DVWA靶场实战(六)——Insecure CAPTCHA

DVWA靶场实战(六)

六、Insecure CAPTCHA:

1.漏洞原理:

  Insecure CAPTCHA(不安全的验证码),CAPTCHA全程为Completely Automated Public Turing Test to Tell Computers and Humans Apart(全自动区分计算机和人类的图灵测试)的简称。这一模块的内容叫做不安全的验证流程比较好,主要是验证流程出现了逻辑漏洞,而不是谷歌的验证码有问题。这一模块验证码使用的是Google提供的reCAPTCHA服务,以下是验证具体的流程。

DVWA靶场实战(六)——Insecure CAPTCHA插图

  服务器通过调用recaptcha_check_answer函数检查用户输入的正确性。

  recaptcha_check_answer($privkey,$remoteip,$challenge,$response)

  参数$privey是服务器申请的private key,$remoteip是用户的IP,$challenge是recaptcha_challenge_field字段的值,来自前端页面,$response是recaptcha_response_field字段的值。函数返回ReCaptchaResponse class的实例,ReCaptchaResponse类有2个属性:

  $is_valid是布尔型的,表示校验是否有效。

  $error是返回的错误代码。

2.注意事项:

  这里打开DVWA靶场的Inseure CAPTCHA的时候,会发现上方有一行这样的报错“reCAPTCHA API key missing from config file: D:phpstudy_proWWWDVWAconfigconfig.inc.php”这种情况。

DVWA靶场实战(六)——Insecure CAPTCHA插图1

  出现这种情况是因为使用reCAPTCHA没有申请密钥,因此需要手动填入密钥,打开提示的配置文件找到文件“config.inc.php”,然后我们找到如下:

$_DVWA[ 'recaptcha_public_key' ]  = ' ';
$_DVWA[ 'recaptcha_private_key' ] = ' ';

  然后将他们改为如下,然后就可以保存了,最后就可以开始进行实战项目了。

$_DVWA[ 'recaptcha_public_key' ]  = '6LdK7xITAAzzAAJQTfL7fu6I-0aPl8KHHieAT_yJg';
$_DVWA[ 'recaptcha_private_key' ] = '6LdK7xITAzzAAL_uw9YXVUOPoIHPZLfw2K1n5NVQ';

DVWA靶场实战(六)——Insecure CAPTCHA插图2

3.实战:

(1)Low:

  代码分析:

php

if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
    // Hide the CAPTCHA form
    $hide_form = true;

    // Get input
    $pass_new  = $_POST[ 'password_new' ];
    $pass_conf = $_POST[ 'password_conf' ];

    // Check CAPTCHA from 3rd party
    $resp = recaptcha_check_answer(
        $_DVWA[ 'recaptcha_private_key'],
        $_POST['g-recaptcha-response']
    );

    // Did the CAPTCHA fail?
    if( !$resp ) {
        // What happens when the CAPTCHA was entered incorrectly
        $html     .= "

The CAPTCHA was incorrect. Please try again.

";
$hide_form = false;
return;
}
else {
// CAPTCHA was correct. Do both new passwords match?
if( $pass_new == $pass_conf ) {
// Show next stage for the user
$html .= "


You passed the CAPTCHA! Click the button to confirm your changes.

$pass_new}" />
$pass_conf}" />


";
}
else {
// Both new passwords do not match.
$html .= "

Both passwords must match.

";
$hide_form = false;
}
}
}

if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
// Hide the CAPTCHA form
$hide_form = true;

// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];

// Check to see if both password match
if( $pass_new == $pass_conf ) {
// They do!
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_new = md5( $pass_new );

// Update database
$insert = "UPDATE users SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

// Feedback for the end user
$html .= "

Password Changed.

";
}
else {
// Issue with the passwords matching
$html .= "

Passwords did not match.

";
$hide_form = false;
}

((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?> 

  这里修改密码一共有两个步骤,第一步是CAPTCHA的验证环节,第二步是将参数POST到后台。由于两步操作完全是分开的,没有联系,于是我们可以忽略第一步的验证,直接提交修改申请。两个步骤对应的step参数不同,可以通过抓取报文并且修改step,来实现的验证绕过。代码没有对CSRF进行任何的防护,可以利用CSRF进行攻击。

  我们开始进行攻击,我们思路就是将第一步跳过直接进行第二步。所以我们这里将输入两个一致的密码不进行验证,直接用Burpsuite进行抓包操作。DVWA靶场实战(六)——Insecure CAPTCHA插图3

  将“step1”修改为“step2”重新发送后,得到以下界面,说明修改成功。

DVWA靶场实战(六)——Insecure CAPTCHA插图4

(2)Medium:

  代码分析:

php

if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
    // Hide the CAPTCHA form
    $hide_form = true;

    // Get input
    $pass_new  = $_POST[ 'password_new' ];
    $pass_conf = $_POST[ 'password_conf' ];

    // Check CAPTCHA from 3rd party
    $resp = recaptcha_check_answer(
        $_DVWA[ 'recaptcha_private_key' ],
        $_POST['g-recaptcha-response']
    );

    // Did the CAPTCHA fail?
    if( !$resp ) {
        // What happens when the CAPTCHA was entered incorrectly
        $html     .= "

The CAPTCHA was incorrect. Please try again.

";
$hide_form = false;
return;
}
else {
// CAPTCHA was correct. Do both new passwords match?
if( $pass_new == $pass_conf ) {
// Show next stage for the user
$html .= "


You passed the CAPTCHA! Click the button to confirm your changes.

$pass_new}" />
$pass_conf}" />



";
}
else {
// Both new passwords do not match.
$html .= "

Both passwords must match.

";
$hide_form = false;
}
}
}

if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
// Hide the CAPTCHA form
$hide_form = true;

// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];

// Check to see if they did stage 1
if( !$_POST[ 'passed_captcha' ] ) {
$html .= "


You have not passed the CAPTCHA.

";
$hide_form = false;
return;
}

// Check to see if both password match
if( $pass_new == $pass_conf ) {
// They do!
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_new = md5( $pass_new );

// Update database
$insert = "UPDATE users SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

// Feedback for the end user
$html .= "

Password Changed.

";
}
else {
// Issue with the passwords matching
$html .= "

Passwords did not match.

";
$hide_form = false;
}

((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

  我们可以看出基于Low级别,在第二步增加了第一步是否通过的验证,即判断参数passed_captcha是否为真。Passed_captcha参数是通过POST提交的,整个请求也就是POST请求,故可以人为加上此参数。

  接下来我们开始攻击,一共也是分两步,但是不同于Low,我们这次使用Burpsuite开始修改报文,将步骤直接调整到第二步,第二步的验证伪造为已验证。然后我们直接加入passed_captcha参数,混入POST参数提交。将“step=1”改为“step=2”,然后加上“&passed_capcha=true”即可。

DVWA靶场实战(六)——Insecure CAPTCHA插图5      

  放包以后,我们可以观察到页面显示“Password Change”成功即是完成。

DVWA靶场实战(六)——Insecure CAPTCHA插图6

(3)High:

  代码分析:

php

if( isset( $_POST[ 'Change' ] ) ) {
    // Hide the CAPTCHA form
    $hide_form = true;

    // Get input
    $pass_new  = $_POST[ 'password_new' ];
    $pass_conf = $_POST[ 'password_conf' ];

    // Check CAPTCHA from 3rd party
    $resp = recaptcha_check_answer(
        $_DVWA[ 'recaptcha_private_key' ],
        $_POST['g-recaptcha-response']
    );

    if (
        $resp || 
        (
            $_POST[ 'g-recaptcha-response' ] == 'hidd3n_valu3'
            && $_SERVER[ 'HTTP_USER_AGENT' ] == 'reCAPTCHA'
        )
    ){
        // CAPTCHA was correct. Do both new passwords match?
        if ($pass_new == $pass_conf) {
            $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
            $pass_new = md5( $pass_new );

            // Update database
            $insert = "UPDATE users SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "' LIMIT 1;";
            $result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '
' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

// Feedback for user
$html .= "

Password Changed.

";

} else {
// Ops. Password mismatch
$html .= "

Both passwords must match.

";
$hide_form = false;
}

} else {
// What happens when the CAPTCHA was entered incorrectly
$html .= "


The CAPTCHA was incorrect. Please try again.

";
$hide_form = false;
return;
}

((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

// Generate Anti-CSRF token
generateSessionToken();

?>

  High级别将验证流程合并,通过连续的判断将两个步骤相同的部分合并,避免第一步验证的直接改参绕过。加入了token机制,有效防止了CSRF漏洞攻击,下面不再做攻击页面。

  我们开始攻击,看到了后端代码发现了,及时不验证也有机会绕过验证,于是针对g-recaptcha-response和HTTP_USER_AGENT操作。

同样不验证,直接提交请求对相关参数进行抓包修改。

DVWA靶场实战(六)——Insecure CAPTCHA插图7 

(4)Impossible:

  代码分析: 

php

if( isset( $_POST[ 'Change' ] ) ) {
    // Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

    // Hide the CAPTCHA form
    $hide_form = true;

    // Get input
    $pass_new  = $_POST[ 'password_new' ];
    $pass_new  = stripslashes( $pass_new );
    $pass_new  = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass_new  = md5( $pass_new );

    $pass_conf = $_POST[ 'password_conf' ];
    $pass_conf = stripslashes( $pass_conf );
    $pass_conf = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_conf ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass_conf = md5( $pass_conf );

    $pass_curr = $_POST[ 'password_current' ];
    $pass_curr = stripslashes( $pass_curr );
    $pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass_curr = md5( $pass_curr );

    // Check CAPTCHA from 3rd party
    $resp = recaptcha_check_answer(
        $_DVWA[ 'recaptcha_private_key' ],
        $_POST['g-recaptcha-response']
    );

    // Did the CAPTCHA fail?
    if( !$resp ) {
        // What happens when the CAPTCHA was entered incorrectly
        $html .= "

The CAPTCHA was incorrect. Please try again.

";
$hide_form = false;
}
else {
// Check that the current password is correct
$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
$data->execute();

// Do both new password match and was the current password correct?
if( ( $pass_new == $pass_conf) && ( $data->rowCount() == 1 ) ) {
// Update the database
$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
$data->execute();

// Feedback for the end user - success!
$html .= "

Password Changed.

";
}
else {
// Feedback for the end user - failed!
$html .= "

Either your current password is incorrect or the new passwords did not match.
Please try again.

";
$hide_form = false;
}
}
}

// Generate Anti-CSRF token
generateSessionToken();

?>

  Impossible的代码作为防御模板,使用Anti-CSRF token机制防御CSRF攻击。验证步骤合并为同一步,无需分开,使得验证环节无法绕过。要求输入修改之前的密码,攻击者无法绕过。利用PDO技术输入内容过滤,防止了sql注入。

文章来源于互联网:DVWA靶场实战(六)——Insecure CAPTCHA

THE END
分享
二维码