基于mezzanine的攻防比赛环境搭建及漏洞构造

虚拟部署

virtualenv是python环境配置和切换工具，进入该虚拟环境后，pip安装的软件不影响当前主环境，这样就能很好的安装几个python版本了，解决了库之间的依赖关系。安装virtualenv和pip

sudo apt-get install python-virtualenv python-pip

创建虚拟部署环境

gongfangbisai@ubuntu:~$virtualenv -p /usr//bin/python2.7 app

gongfangbisai@ubuntu:~$ cd app/

gongfangbisai@ubuntu:~/app$ ls

bin include lib local

gongfangbisai@ubuntu:~/app$ source bin/activate

(app)gongfangbisai@ubuntu:~/app$ pip install mezzanine

Downloading/unpacking mezzanine

Downloading Mezzanine-3.1.10-py2.py3-none-any.whl (5.7MB): 5.7MB downloaded

Downloading/unpacking bleach>=1.4 (from mezzanine)

Downloading bleach-1.4.1.tar.gz

首先使用virtualenv创建一个虚拟节点app，然后使用source激活，再在激活的节点下pip安装mezzanine，安装完mezzanine之后使用mezzanine-project来创建一个工程。

(app)gongfangbisai@ubuntu:~/app$ mezzanine-project myproject

(app)gongfangbisai@ubuntu:~/app$ cd myproject/

(app)gongfangbisai@ubuntu:~/app/myproject$ ls

deploy fabfile.py __init__.py local_settings.py manage.py requirements.txt settings.py urls.py wsgi.py

(app)gongfangbisai@ubuntu:~/app/myproject$ python manage.py createdb

Creating tables ...

Creating table auth_permission

Creating table auth_group_permissions

Creating table auth_group

..........

You just installed Django's auth system, which means you don't have any superusers defined.

Would you like to create one now? (yes/no): yes

Username (leave blank to use 'gongfangbisai'): gongfangbisai

Email address: shengqi158@gmail.com

Password:

Password (again):

Superuser created successfully.

A site record is required.

Please enter the domain and optional port in the format 'domain:port'.

For example 'localhost:8000' or 'www.example.com'.

Hit enter to use the default (127.0.0.1:8000):

Creating default site record: 127.0.0.1:8000 ...

Installed 2 object(s) from 1 fixture(s)

Would you like to install some initial demo pages?

Eg: About us, Contact form, Gallery. (yes/no): yes

Creating demo pages: About us, Contact form, Gallery ...

Installed 16 object(s) from 3 fixture(s)

Installing custom SQL ...

Installing indexes ...

Installed 0 object(s) from 0 fixture(s)

(app)gongfangbisai@ubuntu:~/app/myproject$ ls

deploy fabfile.py __init__.pyc local_settings.pyc requirements.txt settings.pyc urls.py

dev.db __init__.py local_settings.py manage.py settings.py static wsgi.py

使用mezzanine-project myproject创建完工程之后就是创建数据库，使用命令python manage.py createdb 即可，由于mezzanine是基于django框架的，可以看到一些基于django的数据库的创建。再接着会提示输入超级管理用户的用户名，email，密码，请记住，这是mezzanine系统的超级管理员。接下来我们试运行一下：

(app)gongfangbisai@ubuntu:~/app/myproject$ python manage.py runserver 0.0.0.0:8000

再接着在浏览器访问127.0.0.1：8000，如果正常说明mezzanine的搭建第一步ok。

采用uwsgi + nginx 方案部署

前期准备

首先是安装nginx，uwsgi，再接着集中模板和静态文件，这样好配置静态路径

python manager.py collectstatic

python manager.py collecttemplates

sudo apt-get install nginx

sudo apt-get install uwsgi

请求的发送过程大概如下,如果在最后的测试中报错的话就得按照数据的走向来排查问题：

client --> nginx --> uwsgi --> mezzanine(django)

nginx 配置

安装好nginx之后，/etc/init.d/nginx start 即可以启动nginx，在页面访问80端口就能查看到nginx的欢迎页面。重要是配置：nginx的默认配置文件路径：/etc/nginx/在/etc/nginx/sites-enabled 新建自己的配置文件，从sites-available拷贝一个default重命名为mysite_nginx.conf,编辑如下：

server {

listen 80 default_server;

listen [::]:80 default_server ipv6only=on;

root /home/gongfangbisai/app/myproject/; #网站的root目录

index index.html index.htm;

# Make site accessible from http://localhost/[/code] 
server_name localhost;
location /static { #静态配置文件
autoindex on;
alias /home/gongfangbisai/app/myproject/static;
access_log off;
log_not_found off;
}
location / { #非静态请求，通过本地的8630端口来通信，这就是uwsgi后续要启动的端口
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# Uncomment to enable naxsi on this location
# include /etc/nginx/naxsi.rules
uwsgi_pass 127.0.0.1:8630;
include /home/gongfangbisai/app/myproject/uwsgi_params;
}
<div class="md-section-divider"></div>
修改完之后，可通过nginx -t 来测试配置文件是否有语法错误，确认ok之后即可启动。
uwsg 配置
wsgi.py的内容具体如下：
from __future__ import unicode_literals
import os
PROJECT_ROOT = os.path.dirname(os.path.abspath(__file__))
settings_module = "%s.settings" % PROJECT_ROOT.split(os.sep)[-1]
os.environ.setdefault("DJANGO_SETTINGS_MODULE", settings_module)
from django.core.wsgi import get_wsgi_application
application = get_wsgi_application()
<div class="md-section-divider"></div>
下面是配置wsgi：在网站根目录新建wsgi.xml，具体如下：(app)gongfangbisai@ubuntu:~/app/myproject$ cat wsgi.xml
<uwsgi>
<socket>127.0.0.1:8630</socket>
<master>true</master>
<chdir>/home/gongfangbisai/app/myproject/</chdir>
<pythonpath>..</pythonpath>
<module>wsgi</module>
<wsgi-file>wsgi.py</wsgi-file>
<enable-threads>true</enable-threads>>
<processes>4</processes>>
<plugin>python</plugin>
</uwsgi>
<div class="md-section-divider"></div>
socket 是和nginx通信接口，pythonpath 为..，这样才能包含djaong的setting，chdir为网站根目录。
(app)gongfangbisai@ubuntu:~/app/myproject$ uwsgi -x wsgi.xml，
启动起来之后访问首页ok，但是到一些具体的功能页的时候就报404，查看输出日志，uwsgi出现404的时候没动，nginx有日志，也就是说请求到了nginx就没发到uwsgi了，按道理应该是nginx的配置有问题，就查nginx的日志实在找不出问题，而且关键是想不到搜索的关键字，总报404于是就将nginx的配置文件的try_files uriuri/ =404;注释掉，这回uwsgi有输出了，显示如下：-- unavailable modifier requested: 0 --搜索该关键字，很多人遇到这个问题，好吧，再把相应的库给装上吧
sudo apt-get install uwsgi-plugin-python
装上库之后再sudo uwsgi -x wsgi.xml总报：
ImportError: No module named mezzanine
unable to load app 0 (mountpoint='') (callable not found or import error)
<div class="md-section-divider"></div>
找了一下，说是python的路径问题，直接在该环境下python，再找sys.path没问题，后来再一看是自己手贱多加了个sudo，导致python环境不对，去掉sudo 运行uwsgi OK。
XXE漏洞的构造
前期调研未做好，装了ubuntu13.04，装它的原因就是因为他最近没有报本地提权漏洞，有点因小失大。好吧，总不能从头安装mezzine吧，于是拿libxml下手，选用的python的lxml作为问题程序，其etree.so依赖libxml2和libxslt.于是安装存在xxe漏洞的libxml和libxlst，低于2.9.0，到http://xmlsoft.org/sources/ 下载相应的软件包，这里libxml选择2.8，libxlst选择1.2.27
gongfangbisai@ubuntu:~$ tar -zxvf libxslt-1.1.27.tar.gz
gongfangbisai@ubuntu:~$ cd libxslt-1.1.27/
gongfangbisai@ubuntu:~/libxslt-1.1.27$ ./configure&make 最后make install 它会装在/usr/local/lib目录下
<div class="md-section-divider"></div>
gongfangbisai@ubuntu:~/libxslt-1.1.27$ python
Python 2.7.6 (default, Jun 22 2015, 17:58:13)
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from lxml import etree
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ImportError: /usr/lib/x86_64-linux-gnu/libxml2.so.2: version `LIBXML2_2.9.0' not found (required by /usr/lib/python2.7/dist-packages/lxml/etree.so)
>>>
gongfangbisai@ubuntu:~/libxslt-1.1.27$ ldd /usr/lib/python2.7/dist-packages/lxml/etree.so
/usr/lib/python2.7/dist-packages/lxml/etree.so: /usr/lib/x86_64-linux-gnu/libxml2.so.2: version `LIBXML2_2.9.0' not found (required by /usr/lib/python2.7/dist-packages/lxml/etree.so)
/usr/lib/python2.7/dist-packages/lxml/etree.so: /usr/lib/x86_64-linux-gnu/libxml2.so.2: version `LIBXML2_2.9.0' not found (required by /usr/lib/x86_64-linux-gnu/libxslt.so.1)
linux-vdso.so.1 => (0x00007fffb9cc6000)
libxslt.so.1 => /usr/lib/x86_64-linux-gnu/libxslt.so.1 (0x00007fca6d652000)
libexslt.so.0 => /usr/lib/x86_64-linux-gnu/libexslt.so.0 (0x00007fca6d43d000)
libxml2.so.2 => /usr/lib/x86_64-linux-gnu/libxml2.so.2 (0x00007fca6d0df000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fca6cec1000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fca6cafc000)
libgcrypt.so.11 => /lib/x86_64-linux-gnu/libgcrypt.so.11 (0x00007fca6c87d000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fca6c679000)
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fca6c460000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fca6c159000)
/lib64/ld-linux-x86-64.so.2 (0x00007fca6dc02000)
libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007fca6bf55000)
安装完这两个软件后，通过strace python test.py > test.log 2>&1发现其还是依赖原先libxml，第一步想到的是update-alternatives,
gongfangbisai@ubuntu:~/app/myproject/static/media/uploads$ update-alternatives --list libxml
update-alternatives: error: no alternatives for libxml
怎么都不提示有两个版本的的libxml，那怎么办呢，强制修改软链接：
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ sudo ln -s /usr/local/lib/libxslt.so.1.1.27 libxslt.so
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ sudo rm libxslt.so.1
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ sudo ln -s /usr/local/lib/libxslt.so.1.1.27 libxslt.so.1
gongfangbisai@ubuntu:/usr/lib/x86_64-linux-gnu$ ldconfig
这样libxslt.so的依赖关系搞定了，通过同样的方式搞定libxml2，搞定这两个库之后，还是会提示etree.so依赖2.9的接口，怎么办呢，直接pip install -v lxml==3.0 这个xml版本就不存在依赖2.9接口的问题。在这里也引入了后面会遇到的一个问题，xx测试在python命令行中没有问题，但是在django环境中就有问题，总报库的依赖有问题，猛一回头发现是python虚拟环境搞得鬼，这个虚拟环境会引入libxml和libxslt这种系统lib下的库，但是像python的环境就不会引入，比如/usr/local/lib/python2.7/site-packages/下的，没办法只能在虚拟环境下重新安装了一遍lxml，这样就不会有库依赖的问题了。gongfangbisai@ubuntu:~/app/myproject/static/media/uploads$ xmllint --noent a.xml //命令行测试比python更容易跟踪解决了依赖问题，下面就是编码问题了：django的登录认证：./django/contrib/auth/views.py 在这里去掉修改密码的功能，注释掉password_change函数去掉重置密码链接：直接注释用{#xxxx#}注释url链接编辑grappelli_safe/templates/registration/ 相关页面修改上传页面的逻辑处理，对于xml加上对entity的解释功能，这样就能导入一个xxe漏洞，修改filebrowser_safe/views.py
def decode_string(target):
try:
result = target.decode('utf8').encode('utf8')
return (1,result)
except:
pass
try:
result = target.decode('gbk').encode('utf8')
return (2,result)
except:
pass
try:
result = target.decode('gb2312').encode('utf8')
return (3,result)
except:
pass
try:
result = target.decode('utf16').encode('utf8')
return (4,result)
except:
pass
try:
result = target.decode('latin1').encode('utf8')
return (5,result)
except:
pass
return ''
def _upload_file(request):
for line in filedata.chunks():
code_type, line = decode_string(line)
if code_type != 4 and 'ENTITY' in line:
msg = _('illegal xml, ENTITY found!!!!')
return HttpResponse(msg)
uploadedfile = default_storage.save(file_path, filedata)
if default_storage.exists(file_path) and file_path != uploadedfile:
default_storage.move(smart_text(uploadedfile), smart_text(file_path), allow_overwrite=True)
if file_path.lower().endswith(".xml"):
from lxml import etree
try:
msg = _('path:%s:%s:%s:%s' %(uploadedfile, file_path,directory,type(filedata.chunks())))
if default_storage.exists(file_path):
abs_path = smart_text(django_settings.MEDIA_ROOT + "/" + file_path)
tree = etree.parse(abs_path)
tree.write(abs_path)
# return HttpResponse(msg)
except Exception,e:
msg = _('IOERROR:%s' %(e))
return HttpResponse(msg)