื ืึทื ืืืื ืึธืืขืจ ืฉืืจื ืคืืืขืจ ืืืจื GET ืคึผืึทืจืึทืืขืืขืจืก ืืื ืจืืจืืื ืืื ngx_http_rewrite_module, ืืืึธืก, ืืืื ืื ืืึทืงืืืืขื ืืืืฉืึทื, ืืื ืืขื ืืฆื ืืื, ืขืก ืืืึธืื ืืืกืงืืืขื, ืืึธื ืึทืจืืขืื ืืื ืคึผืื ืงื ืื ืืขืืืข ืืืขื, ื ืืฉื ืืจืืขืื). ืืขืืืขื ืงืึทื ืกืึทืงืืืขื ืกืึทื ืืขื ืขื ืืืืืึทื ืืืืึทื, ืคึฟืืืืจืืจืื ื ืืื ืฆืืืขืืืืื ืืื ืฉืืจืขื ื ืืื ืืขืืืขื, ืืื ืคึฟืืืืจืืจืื ื ืืื ืืืขืจืึทืคืืื ืฆื ืขืืืืื ืืจื ืึทืืข ืืขืืืขื ืืืขืงืืึธืจืก. ืืืขืจ ืืขืจ ืืขืงืึทื ืืืึทื ืืืึธืก ืืขืคืืจื ืฆื ืื ืจืื ืขื ืคืื ืืึผืจืื ืืื ืืึทืื ืืื ืคืืจืืืืื ืึท ืืืกืืขืจืืข. ื ืืืืฉ ืฉืคึผืขืืขืจ, ืื ืืฉืืง ืืึทืจืืื ืืื ืืขืืืขื ืคืืจืืืื ืืื ืจืืืึทืืืื, ืืื ืื ืึทื ืึทืืืกืืก ืคืื ืื ืกืืืืช ืคืื ืื ืืฉืืง ืืื ืคึผืึธืืกืืคึผืึธืื ื ืืื ืืขืกืขืจ ืฆืืื.
OpenResty ืืื ืึท ืืืืขืจ ืคืึธืืงืก ืคึผืืืืื ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืฉืจืืึทืื Lua ืกืงืจืืคึผืก ืืื nginx, ืืื ืขืก ืืื ืืขื ืืฆื ืืื ืขืืืขืืข Mail.ru ืคึผืจืึทืืืฉืขืงืก, ืึทืืื ืื ืคึผืจืึธืืืขื ืืื ื ืืฉื ืืขืจืขืื ื ืืื ืกืึทืืืื. ืืื ื ืึธื ืขืืืขืืข ืืึธื, ืืื ืืขืกืึธืฃ ืืืืืขืงืขืจื ืฆื ืขืก ืืื ืกืืจ ืฆื ืคึฟืึทืจืฉืืืื ืื ืืืช ืกืืืืช, ืืขืืืขื ืงืึทื ืกืึทืงืืืขื ืกืึทื ืืื ืืึทืื ืจืขืงืึทืืึทื ืืืืฉืึทื ื ืคึฟืึทืจ ืืขืืืขืืึธืคึผืขืจืก. ืื ืืืืืืขื ืืืขื ืืื ืื ืขืงืกืงืึทืืืืืฉืึทื ืคืื ืื ืืงืืจ ืงืึธื ะธ . ืขืก ืืึธื ืืื ืึทืจืืืกืืขืืืืื ืึทื:
- ืืื nginx, ืืืขื ืืืจ ื ืืฆื ืจืืจืืื ืืื ืืึทื ืืฆืขืจ ืืึทืื, ืขืก ืืื ืื ืืขืืืขืืงืืื ืคืื ืืืขืืืืืึทืืขืจ ืืจืึทืืืขืจืกืึทื (ืืื ืืืกืืึธืืข SSRF) ืืื ืขืืืขืืข ืงืึทื ืคืืืืขืจืืืฉืึทื ื, ืึธืืขืจ ืืึธืก ืืื ืึท ืืึทืืืืกื ืคืึทืงื ืืื ืืึธื ืืืื ืืืืขืงืืึทื ืืืจื ืกืืึทืืืง ืงืึทื ืคืืืืขืจืืืฉืึทื ืึทื ืึทืืืืขืจืก. ะธ ืคึฟืื ืืึทื ืืขืงืก (ืืึธ, ืืืจ ื ืืฆื ืืึธืก ืืืื, ืืึทื ืงืขื). ืืืขื ืืืจ ื ืืฆื OpenResty, ืืขื ืฉืืจืื ืืื ืืจืื ื ืฆื ืคืึทืจืคืืจื, ืึธืืขืจ ืืึธืก ืืื ื ืืฉื ืืืืจืงื ืืื ืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื.
ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืึทืฉืคึผืื:
location ~ /rewrite { rewrite ^.*$ $arg_x; } location / { root html; index index.html index.htm; }ืืึทืืืขืก
curl localhost:8337/rewrite?x=/../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
... - Nginx ืืื ืึท ืืฉืืง ืืืึธืก ื ืืืงืึธืจื ืฆื ืจืื ืขื ืืืื ืื ืจืืจืืื ืฉืืจื ืึผืืื ืึท ื ืึทื ืืืื. ืืืขื ืึท ืจืืืขืจืขืงื ืืื ืืจืืืก, nginx ืึทืืึทืงืืืฅ ืึท ื ืืึท ืืึผืจืื ืืึทืคืขืจ ืงืึธืจืึทืกืคึผืึทื ืืื ื ืฆื ืื ืคืื ืืขื ื ืคืื ืื ืฉืืจื, ืึธืืขืจ ืงืึทืคึผืื ืื ืฉืืจื ืืึธืจื ืืืจื ืึท ืฉืืจื ืคึฟืื ืงืฆืืข ืืื ืืืึธืก ืื ื ืื ืืืื ืืื ืึท ืฉืืจื ืืขืจืืื ืึทืืึธืจ, ืึทืืื ืื ืฉืืจื ืืื ืงืึทืคึผืื ืืืืื ืืื ืื ื ืื. ืืืื; ืื ืจืขืฉื ืคืื ืื ืืึทืคืขืจ ืึผืืื ืึทื ืื ืืฉืืึทืืืืื ืืึทืื. ื ืืืืืืื ืึทื ืึทืืืกืืก ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื .
ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืึทืฉืคึผืื (^@ ื ืื ืืืื)
location ~ /memleak { rewrite ^.*$ "^@asdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdasdf"; } location / { root html; index index.html index.htm; }ืืึทืืืขืก
curl localhost:8337/secret -vv
...
curl localhost:8337/memleak -vv
...
Location: http://localhost:8337/secret
...
- Nginx ืคึผืจืึทืืขืงืฅ GET ืคึผืึทืจืึทืืขืืขืจืก ืคืื ืื ืืืฉืขืงืฉืึทื ืคืื ืกืขืจืืืืก ืืืชืืืช ืืื ืืืื ืขืก ืืขืืืขื ืฆื ื ืืฆื ืืืืื GET ืคึผืึทืจืึทืืขืืขืจืก ืืื ืจืืจืืื. ืืขืจืืืขืจ, ืขืก ืืื ื ืื ืืขืืืขื ืฆื ืืืืืจืข ืื ืืืฉืขืงืฉืึทื ืืืจื ืืึทื ืืฆืขืจ-ืงืึทื ืืจืึธืืื ืคึผืึทืจืึทืืขืืขืจืก ืืื nginx. POST ืคึผืึทืจืึทืืขืืขืจืก ืืขื ืขื ื ืืฉื ืคึผืจืึธืืขืงืืขื. OpenResty ืึทืืึทืื ืืืจ ืฆื ืึทืจืืขืื ืืื ืืืืืข GET ืืื POST ืคึผืึทืจืึทืืขืืขืจืก, ืึทืืื ืืืขื ืืืจ ื ืืฆื POST ืคึผืึทืจืึทืืขืืขืจืก ืืืจื OpenResty, ืขืก ืืื ืืขืืืขื ืฆื ืึทืจืืึทื ืฉืคึผืจืืฆื ืกืคึผืขืฆืืขืืข ืืืชืืืช.
ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืึทืฉืคึผืื:
location ~ /memleak { rewrite_by_lua_block { ngx.req.read_body(); local args, err = ngx.req.get_post_args(); ngx.req.set_uri( args["url"], true ); } } location / { root html; index index.html index.htm; }ืจืขืืืืืึทื:
curl localhost:8337 -d "url=secret" -vv
...
curl localhost:8337 -d "url=%00asdfasdfasdfasdfasdfasdfasdfasdf" -vv
...
Location: http://localhost:8337/{...ะผะพะถะตั ัะพะดะตัะถะฐัั secret...}
...
ืืืืึทืืขืจ ืึธืคึผืจืืฃ
ืืขืจ ืคึผืจืึธืืืขื ืืื ืืขืืืขื ืืขืืืืื ืฆื ืื ืืขืืืขืืึธืคึผืขืจืก ืคืื nginx ืืื OpenResty, ืื ืืขืืืขืืึธืคึผืขืจืก ืืึธื ื ืื ืืึทืืจืึทืืื ืืขื ืคึผืจืึธืืืขื ืืื ืึท ืืืืขืจืืืื ืืฉืืง ืืื nginx, ืืืืึทื ืืื nginx ืืื ืขืก ืืื ืงืืื ืืืขื ืฆื ืืืืืจืข ืืขื ืืขืืช ืืืจื ืื ืื ืืืฉืขืงืฉืึทื ืคืื ืกืคึผืขืฆืืขืืข ืืืชืืืช, ืคืึทืจืจืืืื ืืื ืืจืืืก ืืขื 16ืื ืืขืฆืขืืืขืจ. ืืื ืื 4 ืืืฉืื ืืื ื ืืขื ืืึทืจืืื, ืงืืื ืขื ืืขืจืื ืืขื ืืขื ืขื ืืขืืืื ืฆื OpenResty, ืืึธืืฉ ืขืก ืืื ืืขืืืขื ืึท ืคืืจืฉืืื ื ืึทื ืึท ืืืืขืจ ืืืขืจืกืืข ืคืื โโโโืื ngx.req.set_uri() ืคึฟืื ืงืฆืืข ืืื ืืืจืฃ. ืืืืฃ 18 ืืขืจืฅ 2020 ืืืจ ืคืืจืขืคื ืืืขืื ืืื ืคึฟืึธืจืืึทืฆืืข, ืืืืฃ 21 ืืขืจ OpenResty ืคืจืื , ืืืึธืก ืืืกืืฃ URI ืืืึทืืึทืืืืฉืึทื.
Portswigger ืืื ืึทืจืืืงื ืืื ืืขื ืืืขื ืืึทืืขืจืงืื ืืขื ืคืื OpenResty ืืื Nginx (ืืึธืืฉ ืื ืืึทืืขืจืงืื ื ืึทื ืืืืื ืึท ืงืืืื ืคืจืึทืืืขื ื ืคืื ืืึผืจืื ืืื ืืงืกืคึผืึธืืื ืืื ืคืึทืืฉ ืืื ืืืกืืืืื ื, ืืึธืก ืืื ืืืฉืืืกื ืืืจื ืื ืืขื ื ืคืื ืื ืฉืืจื ื ืึธื ืื ื ืึทื ืืืื ืืื, ืืื ืืขืจ ืึทืืืขืง ืคืื ืืงืกืคึผืืืกืึทื ืจืืกืืจืืงืฉืึทื ื ืืืืฃ ืื ืืขื ื, ืงืขื ืขื ืืืื ืงืึทื ืืจืึธืืื ืืืจื ืื ืึทืืึทืงืขืจ).
ืึทืืื ืืืึธืก ืืื ืืขืจ ืืจืืึทื ืืื ืืืึธืก ืงืขื ืขื ืืืื ืืขืืื ืฆื ืคืึทืจืืืึทืื ืขืก?
ืืื ืืขืืืขื ืึท ืืฉืืง ืืื nginx? ืืึธ, ืขืก ืืื ืืขืืืขื, ืืืืึทื ืืืงืื ื ืืืงืึธืจื ืืื ืืึทืื ืืื ืึท ืืขืืช ืืื ืงืืื ืคืึทื.
ืืื ืืขืืืขื ืึท ืืฉืืง ืืื OpenResty? ืืึธ, ืืื ืืื ืืกืืขืจ ืื ืึทืจืืืกืืขืื ืคืื ืื ืืืืขืจืืืื ืคืื ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืืขืคึฟืื ื ืืืจื OpenResty ืืื ื ืืฉื ืื ืืืขืกืืึทืืืืืึทื ืืื ืืึทืงืืืืขื ืืึทื.
ืืื ืืขืืืขื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื / ื ืืฆื ืืขืืช ืืื OpenResty? ืืึธ, ืืืืึทื ืืื ืืขืจ ืึทืืืขืง ืคืื ืึท ืืงืกืคึผืืืกืึทื ืืืกืืึธืืื ื, ืึทื ืึทื ืืืขืจืึทืคืืื ืืึทืฉืึธืจืข ืืื ืืขืืืื ืืืขืื ืื ืืืืขืจืืืื ืคืื ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืืขื ืืฆื.
ืืืึธืก ืคืื ืื ืืึทืื ืืื ืึท ืืืืขืจืืืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืึท ืืจืืืืืึทืจืฆืืงืืื ืคืื $ 10000? ืคึฟืึทืจ ืืื ืื, ืืึธืก ืืื ืืืื ื ืืฉื ืืืืืืืง. ืืื ืงืืื ืืืืืืืืืจื, ืกืคึผืขืฆืืขื ืืื ืื ืื ืืขืจืกืขืงืฉืึทื ืคืื ืขืืืขืืข ืงืึทืืคึผืึธืื ืึทื ืฅ, ืกืคึผืขืฆืืขื ืื ืฆืืืขืฉืืขืื ืืืจื ืคืึทืจืฉืืืขื ืข ืคึผืจืึทืืืฉืขืงืก ืืื ืืขืืืขืืึธืคึผืขืจืก, ืงืืื ืืืื ืขืจ ืงืขื ืขื ืืึทืจืึทื ืืืจื ืึทื ืึทืืข ืื ืคึฟืขืึดืงืืืื ืคืื ืืืืขืจ ืึทืจืืขื ืืขื ืขื ืืึทืืืืกื ืืื ืืึทืงืืืืขื ืืึทื ืืื ืึทื ืขืก ืืขื ืขื ืงืืื ืขืจืจืึธืจืก. ืืขืจืืืขืจ, ืงืืื ืืืืขืจืืืื ืืืึทืื ืขืจืึทืืืืืื ืึทืงืขืจื ืคึผืื ืงื ืืื ืขืก ืึทืคืขืงืฅ ืืืืขืจืืืื.
ืืื ืงืืื ืคืึทื, ืขืก ืืื ืืื ืคืืจ ืฆื ื ืึธืจืืึทืืืื ืึธืืขืจ ืืึทืืจืขื ืขืฆื / ืคืืืืขืจ ืืื ืคืื ืืื ืืขืืืขื ืื ืึทืจืืึทื ืฉืจืืึทื ืืึทืื ืืืึธืก ืืืื ืืื ืงืืื ืคืื ืืจืืืกื ืืืง ืืึธืืืืข / API, ืกืืึทืื ืขืก ืืขื ืขื ืืงืกืคึผืืืกืึทื ืื ืกืืจืึทืงืฉืึทื ื ืืื ืึท ืงืืึธืจ ืคืืจืฉืืื ื ืึทื ืืึธืก ืืื ื ืืฉื ืคืืจืืื ืื.
ืขืจืจืึทืืึท
ืคืื ืืขืจืคืึทืจืื ื , ืืฉื ืฉืืืจื ืขื ืืืจืช ืืืฉืื:
ืืฉืืง ืืจืืืืืึทืจืฆืืงืืื - ืืฉืืง ืืืืขื ืคืึทืจืืขืกื
ืืฉืืง ืืึทืจืืื - ืืขืืช ืึธื ืืึธื
ืจืืืืจืขืงื - ืจืืืขืจืขืงืฉืึทื
ืึธืคึฟื ืืงืืจ - ืึธืคึฟื ืืงืืจ
ืขืจืจืึทืืึท - ืึทืจืืขื ืืืืฃ ืืืกืืืืงืก
ืืงืืจ: www.habr.com