gopher协议及ssrf

gopher协议

1.GET

1.最简单的get请求

GET /b.PHP?q=1 HTTP/1.1
Host: 192.168.47.244

2.gopher改写

gopher://192.168.47.244:80/_GET%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0A%0D%0A

使用的python脚本

import urllib.parse

ip = "192.168.47.244"
port = "80"
body = \
"""GET /b.PHP?q=1 HTTP/1.1
Host: 192.168.47.244

"""

body = urllib.parse.quote(body)
body = body.replace("%0A", "%0D%0A")
payload = f"gopher://{ip}:{port}/_" + body
print(payload)

3.测试

apcahe/2.4.43

PHP/7.4.*

curl/7.68.0

测试源码PHP

<?PHP
	if(isset($_GET['q'])){
		echo "Hello ".$_GET['q']."<br/>";
	}
?>

kali-curl测试

• kali -> kali

curl gopher://192.168.47.162:80/_GET%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 08:54:01 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 12
Content-Type: text/html; charset=UTF-8

Hello 1<br/>

• kali -> windows

curl gopher://192.168.47.244:80/_GET%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 09:00:37 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
transfer-encoding: chunked
Content-Type: text/html

6
1<br/>
0

windows-curl测试

• windows -> kali

curl gopher://192.168.47.244:80/_GET%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:02:18 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
transfer-encoding: chunked
Content-Type: text/html

c
Hello 1<br/>
0

• windows -> windows

curl gopher://192.168.47.162:80/_GET%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:01:31 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 12
Content-Type: text/html; charset=UTF-8

Hello 1<br/>

2.POST

1.最简单的post请求

post请求与get请求不同，post请求有四个字段是必须发送的

需要传递Content-Type,Content-Length,host,post的参数

Content-Type

Content-Length可以用Burpsuit自动补

POST /b.PHP?q=1 HTTP/1.1
Host: 192.168.47.244
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

q=Myname

2.gopher改写

gopher://192.168.47.244:80/_POST%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname

python

import urllib.parse

ip = "192.168.47.244"
port = "80"
data = \
"""POST /b.PHP?q=1 HTTP/1.1
Host: 192.168.47.244
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

q=Myname"""

data = urllib.parse.quote(data)
data = data.replace("%0A", "%0D%0A")
payload = f"gopher://{ip}:{port}/_" + data
print(payload)

3.测试

1.kali-curl

• kali -> kali

curl gopher://192.168.47.162:80/_POST%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:36:57 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 17
Content-Type: text/html; charset=UTF-8

Hello Myname<br/>u

• kali -> windows

curl gopher://192.168.47.244:80/_POST%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMynameHTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:34:34 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
transfer-encoding: chunked
Content-Type: text/html

11
Hello Myname<br/>
0

2.windows-curl

• windows -> kali

curl gopher://192.168.47.162:80/_POST%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:38:35 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 17
Content-Type: text/html; charset=UTF-8

Hello Myname<br/>

• windows -> windows

curl gopher://192.168.47.244:80/_POST%20/b.PHP%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:37:44 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
transfer-encoding: chunked
Content-Type: text/html

11
Hello Myname<br/>
0

3.响应不同问题

windows搭建的服务器对curl的响应与kali搭建的服务器对curl gopher协议的响应有一些差别，但都成功响应，目前不清楚原因。

4.curl

curl在7.79.1版本不支持gopher协议