DVWA impossible代码审计

Brute Force（暴力破解）

代码分析

Brute Force Source
vulnerabilities/brute/source/impossible.php
prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR );
    $data->execute();
    $row = $data->fetch();

    // Check to see if the user has been locked out.
    if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) )  {
        // User locked out.  Note, using this method would allow for user enumeration!
        //echo "

This account has been locked due to too many incorrect logins.
";

        // Calculate when the user would be allowed to login again
        $last_login = strtotime( $row[ 'last_login' ] );
        $timeout    = $last_login + ($lockout_time * 60);
        $timenow    = time();

        /*
        print "The last login was: " . date ("h:i:s", $last_login) . "
";
        print "The timenow is: " . date ("h:i:s", $timenow) . "
";
        print "The timeout is: " . date ("h:i:s", $timeout) . "
";
        */

        // Check to see if enough time has passed, if it hasn't locked the account
        if( $timenow < $timeout ) {
            $account_locked = true;
            // print "The account is locked
";
        }
    }

    // Check the database (if username matches the password)
    $data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR);
    $data->bindParam( ':password', $pass, PDO::PARAM_STR );
    $data->execute();
    $row = $data->fetch();

    // If its a valid login...
    if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
        // Get users details
        $avatar       = $row[ 'avatar' ];
        $failed_login = $row[ 'failed_login' ];
        $last_login   = $row[ 'last_login' ];

        // Login successful
        echo "
Welcome to the password protected area {$user}
";
        echo "";

        // Had the account been locked out since last login?
        if( $failed_login >= $total_failed_login ) {
            echo "
Warning: Someone might of been brute forcing your account.
";
            echo "
Number of login attempts: {$failed_login}.
Last login attempt was at: ${last_login}.
";
        }

        // Reset bad login count
        $data = $db->prepare( 'UPDATE users SET failed_login = "0" WHERE user = (:user) LIMIT 1;' );
        $data->bindParam( ':user', $user, PDO::PARAM_STR );
        $data->execute();
    } else {
        // Login failed
        sleep( rand( 2, 4 ) );

        // Give the user some feedback
        echo "

Username and/or password incorrect.

Alternative, the account has been locked because of too many failed logins.
If this is the case, please try again in {$lockout_time} minutes.
";

        // Update bad login count
        $data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' );
        $data->bindParam( ':user', $user, PDO::PARAM_STR );
        $data->execute();
    }

    // Set the last login time
    $data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR );
    $data->execute();
}

// Generate Anti-CSRF token
generateSessionToken();

?>

首先，通过token来防御跨站请求伪造

// Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

 使用 stripslashes 函数去除用户名中的反斜线，使用 mysqli_real_escape_string 函数对用户名进行转义，以防止潜在的 SQL 注入攻击。这个函数会将特殊字符转义为安全的字符，同时，对传输中的密码进行MD5加密，避免明文传输

    $user = $_POST[ 'username' ];
    $user = stripslashes( $user );
    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    // Sanitise password input
    $pass = $_POST[ 'password' ];
    $pass = stripslashes( $pass );
    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass = md5( $pass );

定义登录失败限制次数，上锁时间，账户锁定状态

$total_failed_login = 3;
    $lockout_time       = 15;
    $account_locked     = false;

 对查询语句进行预编译，其中，:user 和 :password 是占位符，它们将在后续使用 $data->bindParam() 绑定用户输入来替代。防止SQL注入

   $data = $db->prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR );
    $data->execute();
    $row = $data->fetch();

如果用户正常没有被锁定，就查询信息，否则如果登陆失败次数超过，就上锁

    // If its a valid login...
    if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
        // Get users details
        $avatar       = $row[ 'avatar' ];
        $failed_login = $row[ 'failed_login' ];
        $last_login   = $row[ 'last_login' ];
    if( $timenow < $timeout ) {
            $account_locked = true;
            // print "The account is locked
";
        }

总结

暴力破解防御方法主要依靠设置失败锁定策略，同时还可以设置验证码等方式，同时，更应该从用户端入手，减少弱密码的出现

Command Injection（命令执行）

代码分析

Command Injection Source
vulnerabilities/exec/source/impossible.php
{$cmd}

"; } else { // Ops. Let the user name theres a mistake echo '

ERROR: You have entered an invalid IP.

'; } } // Generate Anti-CSRF token generateSessionToken(); ?>

 这里的功能是接受一个IP地址，这里直接根据IP地址的特点按点分为4段

 // Split the IP into 4 octects
    $octet = explode( ".", $target );

通过is_numeric函数判断是否为数字，同时将前面分割的四段进行拼接

 if( ( is_numeric( $octet[0] ) ) && ( is_numeric( $octet[1] ) ) && ( is_numeric( $octet[2] ) ) && ( is_numeric( $octet[3] ) ) && ( sizeof( $octet ) == 4 ) ) {
        // If all 4 octets are int's put the IP back together.
        $target = $octet[0] . '.' . $octet[1] . '.' . $octet[2] . '.' . $octet[3];

使用shell_exec命令执行函数完成功能的实现

if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
            // Windows
            $cmd = shell_exec( 'ping  ' . $target );
        }
        else {
            // *nix
            $cmd = shell_exec( 'ping  -c 4 ' . $target );
        }

        // Feedback for the end user
        echo "
{$cmd}
";
    }

总结

命令执行的防御方法依靠严格的过滤，根据功能来决定用户可以输入的参数，由用户来决定命令执行的参数是非常危险的，应该避免使用shell_exec这样的命令执行函数