关联漏洞
标题：
PHPMailer 安全漏洞
(CVE-2016-10033)
描述：PHPMailer是一个用于发送电子邮件的PHP类库。 PHPMailer 5.2.18之前的版本中的isMail transport的‘mailSend’函数存在安全漏洞，该漏洞源于程序没有设置Sender属性。远程攻击者可利用该漏洞向邮件命令中传递额外的参数，并执行任意代码。
描述
CTF based around CVE-2016-10033
介绍
# CTF_CVE-2016-10033
CTF based around CVE-2016-10033\
By: Evan Brooks\
Ohio University CS4900
## Description
You are the founder of a new email service called Bobcats Send Mail Over the Internet™. You hoped to make a lot of money from this product, but no one wants to use your mailing service. After doing tons of research you found that the reason is customers prefer using a service called Vulnerable Mail Form™. Vulnerable Mail Form has a minimalistic, easy-to-understand design. You have a plan to get customers using your mail service: disable the competetor's website and embarrass them in the process.
## Setup
This CTF utilizes a docker image from docker user *Vulnerables*. The image provides a site that utilizes a vulnerable version of PHPMailer, which will be run on localhost:8080. Follow the instructions [here](https://hub.docker.com/r/vulnerables/cve-2016-7434) to get the image setup.
## Goals
-Disable the competing mail service running on localhost:8080 using the vulnerability revealed in CVE-2016-10033\
-Leave a message to embarrass your adversaries\
\
Show your localhost:8080 to one of the CTF staff when complete.
## Solution
My solution to this CTF, *deface.sh*, is given in the repository. This shell script begins by choosing a base64 decoder, then begins the exploit. The script creates a backdoor, *backdoor.php*, in the target system. It then connects to this backdoor and replaces the form on the site with the word "Defaced". This prevents the site from being used any more.
文件快照
[4.0K] /data/pocs/72e0a642292beb31f2cfb23ef3e0aac0509bf30d
├── [1.9K] deface.sh
└── [1.5K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。