基于mezzanine的攻防比赛环境搭建及XXE漏洞构造

发表于 | 分类于 | | 阅读次数

虚拟部署

virtualenv是python环境配置和切换工具，进入该虚拟环境后，pip安装的软件不影响当前主环境，这样就能很好的安装几个python版本了，解决了库之间的依赖关系。
安装virtualenv和pip
sudo apt-get install python-virtualenv python-pip

创建虚拟部署环境

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
gongfangbisai@ubuntu:~$virtualenv -p /usr//bin/python2.7 app
gongfangbisai@ubuntu:~$ cd app/
gongfangbisai@ubuntu:~/app$ ls
bin  include  lib  local
gongfangbisai@ubuntu:~/app$ source bin/activate
(app)gongfangbisai@ubuntu:~/app$ pip install mezzanine
Downloading/unpacking mezzanine
  Downloading Mezzanine-3.1.10-py2.py3-none-any.whl (5.7MB): 5.7MB downloaded
Downloading/unpacking bleach>=1.4 (from mezzanine)
  Downloading bleach-1.4.1.tar.gz
``` 
首先使用virtualenv创建一个虚拟节点app，然后使用source激活，再在激活的节点下pip安装mezzanine，安装完mezzanine之后使用mezzanine-project来创建一个工程。 
```bash
(app)gongfangbisai@ubuntu:~/app$ mezzanine-project myproject
(app)gongfangbisai@ubuntu:~/app$ cd myproject/
(app)gongfangbisai@ubuntu:~/app/myproject$ ls
deploy  fabfile.py  __init__.py  local_settings.py  manage.py  requirements.txt  settings.py  urls.py  wsgi.py
(app)gongfangbisai@ubuntu:~/app/myproject$ python manage.py createdb
Creating tables ...
Creating table auth_permission
Creating table auth_group_permissions
Creating table auth_group
..........
You just installed Django's auth system, which means you don't have any superusers defined.
Would you like to create one now? (yes/no): yes
Username (leave blank to use 'gongfangbisai'): gongfangbisai
Email address: shengqi158@gmail.com
Password:
Password (again):
Superuser created successfully.
A site record is required.
Please enter the domain and optional port in the format 'domain:port'.
For example 'localhost:8000' or 'www.example.com'.
Hit enter to use the default (127.0.0.1:8000):
Creating default site record: 127.0.0.1:8000 ...
Installed 2 object(s) from 1 fixture(s)
Would you like to install some initial demo pages?
Eg: About us, Contact form, Gallery. (yes/no): yes
Creating demo pages: About us, Contact form, Gallery ...
Installed 16 object(s) from 3 fixture(s)
Installing custom SQL ...
Installing indexes ...
Installed 0 object(s) from 0 fixture(s)
(app)gongfangbisai@ubuntu:~/app/myproject$ ls
deploy  fabfile.py   __init__.pyc       local_settings.pyc  requirements.txt  settings.pyc  urls.py
dev.db  __init__.py  local_settings.py  manage.py           settings.py       static        wsgi.py
``` 
使用mezzanine-project myproject创建完工程之后就是创建数据库，使用命令python manage.py createdb 即可，由于mezzanine是基于django框架的，可以看到一些基于django的数据库的创建。再接着会提示输入超级管理用户的用户名，email，密码，请记住，这是mezzanine系统的超级管理员。接下来我们试运行一下： 
```bash
(app)gongfangbisai@ubuntu:~/app/myproject$ python manage.py runserver 0.0.0.0:8000

再接着在浏览器访问127.0.0.1：8000，如果正常说明mezzanine的搭建第一步ok。

采用uwsgi + nginx 方案部署

前期准备

首先是安装nginx，uwsgi，再接着集中模板和静态文件，这样好配置静态路径

1
2
3
4
python manager.py collectstatic
python manager.py collecttemplates
sudo apt-get install nginx
sudo apt-get install uwsgi

请求的发送过程大概如下,如果在最后的测试中报错的话就得按照数据的走向来排查问题：

--> nginx --> uwsgi --> mezzanine(django)```
1
2
3
4
5
### nginx 配置
安装好nginx之后，/etc/init.d/nginx start 即可以启动nginx，在页面访问80端口就能查看到nginx的欢迎页面。重要是配置：
nginx的默认配置文件路径：/etc/nginx/
在/etc/nginx/sites-enabled 新建自己的配置文件，从sites-available拷贝一个default重命名为mysite_nginx.conf,编辑如下：

server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;

 root /home/gongfangbisai/app/myproject/; #网站的root目录
 index index.html index.htm;

 # Make site accessible from http://localhost/
 server_name localhost;

location /static {    #静态配置文件
    autoindex on;
    alias /home/gongfangbisai/app/myproject/static;
    access_log off;
    log_not_found off;
}

 location / {        #非静态请求，通过本地的8630端口来通信，这就是uwsgi后续要启动的端口
      # First attempt to serve request as file, then
      # as directory, then fall back to displaying a 404.
      try_files $uri $uri/ =404;
      # Uncomment to enable naxsi on this location
      # include /etc/nginx/naxsi.rules
      uwsgi_pass 127.0.0.1:8630;         
    include /home/gongfangbisai/app/myproject/uwsgi_params;
 }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
修改完之后，可通过nginx -t 来测试配置文件是否有语法错误，确认ok之后即可启动。
### uwsg 配置
wsgi.py的内容具体如下：
```python
from __future__ import unicode_literals
import os
PROJECT_ROOT = os.path.dirname(os.path.abspath(__file__))
settings_module = "%s.settings" % PROJECT_ROOT.split(os.sep)[-1]
os.environ.setdefault("DJANGO_SETTINGS_MODULE", settings_module)
from django.core.wsgi import get_wsgi_application
application = get_wsgi_application()

下面是配置wsgi：
在网站根目录新建wsgi.xml，具体如下：
(app)gongfangbisai@ubuntu:~/app/myproject$ cat wsgi.xml

1
2
3
4
5
6
7
8
9
10
11
<uwsgi>
    <socket>127.0.0.1:8630</socket>
    <master>true</master>
    <chdir>/home/gongfangbisai/app/myproject/</chdir>
    <pythonpath>..</pythonpath>
    <module>wsgi</module>
    <wsgi-file>wsgi.py</wsgi-file>
    <enable-threads>true</enable-threads>>
    <processes>4</processes>>
    <plugin>python</plugin>
</uwsgi>

socket 是和nginx通信接口，pythonpath 为..，这样才能包含djaong的setting，chdir为网站根目录。

1
(app)gongfangbisai@ubuntu:~/app/myproject$ uwsgi -x wsgi.xml，

启动起来之后访问首页ok，但是到一些具体的功能页的时候就报404，查看输出日志，uwsgi出现404的时候没动，nginx有日志，也就是说请求到了nginx就没发到uwsgi了，按道理应该是nginx的配置有问题，就查nginx的日志实在找不出问题，而且关键是想不到搜索的关键字，总报404于是就将nginx的配置文件的try_files $uri $uri/ =404;注释掉，这回uwsgi有输出了，显示如下：
– unavailable modifier requested: 0 –
搜索该关键字，很多人遇到这个问题，好吧，再把相应的库给装上吧

apt-get install uwsgi-plugin-python```
1
2
3
4
5
6
装上库之后再sudo uwsgi -x wsgi.xml总报：
```bash
ImportError: No module named mezzanine
unable to load app 0 (mountpoint='') (callable not found or import error)

找了一下，说是python的路径问题，直接在该环境下python，再找sys.path没问题，后来再一看是自己手贱多加了个sudo，导致python环境不对，去掉sudo 运行uwsgi OK。

XXE漏洞的构造

前期调研未做好，装了ubuntu13.04，装它的原因就是因为他最近没有报本地提权漏洞，有点因小失大。好吧，总不能从头安装mezzine吧，于是拿libxml下手，选用的python的lxml作为问题程序，其etree.so依赖libxml2和libxslt.
于是安装存在xxe漏洞的libxml和libxlst，低于2.9.0，到http://xmlsoft.org/sources/ 下载相应的软件包，这里libxml选择2.8，libxlst选择1.2.27

1
2
3
gongfangbisai@ubuntu:~$ tar -zxvf libxslt-1.1.27.tar.gz
gongfangbisai@ubuntu:~$ cd libxslt-1.1.27/
gongfangbisai@ubuntu:~/libxslt-1.1.27$ ./configure&make 最后make install 它会装在/usr/local/lib目录下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
gongfangbisai@ubuntu:~/libxslt-1.1.27$ python
Python 2.7.6 (default, Jun 22 2015, 17:58:13)
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from lxml import etree
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: /usr/lib/x86_64-linux-gnu/libxml2.so.2: version `LIBXML2_2.9.0' not found (required by /usr/lib/python2.7/dist-packages/lxml/etree.so)
>>>
gongfangbisai@ubuntu:~/libxslt-1.1.27$ ldd /usr/lib/python2.7/dist-packages/lxml/etree.so
/usr/lib/python2.7/dist-packages/lxml/etree.so: /usr/lib/x86_64-linux-gnu/libxml2.so.2: version `LIBXML2_2.9.0' not found (required by /usr/lib/python2.7/dist-packages/lxml/etree.so)
/usr/lib/python2.7/dist-packages/lxml/etree.so: /usr/lib/x86_64-linux-gnu/libxml2.so.2: version `LIBXML2_2.9.0' not found (required by /usr/lib/x86_64-linux-gnu/libxslt.so.1)
        linux-vdso.so.1 =>  (0x00007fffb9cc6000)
        libxslt.so.1 => /usr/lib/x86_64-linux-gnu/libxslt.so.1 (0x00007fca6d652000)
        libexslt.so.0 => /usr/lib/x86_64-linux-gnu/libexslt.so.0 (0x00007fca6d43d000)
        libxml2.so.2 => /usr/lib/x86_64-linux-gnu/libxml2.so.2 (0x00007fca6d0df000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fca6cec1000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fca6cafc000)
        libgcrypt.so.11 => /lib/x86_64-linux-gnu/libgcrypt.so.11 (0x00007fca6c87d000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fca6c679000)
        libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fca6c460000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fca6c159000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fca6dc02000)
        libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007fca6bf55000)

安装完这两个软件后，通过strace python test.py > test.log 2>&1发现其还是依赖原先libxml，第一步想到的是update-alternatives,

1
2
gongfangbisai@ubuntu:~/app/myproject/static/media/uploads$ update-alternatives --list libxml
update-alternatives: error: no alternatives for libxml

怎么都不提示有两个版本的的libxml，那怎么办呢，强制修改软链接：

1
2
3
4
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ sudo ln -s /usr/local/lib/libxslt.so.1.1.27 libxslt.so
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ sudo rm libxslt.so.1
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ sudo ln -s /usr/local/lib/libxslt.so.1.1.27 libxslt.so.1
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ ldconfig

这样libxslt.so的依赖关系搞定了，通过同样的方式搞定libxml2，搞定这两个库之后，还是会提示etree.so依赖2.9的接口，怎么办呢，直接pip install -v lxml==3.0 这个xml版本就不存在依赖2.9接口的问题。在这里也引入了后面会遇到的一个问题，xx测试在python命令行中没有问题，但是在django环境中就有问题，总报库的依赖有问题，猛一回头发现是python虚拟环境搞得鬼，这个虚拟环境会引入libxml和libxslt这种系统lib下的库，但是像python的环境就不会引入，比如/usr/local/lib/python2.7/site-packages/下的，没办法只能在虚拟环境下重新安装了一遍lxml，这样就不会有库依赖的问题了。

gongfangbisai@ubuntu:~/app/myproject/static/media/uploads$ xmllint –noent a.xml //命令行测试比python更容易跟踪

解决了依赖问题，下面就是编码问题了：
django的登录认证：
./django/contrib/auth/views.py 在这里去掉修改密码的功能，注释掉password_change函数

去掉重置密码链接：直接注释用注释url链接
编辑grappelli_safe/templates/registration/ 相关页面

修改上传页面的逻辑处理，对于xml加上对entity的解释功能，这样就能导入一个xxe漏洞，修改filebrowser_safe/views.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
def decode_string(target):
    try:
        result = target.decode('utf8').encode('utf8')
        return (1,result)
    except:
        pass
    try:
        result = target.decode('gbk').encode('utf8')
        return (2,result)
    except:
        pass
    try:
        result = target.decode('gb2312').encode('utf8')
        return (3,result)
    except:
        pass
    try:
        result = target.decode('utf16').encode('utf8')
        return (4,result)
    except:
        pass
    try:
        result = target.decode('latin1').encode('utf8')
        return (5,result)
    except:
        pass
    return ''
def _upload_file(request):
            for line in filedata.chunks():
                code_type, line = decode_string(line)
                if code_type != 4 and 'ENTITY' in line:
                    msg = _('illegal xml, ENTITY found!!!!')
                    return HttpResponse(msg)
            uploadedfile = default_storage.save(file_path, filedata)
            if default_storage.exists(file_path) and file_path != uploadedfile:
                default_storage.move(smart_text(uploadedfile), smart_text(file_path), allow_overwrite=True)
            if file_path.lower().endswith(".xml"):
                from lxml import etree
                try:
                    msg = _('path:%s:%s:%s:%s' %(uploadedfile, file_path,directory,type(filedata.chunks())))
                    if default_storage.exists(file_path):
                        abs_path = smart_text(django_settings.MEDIA_ROOT + "/" + file_path)
                        tree = etree.parse(abs_path)
                        tree.write(abs_path)
#                    return HttpResponse(msg)
                except Exception,e:
                    msg = _('IOERROR:%s' %(e))
                    return HttpResponse(msg)