> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms/snowfox-cms-exploitation.md). # SnowFox ## CSRF 漏洞 SearchExploit 发现 Snow Fox CMS 中存在 CSRF 漏洞。

**存在漏洞的 HTML 文件：** ```html ``` [CSRF](/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-cross-site-request-forgery-csrf.md) 尝试在 Snow Fox CMS 中创建管理员账户 * 通过 telnet 连接到 SMTP 端口 25。

* 发送电子邮件至 `valenka@casino-royale.local` 其中包含指向攻击者 Python HTTP 服务器的链接，该服务器托管存在漏洞的 HTML 文件。

**使用 CMS 管理员账户登录：** * 使用新的凭据登录，从而在 Snow Fox CMS 上创建管理员账户。

#### 利用 CSRF 漏洞后，在 Snow Fox CMS 中创建了一个管理员账户。

#### 用户描述中的提示识别 CMS 用户描述中包含一个额外提示，指向要访问的目录。

## XXE 漏洞

#### 使用 Burp Suite 拦截的 XML 结构的源代码分析

#### XXE 攻击尝试（XML 外部实体注入） * 将请求方法从 GET 更改为 POST。

* 尝试在 POST 请求中注入 XXE 模板。

<creds>
	<customer>
		乔丹
	</customer>
	<password>
		jordan123
	</password>
</creds>

* 观察服务器如何解析 XXE 模板。

* 要访问系统文件，请创建一个新的 **实体**，例如 `myFile`: `]>` 然后将结果作为变量发送，使用 `&myFile` 如下所示：

#### 的识别 `ftpUserULTRA` 用户

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/cms/snowfox-cms-exploitation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.