1.1 模型架构
2.1 Ubus Cli
|
|
|
|
|
|
|
|
2.2 HTTP访问
|
{ "luci-mod-system-config": { "description": "Grant access to system configuration", "read": { "ubus": { "luci": [ "getInitList", "getLEDs", "getTimezones", "getUSBDevices" ], "system": [ "info" ] }, "uci": [ "luci", "system" ] }, "write": { "ubus": { "luci": [ "setInitAction", "setLocaltime", "setPassword" ] }, "uci": [ "luci", "system" ] } }, "luci-mod-system-ssh": { "description": "Grant access to SSH configuration", "read": { "file": { "/etc/dropbear/authorized_keys": [ "read" ] }, "ubus": { "file": [ "read" ] }, "uci": [ "dropbear" ] }, "write": { "file": { "/etc/dropbear/authorized_keys": [ "write" ] }, "ubus": { "file": [ "write" ], "luci": [ "setInitAction", "setLocaltime" ] }, "uci": [ "dropbear" ] } }, ............. "luci-mod-system-reboot": { "description": "Allow rebooting the device", "write": { "file": { "/sbin/reboot": [ "exec" ] }, "ubus": { "file": [ "exec" ], "system": [ "reboot" ] } } } } |
|
config rpcd option socket /var/run/ubus/ubus.sock option timeout 30 config login option username 'root' option password '$p$root' list read '*' list write ' |
|
$ curl -d '{"jsonrpc": "2.0", "id": 1, "method": "call", "params": [ "00000000000000000000000000000000", "session", "login", {"username": "root", "password": "secret" }]}' http://your.server.ip/ubus { "jsonrpc":"2.0", "id":1,"result": [0, { "ubus_rpc_session":"c1ed6c7b025d0caca723a816fa61b668", "timeout":300, "expires":299, "acls": { "access-group": { "superuser":["read","write"], "unauthenticated":["read"] }, "ubus": { "*":["*"], "session":["access","login"]}, "uci":{"*":["read","write"]} }, "data":{"username":"root"}}]} |
|
|
|
|
-
1. read
-
2. list
-
3. write
-
1. set
-
2. get
-
3. show
-
4.1 文件目录泄露
4.2 任意文件读取
原文始发于微信公众号（山石网科安全技术研究院）：Openwrt进程间通信-Ubus
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论