Leeyuxun の note

BUPT | SCSS

DVWA Insecure CAPTCHA

发表于 更新于 分类于

前言

Insecure CAPTCHA，不安全的验证码，主要是开发者验证流程，代码出现逻辑漏洞，并非谷歌验证码有漏洞。

验证码作用就是防止攻击者使用工具自动调用系统功能，防止恶意软件、机器人批操作，如注册、登录功能。对于Brute Force字典暴力破解，严密的验证码机制可以避免使用工具大量尝试登录。

reCAPTCHA验证流程

reCAPTCHA服务验证的具体流程如下；

服务器通过调用recaptcha_check_answer函数检查用户输入的正确性。

1
recaptcha_check_answer($privkey,$remoteip, $challenge,$response)

参数$privkey是服务器申请的private key，$remoteip是用户的ip，$challenge是recaptcha_challenge_field 字段的值，来自前端页面 ，$response是g-recaptcha-response字段的值。函数返回ReCaptchaResponse class的实例，ReCaptchaResponse 类有2个属性 ：

  • $is_valid是布尔型的，表示校验是否有效；
  • $error是返回的错误代码；

LOW

分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
<?php
    if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
        // Hide the CAPTCHA form
        $hide_form = true;
        // Get input
        $pass_new  = $_POST[ 'password_new' ];
        $pass_conf = $_POST[ 'password_conf' ];
        // Check CAPTCHA from 3rd party
        $resp = recaptcha_check_answer(
            $_DVWA[ 'recaptcha_private_key'],
            $_POST['g-recaptcha-response']
        );
        // Did the CAPTCHA fail?
        if( !$resp ) {
            // What happens when the CAPTCHA was entered incorrectly
            $html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
            $hide_form = false;
            return;
        }
        else {
            // CAPTCHA was correct. Do both new passwords match?
            if( $pass_new == $pass_conf ) {
                // Show next stage for the user
                echo "
                    <pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
                    <form action=\"#\" method=\"POST\">
                        <input type=\"hidden\" name=\"step\" value=\"2\" />
                        <input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
                        <input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
                        <input type=\"submit\" name=\"Change\" value=\"Change\" />
                    </form>";
            }
            else {
                // Both new passwords do not match.
                $html     .= "<pre>Both passwords must match.</pre>";
                $hide_form = false;
            }
        }
    }
    if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
        // Hide the CAPTCHA form
        $hide_form = true;
        // Get input
        $pass_new  = $_POST[ 'password_new' ];
        $pass_conf = $_POST[ 'password_conf' ];
        // Check to see if both password match
        if( $pass_new == $pass_conf ) {
            // They do!
            $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
            $pass_new = md5( $pass_new );
            // Update database
            $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
            $result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

            // Feedback for the end user
            echo "<pre>Password Changed.</pre>";
        }
        else {
            // Issue with the passwords matching
            echo "<pre>Passwords did not match.</pre>";
            $hide_form = false;
        }
        ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
    }
?>

分析：

第一步检查用户输入的验证码，验证通过后，服务器返回表单；

第二步客户端提交post请求，服务器完成更改密码的操作；

这其中存在明显的逻辑漏洞，服务器仅仅通过检查Change、step 参数来判断用户是否已经输入了正确的验证码。

攻击测试

根据后端代码，可以使用BurpSuite抓包，然后更改step参数为2，可以更改密码；

MEDIUM

分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
<?php
    if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
        // Hide the CAPTCHA form
        $hide_form = true;
        // Get input
        $pass_new  = $_POST[ 'password_new' ];
        $pass_conf = $_POST[ 'password_conf' ];
        // Check CAPTCHA from 3rd party
        $resp = recaptcha_check_answer(
            $_DVWA[ 'recaptcha_private_key' ],
            $_POST['g-recaptcha-response']
        );
        // Did the CAPTCHA fail?
        if( !$resp ) {
            // What happens when the CAPTCHA was entered incorrectly
            $html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
            $hide_form = false;
            return;
        }
        else {
            // CAPTCHA was correct. Do both new passwords match?
            if( $pass_new == $pass_conf ) {
                // Show next stage for the user
                echo "
                    <pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
                    <form action=\"#\" method=\"POST\">
                        <input type=\"hidden\" name=\"step\" value=\"2\" />
                        <input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
                        <input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
                        <input type=\"hidden\" name=\"passed_captcha\" value=\"true\" />
                        <input type=\"submit\" name=\"Change\" value=\"Change\" />
                    </form>";
            }
            else {
                // Both new passwords do not match.
                $html     .= "<pre>Both passwords must match.</pre>";
                $hide_form = false;
            }
        }
    }
    if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
        // Hide the CAPTCHA form
        $hide_form = true;
        // Get input
        $pass_new  = $_POST[ 'password_new' ];
        $pass_conf = $_POST[ 'password_conf' ];
        // Check to see if they did stage 1
        if( !$_POST[ 'passed_captcha' ] ) {
            $html     .= "<pre><br />You have not passed the CAPTCHA.</pre>";
            $hide_form = false;
            return;
        }
        // Check to see if both password match
        if( $pass_new == $pass_conf ) {
            // They do!
            $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
            $pass_new = md5( $pass_new );
            // Update database
            $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
            $result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
            // Feedback for the end user
            echo "<pre>Password Changed.</pre>";
        }
        else {
            // Issue with the passwords matching
            echo "<pre>Passwords did not match.</pre>";
            $hide_form = false;
        }
        ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
    }
?>

分析：

第二步验证时，参加了对参数passed_captcha的检查，如果参数值为true，则认为用户已经通过了验证码检查。

依然可以通过伪造参数绕过验证，本质上来说，这与Low级别的验证没有任何区别。

攻击测试

依旧抓包更改，除了更改step为2，还需添加passed_captcha为true；

HIGH

分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
<?php
    if( isset( $_POST[ 'Change' ] ) ) {
        // Hide the CAPTCHA form
        $hide_form = true;
        // Get input
        $pass_new  = $_POST[ 'password_new' ];
        $pass_conf = $_POST[ 'password_conf' ];
        // Check CAPTCHA from 3rd party
        $resp = recaptcha_check_answer(
            $_DVWA[ 'recaptcha_private_key' ],
            $_POST['g-recaptcha-response']
        );
        if (
            $resp || 
            (
                $_POST[ 'g-recaptcha-response' ] == 'hidd3n_valu3'
                && $_SERVER[ 'HTTP_USER_AGENT' ] == 'reCAPTCHA'
            )
        ){
            // CAPTCHA was correct. Do both new passwords match?
            if ($pass_new == $pass_conf) {
                $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
                $pass_new = md5( $pass_new );
                // Update database
                $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "' LIMIT 1;";
                $result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
                // Feedback for user
                echo "<pre>Password Changed.</pre>";
            } else {
                // Ops. Password mismatch
                $html     .= "<pre>Both passwords must match.</pre>";
                $hide_form = false;
            }
        } else {
            // What happens when the CAPTCHA was entered incorrectly
            $html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
            $hide_form = false;
            return;
        }
        ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
    }
    // Generate Anti-CSRF token
    generateSessionToken();
?>

分析：

服务器的验证逻辑是当$resp（这里是指谷歌返回的验证结果）是false，并且参数g-recaptcha-response不等于hidd3n_valu3（或者http包头的User-Agent参数不等于reCAPTCHA）时，就认为验证码输入错误，反之则认为已经通过了验证码的检查。

攻击检测

由于$resp参数无法控制，所以重心放在参数g-recaptcha-response、User-Agent上；

依旧抓包，更改参数g-recaptcha-response为hidd3n_valu3，更改User-Agent为reCAPTCHA；

IMPOSSIBLE

分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
<?php
    if( isset( $_POST[ 'Change' ] ) ) {
        // Check Anti-CSRF token
        checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
        // Hide the CAPTCHA form
        $hide_form = true;
        // Get input
        $pass_new  = $_POST[ 'password_new' ];
        $pass_new  = stripslashes( $pass_new );
        $pass_new  = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
        $pass_new  = md5( $pass_new );
        $pass_conf = $_POST[ 'password_conf' ];
        $pass_conf = stripslashes( $pass_conf );
        $pass_conf = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_conf ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
        $pass_conf = md5( $pass_conf );
        $pass_curr = $_POST[ 'password_current' ];
        $pass_curr = stripslashes( $pass_curr );
        $pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
        $pass_curr = md5( $pass_curr );
        // Check CAPTCHA from 3rd party
        $resp = recaptcha_check_answer(
            $_DVWA[ 'recaptcha_private_key' ],
            $_POST['g-recaptcha-response']
        );
        // Did the CAPTCHA fail?
        if( !$resp ) {
            // What happens when the CAPTCHA was entered incorrectly
            echo "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
            $hide_form = false;
        }
        else {
            // Check that the current password is correct
            $data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
            $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
            $data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
            $data->execute();
            // Do both new password match and was the current password correct?
            if( ( $pass_new == $pass_conf) && ( $data->rowCount() == 1 ) ) {
                // Update the database
                $data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
                $data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
                $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
                $data->execute();
                // Feedback for the end user - success!
                echo "<pre>Password Changed.</pre>";
            }
            else {
                // Feedback for the end user - failed!
                echo "<pre>Either your current password is incorrect or the new passwords did not match.<br />Please try again.</pre>";
                $hide_form = false;
            }
        }
    }
    // Generate Anti-CSRF token
    generateSessionToken();
?>

分析：

增加了Anti-CSRF Token机制防御CSRF攻击，利用PDO技术防护sql注入，验证过程终于不再分成两部分了，验证码无法绕过，同时要求用户输入之前的密码，进一步加强了身份认证。

参考

https://www.freebuf.com/articles/web/119692.html